Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    22-02-2022 13:06

General

  • Target

    1e8f0d0824f43f1ac2d664723f81acc89e1fa7acd9f3353ea41c14c6077fbd5b.exe

  • Size

    3.3MB

  • MD5

    2ab31925a654ed3d501fe844f69bb345

  • SHA1

    40e047ba9c50e94e0de35578d9c26e51a7e92bf0

  • SHA256

    1e8f0d0824f43f1ac2d664723f81acc89e1fa7acd9f3353ea41c14c6077fbd5b

  • SHA512

    bb029b924973682346f18ac963a951b1e6132f43867290a5e99bdca7028cfd398431a0037fb453cf95460d7207934fca464561c1a016f445f4a1fe9d61815aee

Malware Config

Extracted

Family

socelars

C2

http://www.fddnice.pw/

http://www.sokoinfo.pw/

http://www.zzhlike.pw/

http://www.wygexde.xyz/

Extracted

Family

smokeloader

Version

2020

C2

http://perseus007.xyz/upload/

http://lambos1.xyz/upload/

http://cipluks.com/upload/

http://ragnar77.com/upload/

http://aslauk.com/upload/

http://qunersoo.xyz/upload /

http://hostunes.info/upload/

http://leonisdas.xyz/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

v113

C2

45.150.67.141:8054

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

  • Executes dropped EXE 10 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
    1⤵
      PID:432
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
      1⤵
      • Drops file in System32 directory
      PID:1100
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2740
      • C:\Windows\system32\wbem\WMIADAP.EXE
        wmiadap.exe /F /T /R
        2⤵
          PID:4024
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
        1⤵
          PID:2752
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
          1⤵
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          PID:2760
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
          1⤵
          • Modifies data under HKEY_USERS
          PID:1752
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
          1⤵
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1832
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k SystemNetworkService
            2⤵
            • Checks processor information in registry
            • Modifies data under HKEY_USERS
            • Modifies registry class
            PID:3904
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
          1⤵
            PID:2492
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
            1⤵
              PID:720
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
              1⤵
                PID:1608
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                1⤵
                  PID:1472
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                  1⤵
                    PID:1316
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    1⤵
                      PID:1152
                    • C:\Users\Admin\AppData\Local\Temp\1e8f0d0824f43f1ac2d664723f81acc89e1fa7acd9f3353ea41c14c6077fbd5b.exe
                      "C:\Users\Admin\AppData\Local\Temp\1e8f0d0824f43f1ac2d664723f81acc89e1fa7acd9f3353ea41c14c6077fbd5b.exe"
                      1⤵
                      • Checks computer location settings
                      • Suspicious use of WriteProcessMemory
                      PID:1532
                      • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
                        "C:\Users\Admin\AppData\Local\Temp\agdsk.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4000
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c taskkill /f /im chrome.exe
                          3⤵
                            PID:5288
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im chrome.exe
                              4⤵
                              • Kills process with taskkill
                              PID:5408
                        • C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
                          "C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          PID:3832
                        • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
                          "C:\Users\Admin\AppData\Local\Temp\wf-game.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:2412
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" "C:\Program Files\patch.dll",patch
                            3⤵
                            • Loads dropped DLL
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4080
                        • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                          "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1296
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1wNij7
                          2⤵
                          • Adds Run key to start application
                          • Enumerates system info in registry
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:3076
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffc0c7746f8,0x7ffc0c774708,0x7ffc0c774718
                            3⤵
                              PID:3448
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
                              3⤵
                                PID:2024
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4072
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3088 /prefetch:8
                                3⤵
                                  PID:4276
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
                                  3⤵
                                    PID:4508
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
                                    3⤵
                                      PID:4524
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5400 /prefetch:8
                                      3⤵
                                        PID:4804
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                                        3⤵
                                          PID:4160
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                                          3⤵
                                            PID:4176
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
                                            3⤵
                                              PID:4700
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                              3⤵
                                              • Drops file in Program Files directory
                                              PID:4628
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6ebfb5460,0x7ff6ebfb5470,0x7ff6ebfb5480
                                                4⤵
                                                  PID:4212
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
                                                3⤵
                                                  PID:5508
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
                                                  3⤵
                                                    PID:4792
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6992 /prefetch:8
                                                    3⤵
                                                      PID:5996
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
                                                      3⤵
                                                        PID:4012
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1792 /prefetch:8
                                                        3⤵
                                                          PID:4512
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,17840923598704867447,14753450251291670460,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6988 /prefetch:2
                                                          3⤵
                                                            PID:3396
                                                        • C:\Users\Admin\AppData\Local\Temp\ujqb.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\ujqb.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Checks computer location settings
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3396
                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            PID:4012
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                              4⤵
                                                                PID:3444
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1jF6h7
                                                              3⤵
                                                                PID:5412
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc0c7746f8,0x7ffc0c774708,0x7ffc0c774718
                                                                  4⤵
                                                                    PID:5380
                                                              • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Checks SCSI registry key(s)
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious behavior: MapViewOfSection
                                                                PID:4044
                                                              • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2428
                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:1932
                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4316
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:4232
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                1⤵
                                                                • Drops file in Windows directory
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4872
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                1⤵
                                                                  PID:4696

                                                                Network

                                                                MITRE ATT&CK Matrix ATT&CK v6

                                                                Persistence

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1060

                                                                Defense Evasion

                                                                Modify Registry

                                                                1
                                                                T1112

                                                                Credential Access

                                                                Credentials in Files

                                                                1
                                                                T1081

                                                                Discovery

                                                                Query Registry

                                                                5
                                                                T1012

                                                                System Information Discovery

                                                                7
                                                                T1082

                                                                Peripheral Device Discovery

                                                                2
                                                                T1120

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Web Service

                                                                1
                                                                T1102

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Program Files\patch.dat
                                                                  MD5

                                                                  e0951976d9544f909a27f759bb3b7f85

                                                                  SHA1

                                                                  f85ab0b98b6b46d2c52a61ae57e6cc381049cd4a

                                                                  SHA256

                                                                  bb0c68cfd8555c4526f36a4a1aabff3ab9565cc1ca8535de1f99f6dcf60c6652

                                                                  SHA512

                                                                  023e61bd1ffab2e909e585a84f2c63fb4748ca118264ec6aac2335df1d286d84f2a97cc983a491af5834b07102951563d29613d2ecc71df1ca43c0e7554d9992

                                                                • C:\Program Files\patch.dll
                                                                  MD5

                                                                  75ca86f2b605a5924edeb57b180620e7

                                                                  SHA1

                                                                  df2fda930efd40c2ae7c59533e5097bd631c3b47

                                                                  SHA256

                                                                  00cb52b80d015d1b692158ce9ca867b99b1ac82d9538090a09881b9edaa0c417

                                                                  SHA512

                                                                  d68b04f03d719506c418daa65d601d55a9319b84d5c53d16430a484a24f78d1237d14168fbc5c94221bf18ed40302cff7a2f02b05f7a0c3b95e870356d2cd63c

                                                                • C:\Program Files\patch.dll
                                                                  MD5

                                                                  75ca86f2b605a5924edeb57b180620e7

                                                                  SHA1

                                                                  df2fda930efd40c2ae7c59533e5097bd631c3b47

                                                                  SHA256

                                                                  00cb52b80d015d1b692158ce9ca867b99b1ac82d9538090a09881b9edaa0c417

                                                                  SHA512

                                                                  d68b04f03d719506c418daa65d601d55a9319b84d5c53d16430a484a24f78d1237d14168fbc5c94221bf18ed40302cff7a2f02b05f7a0c3b95e870356d2cd63c

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C
                                                                  MD5

                                                                  bc89ed9bf3569b9c4ac7d7dbefd2b16e

                                                                  SHA1

                                                                  50ca8e08d4f63946443ed2e197325ede26f8e3c9

                                                                  SHA256

                                                                  bc5bae4bd9595d062347fc45150fd49a50ad574fa1aaed0f02482aef9f9f064c

                                                                  SHA512

                                                                  f2cfebe3739e2243129baf18a0c2550d27f83def9ae9c60a8c45d67fa6f65ca13a6ac15210cf6f1d0c44fd49c53a834cb6588163f2a4889e3dee249e1a3dc579

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C
                                                                  MD5

                                                                  41b5ec34173c498336485bf32f0f0dff

                                                                  SHA1

                                                                  f93c0298cb6e49ec4d8f023c705a9dc4c179c9ac

                                                                  SHA256

                                                                  5921a5339a0b39f053c7965e4d503f17580e820ddd1812aa6e661d7eb64e34c4

                                                                  SHA512

                                                                  b5452e914e32f3164812cc61890bda07f733a6033c3fef13cfff8653ee9322c164d5302485fe29c84b9357d2205a0ea16329b826810c2e50dfe2ba43f98c1820

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  MD5

                                                                  ee62affb981b3e9a3246eef79249ad40

                                                                  SHA1

                                                                  a1c3564d86bb6341894e1efa65cd923a5c280c8f

                                                                  SHA256

                                                                  4a3834071a2ac2372115d0e1146132f41a1497b6616d822eb926bf3ab32dc1ca

                                                                  SHA512

                                                                  1450bfd79cbedfb186adfd9f7f2ff9c9296ffd5badae62048bbc67f808d431325ab5afbcc980251833a93f28dc3d6a74d2febdaf6d46697eacfac53c82b2acc4

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                  MD5

                                                                  e5e3377341056643b0494b6842c0b544

                                                                  SHA1

                                                                  d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                                  SHA256

                                                                  e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                                  SHA512

                                                                  83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                                • C:\Users\Admin\AppData\Local\Temp\CC4F.tmp
                                                                  MD5

                                                                  4f3387277ccbd6d1f21ac5c07fe4ca68

                                                                  SHA1

                                                                  e16506f662dc92023bf82def1d621497c8ab5890

                                                                  SHA256

                                                                  767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

                                                                  SHA512

                                                                  9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

                                                                • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                  MD5

                                                                  9f4a6bcd4a67e036b09f29cf4d1eed7d

                                                                  SHA1

                                                                  4e381845b6bb54b99285239877d1eaec6f421a36

                                                                  SHA256

                                                                  6031eba7674442ea58dd64f9c1735680cfc62bb5a59e0360760b2fe71eaa800b

                                                                  SHA512

                                                                  694719b079ab97a26ecce09cbaf5046a444a996831070609914e9e226f910528a9a3f6f22a89daf2b8fa5c8eeb0f77a9144b2e628356f1513503f934bc533bb1

                                                                • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                  MD5

                                                                  9f4a6bcd4a67e036b09f29cf4d1eed7d

                                                                  SHA1

                                                                  4e381845b6bb54b99285239877d1eaec6f421a36

                                                                  SHA256

                                                                  6031eba7674442ea58dd64f9c1735680cfc62bb5a59e0360760b2fe71eaa800b

                                                                  SHA512

                                                                  694719b079ab97a26ecce09cbaf5046a444a996831070609914e9e226f910528a9a3f6f22a89daf2b8fa5c8eeb0f77a9144b2e628356f1513503f934bc533bb1

                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                                                                  MD5

                                                                  137386467517e466a292749a57636e20

                                                                  SHA1

                                                                  abf7d3f16c3e306cbeacd9c8b251f61cc9a331ec

                                                                  SHA256

                                                                  a19ae371a0c342882da0e9c3391c3c3098b68cd703b47f87d72843f2ee9669c4

                                                                  SHA512

                                                                  d07f5183c12c7c21a27424e3e4256c8d40d253ab8f15330c3b0c88e38267db88fc0291b52a0b761ed75021835bc5acb03224558bf6509df8b877ddbcbd6717d1

                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                                                                  MD5

                                                                  137386467517e466a292749a57636e20

                                                                  SHA1

                                                                  abf7d3f16c3e306cbeacd9c8b251f61cc9a331ec

                                                                  SHA256

                                                                  a19ae371a0c342882da0e9c3391c3c3098b68cd703b47f87d72843f2ee9669c4

                                                                  SHA512

                                                                  d07f5183c12c7c21a27424e3e4256c8d40d253ab8f15330c3b0c88e38267db88fc0291b52a0b761ed75021835bc5acb03224558bf6509df8b877ddbcbd6717d1

                                                                • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
                                                                  MD5

                                                                  618c39d0b0b20b2b5449ab2eae8e00a2

                                                                  SHA1

                                                                  8cb2c1556062e3352b24e7c05f32c65138cb71ac

                                                                  SHA256

                                                                  e8ba721c624ea94595a594790089702d36e024966bf2110bdf374ee2a292e375

                                                                  SHA512

                                                                  197a6e6e591d665f2b32ff7e4dd2fea5a1fa81f873d9295ed45617869a4802c24d2eb8c213f30a05b8739c609435493f7d672c5ba8362e009086294b1067555d

                                                                • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
                                                                  MD5

                                                                  618c39d0b0b20b2b5449ab2eae8e00a2

                                                                  SHA1

                                                                  8cb2c1556062e3352b24e7c05f32c65138cb71ac

                                                                  SHA256

                                                                  e8ba721c624ea94595a594790089702d36e024966bf2110bdf374ee2a292e375

                                                                  SHA512

                                                                  197a6e6e591d665f2b32ff7e4dd2fea5a1fa81f873d9295ed45617869a4802c24d2eb8c213f30a05b8739c609435493f7d672c5ba8362e009086294b1067555d

                                                                • C:\Users\Admin\AppData\Local\Temp\edge_BITS_3076_1117846596\78994259-9abe-4b6f-a716-b2e24dd93ee9
                                                                  MD5

                                                                  27c9f03d0d772f4f8529d9375a04d01d

                                                                  SHA1

                                                                  7730ee2072fcdad00e5d41f6a2576c16c7178a77

                                                                  SHA256

                                                                  5ccb5514c9ba0b5db5b00115ead62c8d5dc50b1e247a3e2ce64e37e12f71fd70

                                                                  SHA512

                                                                  f790da6ceb46e0a5bdf7339f38444e1f5708fd08d6acb66ab546846a4353c558c2969f21e056385829d8a1f66dd8188d81740664eee13cfd728cda02f32cf592

                                                                • C:\Users\Admin\AppData\Local\Temp\edge_BITS_3076_1764459636\b22f5f18-f7ea-4290-929d-b13c03908334
                                                                  MD5

                                                                  a36d70bcd9333175811c53122f7d2c1d

                                                                  SHA1

                                                                  9a9a0c0ac2fc1db6e7b78868c8d4c96d747b8f1c

                                                                  SHA256

                                                                  26123bef7d73536450862d2c4d44963d720aa80b6fc2d8496f559cb9c1fdeb00

                                                                  SHA512

                                                                  e69aee2d91c50dd63030bd64cd12b5120c1db9871caf3c26b2cbf29ff96891b5f2e7d1388e4b731f77d7fb24904f379a6a8d5c1b2aacf8a8501fd0111ab0caf5

                                                                • C:\Users\Admin\AppData\Local\Temp\edge_BITS_3076_1794394757\1d147c3b-6a51-425f-a960-c0159921df27
                                                                  MD5

                                                                  22351f8e29208582a8c4a3be256433d7

                                                                  SHA1

                                                                  f05a56b94cfaf46b1c74f815cc9b9d80784ffb7e

                                                                  SHA256

                                                                  9ab1dc1c2c03aa5b274e583dc42891bc07dcceea577ac348940e112b48fa6006

                                                                  SHA512

                                                                  e13bf84d66b5f067508f5a8fb92cbea9bde8ffa3cca9a72ef1baf30d4675807de90fb2b461ea8f5ede9e13003c9fa5f3f56213aa09e4d8a2294f1f08c110a731

                                                                • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  MD5

                                                                  b7161c0845a64ff6d7345b67ff97f3b0

                                                                  SHA1

                                                                  d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                  SHA256

                                                                  fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                  SHA512

                                                                  98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  MD5

                                                                  bace8fd0110acc2ad29453621b43c3c3

                                                                  SHA1

                                                                  6d4b2147d16681eecf49edac27f8b5fb8253549c

                                                                  SHA256

                                                                  0a0443e59dac6b34492d1f752a532683c9b9402f255f532d919f2de5b5227bf3

                                                                  SHA512

                                                                  7d0741443587adb7c0a46219229d1055529cc9458650c1a81acca3a59cbc397fbb815a985bda8b05cdb88ce47d48008051ca7c774bb89705022ffa53d0afb7db

                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  MD5

                                                                  a6279ec92ff948760ce53bba817d6a77

                                                                  SHA1

                                                                  5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                                  SHA256

                                                                  8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                                  SHA512

                                                                  213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  MD5

                                                                  a6279ec92ff948760ce53bba817d6a77

                                                                  SHA1

                                                                  5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                                  SHA256

                                                                  8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                                  SHA512

                                                                  213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  MD5

                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                  SHA1

                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                  SHA256

                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                  SHA512

                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  MD5

                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                  SHA1

                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                  SHA256

                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                  SHA512

                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                • C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
                                                                  MD5

                                                                  6c3dcac23d9ea23eaa3af760ffbd7f56

                                                                  SHA1

                                                                  48520b338f54a9a0e07b30ec2e773164d3fd50ad

                                                                  SHA256

                                                                  6d11b804427bc17bb43557ede9d9278966b1b5f32807061f0489caecdaefa369

                                                                  SHA512

                                                                  2ad1c0c92f0c4df907fc826e172a99f6cea2bcb09bf9b18db6e414e70df7b041442a2712ede0c1e87722c4fd382d991877de74093142b4d1ff8138977efdc1dd

                                                                • C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
                                                                  MD5

                                                                  6c3dcac23d9ea23eaa3af760ffbd7f56

                                                                  SHA1

                                                                  48520b338f54a9a0e07b30ec2e773164d3fd50ad

                                                                  SHA256

                                                                  6d11b804427bc17bb43557ede9d9278966b1b5f32807061f0489caecdaefa369

                                                                  SHA512

                                                                  2ad1c0c92f0c4df907fc826e172a99f6cea2bcb09bf9b18db6e414e70df7b041442a2712ede0c1e87722c4fd382d991877de74093142b4d1ff8138977efdc1dd

                                                                • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                  MD5

                                                                  5ff4acf3bd3c36d12995d537a05eba48

                                                                  SHA1

                                                                  955ee2b5e8a361d46b6f8f584008d1eedfc820a3

                                                                  SHA256

                                                                  542f94bd50fe352ad5c08f5ffbda7c70f4e3d81cadfba15415498faa00294713

                                                                  SHA512

                                                                  acc0bbbaf42099a13a7995aff5e66e569139dbda853fac51f9a5dc1188d9bc9d5bb3f055f4d982d96960e42d2411699c7114692899b9d4eb9ae7b74223e91b20

                                                                • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                  MD5

                                                                  5ff4acf3bd3c36d12995d537a05eba48

                                                                  SHA1

                                                                  955ee2b5e8a361d46b6f8f584008d1eedfc820a3

                                                                  SHA256

                                                                  542f94bd50fe352ad5c08f5ffbda7c70f4e3d81cadfba15415498faa00294713

                                                                  SHA512

                                                                  acc0bbbaf42099a13a7995aff5e66e569139dbda853fac51f9a5dc1188d9bc9d5bb3f055f4d982d96960e42d2411699c7114692899b9d4eb9ae7b74223e91b20

                                                                • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                  MD5

                                                                  8cbde3982249e20a6f564eb414f06fe4

                                                                  SHA1

                                                                  6d040b6c0f9d10b07f0b63797aa7bfabf0703925

                                                                  SHA256

                                                                  4a8a37d0010b2a946e9b202ea07d8b93a29a3ea9a56852678307076e10999c83

                                                                  SHA512

                                                                  d84863489b5fb2d17ee1df47de735a88d510bb8f5e378126243e34edb017d3ed82807c7dbd5cf6a977601f0e440be12e680679f1ce472619fd0ebbe9579c3e1b

                                                                • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                  MD5

                                                                  8cbde3982249e20a6f564eb414f06fe4

                                                                  SHA1

                                                                  6d040b6c0f9d10b07f0b63797aa7bfabf0703925

                                                                  SHA256

                                                                  4a8a37d0010b2a946e9b202ea07d8b93a29a3ea9a56852678307076e10999c83

                                                                  SHA512

                                                                  d84863489b5fb2d17ee1df47de735a88d510bb8f5e378126243e34edb017d3ed82807c7dbd5cf6a977601f0e440be12e680679f1ce472619fd0ebbe9579c3e1b

                                                                • C:\Users\Admin\AppData\Local\Temp\ujqb.exe
                                                                  MD5

                                                                  18a86be17e87c2a06c0053efeb2898ea

                                                                  SHA1

                                                                  d381295bbf96fdd6d6af49d2149d21331c905415

                                                                  SHA256

                                                                  97c250fd07a2baed077ae385f6c88a2687546412137288d59b52c1570fce4688

                                                                  SHA512

                                                                  6b0610d1302932178aa70ba51ac06c2bb7734bff4e306c7db1dd6174be5a25bbaed08cbf215e651502655cd37d15cd30b0b4fbfffb5250399d00c4771cc88227

                                                                • C:\Users\Admin\AppData\Local\Temp\ujqb.exe
                                                                  MD5

                                                                  18a86be17e87c2a06c0053efeb2898ea

                                                                  SHA1

                                                                  d381295bbf96fdd6d6af49d2149d21331c905415

                                                                  SHA256

                                                                  97c250fd07a2baed077ae385f6c88a2687546412137288d59b52c1570fce4688

                                                                  SHA512

                                                                  6b0610d1302932178aa70ba51ac06c2bb7734bff4e306c7db1dd6174be5a25bbaed08cbf215e651502655cd37d15cd30b0b4fbfffb5250399d00c4771cc88227

                                                                • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
                                                                  MD5

                                                                  5530c8bf2fddf2afc18b2defc14d3a74

                                                                  SHA1

                                                                  872b5a3d72b20f64fbe5e5ed1998ea749d0ef648

                                                                  SHA256

                                                                  6e052a1f2392408efc528e25591b417c14cb1ff6e96faa6ff26b61f61ebfca3c

                                                                  SHA512

                                                                  a388aa78aecb876d42823c2a06f10f873182eacd18c31ae52323014f635e13fab16b07b0752462ad02fd9cdbba47c269bbcf4dacb89be39f0352bc02ee09ae0b

                                                                • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
                                                                  MD5

                                                                  5530c8bf2fddf2afc18b2defc14d3a74

                                                                  SHA1

                                                                  872b5a3d72b20f64fbe5e5ed1998ea749d0ef648

                                                                  SHA256

                                                                  6e052a1f2392408efc528e25591b417c14cb1ff6e96faa6ff26b61f61ebfca3c

                                                                  SHA512

                                                                  a388aa78aecb876d42823c2a06f10f873182eacd18c31ae52323014f635e13fab16b07b0752462ad02fd9cdbba47c269bbcf4dacb89be39f0352bc02ee09ae0b

                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk
                                                                  MD5

                                                                  82c76624dfa8d52a138cd60144fde4bc

                                                                  SHA1

                                                                  f5f512251ce743a6263deb9ae07c4acdf5c17940

                                                                  SHA256

                                                                  7c8095577df6e07a8402327a0aa2aebc4742a906062e5bc83c77d7748eb93910

                                                                  SHA512

                                                                  182e863f9e69ae2b7390ad23414c1d26b191b5ebd6e3e7c6a1473c348b3f61fc8b29586893a8ddb3ab8b7b58ccb49a97958dc32780e3f8679382f246212362ec

                                                                • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                  MD5

                                                                  688677f186c2af08a7d8dd4cc07e941b

                                                                  SHA1

                                                                  33e17e04bfc0c05903dcebe055d61eed9bd4db4b

                                                                  SHA256

                                                                  6dffb53c2ed82e4c9e3f0a78a7965ff94eab852bb6cf68d2de78a8970d4c2319

                                                                  SHA512

                                                                  e1d470c289be009d70191123b1f8641080e5d6846a30e2258603d9c5a980b7f9a7de57c27addbd3514d3938d0394646a8a6251fe3800122e31c442b3ae612b68

                                                                • \??\pipe\LOCAL\crashpad_3076_LSMMBDKYZWFVDXJK
                                                                  MD5

                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                  SHA1

                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                  SHA256

                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                  SHA512

                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                • memory/432-149-0x000001A2FE120000-0x000001A2FE187000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/720-156-0x0000029D77180000-0x0000029D771E7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/720-155-0x0000029D770C0000-0x0000029D77104000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/896-202-0x0000000008A40000-0x0000000008A56000-memory.dmp
                                                                  Filesize

                                                                  88KB

                                                                • memory/1100-153-0x00000252F5940000-0x00000252F59A7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1152-152-0x000001964FDA0000-0x000001964FDE4000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/1152-154-0x00000196504F0000-0x0000019650557000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1296-141-0x0000000000230000-0x0000000000266000-memory.dmp
                                                                  Filesize

                                                                  216KB

                                                                • memory/1296-146-0x000000001C450000-0x000000001C452000-memory.dmp
                                                                  Filesize

                                                                  8KB

                                                                • memory/1296-145-0x00007FFC10DD3000-0x00007FFC10DD5000-memory.dmp
                                                                  Filesize

                                                                  8KB

                                                                • memory/1316-158-0x000002B28CD70000-0x000002B28CDD7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1472-166-0x00000264133B0000-0x0000026413417000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1608-165-0x000002074DD40000-0x000002074DDA7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1752-160-0x000001C3E2EF0000-0x000001C3E2F57000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1832-148-0x0000020267840000-0x00000202678A7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1832-147-0x0000020267780000-0x00000202677C4000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/2024-187-0x00007FFC30390000-0x00007FFC30391000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/2492-151-0x000002667E740000-0x000002667E7A7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/2492-150-0x000002667E130000-0x000002667E174000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/2740-167-0x00000146F8000000-0x00000146F8067000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/2752-161-0x0000025B8EF30000-0x0000025B8EF74000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/2752-163-0x0000025B8F200000-0x0000025B8F267000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/2760-164-0x0000025E68320000-0x0000025E68387000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/3444-264-0x0000000004DF0000-0x0000000004E02000-memory.dmp
                                                                  Filesize

                                                                  72KB

                                                                • memory/3444-268-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/3444-273-0x0000000005100000-0x000000000520A000-memory.dmp
                                                                  Filesize

                                                                  1.0MB

                                                                • memory/3444-267-0x000000007161E000-0x000000007161F000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/3444-262-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                  Filesize

                                                                  112KB

                                                                • memory/3444-263-0x0000000005360000-0x0000000005978000-memory.dmp
                                                                  Filesize

                                                                  6.1MB

                                                                • memory/3444-265-0x0000000004E50000-0x0000000004E8C000-memory.dmp
                                                                  Filesize

                                                                  240KB

                                                                • memory/3832-232-0x0000000004220000-0x0000000004228000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/3832-235-0x00000000041A0000-0x00000000041A8000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/3832-234-0x00000000041A0000-0x00000000041A8000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/3832-233-0x00000000044E0000-0x00000000044E8000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/3832-231-0x0000000004260000-0x0000000004268000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/3832-229-0x0000000004180000-0x0000000004188000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/3832-230-0x00000000041A0000-0x00000000041A8000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/3904-157-0x000001BE72E70000-0x000001BE72ED7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/4012-180-0x0000000004E90000-0x0000000004F22000-memory.dmp
                                                                  Filesize

                                                                  584KB

                                                                • memory/4012-181-0x00000000054E0000-0x0000000005A84000-memory.dmp
                                                                  Filesize

                                                                  5.6MB

                                                                • memory/4012-178-0x00000000005D0000-0x000000000065E000-memory.dmp
                                                                  Filesize

                                                                  568KB

                                                                • memory/4012-185-0x0000000005380000-0x000000000538A000-memory.dmp
                                                                  Filesize

                                                                  40KB

                                                                • memory/4012-182-0x000000007161E000-0x000000007161F000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4012-184-0x0000000004F70000-0x0000000004F71000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/4044-189-0x0000000000A59000-0x0000000000A62000-memory.dmp
                                                                  Filesize

                                                                  36KB

                                                                • memory/4044-190-0x0000000000980000-0x0000000000989000-memory.dmp
                                                                  Filesize

                                                                  36KB

                                                                • memory/4044-191-0x0000000000400000-0x0000000000409000-memory.dmp
                                                                  Filesize

                                                                  36KB

                                                                • memory/4044-179-0x0000000000A59000-0x0000000000A62000-memory.dmp
                                                                  Filesize

                                                                  36KB

                                                                • memory/4080-159-0x0000000000B40000-0x0000000000B7A000-memory.dmp
                                                                  Filesize

                                                                  232KB

                                                                • memory/4080-162-0x0000000002610000-0x0000000002666000-memory.dmp
                                                                  Filesize

                                                                  344KB

                                                                • memory/4872-207-0x0000024B4CB30000-0x0000024B4CB40000-memory.dmp
                                                                  Filesize

                                                                  64KB

                                                                • memory/4872-209-0x0000024B4F880000-0x0000024B4F884000-memory.dmp
                                                                  Filesize

                                                                  16KB

                                                                • memory/4872-208-0x0000024B4CB90000-0x0000024B4CBA0000-memory.dmp
                                                                  Filesize

                                                                  64KB