Analysis

  • max time kernel
    153s
  • max time network
    159s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    20-12-2021 12:06

General

  • Target

    58c231de8df8a6742c8410650846b700a01436340e42833e5bb1c1f0ac3e5107.exe

  • Size

    322KB

  • MD5

    e737b552b95983f93da575b47888ff9d

  • SHA1

    c484c58f9483a72f7fb94dd42c4d17d46fb9ae74

  • SHA256

    58c231de8df8a6742c8410650846b700a01436340e42833e5bb1c1f0ac3e5107

  • SHA512

    faa02f86c9e609b53c3d5717e0632aa04b984550f7bbaadfba3c8ab8d1ca739e5aff0cf617456243f6dee9ade78628750e8e5d6e1235a09f8fe297694ec3c60d

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

mubrikych.top

oxxyfix.xyz

Extracted

Family

redline

Botnet

1

C2

86.107.197.138:38133

Extracted

Family

redline

Botnet

install

C2

62.182.156.187:56323

Extracted

Family

amadey

Version

2.86

C2

185.215.113.35/d2VxjasuwS/index.php

Extracted

Family

redline

Botnet

444

C2

31.131.254.105:1498

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Arkei

    Arkei is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 17 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 63 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58c231de8df8a6742c8410650846b700a01436340e42833e5bb1c1f0ac3e5107.exe
    "C:\Users\Admin\AppData\Local\Temp\58c231de8df8a6742c8410650846b700a01436340e42833e5bb1c1f0ac3e5107.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:684
    • C:\Users\Admin\AppData\Local\Temp\58c231de8df8a6742c8410650846b700a01436340e42833e5bb1c1f0ac3e5107.exe
      "C:\Users\Admin\AppData\Local\Temp\58c231de8df8a6742c8410650846b700a01436340e42833e5bb1c1f0ac3e5107.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3896
  • C:\Users\Admin\AppData\Local\Temp\E933.exe
    C:\Users\Admin\AppData\Local\Temp\E933.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:3232
  • C:\Users\Admin\AppData\Local\Temp\3F05.exe
    C:\Users\Admin\AppData\Local\Temp\3F05.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Users\Admin\AppData\Local\Temp\3F05.exe
      C:\Users\Admin\AppData\Local\Temp\3F05.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:736
  • C:\Users\Admin\AppData\Local\Temp\4E19.exe
    C:\Users\Admin\AppData\Local\Temp\4E19.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    PID:1864
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4E19.exe" & exit
      2⤵
        PID:1292
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 5
          3⤵
          • Delays execution with timeout.exe
          PID:4136
    • C:\Users\Admin\AppData\Local\Temp\530C.exe
      C:\Users\Admin\AppData\Local\Temp\530C.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1464
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gfgcujcy\
        2⤵
          PID:3024
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gllmbqb.exe" C:\Windows\SysWOW64\gfgcujcy\
          2⤵
            PID:3648
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" create gfgcujcy binPath= "C:\Windows\SysWOW64\gfgcujcy\gllmbqb.exe /d\"C:\Users\Admin\AppData\Local\Temp\530C.exe\"" type= own start= auto DisplayName= "wifi support"
            2⤵
              PID:1584
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" description gfgcujcy "wifi internet conection"
              2⤵
                PID:2120
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\System32\sc.exe" start gfgcujcy
                2⤵
                  PID:3308
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                  2⤵
                    PID:3088
                • C:\Users\Admin\AppData\Local\Temp\5791.exe
                  C:\Users\Admin\AppData\Local\Temp\5791.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1752
                  • C:\Users\Admin\AppData\Local\Temp\5791.exe
                    C:\Users\Admin\AppData\Local\Temp\5791.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1476
                • C:\Users\Admin\AppData\Local\Temp\608B.exe
                  C:\Users\Admin\AppData\Local\Temp\608B.exe
                  1⤵
                  • Executes dropped EXE
                  PID:948
                  • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                    "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:4008
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                      3⤵
                        PID:2000
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                          4⤵
                            PID:4172
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /F
                          3⤵
                          • Creates scheduled task(s)
                          PID:1156
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                      • Accesses Microsoft Outlook profiles
                      • outlook_office_path
                      • outlook_win_path
                      PID:2424
                    • C:\Users\Admin\AppData\Local\Temp\66E5.exe
                      C:\Users\Admin\AppData\Local\Temp\66E5.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2356
                      • C:\Users\Admin\AppData\Local\Temp\66E5.exe
                        C:\Users\Admin\AppData\Local\Temp\66E5.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2516
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:2036
                      • C:\Users\Admin\AppData\Local\Temp\758C.exe
                        C:\Users\Admin\AppData\Local\Temp\758C.exe
                        1⤵
                        • Executes dropped EXE
                        PID:3664
                        • C:\Windows\system32\cmd.exe
                          cmd /C C:\Users\Admin\AppData\Roaming\\counterstrike.exe
                          2⤵
                            PID:768
                            • C:\Users\Admin\AppData\Roaming\counterstrike.exe
                              C:\Users\Admin\AppData\Roaming\\counterstrike.exe
                              3⤵
                              • Executes dropped EXE
                              PID:1132
                              • C:\Users\Admin\AppData\Local\Temp\leakless-34a05a9dc363ec03e25d5dcc5ff915d2\leakless.exe
                                C:\Users\Admin\AppData\Local\Temp\leakless-34a05a9dc363ec03e25d5dcc5ff915d2\leakless.exe 3e27378fe9c38693005768798f1c3122 127.0.0.1:49881 "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-extensions-with-background-pages --use-mock-keychain --force-color-profile=srgb --disable-popup-blocking "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-ipc-flooding-protection --mute-audio --no-first-run --disable-backgrounding-occluded-windows --disable-dev-shm-usage --metrics-recording-only --disable-blink-features=AutomationControlled --no-startup-window --disable-breakpad --disable-default-apps --disable-hang-monitor --disable-renderer-backgrounding --remote-debugging-port=0 --disable-background-timer-throttling --disable-sync --enable-automation --disable-features=site-per-process,TranslateUI --disable-client-side-phishing-detection --disable-prompt-on-repost --enable-features=NetworkService,NetworkServiceInProcess
                                4⤵
                                • Executes dropped EXE
                                PID:4080
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-extensions-with-background-pages --use-mock-keychain --force-color-profile=srgb --disable-popup-blocking "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-ipc-flooding-protection --mute-audio --no-first-run --disable-backgrounding-occluded-windows --disable-dev-shm-usage --metrics-recording-only --disable-blink-features=AutomationControlled --no-startup-window --disable-breakpad --disable-default-apps --disable-hang-monitor --disable-renderer-backgrounding --remote-debugging-port=0 --disable-background-timer-throttling --disable-sync --enable-automation --disable-features=site-per-process,TranslateUI --disable-client-side-phishing-detection --disable-prompt-on-repost --enable-features=NetworkService,NetworkServiceInProcess
                                  5⤵
                                  • Enumerates system info in registry
                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:724
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7fff27064f50,0x7fff27064f60,0x7fff27064f70
                                    6⤵
                                      PID:1372
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,4693400744131139639,4188011094289746557,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:2
                                      6⤵
                                        PID:2424
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,4693400744131139639,4188011094289746557,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2308 /prefetch:8
                                        6⤵
                                          PID:3428
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --field-trial-handle=1632,4693400744131139639,4188011094289746557,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --disable-blink-features=AutomationControlled --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=3000 /prefetch:1
                                          6⤵
                                            PID:2464
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --field-trial-handle=1632,4693400744131139639,4188011094289746557,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --disable-gpu-compositing --disable-blink-features=AutomationControlled --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=4340 /prefetch:1
                                            6⤵
                                              PID:624
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,4693400744131139639,4188011094289746557,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=5076 /prefetch:8
                                              6⤵
                                                PID:4248
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,4693400744131139639,4188011094289746557,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=5412 /prefetch:8
                                                6⤵
                                                  PID:4304
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,4693400744131139639,4188011094289746557,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=5588 /prefetch:8
                                                  6⤵
                                                    PID:4544
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,4693400744131139639,4188011094289746557,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2332 /prefetch:2
                                                    6⤵
                                                    • Drops file in Program Files directory
                                                    PID:4660
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,4693400744131139639,4188011094289746557,131072 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2132 /prefetch:8
                                                    6⤵
                                                    • Drops file in Program Files directory
                                                    PID:4668
                                                • C:\Windows\system32\taskkill.exe
                                                  taskkill /t /f /pid 724
                                                  5⤵
                                                  • Kills process with taskkill
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4596
                                        • C:\Windows\SysWOW64\gfgcujcy\gllmbqb.exe
                                          C:\Windows\SysWOW64\gfgcujcy\gllmbqb.exe /d"C:\Users\Admin\AppData\Local\Temp\530C.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:1092
                                          • C:\Windows\SysWOW64\svchost.exe
                                            svchost.exe
                                            2⤵
                                            • Drops file in System32 directory
                                            • Suspicious use of SetThreadContext
                                            • Modifies data under HKEY_USERS
                                            PID:800
                                            • C:\Windows\SysWOW64\svchost.exe
                                              svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                                              3⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4432
                                        • C:\Users\Admin\AppData\Local\Temp\8675.exe
                                          C:\Users\Admin\AppData\Local\Temp\8675.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Suspicious use of SetThreadContext
                                          PID:3500
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                            2⤵
                                              PID:4776
                                          • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                                            C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:4856
                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                            1⤵
                                            • Drops file in Windows directory
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3220
                                          • C:\Windows\system32\browser_broker.exe
                                            C:\Windows\system32\browser_broker.exe -Embedding
                                            1⤵
                                              PID:1124
                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                              1⤵
                                                PID:1244

                                              Network

                                              MITRE ATT&CK Matrix ATT&CK v6

                                              Execution

                                              Scheduled Task

                                              1
                                              T1053

                                              Persistence

                                              New Service

                                              1
                                              T1050

                                              Modify Existing Service

                                              1
                                              T1031

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1060

                                              Scheduled Task

                                              1
                                              T1053

                                              Privilege Escalation

                                              New Service

                                              1
                                              T1050

                                              Scheduled Task

                                              1
                                              T1053

                                              Defense Evasion

                                              Disabling Security Tools

                                              1
                                              T1089

                                              Modify Registry

                                              2
                                              T1112

                                              Credential Access

                                              Credentials in Files

                                              2
                                              T1081

                                              Discovery

                                              Query Registry

                                              4
                                              T1012

                                              System Information Discovery

                                              4
                                              T1082

                                              Peripheral Device Discovery

                                              1
                                              T1120

                                              Collection

                                              Data from Local System

                                              2
                                              T1005

                                              Email Collection

                                              1
                                              T1114

                                              Command and Control

                                              Web Service

                                              1
                                              T1102

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                MD5

                                                dbfe6838bfb83a665a7d2e8dd6c6f513

                                                SHA1

                                                9853d67bf77f535cd9d44d01f9fe049c9f78e05f

                                                SHA256

                                                c956630b9d0d4c7ff6a5b00de00a1e65f8017fe927ee7f76a19d4d094b5536e5

                                                SHA512

                                                dc932a17ecee2c8247c507798065b6de301aba0574483bac05f456400d998b4067140092fabb701b475191e437c5c635fa553a98f6ee70a97f8c7fbb879734d8

                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                MD5

                                                c45fe928f7df395bd38559c13705b984

                                                SHA1

                                                53f605b8b42c9b0a8d500b025705c449833e0dcc

                                                SHA256

                                                cc95642bbd6fa8bd57b451961f81614b189f6811fa495352576952cf4d1270c1

                                                SHA512

                                                9446520d360fe4316eb7b6b194a6ee694faea8d3abab7d59ef56952a57121854a68a244b2bb8ac5cab4b6ab0227042ad9187677a992435f8043c6bd804f03b2d

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5791.exe.log
                                                MD5

                                                41fbed686f5700fc29aaccf83e8ba7fd

                                                SHA1

                                                5271bc29538f11e42a3b600c8dc727186e912456

                                                SHA256

                                                df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                                                SHA512

                                                234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\66E5.exe.log
                                                MD5

                                                605f809fab8c19729d39d075f7ffdb53

                                                SHA1

                                                c546f877c9bd53563174a90312a8337fdfc5fdd9

                                                SHA256

                                                6904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556

                                                SHA512

                                                82cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3

                                              • C:\Users\Admin\AppData\Local\Temp\19850783111134003120
                                                MD5

                                                d41d8cd98f00b204e9800998ecf8427e

                                                SHA1

                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                SHA256

                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                SHA512

                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                              • C:\Users\Admin\AppData\Local\Temp\19850783111134003120
                                                MD5

                                                d41d8cd98f00b204e9800998ecf8427e

                                                SHA1

                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                SHA256

                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                SHA512

                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                              • C:\Users\Admin\AppData\Local\Temp\3F05.exe
                                                MD5

                                                06051f164f83d1891fd651b8153abef5

                                                SHA1

                                                35ec9a83d509dadcbed6b8f24a7c035d1ba7a484

                                                SHA256

                                                6e6b183a194ede9f29e11d91ebb1522a854e17bedb861ae4e07a40a5bc93a51b

                                                SHA512

                                                221819b73de97de9d8e03e714496247f5c5de45227588b050e6ca188e9d0ca300d9e41bc5c2aace249c79210ceefcc39a973ddc20662e3eadc0d6ce5513fc243

                                              • C:\Users\Admin\AppData\Local\Temp\3F05.exe
                                                MD5

                                                06051f164f83d1891fd651b8153abef5

                                                SHA1

                                                35ec9a83d509dadcbed6b8f24a7c035d1ba7a484

                                                SHA256

                                                6e6b183a194ede9f29e11d91ebb1522a854e17bedb861ae4e07a40a5bc93a51b

                                                SHA512

                                                221819b73de97de9d8e03e714496247f5c5de45227588b050e6ca188e9d0ca300d9e41bc5c2aace249c79210ceefcc39a973ddc20662e3eadc0d6ce5513fc243

                                              • C:\Users\Admin\AppData\Local\Temp\3F05.exe
                                                MD5

                                                06051f164f83d1891fd651b8153abef5

                                                SHA1

                                                35ec9a83d509dadcbed6b8f24a7c035d1ba7a484

                                                SHA256

                                                6e6b183a194ede9f29e11d91ebb1522a854e17bedb861ae4e07a40a5bc93a51b

                                                SHA512

                                                221819b73de97de9d8e03e714496247f5c5de45227588b050e6ca188e9d0ca300d9e41bc5c2aace249c79210ceefcc39a973ddc20662e3eadc0d6ce5513fc243

                                              • C:\Users\Admin\AppData\Local\Temp\4E19.exe
                                                MD5

                                                9f552053040a466fc3fd745e37ebe354

                                                SHA1

                                                e5b585661f55b2b8033fe2228df55c7ead070e01

                                                SHA256

                                                b97e66178aa10ab5b06531c7fb2fd36d7c94485367f6db3e94c969f40d8e6940

                                                SHA512

                                                a9811f4baafe97adbcb1dcc03a87796ede4be4db1b1fcfb23a33b5cefd6764da9257faa12ca4de811973e5acf4cba68d557095587aa2d807008ee161abc5de87

                                              • C:\Users\Admin\AppData\Local\Temp\4E19.exe
                                                MD5

                                                9f552053040a466fc3fd745e37ebe354

                                                SHA1

                                                e5b585661f55b2b8033fe2228df55c7ead070e01

                                                SHA256

                                                b97e66178aa10ab5b06531c7fb2fd36d7c94485367f6db3e94c969f40d8e6940

                                                SHA512

                                                a9811f4baafe97adbcb1dcc03a87796ede4be4db1b1fcfb23a33b5cefd6764da9257faa12ca4de811973e5acf4cba68d557095587aa2d807008ee161abc5de87

                                              • C:\Users\Admin\AppData\Local\Temp\530C.exe
                                                MD5

                                                44d65948e693d217c38e2cca0be02e4d

                                                SHA1

                                                a8f1bffff003a591f0eb4264f3eeadf03b1f6594

                                                SHA256

                                                f817c83321640bfc088858c746e7829d53cbe9c1c5ad1e0d81615936a7a09596

                                                SHA512

                                                38af1832b26b36d242a3f61e502ad888bcb34bf3936dd6e1d61d302753e03e19882e1175b346ef6f35ccaf4c04390b5b527ae5de7666bf3c76d74834bc18b1f1

                                              • C:\Users\Admin\AppData\Local\Temp\530C.exe
                                                MD5

                                                44d65948e693d217c38e2cca0be02e4d

                                                SHA1

                                                a8f1bffff003a591f0eb4264f3eeadf03b1f6594

                                                SHA256

                                                f817c83321640bfc088858c746e7829d53cbe9c1c5ad1e0d81615936a7a09596

                                                SHA512

                                                38af1832b26b36d242a3f61e502ad888bcb34bf3936dd6e1d61d302753e03e19882e1175b346ef6f35ccaf4c04390b5b527ae5de7666bf3c76d74834bc18b1f1

                                              • C:\Users\Admin\AppData\Local\Temp\5791.exe
                                                MD5

                                                224016e7d9a073ce240c6df108ba0ebb

                                                SHA1

                                                e5289609b29c0ab6b399e100c9f87fc39b29ac61

                                                SHA256

                                                9c55d8b1e171b21b41833dcbab1b07157f3bd3a12a06578c9063a211bb0bc61e

                                                SHA512

                                                a8f705f75dc0e1b98e22ecaa2995d763b1bbf231c5e0ad4a24390fde1ab6ebb27dc6aac3fcc27026090e90c98a96c47a39c9220e3d119f7072921b89a058e0fa

                                              • C:\Users\Admin\AppData\Local\Temp\5791.exe
                                                MD5

                                                224016e7d9a073ce240c6df108ba0ebb

                                                SHA1

                                                e5289609b29c0ab6b399e100c9f87fc39b29ac61

                                                SHA256

                                                9c55d8b1e171b21b41833dcbab1b07157f3bd3a12a06578c9063a211bb0bc61e

                                                SHA512

                                                a8f705f75dc0e1b98e22ecaa2995d763b1bbf231c5e0ad4a24390fde1ab6ebb27dc6aac3fcc27026090e90c98a96c47a39c9220e3d119f7072921b89a058e0fa

                                              • C:\Users\Admin\AppData\Local\Temp\5791.exe
                                                MD5

                                                224016e7d9a073ce240c6df108ba0ebb

                                                SHA1

                                                e5289609b29c0ab6b399e100c9f87fc39b29ac61

                                                SHA256

                                                9c55d8b1e171b21b41833dcbab1b07157f3bd3a12a06578c9063a211bb0bc61e

                                                SHA512

                                                a8f705f75dc0e1b98e22ecaa2995d763b1bbf231c5e0ad4a24390fde1ab6ebb27dc6aac3fcc27026090e90c98a96c47a39c9220e3d119f7072921b89a058e0fa

                                              • C:\Users\Admin\AppData\Local\Temp\608B.exe
                                                MD5

                                                7d782bbbbd6cb54410caef8242537cab

                                                SHA1

                                                ca691b9fea276140b5c95cfea35329ecfd4c592b

                                                SHA256

                                                6960869ade53d02d2eb6c52826785aec6524c7be92c89f5dfbc83ac986b2b14b

                                                SHA512

                                                962e98d23c2e50ba2ed644314340af4c73cfe8b3eaaa904431500b21f936ccc8686c147a4ea66f507d72195e920c63ecc6d435a73f87922e4dd622e8cac036b4

                                              • C:\Users\Admin\AppData\Local\Temp\608B.exe
                                                MD5

                                                7d782bbbbd6cb54410caef8242537cab

                                                SHA1

                                                ca691b9fea276140b5c95cfea35329ecfd4c592b

                                                SHA256

                                                6960869ade53d02d2eb6c52826785aec6524c7be92c89f5dfbc83ac986b2b14b

                                                SHA512

                                                962e98d23c2e50ba2ed644314340af4c73cfe8b3eaaa904431500b21f936ccc8686c147a4ea66f507d72195e920c63ecc6d435a73f87922e4dd622e8cac036b4

                                              • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                                                MD5

                                                7d782bbbbd6cb54410caef8242537cab

                                                SHA1

                                                ca691b9fea276140b5c95cfea35329ecfd4c592b

                                                SHA256

                                                6960869ade53d02d2eb6c52826785aec6524c7be92c89f5dfbc83ac986b2b14b

                                                SHA512

                                                962e98d23c2e50ba2ed644314340af4c73cfe8b3eaaa904431500b21f936ccc8686c147a4ea66f507d72195e920c63ecc6d435a73f87922e4dd622e8cac036b4

                                              • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                                                MD5

                                                7d782bbbbd6cb54410caef8242537cab

                                                SHA1

                                                ca691b9fea276140b5c95cfea35329ecfd4c592b

                                                SHA256

                                                6960869ade53d02d2eb6c52826785aec6524c7be92c89f5dfbc83ac986b2b14b

                                                SHA512

                                                962e98d23c2e50ba2ed644314340af4c73cfe8b3eaaa904431500b21f936ccc8686c147a4ea66f507d72195e920c63ecc6d435a73f87922e4dd622e8cac036b4

                                              • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                                                MD5

                                                7d782bbbbd6cb54410caef8242537cab

                                                SHA1

                                                ca691b9fea276140b5c95cfea35329ecfd4c592b

                                                SHA256

                                                6960869ade53d02d2eb6c52826785aec6524c7be92c89f5dfbc83ac986b2b14b

                                                SHA512

                                                962e98d23c2e50ba2ed644314340af4c73cfe8b3eaaa904431500b21f936ccc8686c147a4ea66f507d72195e920c63ecc6d435a73f87922e4dd622e8cac036b4

                                              • C:\Users\Admin\AppData\Local\Temp\66E5.exe
                                                MD5

                                                f497ff63ca89d5513a63de1dc1bae58f

                                                SHA1

                                                ca6b819d4c0d27d5d737f2dc70109b87b6344bef

                                                SHA256

                                                ce9422ae9f6eb554748eaf832be6aced3f5ac556ed53734573c43a6e34198241

                                                SHA512

                                                6729da8220b548fa8b9d9f23ae39330a5dcb4ac22597121ce56dca6d433ac061502d6c270032135b321d6f4d79b4f0e7299efa961f8c7a3a49508be06cbab02a

                                              • C:\Users\Admin\AppData\Local\Temp\66E5.exe
                                                MD5

                                                f497ff63ca89d5513a63de1dc1bae58f

                                                SHA1

                                                ca6b819d4c0d27d5d737f2dc70109b87b6344bef

                                                SHA256

                                                ce9422ae9f6eb554748eaf832be6aced3f5ac556ed53734573c43a6e34198241

                                                SHA512

                                                6729da8220b548fa8b9d9f23ae39330a5dcb4ac22597121ce56dca6d433ac061502d6c270032135b321d6f4d79b4f0e7299efa961f8c7a3a49508be06cbab02a

                                              • C:\Users\Admin\AppData\Local\Temp\66E5.exe
                                                MD5

                                                f497ff63ca89d5513a63de1dc1bae58f

                                                SHA1

                                                ca6b819d4c0d27d5d737f2dc70109b87b6344bef

                                                SHA256

                                                ce9422ae9f6eb554748eaf832be6aced3f5ac556ed53734573c43a6e34198241

                                                SHA512

                                                6729da8220b548fa8b9d9f23ae39330a5dcb4ac22597121ce56dca6d433ac061502d6c270032135b321d6f4d79b4f0e7299efa961f8c7a3a49508be06cbab02a

                                              • C:\Users\Admin\AppData\Local\Temp\758C.exe
                                                MD5

                                                9f25eb870ee8a56eda7d35dc25f2241c

                                                SHA1

                                                7af117f07ca61a75baa2e4b183f980832b19f390

                                                SHA256

                                                53e95f5ab8f18a70baf702d59c2b308fb998de4cdc06d4d7d30c450e4cdfd4e3

                                                SHA512

                                                f39f4f99302cbcc3b0cd60a9899864ec9d2b84aa937ef1e07696043198d673908006e11cd40972bdfe0015112bc2310c03cc9467d0a2e523d5b1bc3858bd5eb2

                                              • C:\Users\Admin\AppData\Local\Temp\758C.exe
                                                MD5

                                                9f25eb870ee8a56eda7d35dc25f2241c

                                                SHA1

                                                7af117f07ca61a75baa2e4b183f980832b19f390

                                                SHA256

                                                53e95f5ab8f18a70baf702d59c2b308fb998de4cdc06d4d7d30c450e4cdfd4e3

                                                SHA512

                                                f39f4f99302cbcc3b0cd60a9899864ec9d2b84aa937ef1e07696043198d673908006e11cd40972bdfe0015112bc2310c03cc9467d0a2e523d5b1bc3858bd5eb2

                                              • C:\Users\Admin\AppData\Local\Temp\8675.exe
                                                MD5

                                                2fe55f16da6348999312ef5ec21ae20d

                                                SHA1

                                                112bb1adce4ff9c427f61acbad6129794f8b213e

                                                SHA256

                                                f441a110f19b615e5c5fcf95ad57f96c418c2b5b3ad2565ff3863442457b422d

                                                SHA512

                                                12747dd0fb27ace42c58f9412099d8fb33e73a24a1c1a86ebab96c22aef9f11a32320b8eca61fa9197ec8476a358ef674e067151d163b2a96f92085cf3d72724

                                              • C:\Users\Admin\AppData\Local\Temp\8675.exe
                                                MD5

                                                2fe55f16da6348999312ef5ec21ae20d

                                                SHA1

                                                112bb1adce4ff9c427f61acbad6129794f8b213e

                                                SHA256

                                                f441a110f19b615e5c5fcf95ad57f96c418c2b5b3ad2565ff3863442457b422d

                                                SHA512

                                                12747dd0fb27ace42c58f9412099d8fb33e73a24a1c1a86ebab96c22aef9f11a32320b8eca61fa9197ec8476a358ef674e067151d163b2a96f92085cf3d72724

                                              • C:\Users\Admin\AppData\Local\Temp\E933.exe
                                                MD5

                                                265ed6f79387305a37bd4a598403adf1

                                                SHA1

                                                c0647e1d4a77715a54141e4898bebcd322f3d9da

                                                SHA256

                                                1c10d4f9c74cbfb4478aa18e3430ea14c07da31ca819ffb8bea5d6e30218bff5

                                                SHA512

                                                1a7c615cab3ebe9910282b01bec5f5eb9558f40d716c4b0914e15d3d8b59e7d4bc37569575c8d9ba612613e1298f3f390d0bbaa153975f40ec262cea27b58b62

                                              • C:\Users\Admin\AppData\Local\Temp\E933.exe
                                                MD5

                                                265ed6f79387305a37bd4a598403adf1

                                                SHA1

                                                c0647e1d4a77715a54141e4898bebcd322f3d9da

                                                SHA256

                                                1c10d4f9c74cbfb4478aa18e3430ea14c07da31ca819ffb8bea5d6e30218bff5

                                                SHA512

                                                1a7c615cab3ebe9910282b01bec5f5eb9558f40d716c4b0914e15d3d8b59e7d4bc37569575c8d9ba612613e1298f3f390d0bbaa153975f40ec262cea27b58b62

                                              • C:\Users\Admin\AppData\Local\Temp\gllmbqb.exe
                                                MD5

                                                1ae3003154d2f5d745a8517adcf5e17f

                                                SHA1

                                                df1baf85e5ee05bb102ace3aed414dfc4d63cb8a

                                                SHA256

                                                ca40e72062f8da5eb175cc741e8dc3e9d81722333f550a46462c37b13e784643

                                                SHA512

                                                1e7b255214b160fb15dfeb7929dea866c95c0d4e949600ac4f0462beeab01c6493dc3d67b04fcebf1472e9e411938dfbe40e9d67545b32d4150ff70a9d65888d

                                              • C:\Users\Admin\AppData\Local\Temp\leakless-34a05a9dc363ec03e25d5dcc5ff915d2\leakless.exe
                                                MD5

                                                3ea012e26f60ab84a7cf5ad579a83cf4

                                                SHA1

                                                3bd5db30c5a7c8f98a8ccffef341bdd185d3293f

                                                SHA256

                                                6239686d69c87891881710569472e327dadbce031d98f08fea0f98d8c1d62399

                                                SHA512

                                                f3272c880671a1a7a877682f1637ee8e4095990156bee13a41da79ddeb466e540268fc827ed23ac6748ce37a924dc321936e3df031700d0c551031af967457e0

                                              • C:\Users\Admin\AppData\Local\Temp\leakless-34a05a9dc363ec03e25d5dcc5ff915d2\leakless.exe
                                                MD5

                                                3ea012e26f60ab84a7cf5ad579a83cf4

                                                SHA1

                                                3bd5db30c5a7c8f98a8ccffef341bdd185d3293f

                                                SHA256

                                                6239686d69c87891881710569472e327dadbce031d98f08fea0f98d8c1d62399

                                                SHA512

                                                f3272c880671a1a7a877682f1637ee8e4095990156bee13a41da79ddeb466e540268fc827ed23ac6748ce37a924dc321936e3df031700d0c551031af967457e0

                                              • C:\Users\Admin\AppData\Roaming\counterstrike.exe
                                                MD5

                                                9a0f30f9096d0a3cea84512b2044b5fa

                                                SHA1

                                                9c6e6ceb67e75c9960ad5a4cc756b6f096c30343

                                                SHA256

                                                5b8c8da4d888e49c2f9b009163169bdf444db2a48dc9f9b9d020cc9178972fd9

                                                SHA512

                                                e88edab9a771e9e5fb3bcbc2d497a49e56cb440f933cf64d8e60a39c8228842e035803eb21c25cc5c5f26f1b6456796b01e8ca49f9dc3ee3dd279da4cc75d833

                                              • C:\Users\Admin\AppData\Roaming\counterstrike.exe
                                                MD5

                                                9a0f30f9096d0a3cea84512b2044b5fa

                                                SHA1

                                                9c6e6ceb67e75c9960ad5a4cc756b6f096c30343

                                                SHA256

                                                5b8c8da4d888e49c2f9b009163169bdf444db2a48dc9f9b9d020cc9178972fd9

                                                SHA512

                                                e88edab9a771e9e5fb3bcbc2d497a49e56cb440f933cf64d8e60a39c8228842e035803eb21c25cc5c5f26f1b6456796b01e8ca49f9dc3ee3dd279da4cc75d833

                                              • C:\Windows\SysWOW64\gfgcujcy\gllmbqb.exe
                                                MD5

                                                1ae3003154d2f5d745a8517adcf5e17f

                                                SHA1

                                                df1baf85e5ee05bb102ace3aed414dfc4d63cb8a

                                                SHA256

                                                ca40e72062f8da5eb175cc741e8dc3e9d81722333f550a46462c37b13e784643

                                                SHA512

                                                1e7b255214b160fb15dfeb7929dea866c95c0d4e949600ac4f0462beeab01c6493dc3d67b04fcebf1472e9e411938dfbe40e9d67545b32d4150ff70a9d65888d

                                              • \??\pipe\crashpad_724_DOWMRLEJGYXTQVTV
                                                MD5

                                                d41d8cd98f00b204e9800998ecf8427e

                                                SHA1

                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                SHA256

                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                SHA512

                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                              • \ProgramData\mozglue.dll
                                                MD5

                                                8f73c08a9660691143661bf7332c3c27

                                                SHA1

                                                37fa65dd737c50fda710fdbde89e51374d0c204a

                                                SHA256

                                                3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                SHA512

                                                0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                              • \ProgramData\nss3.dll
                                                MD5

                                                bfac4e3c5908856ba17d41edcd455a51

                                                SHA1

                                                8eec7e888767aa9e4cca8ff246eb2aacb9170428

                                                SHA256

                                                e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                                                SHA512

                                                2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                                              • \ProgramData\sqlite3.dll
                                                MD5

                                                e477a96c8f2b18d6b5c27bde49c990bf

                                                SHA1

                                                e980c9bf41330d1e5bd04556db4646a0210f7409

                                                SHA256

                                                16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

                                                SHA512

                                                335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

                                              • memory/684-118-0x0000000000630000-0x0000000000639000-memory.dmp
                                                Filesize

                                                36KB

                                              • memory/736-135-0x0000000000402F47-mapping.dmp
                                              • memory/768-204-0x0000000000000000-mapping.dmp
                                              • memory/800-255-0x0000000000620000-0x0000000000621000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/800-254-0x0000000000719A6B-mapping.dmp
                                              • memory/800-253-0x0000000000710000-0x0000000000725000-memory.dmp
                                                Filesize

                                                84KB

                                              • memory/800-256-0x0000000000620000-0x0000000000621000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/948-214-0x0000000000400000-0x00000000004D6000-memory.dmp
                                                Filesize

                                                856KB

                                              • memory/948-213-0x0000000000530000-0x000000000067A000-memory.dmp
                                                Filesize

                                                1.3MB

                                              • memory/948-148-0x0000000000000000-mapping.dmp
                                              • memory/948-212-0x00000000006D6000-0x00000000006F4000-memory.dmp
                                                Filesize

                                                120KB

                                              • memory/1092-257-0x0000000000400000-0x00000000004D2000-memory.dmp
                                                Filesize

                                                840KB

                                              • memory/1132-209-0x0000000000000000-mapping.dmp
                                              • memory/1156-262-0x0000000000000000-mapping.dmp
                                              • memory/1292-258-0x0000000000000000-mapping.dmp
                                              • memory/1464-174-0x0000000000400000-0x00000000004D2000-memory.dmp
                                                Filesize

                                                840KB

                                              • memory/1464-172-0x0000000000530000-0x0000000000543000-memory.dmp
                                                Filesize

                                                76KB

                                              • memory/1464-138-0x0000000000000000-mapping.dmp
                                              • memory/1476-188-0x0000000004D40000-0x0000000004D41000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1476-177-0x0000000000400000-0x0000000000420000-memory.dmp
                                                Filesize

                                                128KB

                                              • memory/1476-184-0x0000000004CE0000-0x0000000004CE1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1476-185-0x0000000004E10000-0x0000000004E11000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1476-178-0x0000000000419326-mapping.dmp
                                              • memory/1476-183-0x0000000005250000-0x0000000005251000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1476-205-0x0000000004C40000-0x0000000005246000-memory.dmp
                                                Filesize

                                                6.0MB

                                              • memory/1476-197-0x0000000004D80000-0x0000000004D81000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1476-242-0x0000000005860000-0x0000000005861000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1584-181-0x0000000000000000-mapping.dmp
                                              • memory/1752-147-0x00000000049A0000-0x00000000049A1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1752-141-0x0000000000000000-mapping.dmp
                                              • memory/1752-144-0x0000000000150000-0x0000000000151000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1752-149-0x0000000004B60000-0x0000000004B61000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1752-152-0x0000000002490000-0x0000000002491000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1752-155-0x0000000005070000-0x0000000005071000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1752-146-0x00000000049C0000-0x00000000049C1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/1864-153-0x0000000000806000-0x0000000000818000-memory.dmp
                                                Filesize

                                                72KB

                                              • memory/1864-130-0x0000000000000000-mapping.dmp
                                              • memory/1864-156-0x00000000005E0000-0x00000000005FC000-memory.dmp
                                                Filesize

                                                112KB

                                              • memory/1864-157-0x0000000000400000-0x00000000004D2000-memory.dmp
                                                Filesize

                                                840KB

                                              • memory/2000-261-0x0000000000000000-mapping.dmp
                                              • memory/2036-168-0x00000000009F0000-0x00000000009F7000-memory.dmp
                                                Filesize

                                                28KB

                                              • memory/2036-169-0x00000000009E0000-0x00000000009EC000-memory.dmp
                                                Filesize

                                                48KB

                                              • memory/2036-165-0x0000000000000000-mapping.dmp
                                              • memory/2120-186-0x0000000000000000-mapping.dmp
                                              • memory/2356-171-0x0000000002520000-0x0000000002521000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/2356-164-0x00000000001B0000-0x00000000001B1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/2356-160-0x0000000000000000-mapping.dmp
                                              • memory/2356-170-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/2424-154-0x0000000000000000-mapping.dmp
                                              • memory/2424-161-0x0000000000110000-0x000000000017B000-memory.dmp
                                                Filesize

                                                428KB

                                              • memory/2424-159-0x0000000000180000-0x00000000001F4000-memory.dmp
                                                Filesize

                                                464KB

                                              • memory/2516-248-0x00000000073E0000-0x00000000073E1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/2516-206-0x00000000057A0000-0x0000000005DA6000-memory.dmp
                                                Filesize

                                                6.0MB

                                              • memory/2516-249-0x0000000007AE0000-0x0000000007AE1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/2516-241-0x0000000005BB0000-0x0000000005BB1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/2516-192-0x0000000000400000-0x0000000000420000-memory.dmp
                                                Filesize

                                                128KB

                                              • memory/2516-193-0x000000000041932E-mapping.dmp
                                              • memory/2516-269-0x00000000077B0000-0x00000000077B1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/2928-127-0x0000000000000000-mapping.dmp
                                              • memory/2928-136-0x00000000005D0000-0x000000000071A000-memory.dmp
                                                Filesize

                                                1.3MB

                                              • memory/3024-173-0x0000000000000000-mapping.dmp
                                              • memory/3068-126-0x0000000002DA0000-0x0000000002DB6000-memory.dmp
                                                Filesize

                                                88KB

                                              • memory/3068-158-0x0000000003290000-0x00000000032A6000-memory.dmp
                                                Filesize

                                                88KB

                                              • memory/3068-119-0x00000000010C0000-0x00000000010D6000-memory.dmp
                                                Filesize

                                                88KB

                                              • memory/3088-207-0x0000000000000000-mapping.dmp
                                              • memory/3232-124-0x0000000001FA0000-0x0000000001FA9000-memory.dmp
                                                Filesize

                                                36KB

                                              • memory/3232-125-0x0000000000400000-0x00000000004CD000-memory.dmp
                                                Filesize

                                                820KB

                                              • memory/3232-120-0x0000000000000000-mapping.dmp
                                              • memory/3308-191-0x0000000000000000-mapping.dmp
                                              • memory/3500-231-0x0000000001200000-0x0000000001201000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/3500-226-0x00000000011A0000-0x00000000011A1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/3500-225-0x0000000001180000-0x0000000001181000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/3500-224-0x0000000001170000-0x0000000001171000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/3500-218-0x0000000000000000-mapping.dmp
                                              • memory/3500-227-0x00000000011B0000-0x00000000011B1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/3500-232-0x0000000000190000-0x0000000000C46000-memory.dmp
                                                Filesize

                                                10.7MB

                                              • memory/3500-234-0x00000000011F0000-0x00000000011F1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/3500-228-0x00000000011C0000-0x00000000011C1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/3500-229-0x00000000011D0000-0x00000000011D1000-memory.dmp
                                                Filesize

                                                4KB

                                              • memory/3648-175-0x0000000000000000-mapping.dmp
                                              • memory/3664-187-0x0000000000000000-mapping.dmp
                                              • memory/3896-117-0x0000000000402F47-mapping.dmp
                                              • memory/3896-116-0x0000000000400000-0x0000000000409000-memory.dmp
                                                Filesize

                                                36KB

                                              • memory/4008-264-0x0000000000400000-0x00000000004D6000-memory.dmp
                                                Filesize

                                                856KB

                                              • memory/4008-263-0x0000000002100000-0x0000000002138000-memory.dmp
                                                Filesize

                                                224KB

                                              • memory/4008-215-0x0000000000000000-mapping.dmp
                                              • memory/4080-221-0x0000000000000000-mapping.dmp
                                              • memory/4136-265-0x0000000000000000-mapping.dmp
                                              • memory/4172-266-0x0000000000000000-mapping.dmp
                                              • memory/4432-277-0x0000000002C00000-0x0000000002CF1000-memory.dmp
                                                Filesize

                                                964KB

                                              • memory/4432-276-0x0000000002C9259C-mapping.dmp
                                              • memory/4432-272-0x0000000002C00000-0x0000000002CF1000-memory.dmp
                                                Filesize

                                                964KB

                                              • memory/4596-278-0x0000000000000000-mapping.dmp
                                              • memory/4776-279-0x0000000000570000-0x0000000000590000-memory.dmp
                                                Filesize

                                                128KB

                                              • memory/4776-284-0x0000000000589326-mapping.dmp
                                              • memory/4776-292-0x0000000004990000-0x0000000004F96000-memory.dmp
                                                Filesize

                                                6.0MB

                                              • memory/4856-302-0x0000000000400000-0x00000000004D6000-memory.dmp
                                                Filesize

                                                856KB