glupteba | b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8

Target

EB7233922891E1DAD0434FBD52623647.exe
Size

7.9MB
MD5

eb7233922891e1dad0434fbd52623647
SHA1

331126b108532ab9a1e932141bff55a38656bce9
SHA256

b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8
SHA512

597fbb0f397c45c8a2c5f63893c6d6bd4641e952510dfcac05dadb7afaaf4e005df1261649d4e79951979bad0be1fb09feebac7a6d23c31679590cbf40e1d4ac

Score

10^/10

glupteba metasploit backdoor dropper evasion loader persistence spyware stealer trojan vmprotect

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/668-220-0x00000000014C0000-0x0000000001DE6000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rUNdlL32.eXe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3196 4972 rUNdlL32.eXe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	4972	rUNdlL32.eXe

Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 1260 created 868	1260	WerFault.exe	rundll32.exe
PID 4836 created 668	4836	WerFault.exe	Info.exe
PID 4536 created 3364	4536	WerFault.exe	pub2.exe

evasion 2 IoCs

evasion.

evasion

Processes:

resource	yara_rule
behavioral1/memory/668-220-0x00000000014C0000-0x0000000001DE6000-memory.dmp	evasion
behavioral1/memory/1544-261-0x0000000000400000-0x0000000000759000-memory.dmp	evasion

Executes dropped EXE 8 IoCs

Processes:

KRSetp.exeFolder.exeFolder.exeInfo.exeInstallation.exemd9_1sjm.exepub2.exemysetold.exe

pid process

5080 KRSetp.exe
2428 Folder.exe
3864 Folder.exe
668 Info.exe
1268 Installation.exe
1544 md9_1sjm.exe
3364 pub2.exe
3628 mysetold.exe

pid	process
5080	KRSetp.exe
2428	Folder.exe
3864	Folder.exe
668	Info.exe
1268	Installation.exe
1544	md9_1sjm.exe
3364	pub2.exe
3628	mysetold.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe	vmprotect
behavioral1/memory/1544-261-0x0000000000400000-0x0000000000759000-memory.dmp	vmprotect

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

868 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
868	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5"	msedge.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

md9_1sjm.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md9_1sjm.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md9_1sjm.exe

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mysetold.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mysetold.exe	autoit_exe

Drops file in Windows directory 1 IoCs

Processes:

WerFault.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1492 868 WerFault.exe rundll32.exe
1376 668 WerFault.exe Info.exe
4148 3364 WerFault.exe pub2.exe

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

pid	pid_target	process	target process
1492	868	WerFault.exe	rundll32.exe
1376	668	WerFault.exe	Info.exe
4148	3364	WerFault.exe	pub2.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Modifies data under HKEY_USERS 1 IoCs

Processes:

svchost.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

WerFault.exemsedge.exemsedge.exeWerFault.exeidentity_helper.exeWerFault.exemsedge.exe

pid	process
1492	WerFault.exe
1492	WerFault.exe
1928	msedge.exe
1928	msedge.exe
4744	msedge.exe
4744	msedge.exe
1376	WerFault.exe
1376	WerFault.exe
3392	identity_helper.exe
3392	identity_helper.exe
4148	WerFault.exe
4148	WerFault.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

KRSetp.exeWerFault.exesvchost.exemd9_1sjm.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	5080	KRSetp.exe
Token: SeRestorePrivilege	1492	WerFault.exe
Token: SeBackupPrivilege	1492	WerFault.exe
Token: SeBackupPrivilege	1492	WerFault.exe
Token: SeTcbPrivilege	864	svchost.exe
Token: SeTcbPrivilege	864	svchost.exe
Token: SeTcbPrivilege	864	svchost.exe
Token: SeTcbPrivilege	864	svchost.exe
Token: SeTcbPrivilege	864	svchost.exe
Token: SeTcbPrivilege	864	svchost.exe
Token: SeManageVolumePrivilege	1544	md9_1sjm.exe
Token: SeManageVolumePrivilege	1544	md9_1sjm.exe
Token: SeManageVolumePrivilege	1544	md9_1sjm.exe
Token: SeManageVolumePrivilege	1544	md9_1sjm.exe
Token: SeManageVolumePrivilege	1544	md9_1sjm.exe
Token: SeSystemtimePrivilege	1040	svchost.exe
Token: SeSystemtimePrivilege	1040	svchost.exe
Token: SeIncBasePriorityPrivilege	1040	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exemysetold.exe

pid	process
4744	msedge.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

mysetold.exe

pid	process
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe
3628	mysetold.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Installation.exe

pid process

1268 Installation.exe

pid	process
1268	Installation.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

EB7233922891E1DAD0434FBD52623647.exemsedge.exeFolder.exerUNdlL32.eXeWerFault.exe

description	pid	process	target process
PID 4908 wrote to memory of 5080	4908	EB7233922891E1DAD0434FBD52623647.exe	KRSetp.exe
PID 4908 wrote to memory of 5080	4908	EB7233922891E1DAD0434FBD52623647.exe	KRSetp.exe
PID 4908 wrote to memory of 4744	4908	EB7233922891E1DAD0434FBD52623647.exe	msedge.exe
PID 4908 wrote to memory of 4744	4908	EB7233922891E1DAD0434FBD52623647.exe	msedge.exe
PID 4908 wrote to memory of 2428	4908	EB7233922891E1DAD0434FBD52623647.exe	Folder.exe
PID 4908 wrote to memory of 2428	4908	EB7233922891E1DAD0434FBD52623647.exe	Folder.exe
PID 4908 wrote to memory of 2428	4908	EB7233922891E1DAD0434FBD52623647.exe	Folder.exe
PID 4744 wrote to memory of 4928	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 4928	4744	msedge.exe	msedge.exe
PID 2428 wrote to memory of 3864	2428	Folder.exe	Folder.exe
PID 2428 wrote to memory of 3864	2428	Folder.exe	Folder.exe
PID 2428 wrote to memory of 3864	2428	Folder.exe	Folder.exe
PID 4908 wrote to memory of 668	4908	EB7233922891E1DAD0434FBD52623647.exe	Info.exe
PID 4908 wrote to memory of 668	4908	EB7233922891E1DAD0434FBD52623647.exe	Info.exe
PID 4908 wrote to memory of 668	4908	EB7233922891E1DAD0434FBD52623647.exe	Info.exe
PID 3196 wrote to memory of 868	3196	rUNdlL32.eXe	rundll32.exe
PID 3196 wrote to memory of 868	3196	rUNdlL32.eXe	rundll32.exe
PID 3196 wrote to memory of 868	3196	rUNdlL32.eXe	rundll32.exe
PID 1260 wrote to memory of 868	1260	WerFault.exe	rundll32.exe
PID 1260 wrote to memory of 868	1260	WerFault.exe	rundll32.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1748	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1928	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 1928	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 2188	4744	msedge.exe	msedge.exe
PID 4744 wrote to memory of 2188	4744	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\EB7233922891E1DAD0434FBD52623647.exe
"C:\Users\Admin\AppData\Local\Temp\EB7233922891E1DAD0434FBD52623647.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/19Pfw7
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7fffd8a646f8,0x7fffd8a64708,0x7fffd8a64718
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 /prefetch:8
    3⤵
    PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:1260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12560159820918800579,12355020321292911196,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3944 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1376
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe" -a
    3⤵
    - Executes dropped EXE
    PID:3864
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe"
  2⤵
  - Executes dropped EXE
  PID:668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 240
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1376
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1268
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\pub2.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\pub2.exe"
  2⤵
  - Executes dropped EXE
  PID:3364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 240
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4148
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\mysetold.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\mysetold.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3628

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 8PFJ7Xr/RkiQhw851r/usQ.0.2
1⤵
PID:4720

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  - Loads dropped DLL
  PID:868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 448
    3⤵
    - Drops file in Windows directory
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 868 -ip 868
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 668 -ip 668
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3364 -ip 3364
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe

MD5
b89068659ca07ab9b39f1c580a6f9d39

SHA1
7e3e246fcf920d1ada06900889d099784fe06aa5

SHA256
9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

SHA512
940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe

MD5
b89068659ca07ab9b39f1c580a6f9d39

SHA1
7e3e246fcf920d1ada06900889d099784fe06aa5

SHA256
9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

SHA512
940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe

MD5
b89068659ca07ab9b39f1c580a6f9d39

SHA1
7e3e246fcf920d1ada06900889d099784fe06aa5

SHA256
9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

SHA512
940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe

MD5
bda0c64936b09cfb76fda98e37f5b6a4

SHA1
8ee82a7dee86562cb7b1732dafe4c5a9f16f51b8

SHA256
4f5a67a18795c134aa846250f5e88b5fafd28f329fd1742d02b141e1095f9783

SHA512
cf1c0d7a5345ad68887a4f6328db54d3119935aad66544e466a002ec9491990da05614c0457c94e7545924b159afc0bc68f350342cc7f7335406c30ba0be362e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe

MD5
bda0c64936b09cfb76fda98e37f5b6a4

SHA1
8ee82a7dee86562cb7b1732dafe4c5a9f16f51b8

SHA256
4f5a67a18795c134aa846250f5e88b5fafd28f329fd1742d02b141e1095f9783

SHA512
cf1c0d7a5345ad68887a4f6328db54d3119935aad66544e466a002ec9491990da05614c0457c94e7545924b159afc0bc68f350342cc7f7335406c30ba0be362e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe

MD5
cbafd60beffb18c666ff85f1517a76f9

SHA1
9e015cba7168b610969bfc299a4ffe4763f4fd5f

SHA256
d31f2d2d991acee74d9be732c8180f37cea12aceaba324804fbcf2d0d2891a3d

SHA512
ba61ac5f49827b0fba2c72f4b19540b91f8bceb8b441a713b7de00317059955ad592c88af8f9c94093077503ab3b4c4c522b0e577599ca5020ad1b0f254066ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe

MD5
cbafd60beffb18c666ff85f1517a76f9

SHA1
9e015cba7168b610969bfc299a4ffe4763f4fd5f

SHA256
d31f2d2d991acee74d9be732c8180f37cea12aceaba324804fbcf2d0d2891a3d

SHA512
ba61ac5f49827b0fba2c72f4b19540b91f8bceb8b441a713b7de00317059955ad592c88af8f9c94093077503ab3b4c4c522b0e577599ca5020ad1b0f254066ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe

MD5
5af9f5b4e531fab8417a2f137350c842

SHA1
644e6ea394ba94830101d4aeb7d9d23c690b0b83

SHA256
a8543cfdbca49e47db17342a882732ae5889601ab06c56927ec1761ba09bfbc4

SHA512
8a0fd77bb8dac23e84e559624c812326184145b7add8ea502c8c11a5c8ba68d5b69878311c41981d75a163ee428e7969e9dd5c4fef955e43913a1e037d4b7b31

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe

MD5
5af9f5b4e531fab8417a2f137350c842

SHA1
644e6ea394ba94830101d4aeb7d9d23c690b0b83

SHA256
a8543cfdbca49e47db17342a882732ae5889601ab06c56927ec1761ba09bfbc4

SHA512
8a0fd77bb8dac23e84e559624c812326184145b7add8ea502c8c11a5c8ba68d5b69878311c41981d75a163ee428e7969e9dd5c4fef955e43913a1e037d4b7b31

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe

MD5
9b55bffb97ebd2c51834c415982957b4

SHA1
728262abdfc4f0e8a84eb3b5cd2be9ea9d0acc16

SHA256
a62cee3d2610ed0f693179838803e5c60dcd4f68028c60f5761b90c750125e11

SHA512
4fa9d641aba15fd07a0711530ab1f1a4e8dbafe03e1ab71845bcdcd0a1efa9e59a05915834c5c717beada659dd5ee459aa7e08b4b0acc8f867ace07430eb11f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe

MD5
9b55bffb97ebd2c51834c415982957b4

SHA1
728262abdfc4f0e8a84eb3b5cd2be9ea9d0acc16

SHA256
a62cee3d2610ed0f693179838803e5c60dcd4f68028c60f5761b90c750125e11

SHA512
4fa9d641aba15fd07a0711530ab1f1a4e8dbafe03e1ab71845bcdcd0a1efa9e59a05915834c5c717beada659dd5ee459aa7e08b4b0acc8f867ace07430eb11f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mysetold.exe

MD5
96cf21aab98bc02dbc797e9d15ad4170

SHA1
86107ee6defd4fd8656187b2ebcbd58168639579

SHA256
35d3aec171b80d770f671e626024482017c5f4831208aa42032cea4c55983caf

SHA512
d0543a570376c198a326ff8c143f9de0b8e42b1bff5eb2f65e4307f144fe60ecf5987c72ae9819bafe5cb1207f3fbb81c05a5e48d85867f7438c5dfe70eb4a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mysetold.exe

MD5
96cf21aab98bc02dbc797e9d15ad4170

SHA1
86107ee6defd4fd8656187b2ebcbd58168639579

SHA256
35d3aec171b80d770f671e626024482017c5f4831208aa42032cea4c55983caf

SHA512
d0543a570376c198a326ff8c143f9de0b8e42b1bff5eb2f65e4307f144fe60ecf5987c72ae9819bafe5cb1207f3fbb81c05a5e48d85867f7438c5dfe70eb4a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\pub2.exe

MD5
5e8856c0eaac948c6245109413df2cd3

SHA1
36cdf54f902f59530f5b555cc1d3726418dd1e12

SHA256
b9d5320c2f8baa3fba95bf4467e4160a4fd8096417bf3675be649a865461aa21

SHA512
6bd31da0979e1664808f473d68fcca458705f83f49d3a6b3b71a3b916c6fc0f8479677edba4caadac1cb97ec1de994067391f24b040a6d7f8d42a6010d932d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\pub2.exe

MD5
5e8856c0eaac948c6245109413df2cd3

SHA1
36cdf54f902f59530f5b555cc1d3726418dd1e12

SHA256
b9d5320c2f8baa3fba95bf4467e4160a4fd8096417bf3675be649a865461aa21

SHA512
6bd31da0979e1664808f473d68fcca458705f83f49d3a6b3b71a3b916c6fc0f8479677edba4caadac1cb97ec1de994067391f24b040a6d7f8d42a6010d932d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dat

MD5
5fd2eba6df44d23c9e662763009d7f84

SHA1
43530574f8ac455ae263c70cc99550bc60bfa4f1

SHA256
2991e2231855661e94ef80a4202487a9d7dc7bebccab9a0b2a786cf0783a051f

SHA512
321a86725e533dedb5b74e17218e6e53a49fa6ffc87d7f7da0f0b8441a081fe785f7846a76f67ef03ec3abddacbe8906b20a2f3ce8178896ec57090ef7ab0eb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll

MD5
1c7be730bdc4833afb7117d48c3fd513

SHA1
dc7e38cfe2ae4a117922306aead5a7544af646b8

SHA256
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

SHA512
7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll

MD5
1c7be730bdc4833afb7117d48c3fd513

SHA1
dc7e38cfe2ae4a117922306aead5a7544af646b8

SHA256
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

SHA512
7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

Download Submit
\??\PIPE\lsarpc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4744_TFXQHNPOXMTJJHUU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/668-220-0x00000000014C0000-0x0000000001DE6000-memory.dmp

Filesize
9.1MB

Download
memory/668-168-0x0000000000000000-mapping.dmp

Download
memory/824-214-0x0000000000000000-mapping.dmp

Download
memory/868-172-0x0000000000000000-mapping.dmp

Download
memory/916-242-0x0000000000000000-mapping.dmp

Download
memory/1260-249-0x0000000000000000-mapping.dmp

Download
memory/1268-221-0x0000000000000000-mapping.dmp

Download
memory/1376-338-0x0000000000000000-mapping.dmp

Download
memory/1544-258-0x0000000000000000-mapping.dmp

Download
memory/1544-279-0x0000000003820000-0x00000000038A0000-memory.dmp

Filesize
512KB

Download
memory/1544-261-0x0000000000400000-0x0000000000759000-memory.dmp

Filesize
3.3MB

Download
memory/1544-278-0x00000000044B0000-0x00000000044B8000-memory.dmp

Filesize
32KB

Download
memory/1544-287-0x00000000039E0000-0x0000000003A60000-memory.dmp

Filesize
512KB

Download
memory/1748-179-0x00007FFFEAD80000-0x00007FFFEAD81000-memory.dmp

Filesize
4KB

Download
memory/1748-176-0x0000000000000000-mapping.dmp

Download
memory/1928-177-0x0000000000000000-mapping.dmp

Download
memory/2112-256-0x00000202C9B00000-0x00000202C9B10000-memory.dmp

Filesize
64KB

Download
memory/2112-255-0x00000202C9A80000-0x00000202C9A90000-memory.dmp

Filesize
64KB

Download
memory/2112-257-0x00000202CC100000-0x00000202CC104000-memory.dmp

Filesize
16KB

Download
memory/2188-184-0x0000000000000000-mapping.dmp

Download
memory/2428-158-0x0000000000000000-mapping.dmp

Download
memory/3364-334-0x0000000000BA0000-0x0000000000BA9000-memory.dmp

Filesize
36KB

Download
memory/3364-331-0x0000000000000000-mapping.dmp

Download
memory/3392-224-0x0000000000000000-mapping.dmp

Download
memory/3628-335-0x0000000000000000-mapping.dmp

Download
memory/3864-166-0x0000000000000000-mapping.dmp

Download
memory/4104-228-0x0000000000000000-mapping.dmp

Download
memory/4628-193-0x0000000000000000-mapping.dmp

Download
memory/4648-196-0x0000000000000000-mapping.dmp

Download
memory/4732-231-0x0000000000000000-mapping.dmp

Download
memory/4744-157-0x0000000000000000-mapping.dmp

Download
memory/4928-162-0x0000000000000000-mapping.dmp

Download
memory/5040-203-0x0000000000000000-mapping.dmp

Download
memory/5080-156-0x0000000001240000-0x00000000012FD000-memory.dmp

Filesize
756KB

Download
memory/5080-148-0x0000000000000000-mapping.dmp

Download
memory/5080-155-0x00000000012B0000-0x00000000012B1000-memory.dmp

Filesize
4KB

Download
memory/5080-154-0x0000000001290000-0x00000000012AC000-memory.dmp

Filesize
112KB

Download
memory/5080-153-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download
memory/5080-151-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download