Analysis
-
max time kernel
78s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-09-2022 10:31
Static task
static1
Behavioral task
behavioral1
Sample
4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe
Resource
win10v2004-20220901-en
General
-
Target
4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe
-
Size
4.8MB
-
MD5
e20c33f2403cd0bc0b8cf425586ef01c
-
SHA1
0d55b0167cffeaaea07493b5ff3b0ca3e54d67c5
-
SHA256
4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc
-
SHA512
2308573c4b9277dbcf7cc93511ff9ecbc3340edb20c86772aa0a326e5c6621abc4b770d59e479af55f5ae0f011203b42048d43387eae500da31a85b9831cbb14
-
SSDEEP
98304:83ReZRsg6m4bZTqS1CGjqc9kfqfVhJaI/M4KBMzWOBfB+sV7q3R2u5I:KUs3mir1CzCSSM4zKI7q4Z
Malware Config
Extracted
oski
rgjeweller.mu/oski/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Executes dropped EXE 1 IoCs
Processes:
pay.exepid process 3256 pay.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4532 3256 WerFault.exe pay.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 340 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe 340 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exeAcroRd32.exeRdrCEF.exedescription pid process target process PID 544 wrote to memory of 3256 544 4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe pay.exe PID 544 wrote to memory of 3256 544 4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe pay.exe PID 544 wrote to memory of 3256 544 4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe pay.exe PID 544 wrote to memory of 340 544 4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe AcroRd32.exe PID 544 wrote to memory of 340 544 4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe AcroRd32.exe PID 544 wrote to memory of 340 544 4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe AcroRd32.exe PID 340 wrote to memory of 3120 340 AcroRd32.exe RdrCEF.exe PID 340 wrote to memory of 3120 340 AcroRd32.exe RdrCEF.exe PID 340 wrote to memory of 3120 340 AcroRd32.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3180 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe PID 3120 wrote to memory of 3248 3120 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe"C:\Users\Admin\AppData\Local\Temp\4ac1f3c7d6751d5f161f82483bbcf27b795d3b205391acbde576094da81badfc.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pay.exe"C:\Users\Admin\AppData\Local\Temp\pay.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 13483⤵
- Program crash
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\pay.pdf"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D04D30DB5FEE12BDAB02952BB65CF291 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B6D6B4751D7A49E9E85D661D93D8830F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B6D6B4751D7A49E9E85D661D93D8830F --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1E1820AB24E1F25C0E2A7A9D7F4C3EFF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1E1820AB24E1F25C0E2A7A9D7F4C3EFF --renderer-client-id=4 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DFB931FDEC0204AAF6A2C32022473FCD --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1F58DA7DAF34F11B8DD0FF47C5340595 --mojo-platform-channel-handle=2608 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3F4860FB1D269D83E9975A6EA2A2B77F --mojo-platform-channel-handle=2576 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3256 -ip 32561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pay.exeFilesize
200KB
MD5dda0fc7975110e188a92fa9f417766f2
SHA1aca95b54cd6ae159224f903d1e1c2f58e2206174
SHA256e872b9dd00f8fd62e837cbba0a6eba7327a69866f04090c2f2402871feb8b8cc
SHA512aa1ddfa57d900f40fd8199d508bf7c20951ec770f69ba3e5889cf3e1a7a36c8b1289728c35bda247026cd7b81bc5c6decb929291996fe9497285948f7f650a8f
-
C:\Users\Admin\AppData\Local\Temp\pay.exeFilesize
200KB
MD5dda0fc7975110e188a92fa9f417766f2
SHA1aca95b54cd6ae159224f903d1e1c2f58e2206174
SHA256e872b9dd00f8fd62e837cbba0a6eba7327a69866f04090c2f2402871feb8b8cc
SHA512aa1ddfa57d900f40fd8199d508bf7c20951ec770f69ba3e5889cf3e1a7a36c8b1289728c35bda247026cd7b81bc5c6decb929291996fe9497285948f7f650a8f
-
C:\Users\Admin\AppData\Local\Temp\pay.pdfFilesize
6.8MB
MD5f6302277c21ecd0563439315f98078c8
SHA14f99219add6c11d2d6dcea76cba3e82d9b7233fe
SHA256ed9f9141d3590513a05fc6117ba4567259713c687e948f45352936ff310b5b51
SHA5129a509f50da24e20cc24cce4e7a0386aa9104ebc0d34d2f8710722be2319dae2418411b00b9f00eb7ddefa6ea6f90533fa655c947ea331c647f443301f924312e
-
memory/64-155-0x0000000000000000-mapping.dmp
-
memory/340-135-0x0000000000000000-mapping.dmp
-
memory/1356-147-0x0000000000000000-mapping.dmp
-
memory/1524-152-0x0000000000000000-mapping.dmp
-
memory/2008-158-0x0000000000000000-mapping.dmp
-
memory/3120-137-0x0000000000000000-mapping.dmp
-
memory/3180-139-0x0000000000000000-mapping.dmp
-
memory/3248-142-0x0000000000000000-mapping.dmp
-
memory/3256-132-0x0000000000000000-mapping.dmp