quasar | 54c1dc44cd458da7ec96343973fa7f350df27517715f41483f9cab748d3a9203

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-05-2022 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e.exe
Size

10.4MB
MD5

621c28cd39d9d6f9a3377b8da8a8849b
SHA1

5a025ed5f5baae77496e27fb2996fcb22d67ed40
SHA256

54c1dc44cd458da7ec96343973fa7f350df27517715f41483f9cab748d3a9203
SHA512

b5600b871ac950ec10d7bd0c38bb242a9921b1bccd2dacaa709471475a4c410eb2b43b693e2c18db40349f5c8e15b2c0ee93dde4eb3cbce2f47db880fe48033f

Score

10^/10

quasar redline venomrat awsr v/r/b discovery evasion infostealer persistence rat rootkit spyware stealer suricata trojan

Malware Config

Extracted

Family

redline

Botnet

AwsR

siyatermi.duckdns.org:17044

Extracted

Family

quasar

Version

2.1.0.0

Botnet

V/R/B

siyatermi.duckdns.org:1518

Mutex

VNM_MUTEX_mJ6pCWZMe3OMOha5bj

Attributes

encryption_key
g1Bi32PXFGwyBI9DJGTD
install_name
Start Process.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Browser Module
subdirectory
Sys Resources

Signatures

Contains code to disable Windows Defender 7 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Start Process.exe	disable_win_def
C:\Users\Admin\AppData\Roaming\Start Process.exe	disable_win_def
behavioral2/memory/4368-140-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
C:\Users\Admin\AppData\Roaming\Sys Resources\Start Process.exe	disable_win_def
C:\Users\Admin\AppData\Roaming\Sys Resources\Start Process.exe	disable_win_def
C:\Users\Admin\AppData\Roaming\Start Process.exe	disable_win_def
C:\Users\Admin\AppData\Roaming\Start Process.exe	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Quasar Payload 7 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Start Process.exe	family_quasar
C:\Users\Admin\AppData\Roaming\Start Process.exe	family_quasar
behavioral2/memory/4368-140-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\Sys Resources\Start Process.exe	family_quasar
C:\Users\Admin\AppData\Roaming\Sys Resources\Start Process.exe	family_quasar
C:\Users\Admin\AppData\Roaming\Start Process.exe	family_quasar
C:\Users\Admin\AppData\Roaming\Start Process.exe	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Software Check.exe	family_redline
C:\Users\Admin\AppData\Roaming\Software Check.exe	family_redline
behavioral2/memory/4544-138-0x0000000000F10000-0x0000000000F2E000-memory.dmp	family_redline

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata

Executes dropped EXE 6 IoCs

Processes:

Software Check.exeStart Process.exeTiktok Share Bot byDenmark.exeStart Process.exeStart Process.exeStart Process.exe

pid	process
4544	Software Check.exe
4368	Start Process.exe
1772	Tiktok Share Bot byDenmark.exe
2960	Start Process.exe
872	Start Process.exe
4540	Start Process.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Tiktok Share Bot byDenmark.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Tiktok Share Bot byDenmark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Tiktok Share Bot byDenmark.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e.exeStart Process.exeStart Process.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	Start Process.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	Start Process.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

Start Process.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	Start Process.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Start Process.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 ip-api.com

flow	ioc
8	ip-api.com

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d412a8e7-d659-4fd2-99dd-f365733862ed.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220525082552.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5028 1772 WerFault.exe Tiktok Share Bot byDenmark.exe

pid	pid_target	process	target process
5028	1772	WerFault.exe	Tiktok Share Bot byDenmark.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4108 schtasks.exe
2816 schtasks.exe

pid	process
4108	schtasks.exe
2816	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 6 IoCs

Processes:

taskmgr.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

4824 PING.EXE
3284 PING.EXE

pid	process
4824	PING.EXE
3284	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Tiktok Share Bot byDenmark.exe

pid	process
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe
1772	Tiktok Share Bot byDenmark.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Start Process.exe

pid process

2960 Start Process.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

5084 msedge.exe
5084 msedge.exe
5084 msedge.exe
5084 msedge.exe
5084 msedge.exe
5084 msedge.exe
5084 msedge.exe

pid	process
2960	Start Process.exe

pid	process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

Tiktok Share Bot byDenmark.exeSoftware Check.exeStart Process.exepowershell.exeStart Process.exeStart Process.exetaskmgr.exeStart Process.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1772	Tiktok Share Bot byDenmark.exe
Token: SeDebugPrivilege	4544	Software Check.exe
Token: SeDebugPrivilege	4368	Start Process.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	2960	Start Process.exe
Token: SeDebugPrivilege	2960	Start Process.exe
Token: SeDebugPrivilege	872	Start Process.exe
Token: SeDebugPrivilege	4228	taskmgr.exe
Token: SeSystemProfilePrivilege	4228	taskmgr.exe
Token: SeCreateGlobalPrivilege	4228	taskmgr.exe
Token: SeDebugPrivilege	4540	Start Process.exe
Token: 33	4544	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4544	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exemsedge.exe

pid	process
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
5084	msedge.exe
4228	taskmgr.exe
5084	msedge.exe
4228	taskmgr.exe
5084	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe
4228	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Start Process.exe

pid process

2960 Start Process.exe

pid	process
2960	Start Process.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e.exeStart Process.exeStart Process.execmd.execmd.exeStart Process.execmd.exemsedge.exe

description	pid	process	target process
PID 4260 wrote to memory of 4544	4260	e.exe	Software Check.exe
PID 4260 wrote to memory of 4544	4260	e.exe	Software Check.exe
PID 4260 wrote to memory of 4544	4260	e.exe	Software Check.exe
PID 4260 wrote to memory of 4368	4260	e.exe	Start Process.exe
PID 4260 wrote to memory of 4368	4260	e.exe	Start Process.exe
PID 4260 wrote to memory of 4368	4260	e.exe	Start Process.exe
PID 4260 wrote to memory of 1772	4260	e.exe	Tiktok Share Bot byDenmark.exe
PID 4260 wrote to memory of 1772	4260	e.exe	Tiktok Share Bot byDenmark.exe
PID 4368 wrote to memory of 4108	4368	Start Process.exe	schtasks.exe
PID 4368 wrote to memory of 4108	4368	Start Process.exe	schtasks.exe
PID 4368 wrote to memory of 4108	4368	Start Process.exe	schtasks.exe
PID 4368 wrote to memory of 2960	4368	Start Process.exe	Start Process.exe
PID 4368 wrote to memory of 2960	4368	Start Process.exe	Start Process.exe
PID 4368 wrote to memory of 2960	4368	Start Process.exe	Start Process.exe
PID 4368 wrote to memory of 2312	4368	Start Process.exe	powershell.exe
PID 4368 wrote to memory of 2312	4368	Start Process.exe	powershell.exe
PID 4368 wrote to memory of 2312	4368	Start Process.exe	powershell.exe
PID 2960 wrote to memory of 2816	2960	Start Process.exe	schtasks.exe
PID 2960 wrote to memory of 2816	2960	Start Process.exe	schtasks.exe
PID 2960 wrote to memory of 2816	2960	Start Process.exe	schtasks.exe
PID 4368 wrote to memory of 3328	4368	Start Process.exe	cmd.exe
PID 4368 wrote to memory of 3328	4368	Start Process.exe	cmd.exe
PID 4368 wrote to memory of 3328	4368	Start Process.exe	cmd.exe
PID 3328 wrote to memory of 1796	3328	cmd.exe	cmd.exe
PID 3328 wrote to memory of 1796	3328	cmd.exe	cmd.exe
PID 3328 wrote to memory of 1796	3328	cmd.exe	cmd.exe
PID 4368 wrote to memory of 2604	4368	Start Process.exe	cmd.exe
PID 4368 wrote to memory of 2604	4368	Start Process.exe	cmd.exe
PID 4368 wrote to memory of 2604	4368	Start Process.exe	cmd.exe
PID 2604 wrote to memory of 1476	2604	cmd.exe	chcp.com
PID 2604 wrote to memory of 1476	2604	cmd.exe	chcp.com
PID 2604 wrote to memory of 1476	2604	cmd.exe	chcp.com
PID 2604 wrote to memory of 4824	2604	cmd.exe	PING.EXE
PID 2604 wrote to memory of 4824	2604	cmd.exe	PING.EXE
PID 2604 wrote to memory of 4824	2604	cmd.exe	PING.EXE
PID 2604 wrote to memory of 872	2604	cmd.exe	Start Process.exe
PID 2604 wrote to memory of 872	2604	cmd.exe	Start Process.exe
PID 2604 wrote to memory of 872	2604	cmd.exe	Start Process.exe
PID 872 wrote to memory of 4520	872	Start Process.exe	cmd.exe
PID 872 wrote to memory of 4520	872	Start Process.exe	cmd.exe
PID 872 wrote to memory of 4520	872	Start Process.exe	cmd.exe
PID 4520 wrote to memory of 3160	4520	cmd.exe	chcp.com
PID 4520 wrote to memory of 3160	4520	cmd.exe	chcp.com
PID 4520 wrote to memory of 3160	4520	cmd.exe	chcp.com
PID 4520 wrote to memory of 3284	4520	cmd.exe	PING.EXE
PID 4520 wrote to memory of 3284	4520	cmd.exe	PING.EXE
PID 4520 wrote to memory of 3284	4520	cmd.exe	PING.EXE
PID 5084 wrote to memory of 4676	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4676	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe
PID 5084 wrote to memory of 4708	5084	msedge.exe	msedge.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1968 attrib.exe

pid	process
1968	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e.exe
"C:\Users\Admin\AppData\Local\Temp\e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Roaming\Start Process.exe
  "C:\Users\Admin\AppData\Roaming\Start Process.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Windows security modification
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Browser Module" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Start Process.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4108
- - C:\Users\Admin\AppData\Roaming\Sys Resources\Start Process.exe
    "C:\Users\Admin\AppData\Roaming\Sys Resources\Start Process.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Browser Module" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Sys Resources\Start Process.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2816
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NhFLcZJbYSwR.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Users\Admin\AppData\Roaming\Start Process.exe
      "C:\Users\Admin\AppData\Roaming\Start Process.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:872
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\03uWplbNq50F.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4520
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3160
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:3284
      - C:\Users\Admin\AppData\Roaming\Start Process.exe
        
        "C:\Users\Admin\AppData\Roaming\Start Process.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4540
- C:\Users\Admin\AppData\Roaming\Software Check.exe
  "C:\Users\Admin\AppData\Roaming\Software Check.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Users\Admin\AppData\Roaming\Tiktok Share Bot byDenmark.exe
  "C:\Users\Admin\AppData\Roaming\Tiktok Share Bot byDenmark.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1772 -s 1920
    3⤵
    - Program crash
    PID:5028

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 1772 -ip 1772
1⤵
PID:5064

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:4824

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:1476

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bing.com/search?q=atrrib+-S+-H&src=IE-SearchBox&FORM=IE11SR
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdd88146f8,0x7ffdd8814708,0x7ffdd8814718
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff777425460,0x7ff777425470,0x7ff777425480
    3⤵
    PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,14145742972000767710,6608146883388291421,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:1
  2⤵
  PID:5444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:5796

C:\Windows\System32\attrib.exe
"C:\Windows\System32\attrib.exe" -S -H *
1⤵
- Views/modifies file attributes
PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Start Process.exe.log

Filesize
1KB

MD5
10eab9c2684febb5327b6976f2047587

SHA1
a12ed54146a7f5c4c580416aecb899549712449e

SHA256
f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928

SHA512
7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\03uWplbNq50F.bat

Filesize
207B

MD5
0246c11f16bac8a70fbd4462ea17a9c0

SHA1
0a4fc2c698a24b8f8f547563bd4fc7712461e800

SHA256
5f21a6953305d24e335d97080d05db6f549d64197649225ccf0a001c07a57c96

SHA512
c61dedf1bc40d762953fe7ae395abeb78ce254d69b7cd50ef5bd06ca14b0e67e940774868a7a0e3206aa61d3ca96fae6f791f1703a39cfbd7f8446b70f0d1db8

Download Submit
C:\Users\Admin\AppData\Local\Temp\NhFLcZJbYSwR.bat

Filesize
207B

MD5
90a6d07d3a1757e812c08a8239805a0c

SHA1
48516307b96aad2984b4cd2e5f03b173e1589ebc

SHA256
b2cf576f3bc701a25f9c1125708a826d88ccf654d442f2cdbc5a83babade748f

SHA512
f43e6d5893dcf7b9bd126fdb808d9438dc804743f02af26e80d99170eafe59b190c6f8fbc1c3167261cd4c6f125b1f56924f7390fb5d8925a34882dee123d748

Download Submit
C:\Users\Admin\AppData\Roaming\Software Check.exe

Filesize
95KB

MD5
27c2436f6a1c111bef78597d37751138

SHA1
f1dabacffc82bbfc7d8db578f0a5653d7fe84bca

SHA256
bcac81c69094ea47c3a00cae028ac4c64dd6cbd4fe85e11363e3e35b48c04842

SHA512
97e717b9ad5b063e4ff1209684b27d033c5a4a8d9679e3d42d7308fbac1c885a1d3c85d3fed70b7a9adc82203d0e943777d7819456599276c61549186e319636

Download Submit
C:\Users\Admin\AppData\Roaming\Software Check.exe

Filesize
95KB

MD5
27c2436f6a1c111bef78597d37751138

SHA1
f1dabacffc82bbfc7d8db578f0a5653d7fe84bca

SHA256
bcac81c69094ea47c3a00cae028ac4c64dd6cbd4fe85e11363e3e35b48c04842

SHA512
97e717b9ad5b063e4ff1209684b27d033c5a4a8d9679e3d42d7308fbac1c885a1d3c85d3fed70b7a9adc82203d0e943777d7819456599276c61549186e319636

Download Submit
C:\Users\Admin\AppData\Roaming\Start Process.exe

Filesize
535KB

MD5
4d97786ab8047ad6c08532ed7a017573

SHA1
a64d07233d813f9a085722295dca62ca726e291a

SHA256
5a72c2a12e0e42313c5d01277d3b26f52810a9753e31883f5f3e7a73a0021870

SHA512
9224f6c0af0bb3aa6804e09b36617d2ecf762caf81ec0f2627553788f7045d09878b41ddb63a1d0779973cba52d2f1d59f69bc6c826ad8bb0d807444abab87d2

Download Submit
C:\Users\Admin\AppData\Roaming\Start Process.exe

Filesize
535KB

MD5
4d97786ab8047ad6c08532ed7a017573

SHA1
a64d07233d813f9a085722295dca62ca726e291a

SHA256
5a72c2a12e0e42313c5d01277d3b26f52810a9753e31883f5f3e7a73a0021870

SHA512
9224f6c0af0bb3aa6804e09b36617d2ecf762caf81ec0f2627553788f7045d09878b41ddb63a1d0779973cba52d2f1d59f69bc6c826ad8bb0d807444abab87d2

Download Submit
C:\Users\Admin\AppData\Roaming\Start Process.exe

Filesize
535KB

MD5
4d97786ab8047ad6c08532ed7a017573

SHA1
a64d07233d813f9a085722295dca62ca726e291a

SHA256
5a72c2a12e0e42313c5d01277d3b26f52810a9753e31883f5f3e7a73a0021870

SHA512
9224f6c0af0bb3aa6804e09b36617d2ecf762caf81ec0f2627553788f7045d09878b41ddb63a1d0779973cba52d2f1d59f69bc6c826ad8bb0d807444abab87d2

Download Submit
C:\Users\Admin\AppData\Roaming\Start Process.exe

Filesize
535KB

MD5
4d97786ab8047ad6c08532ed7a017573

SHA1
a64d07233d813f9a085722295dca62ca726e291a

SHA256
5a72c2a12e0e42313c5d01277d3b26f52810a9753e31883f5f3e7a73a0021870

SHA512
9224f6c0af0bb3aa6804e09b36617d2ecf762caf81ec0f2627553788f7045d09878b41ddb63a1d0779973cba52d2f1d59f69bc6c826ad8bb0d807444abab87d2

Download Submit
C:\Users\Admin\AppData\Roaming\Sys Resources\Start Process.exe

Filesize
535KB

MD5
4d97786ab8047ad6c08532ed7a017573

SHA1
a64d07233d813f9a085722295dca62ca726e291a

SHA256
5a72c2a12e0e42313c5d01277d3b26f52810a9753e31883f5f3e7a73a0021870

SHA512
9224f6c0af0bb3aa6804e09b36617d2ecf762caf81ec0f2627553788f7045d09878b41ddb63a1d0779973cba52d2f1d59f69bc6c826ad8bb0d807444abab87d2

Download Submit
C:\Users\Admin\AppData\Roaming\Sys Resources\Start Process.exe

Filesize
535KB

MD5
4d97786ab8047ad6c08532ed7a017573

SHA1
a64d07233d813f9a085722295dca62ca726e291a

SHA256
5a72c2a12e0e42313c5d01277d3b26f52810a9753e31883f5f3e7a73a0021870

SHA512
9224f6c0af0bb3aa6804e09b36617d2ecf762caf81ec0f2627553788f7045d09878b41ddb63a1d0779973cba52d2f1d59f69bc6c826ad8bb0d807444abab87d2

Download Submit
C:\Users\Admin\AppData\Roaming\Tiktok Share Bot byDenmark.exe

Filesize
9.8MB

MD5
6720bbc01a878d9003076c2b22bfe0cf

SHA1
6f2e7acde97d9847400013880d2796428504e580

SHA256
90529087bb4c13893ee9e5f3808ace6cdc1bffa2f85aa2f5005b19c2865d143e

SHA512
fa41ec8c1baa2e371987402c57dbef31e377897c6154ee290455fbc1e42d90e82c504036165bdc467c25696e4c455fac8bb89e6f7631f961f2282d5d3667bcf9

Download Submit
C:\Users\Admin\AppData\Roaming\Tiktok Share Bot byDenmark.exe

Filesize
9.8MB

MD5
6720bbc01a878d9003076c2b22bfe0cf

SHA1
6f2e7acde97d9847400013880d2796428504e580

SHA256
90529087bb4c13893ee9e5f3808ace6cdc1bffa2f85aa2f5005b19c2865d143e

SHA512
fa41ec8c1baa2e371987402c57dbef31e377897c6154ee290455fbc1e42d90e82c504036165bdc467c25696e4c455fac8bb89e6f7631f961f2282d5d3667bcf9

Download Submit
\??\pipe\LOCAL\crashpad_5084_YKHGWSVRPKCJIMXZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/872-184-0x0000000000000000-mapping.dmp

Download
memory/1460-211-0x0000000000000000-mapping.dmp

Download
memory/1476-182-0x0000000000000000-mapping.dmp

Download
memory/1772-148-0x000001F13EF30000-0x000001F13EF40000-memory.dmp

Filesize
64KB

Download
memory/1772-137-0x0000000000000000-mapping.dmp

Download
memory/1772-149-0x000001F13EF40000-0x000001F13EF50000-memory.dmp

Filesize
64KB

Download
memory/1772-147-0x00007FFDFAA70000-0x00007FFDFAC65000-memory.dmp

Filesize
2.0MB

Download
memory/1796-177-0x0000000000000000-mapping.dmp

Download
memory/1968-207-0x0000000000000000-mapping.dmp

Download
memory/2312-158-0x00000000050D0000-0x00000000056F8000-memory.dmp

Filesize
6.2MB

Download
memory/2312-160-0x0000000005870000-0x00000000058D6000-memory.dmp

Filesize
408KB

Download
memory/2312-156-0x0000000000000000-mapping.dmp

Download
memory/2312-173-0x0000000007430000-0x0000000007438000-memory.dmp

Filesize
32KB

Download
memory/2312-157-0x00000000024E0000-0x0000000002516000-memory.dmp

Filesize
216KB

Download
memory/2312-169-0x0000000007180000-0x000000000718A000-memory.dmp

Filesize
40KB

Download
memory/2312-159-0x0000000005040000-0x0000000005062000-memory.dmp

Filesize
136KB

Download
memory/2312-172-0x0000000007450000-0x000000000746A000-memory.dmp

Filesize
104KB

Download
memory/2312-161-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Filesize
120KB

Download
memory/2312-171-0x0000000007340000-0x000000000734E000-memory.dmp

Filesize
56KB

Download
memory/2312-170-0x0000000007390000-0x0000000007426000-memory.dmp

Filesize
600KB

Download
memory/2312-164-0x0000000006D80000-0x0000000006DB2000-memory.dmp

Filesize
200KB

Download
memory/2312-166-0x0000000006D60000-0x0000000006D7E000-memory.dmp

Filesize
120KB

Download
memory/2312-165-0x0000000073C20000-0x0000000073C6C000-memory.dmp

Filesize
304KB

Download
memory/2312-168-0x0000000007110000-0x000000000712A000-memory.dmp

Filesize
104KB

Download
memory/2312-167-0x0000000007750000-0x0000000007DCA000-memory.dmp

Filesize
6.5MB

Download
memory/2604-180-0x0000000000000000-mapping.dmp

Download
memory/2816-162-0x0000000000000000-mapping.dmp

Download
memory/2960-163-0x00000000060C0000-0x00000000060CA000-memory.dmp

Filesize
40KB

Download
memory/2960-153-0x0000000000000000-mapping.dmp

Download
memory/3000-205-0x0000000000000000-mapping.dmp

Download
memory/3148-209-0x0000000000000000-mapping.dmp

Download
memory/3160-189-0x0000000000000000-mapping.dmp

Download
memory/3284-190-0x0000000000000000-mapping.dmp

Download
memory/3328-176-0x0000000000000000-mapping.dmp

Download
memory/3500-201-0x0000000000000000-mapping.dmp

Download
memory/3696-197-0x0000000000000000-mapping.dmp

Download
memory/3864-199-0x0000000000000000-mapping.dmp

Download
memory/4108-152-0x0000000000000000-mapping.dmp

Download
memory/4148-194-0x0000000000000000-mapping.dmp

Download
memory/4260-130-0x0000000074BC0000-0x0000000075171000-memory.dmp

Filesize
5.7MB

Download
memory/4368-140-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4368-133-0x0000000000000000-mapping.dmp

Download
memory/4368-142-0x0000000005530000-0x0000000005AD4000-memory.dmp

Filesize
5.6MB

Download
memory/4368-145-0x0000000004E70000-0x0000000004F02000-memory.dmp

Filesize
584KB

Download
memory/4368-151-0x0000000005280000-0x00000000052E6000-memory.dmp

Filesize
408KB

Download
memory/4520-187-0x0000000000000000-mapping.dmp

Download
memory/4540-202-0x0000000000000000-mapping.dmp

Download
memory/4544-131-0x0000000000000000-mapping.dmp

Download
memory/4544-138-0x0000000000F10000-0x0000000000F2E000-memory.dmp

Filesize
120KB

Download
memory/4544-174-0x0000000006D40000-0x0000000006F02000-memory.dmp

Filesize
1.8MB

Download
memory/4544-143-0x0000000005E30000-0x0000000006448000-memory.dmp

Filesize
6.1MB

Download
memory/4544-150-0x0000000005A60000-0x0000000005B6A000-memory.dmp

Filesize
1.0MB

Download
memory/4544-175-0x0000000007440000-0x000000000796C000-memory.dmp

Filesize
5.2MB

Download
memory/4544-179-0x0000000007420000-0x000000000743E000-memory.dmp

Filesize
120KB

Download
memory/4544-146-0x00000000057B0000-0x00000000057EC000-memory.dmp

Filesize
240KB

Download
memory/4544-144-0x0000000005750000-0x0000000005762000-memory.dmp

Filesize
72KB

Download
memory/4544-178-0x0000000007340000-0x00000000073B6000-memory.dmp

Filesize
472KB

Download
memory/4676-191-0x0000000000000000-mapping.dmp

Download
memory/4708-193-0x0000000000000000-mapping.dmp

Download
memory/4824-183-0x0000000000000000-mapping.dmp

Download
memory/5148-213-0x0000000000000000-mapping.dmp

Download
memory/5276-220-0x0000000000000000-mapping.dmp

Download
memory/5444-222-0x0000000000000000-mapping.dmp

Download
memory/5556-215-0x0000000000000000-mapping.dmp

Download
memory/5732-216-0x0000000000000000-mapping.dmp

Download
memory/5836-217-0x0000000000000000-mapping.dmp

Download
memory/5928-218-0x0000000000000000-mapping.dmp

Download