Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2022 19:41

General

  • Target

    06cb1bb9f65f954677aa5e66cfecad10.exe

  • Size

    4.9MB

  • MD5

    06cb1bb9f65f954677aa5e66cfecad10

  • SHA1

    7226decd411a371d2727b8b6742f578425b0a7c2

  • SHA256

    4faa19632922332b8aedd25006c9c3349bcb9f2bf24bf116857258a7769efbf0

  • SHA512

    ea81cca73a9abad99666e974ae73b9cc38d19fa666b0914d518dee731eab4ed2ed3b7797f453db2f0f22ce6cdc2866591ac0cc56aa01d7530b29e30da8cc098b

  • SSDEEP

    49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
  • Executes dropped EXE 7 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • System policy modification 1 TTPs 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06cb1bb9f65f954677aa5e66cfecad10.exe
    "C:\Users\Admin\AppData\Local\Temp\06cb1bb9f65f954677aa5e66cfecad10.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3604
      • C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:204
        • C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4500
          • C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe
            "C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe"
            5⤵
            • Executes dropped EXE
            PID:3600
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:760
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:900
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:968
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1852
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4324
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1844
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3296
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1316
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1956
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2528
    • C:\Windows\ShellComponents\wininit.exe
      "C:\Windows\ShellComponents\wininit.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks computer location settings
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3472
      • C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.exe
        "C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:260
        • C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.exe
          "C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.exe"
          4⤵
          • Executes dropped EXE
          PID:3244
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6b25c67-b63c-4af4-9af3-82aafaaf80a0.vbs"
        3⤵
          PID:2364
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf54d50b-189e-4011-b8e0-4238d33b324a.vbs"
          3⤵
            PID:4028
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\ShellComponents\wininit.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2020
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\ShellComponents\wininit.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3556
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellComponents\wininit.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2300
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\My Documents\RuntimeBroker.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:5036
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4180
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\My Documents\RuntimeBroker.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3884

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        3a6bad9528f8e23fb5c77fbd81fa28e8

        SHA1

        f127317c3bc6407f536c0f0600dcbcf1aabfba36

        SHA256

        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

        SHA512

        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        5f0ddc7f3691c81ee14d17b419ba220d

        SHA1

        f0ef5fde8bab9d17c0b47137e014c91be888ee53

        SHA256

        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

        SHA512

        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        3a6bad9528f8e23fb5c77fbd81fa28e8

        SHA1

        f127317c3bc6407f536c0f0600dcbcf1aabfba36

        SHA256

        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

        SHA512

        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        3a6bad9528f8e23fb5c77fbd81fa28e8

        SHA1

        f127317c3bc6407f536c0f0600dcbcf1aabfba36

        SHA256

        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

        SHA512

        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        5f0ddc7f3691c81ee14d17b419ba220d

        SHA1

        f0ef5fde8bab9d17c0b47137e014c91be888ee53

        SHA256

        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

        SHA512

        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        5f0ddc7f3691c81ee14d17b419ba220d

        SHA1

        f0ef5fde8bab9d17c0b47137e014c91be888ee53

        SHA256

        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

        SHA512

        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        5f0ddc7f3691c81ee14d17b419ba220d

        SHA1

        f0ef5fde8bab9d17c0b47137e014c91be888ee53

        SHA256

        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

        SHA512

        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        5f0ddc7f3691c81ee14d17b419ba220d

        SHA1

        f0ef5fde8bab9d17c0b47137e014c91be888ee53

        SHA256

        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

        SHA512

        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        5f0ddc7f3691c81ee14d17b419ba220d

        SHA1

        f0ef5fde8bab9d17c0b47137e014c91be888ee53

        SHA256

        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

        SHA512

        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        944B

        MD5

        5f0ddc7f3691c81ee14d17b419ba220d

        SHA1

        f0ef5fde8bab9d17c0b47137e014c91be888ee53

        SHA256

        a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

        SHA512

        2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

      • C:\Users\Admin\AppData\Local\Temp\a6b25c67-b63c-4af4-9af3-82aafaaf80a0.vbs

        Filesize

        714B

        MD5

        af41f7a7cabee6f74596de4e097bb80e

        SHA1

        29237ba92748d98d7b9c28549f49c7ca95f62be9

        SHA256

        d6cea33c3eae9f07eb81d48a3ed2f7341ff07f5d6b297c1661f5045390e6f558

        SHA512

        b06404219ded85f0844ea8d56df99a6eaa543dc40019fb2aec4f97887fbbfb8af650d5caa45cc3d236bc7a566d777bf1b06d891e446f3db3bac02ed07532d6f4

      • C:\Users\Admin\AppData\Local\Temp\cf54d50b-189e-4011-b8e0-4238d33b324a.vbs

        Filesize

        490B

        MD5

        4111a36294777424783f46b12228a760

        SHA1

        1e1818961ccc2cd3af546874da0f7fe9a6b2e9d6

        SHA256

        775e90cfcd95eb7c5251164a1ac6ba464feff6d8ebad6ead880d98c120bbf7b7

        SHA512

        ecf4dc2424d443e615a7079d1abe527d13c157e500ca62dbd521e59046c02855e8d3f3e22d15210bb733f23ec5c685ed6a25f26e4f73b1292b3196d6532de005

      • C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.exe

        Filesize

        75KB

        MD5

        e0a68b98992c1699876f818a22b5b907

        SHA1

        d41e8ad8ba51217eb0340f8f69629ccb474484d0

        SHA256

        2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

        SHA512

        856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

      • C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.exe

        Filesize

        75KB

        MD5

        e0a68b98992c1699876f818a22b5b907

        SHA1

        d41e8ad8ba51217eb0340f8f69629ccb474484d0

        SHA256

        2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

        SHA512

        856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

      • C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.exe

        Filesize

        75KB

        MD5

        e0a68b98992c1699876f818a22b5b907

        SHA1

        d41e8ad8ba51217eb0340f8f69629ccb474484d0

        SHA256

        2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

        SHA512

        856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

      • C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe

        Filesize

        75KB

        MD5

        e0a68b98992c1699876f818a22b5b907

        SHA1

        d41e8ad8ba51217eb0340f8f69629ccb474484d0

        SHA256

        2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

        SHA512

        856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

      • C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe

        Filesize

        75KB

        MD5

        e0a68b98992c1699876f818a22b5b907

        SHA1

        d41e8ad8ba51217eb0340f8f69629ccb474484d0

        SHA256

        2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

        SHA512

        856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

      • C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe

        Filesize

        75KB

        MD5

        e0a68b98992c1699876f818a22b5b907

        SHA1

        d41e8ad8ba51217eb0340f8f69629ccb474484d0

        SHA256

        2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

        SHA512

        856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

      • C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe

        Filesize

        75KB

        MD5

        e0a68b98992c1699876f818a22b5b907

        SHA1

        d41e8ad8ba51217eb0340f8f69629ccb474484d0

        SHA256

        2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

        SHA512

        856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

      • C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe

        Filesize

        75KB

        MD5

        e0a68b98992c1699876f818a22b5b907

        SHA1

        d41e8ad8ba51217eb0340f8f69629ccb474484d0

        SHA256

        2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

        SHA512

        856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

      • C:\Windows\ShellComponents\wininit.exe

        Filesize

        4.9MB

        MD5

        edea1ba139a7a0c24ba1c90e07db6657

        SHA1

        e39984a3df1afc09ffb85be64a2a93bd0c37acbb

        SHA256

        9f265d81be450276e57de81011d944bc6c43e0b1ffb29e23df5ae00db19a18f2

        SHA512

        9d88bba9f3a3d2dace5e05c50638688b49208fdde98facb9e824dd100ba3bde974a35b5b825e8e7b84c3e28b6771951d7a95f5127638d9df813d464a0d7c2249

      • C:\Windows\ShellComponents\wininit.exe

        Filesize

        4.9MB

        MD5

        edea1ba139a7a0c24ba1c90e07db6657

        SHA1

        e39984a3df1afc09ffb85be64a2a93bd0c37acbb

        SHA256

        9f265d81be450276e57de81011d944bc6c43e0b1ffb29e23df5ae00db19a18f2

        SHA512

        9d88bba9f3a3d2dace5e05c50638688b49208fdde98facb9e824dd100ba3bde974a35b5b825e8e7b84c3e28b6771951d7a95f5127638d9df813d464a0d7c2249

      • memory/204-140-0x0000000000000000-mapping.dmp

      • memory/204-142-0x00000000006B4000-0x00000000006B7000-memory.dmp

        Filesize

        12KB

      • memory/260-206-0x0000000000000000-mapping.dmp

      • memory/760-163-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/760-151-0x0000000000000000-mapping.dmp

      • memory/760-188-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/760-162-0x00000210299A0000-0x00000210299C2000-memory.dmp

        Filesize

        136KB

      • memory/808-164-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/808-150-0x0000000000000000-mapping.dmp

      • memory/808-196-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/900-153-0x0000000000000000-mapping.dmp

      • memory/900-192-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/900-166-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/968-197-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/968-152-0x0000000000000000-mapping.dmp

      • memory/968-165-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/1316-159-0x0000000000000000-mapping.dmp

      • memory/1316-172-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/1316-189-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/1844-193-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/1844-169-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/1844-156-0x0000000000000000-mapping.dmp

      • memory/1852-194-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/1852-154-0x0000000000000000-mapping.dmp

      • memory/1852-167-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/1956-160-0x0000000000000000-mapping.dmp

      • memory/1956-199-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/1956-174-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/2364-213-0x0000000000000000-mapping.dmp

      • memory/2528-161-0x0000000000000000-mapping.dmp

      • memory/2528-173-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/2528-198-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/2848-171-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/2848-158-0x0000000000000000-mapping.dmp

      • memory/2848-190-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/3244-209-0x0000000000000000-mapping.dmp

      • memory/3296-195-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/3296-170-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/3296-157-0x0000000000000000-mapping.dmp

      • memory/3472-212-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/3472-200-0x0000000000000000-mapping.dmp

      • memory/3472-204-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/3472-203-0x0000000000200000-0x00000000006F4000-memory.dmp

        Filesize

        5.0MB

      • memory/3472-217-0x000000001DEE0000-0x000000001E0A2000-memory.dmp

        Filesize

        1.8MB

      • memory/3600-147-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/3600-146-0x0000000000000000-mapping.dmp

      • memory/3600-149-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

      • memory/3604-139-0x000000000111B000-0x0000000001121000-memory.dmp

        Filesize

        24KB

      • memory/3604-136-0x0000000000000000-mapping.dmp

      • memory/4028-214-0x0000000000000000-mapping.dmp

      • memory/4324-191-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/4324-155-0x0000000000000000-mapping.dmp

      • memory/4324-168-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/4500-143-0x0000000000000000-mapping.dmp

      • memory/4500-145-0x0000000000A04000-0x0000000000A07000-memory.dmp

        Filesize

        12KB

      • memory/4648-205-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/4648-132-0x0000000000A60000-0x0000000000F54000-memory.dmp

        Filesize

        5.0MB

      • memory/4648-135-0x000000001D400000-0x000000001D928000-memory.dmp

        Filesize

        5.2MB

      • memory/4648-175-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB

      • memory/4648-134-0x000000001CE80000-0x000000001CED0000-memory.dmp

        Filesize

        320KB

      • memory/4648-133-0x00007FFAB6DA0000-0x00007FFAB7861000-memory.dmp

        Filesize

        10.8MB