Analysis
-
max time kernel
151s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
26-01-2022 10:45
Static task
static1
Behavioral task
behavioral1
Sample
0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exe
Resource
win10v2004-en-20220112
General
-
Target
0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exe
-
Size
334KB
-
MD5
57ee423591aca6825afbdf0a273a342f
-
SHA1
a4d8552d6c3d21bcfc7c11ba77302260c4c9e2e9
-
SHA256
0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f
-
SHA512
3c349a5a37aa13c0916901b6938a88e73023eef344cf997210d383f90d09ac0890f853f340fdf8b62479032fb73092ffd700f75eb5650726729d1524f3b854f0
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 4088 created 2888 4088 WerFault.exe swcwuuc PID 3484 created 2520 3484 WerFault.exe explorer.exe PID 3056 created 2592 3056 WerFault.exe DllHost.exe PID 2656 created 1216 2656 WerFault.exe DllHost.exe PID 1344 created 3928 1344 WerFault.exe DllHost.exe PID 3428 created 2080 3428 WerFault.exe DllHost.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
725A.exeswcwuucawcwuucpid process 2184 725A.exe 2888 swcwuuc 3008 awcwuuc -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Drops file in Windows directory 1 IoCs
Processes:
TiWorker.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3672 2888 WerFault.exe swcwuuc 1344 2520 WerFault.exe explorer.exe 3628 2592 WerFault.exe DllHost.exe 696 1216 WerFault.exe DllHost.exe 3788 3928 WerFault.exe DllHost.exe 3748 2080 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
725A.exeawcwuuc0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 725A.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 725A.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI awcwuuc Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI awcwuuc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI awcwuuc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 725A.exe -
Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe -
Enumerates system info in registry 2 TTPs 12 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3636 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "659278702" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cce5a29beacafa47833fc2d72883fdda00000000020000000000106600000001000020000000192aa63a0d675afa11195c1c4af008d707b97f18ff73e01d08ff19567a079295000000000e80000000020000200000003896ee9228b75492e22d6620e06a7be8d6f05431c1183169be4c03b6ca06523d20000000fc0e1b3618c98245c48bfd9a59ba69239d6d8af4aa624b710fc92ef7e5caea7f4000000017d1f4744c41db4f13bfe164c86cca461e3047de86b718b200ff1eb52c91832c9bcdb61bfbc7c88b233998a8b6ecda6c737e3b8c01cab553116abd117e74342e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e3ea2da212d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30937762" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a059f42da212d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30937762" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "694436831" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{522F6ED3-7E95-11EC-82D0-D2C6621C002E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "659278702" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30937762" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cce5a29beacafa47833fc2d72883fdda000000000200000000001066000000010000200000003c41a9ea878d04c140f7639f39f82516d71ef0b0bc074afd0d8a6f5eeb8527cc000000000e8000000002000020000000ac61edbbb4a2a661332db2821d8bca96e521ca3f900142cf17770875d08af138200000002fff5a59a1329533f103174d4b688ace0e7ccd287ce87932535e0ec00e7d71dd40000000537fb925b6dae5d15e1c3091922811571e6b3075e76effe790f8388b765e0748675ac35ea7bfbaa58c33eca42a936ae3439f68bd4d6e45643534a2da91f6ac73 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exepid process 3872 0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exe 3872 0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exe 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 2308 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2308 -
Suspicious behavior: MapViewOfSection 63 IoCs
Processes:
0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exe725A.exeawcwuucexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 3872 0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exe 2184 725A.exe 3008 awcwuuc 2308 2308 2308 2308 2308 2308 2184 explorer.exe 2184 explorer.exe 2308 2308 3012 explorer.exe 3012 explorer.exe 2308 2308 2904 explorer.exe 2904 explorer.exe 2308 2308 3692 explorer.exe 3692 explorer.exe 2308 2308 4040 explorer.exe 4040 explorer.exe 4040 explorer.exe 4040 explorer.exe 2308 2308 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 3388 WMIC.exe Token: SeSecurityPrivilege 3388 WMIC.exe Token: SeTakeOwnershipPrivilege 3388 WMIC.exe Token: SeLoadDriverPrivilege 3388 WMIC.exe Token: SeSystemProfilePrivilege 3388 WMIC.exe Token: SeSystemtimePrivilege 3388 WMIC.exe Token: SeProfSingleProcessPrivilege 3388 WMIC.exe Token: SeIncBasePriorityPrivilege 3388 WMIC.exe Token: SeCreatePagefilePrivilege 3388 WMIC.exe Token: SeBackupPrivilege 3388 WMIC.exe Token: SeRestorePrivilege 3388 WMIC.exe Token: SeShutdownPrivilege 3388 WMIC.exe Token: SeDebugPrivilege 3388 WMIC.exe Token: SeSystemEnvironmentPrivilege 3388 WMIC.exe Token: SeRemoteShutdownPrivilege 3388 WMIC.exe Token: SeUndockPrivilege 3388 WMIC.exe Token: SeManageVolumePrivilege 3388 WMIC.exe Token: 33 3388 WMIC.exe Token: 34 3388 WMIC.exe Token: 35 3388 WMIC.exe Token: 36 3388 WMIC.exe Token: SeIncreaseQuotaPrivilege 3388 WMIC.exe Token: SeSecurityPrivilege 3388 WMIC.exe Token: SeTakeOwnershipPrivilege 3388 WMIC.exe Token: SeLoadDriverPrivilege 3388 WMIC.exe Token: SeSystemProfilePrivilege 3388 WMIC.exe Token: SeSystemtimePrivilege 3388 WMIC.exe Token: SeProfSingleProcessPrivilege 3388 WMIC.exe Token: SeIncBasePriorityPrivilege 3388 WMIC.exe Token: SeCreatePagefilePrivilege 3388 WMIC.exe Token: SeBackupPrivilege 3388 WMIC.exe Token: SeRestorePrivilege 3388 WMIC.exe Token: SeShutdownPrivilege 3388 WMIC.exe Token: SeDebugPrivilege 3388 WMIC.exe Token: SeSystemEnvironmentPrivilege 3388 WMIC.exe Token: SeRemoteShutdownPrivilege 3388 WMIC.exe Token: SeUndockPrivilege 3388 WMIC.exe Token: SeManageVolumePrivilege 3388 WMIC.exe Token: 33 3388 WMIC.exe Token: 34 3388 WMIC.exe Token: 35 3388 WMIC.exe Token: 36 3388 WMIC.exe Token: SeIncreaseQuotaPrivilege 1588 WMIC.exe Token: SeSecurityPrivilege 1588 WMIC.exe Token: SeTakeOwnershipPrivilege 1588 WMIC.exe Token: SeLoadDriverPrivilege 1588 WMIC.exe Token: SeSystemProfilePrivilege 1588 WMIC.exe Token: SeSystemtimePrivilege 1588 WMIC.exe Token: SeProfSingleProcessPrivilege 1588 WMIC.exe Token: SeIncBasePriorityPrivilege 1588 WMIC.exe Token: SeCreatePagefilePrivilege 1588 WMIC.exe Token: SeBackupPrivilege 1588 WMIC.exe Token: SeRestorePrivilege 1588 WMIC.exe Token: SeShutdownPrivilege 1588 WMIC.exe Token: SeDebugPrivilege 1588 WMIC.exe Token: SeSystemEnvironmentPrivilege 1588 WMIC.exe Token: SeRemoteShutdownPrivilege 1588 WMIC.exe Token: SeUndockPrivilege 1588 WMIC.exe Token: SeManageVolumePrivilege 1588 WMIC.exe Token: 33 1588 WMIC.exe Token: 34 1588 WMIC.exe Token: 35 1588 WMIC.exe Token: 36 1588 WMIC.exe Token: SeIncreaseQuotaPrivilege 1588 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4000 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4000 iexplore.exe 4000 iexplore.exe 3400 IEXPLORE.EXE 3400 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exeWerFault.exeiexplore.exeWerFault.exeexplorer.exedescription pid process target process PID 2308 wrote to memory of 2184 2308 725A.exe PID 2308 wrote to memory of 2184 2308 725A.exe PID 2308 wrote to memory of 2184 2308 725A.exe PID 2308 wrote to memory of 3284 2308 cmd.exe PID 2308 wrote to memory of 3284 2308 cmd.exe PID 3284 wrote to memory of 3388 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 3388 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 1588 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 1588 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 1568 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 1568 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 392 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 392 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 4020 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 4020 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 3252 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 3252 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 1840 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 1840 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 3536 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 3536 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 1096 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 1096 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 2320 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 2320 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 2500 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 2500 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 2520 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 2520 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 2608 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 2608 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 3172 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 3172 3284 cmd.exe WMIC.exe PID 3284 wrote to memory of 3636 3284 cmd.exe ipconfig.exe PID 3284 wrote to memory of 3636 3284 cmd.exe ipconfig.exe PID 3284 wrote to memory of 1804 3284 cmd.exe ROUTE.EXE PID 3284 wrote to memory of 1804 3284 cmd.exe ROUTE.EXE PID 3284 wrote to memory of 3776 3284 cmd.exe netsh.exe PID 3284 wrote to memory of 3776 3284 cmd.exe netsh.exe PID 3284 wrote to memory of 752 3284 cmd.exe systeminfo.exe PID 3284 wrote to memory of 752 3284 cmd.exe systeminfo.exe PID 4088 wrote to memory of 2888 4088 WerFault.exe swcwuuc PID 4088 wrote to memory of 2888 4088 WerFault.exe swcwuuc PID 4000 wrote to memory of 3400 4000 iexplore.exe IEXPLORE.EXE PID 4000 wrote to memory of 3400 4000 iexplore.exe IEXPLORE.EXE PID 4000 wrote to memory of 3400 4000 iexplore.exe IEXPLORE.EXE PID 2308 wrote to memory of 2520 2308 explorer.exe PID 2308 wrote to memory of 2520 2308 explorer.exe PID 2308 wrote to memory of 2520 2308 explorer.exe PID 2308 wrote to memory of 2520 2308 explorer.exe PID 2308 wrote to memory of 696 2308 explorer.exe PID 2308 wrote to memory of 696 2308 explorer.exe PID 2308 wrote to memory of 696 2308 explorer.exe PID 3484 wrote to memory of 2520 3484 WerFault.exe explorer.exe PID 3484 wrote to memory of 2520 3484 WerFault.exe explorer.exe PID 2308 wrote to memory of 2184 2308 explorer.exe PID 2308 wrote to memory of 2184 2308 explorer.exe PID 2308 wrote to memory of 2184 2308 explorer.exe PID 2308 wrote to memory of 2184 2308 explorer.exe PID 2184 wrote to memory of 3400 2184 explorer.exe IEXPLORE.EXE PID 2184 wrote to memory of 3400 2184 explorer.exe IEXPLORE.EXE PID 2308 wrote to memory of 3012 2308 explorer.exe PID 2308 wrote to memory of 3012 2308 explorer.exe PID 2308 wrote to memory of 3012 2308 explorer.exe
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2592 -s 9562⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exe"C:\Users\Admin\AppData\Local\Temp\0b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe dac22ac013e68b278886ffa71ee0f452 v3ZlOpwF30iFnWPJhhsB+A.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\725A.exeC:\Users\Admin\AppData\Local\Temp\725A.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Users\Admin\AppData\Roaming\swcwuucC:\Users\Admin\AppData\Roaming\swcwuuc1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 3402⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\awcwuucC:\Users\Admin\AppData\Roaming\awcwuuc1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2888 -ip 28881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4000 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 8842⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2520 -ip 25201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 568 -p 2592 -ip 25921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1216 -s 8402⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 368 -p 1216 -ip 12161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3928 -s 8122⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 592 -p 3928 -ip 39281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2080 -s 8082⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 580 -p 2080 -ip 20801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\725A.exeMD5
18b755821bf0ededdb63e5201cb9f262
SHA11e202e8de7745dc6bba05479927cd361828ef253
SHA256bfc45c7920cd98543aebbd4d2419540f33352ac9cb7dd8c4ff5cf4d77d6efea1
SHA5128dcc01ff82b78f34df983d75740110b71504fd7b8918430087c7ffa1a373228499d34a43de6b738885abe7c7081778e6030e26d603b43bd8e3822f73694348a2
-
C:\Users\Admin\AppData\Local\Temp\725A.exeMD5
18b755821bf0ededdb63e5201cb9f262
SHA11e202e8de7745dc6bba05479927cd361828ef253
SHA256bfc45c7920cd98543aebbd4d2419540f33352ac9cb7dd8c4ff5cf4d77d6efea1
SHA5128dcc01ff82b78f34df983d75740110b71504fd7b8918430087c7ffa1a373228499d34a43de6b738885abe7c7081778e6030e26d603b43bd8e3822f73694348a2
-
C:\Users\Admin\AppData\Roaming\awcwuucMD5
57ee423591aca6825afbdf0a273a342f
SHA1a4d8552d6c3d21bcfc7c11ba77302260c4c9e2e9
SHA2560b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f
SHA5123c349a5a37aa13c0916901b6938a88e73023eef344cf997210d383f90d09ac0890f853f340fdf8b62479032fb73092ffd700f75eb5650726729d1524f3b854f0
-
C:\Users\Admin\AppData\Roaming\awcwuucMD5
57ee423591aca6825afbdf0a273a342f
SHA1a4d8552d6c3d21bcfc7c11ba77302260c4c9e2e9
SHA2560b8c0422dfc65a0d559a0002b26fc3e8585391aae590b10ce59d8bbbf033329f
SHA5123c349a5a37aa13c0916901b6938a88e73023eef344cf997210d383f90d09ac0890f853f340fdf8b62479032fb73092ffd700f75eb5650726729d1524f3b854f0
-
C:\Users\Admin\AppData\Roaming\swcwuucMD5
18b755821bf0ededdb63e5201cb9f262
SHA11e202e8de7745dc6bba05479927cd361828ef253
SHA256bfc45c7920cd98543aebbd4d2419540f33352ac9cb7dd8c4ff5cf4d77d6efea1
SHA5128dcc01ff82b78f34df983d75740110b71504fd7b8918430087c7ffa1a373228499d34a43de6b738885abe7c7081778e6030e26d603b43bd8e3822f73694348a2
-
C:\Users\Admin\AppData\Roaming\swcwuucMD5
18b755821bf0ededdb63e5201cb9f262
SHA11e202e8de7745dc6bba05479927cd361828ef253
SHA256bfc45c7920cd98543aebbd4d2419540f33352ac9cb7dd8c4ff5cf4d77d6efea1
SHA5128dcc01ff82b78f34df983d75740110b71504fd7b8918430087c7ffa1a373228499d34a43de6b738885abe7c7081778e6030e26d603b43bd8e3822f73694348a2
-
memory/696-257-0x0000000001010000-0x000000000101C000-memory.dmpFilesize
48KB
-
memory/1904-752-0x00000162FF810000-0x00000162FF811000-memory.dmpFilesize
4KB
-
memory/1904-280-0x00000162FF810000-0x00000162FF811000-memory.dmpFilesize
4KB
-
memory/2092-272-0x0000022E081A0000-0x0000022E081A1000-memory.dmpFilesize
4KB
-
memory/2112-273-0x000001ECA3A80000-0x000001ECA3A81000-memory.dmpFilesize
4KB
-
memory/2156-274-0x0000024C74500000-0x0000024C74501000-memory.dmpFilesize
4KB
-
memory/2184-258-0x0000000000430000-0x0000000000437000-memory.dmpFilesize
28KB
-
memory/2184-138-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/2184-137-0x0000000000580000-0x0000000000589000-memory.dmpFilesize
36KB
-
memory/2184-136-0x0000000000620000-0x000000000064A000-memory.dmpFilesize
168KB
-
memory/2184-259-0x0000000000420000-0x000000000042B000-memory.dmpFilesize
44KB
-
memory/2304-268-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/2304-269-0x0000000004BB0000-0x0000000004BBB000-memory.dmpFilesize
44KB
-
memory/2308-176-0x0000000003170000-0x0000000008000000-memory.dmpFilesize
78.6MB
-
memory/2308-133-0x0000000000CB0000-0x0000000000CC6000-memory.dmpFilesize
88KB
-
memory/2308-246-0x0000000008680000-0x0000000008696000-memory.dmpFilesize
88KB
-
memory/2308-139-0x0000000002D70000-0x0000000002D86000-memory.dmpFilesize
88KB
-
memory/2400-275-0x0000017AB8BF0000-0x0000017AB8BF1000-memory.dmpFilesize
4KB
-
memory/2520-255-0x0000000000E00000-0x0000000000E75000-memory.dmpFilesize
468KB
-
memory/2520-256-0x0000000000B50000-0x0000000000BBB000-memory.dmpFilesize
428KB
-
memory/2548-278-0x0000023434030000-0x0000023434031000-memory.dmpFilesize
4KB
-
memory/2696-276-0x000001EFB1DE0000-0x000001EFB1DE1000-memory.dmpFilesize
4KB
-
memory/2764-277-0x000001C7C1C50000-0x000001C7C1C51000-memory.dmpFilesize
4KB
-
memory/2888-244-0x0000000000400000-0x000000000047D000-memory.dmpFilesize
500KB
-
memory/2888-242-0x0000000000540000-0x000000000056B000-memory.dmpFilesize
172KB
-
memory/2904-263-0x0000000000AF0000-0x0000000000AF9000-memory.dmpFilesize
36KB
-
memory/2904-262-0x0000000000B00000-0x0000000000B05000-memory.dmpFilesize
20KB
-
memory/3008-243-0x0000000000620000-0x000000000064B000-memory.dmpFilesize
172KB
-
memory/3008-245-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/3012-261-0x00000000006E0000-0x00000000006EE000-memory.dmpFilesize
56KB
-
memory/3012-260-0x00000000006F0000-0x00000000006F9000-memory.dmpFilesize
36KB
-
memory/3692-265-0x00000000003A0000-0x00000000003AC000-memory.dmpFilesize
48KB
-
memory/3692-264-0x00000000003B0000-0x00000000003B6000-memory.dmpFilesize
24KB
-
memory/3720-270-0x0000000000DD0000-0x0000000000DD7000-memory.dmpFilesize
28KB
-
memory/3720-271-0x0000000000DC0000-0x0000000000DCD000-memory.dmpFilesize
52KB
-
memory/3788-686-0x000001D58BA10000-0x000001D58BA17000-memory.dmpFilesize
28KB
-
memory/3788-684-0x000001D58BDC0000-0x000001D58C2C1000-memory.dmpFilesize
5.0MB
-
memory/3860-279-0x000001AA08FE0000-0x000001AA08FE1000-memory.dmpFilesize
4KB
-
memory/3872-132-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/3872-130-0x0000000000550000-0x000000000057B000-memory.dmpFilesize
172KB
-
memory/3872-131-0x00000000021B0000-0x00000000021B9000-memory.dmpFilesize
36KB
-
memory/4040-266-0x0000000000B40000-0x0000000000B46000-memory.dmpFilesize
24KB
-
memory/4040-267-0x0000000000B30000-0x0000000000B3B000-memory.dmpFilesize
44KB