Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17-10-2022 23:30
Behavioral task
behavioral1
Sample
cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe
Resource
win7-20220812-en
General
-
Target
cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe
-
Size
28.3MB
-
MD5
668c94eba455cc5ff70d132c321418ec
-
SHA1
02b9bc9efda3e7d1269a3c6d9dbcb04691a0416c
-
SHA256
cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429
-
SHA512
4802bdf6cce94b4fd065affc5ff9470cf9a9892a2963df2567a28390ba3603456173f2571a3ae39ce08dc26b059cea5b2ea35865f732c24230059dbd0582185a
-
SSDEEP
786432:m5NgWSIq8kjHIVkNXqp5jIqsL9wMkuhVGxxGM+LePAREz+UNK/:mvp9GHIVkNap5jFC+Mkuh+GJLexTi
Malware Config
Extracted
darkcomet
Sazan
46.1.103.13:1604
DC_MUTEX-LFFAWM6
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
8mlW7yUboqwX
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Executes dropped EXE 2 IoCs
Processes:
CG_LOADER.EXEmsdcsc.exepid process 1768 CG_LOADER.EXE 2012 msdcsc.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\CG_LOADER.EXE vmprotect C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE vmprotect C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE vmprotect behavioral1/memory/1768-69-0x0000000000F20000-0x0000000002AAC000-memory.dmp vmprotect -
Loads dropped DLL 3 IoCs
Processes:
cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exepid process 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 3 IoCs
Processes:
cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 48 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell chrome.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
CG_LOADER.EXEchrome.exechrome.exechrome.exechrome.exepid process 1768 CG_LOADER.EXE 1248 chrome.exe 1956 chrome.exe 1956 chrome.exe 2660 chrome.exe 2792 chrome.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exemsdcsc.exeCG_LOADER.EXEdescription pid process Token: SeIncreaseQuotaPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeSecurityPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeTakeOwnershipPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeLoadDriverPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeSystemProfilePrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeSystemtimePrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeProfSingleProcessPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeIncBasePriorityPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeCreatePagefilePrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeBackupPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeRestorePrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeShutdownPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeDebugPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeSystemEnvironmentPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeChangeNotifyPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeRemoteShutdownPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeUndockPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeManageVolumePrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeImpersonatePrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeCreateGlobalPrivilege 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: 33 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: 34 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: 35 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeIncreaseQuotaPrivilege 2012 msdcsc.exe Token: SeSecurityPrivilege 2012 msdcsc.exe Token: SeTakeOwnershipPrivilege 2012 msdcsc.exe Token: SeLoadDriverPrivilege 2012 msdcsc.exe Token: SeSystemProfilePrivilege 2012 msdcsc.exe Token: SeSystemtimePrivilege 2012 msdcsc.exe Token: SeProfSingleProcessPrivilege 2012 msdcsc.exe Token: SeIncBasePriorityPrivilege 2012 msdcsc.exe Token: SeCreatePagefilePrivilege 2012 msdcsc.exe Token: SeBackupPrivilege 2012 msdcsc.exe Token: SeRestorePrivilege 2012 msdcsc.exe Token: SeShutdownPrivilege 2012 msdcsc.exe Token: SeDebugPrivilege 2012 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2012 msdcsc.exe Token: SeChangeNotifyPrivilege 2012 msdcsc.exe Token: SeRemoteShutdownPrivilege 2012 msdcsc.exe Token: SeUndockPrivilege 2012 msdcsc.exe Token: SeManageVolumePrivilege 2012 msdcsc.exe Token: SeImpersonatePrivilege 2012 msdcsc.exe Token: SeCreateGlobalPrivilege 2012 msdcsc.exe Token: 33 2012 msdcsc.exe Token: 34 2012 msdcsc.exe Token: 35 2012 msdcsc.exe Token: SeDebugPrivilege 1768 CG_LOADER.EXE -
Suspicious use of FindShellTrayWindow 59 IoCs
Processes:
chrome.exepid process 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
Processes:
chrome.exepid process 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe 1956 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
msdcsc.exechrome.exepid process 2012 msdcsc.exe 2660 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.execmd.exemsdcsc.exechrome.exedescription pid process target process PID 1948 wrote to memory of 1828 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe cmd.exe PID 1948 wrote to memory of 1828 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe cmd.exe PID 1948 wrote to memory of 1828 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe cmd.exe PID 1948 wrote to memory of 1828 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe cmd.exe PID 1828 wrote to memory of 1752 1828 cmd.exe attrib.exe PID 1828 wrote to memory of 1752 1828 cmd.exe attrib.exe PID 1828 wrote to memory of 1752 1828 cmd.exe attrib.exe PID 1828 wrote to memory of 1752 1828 cmd.exe attrib.exe PID 1948 wrote to memory of 1768 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe CG_LOADER.EXE PID 1948 wrote to memory of 1768 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe CG_LOADER.EXE PID 1948 wrote to memory of 1768 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe CG_LOADER.EXE PID 1948 wrote to memory of 1768 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe CG_LOADER.EXE PID 1948 wrote to memory of 2012 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe msdcsc.exe PID 1948 wrote to memory of 2012 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe msdcsc.exe PID 1948 wrote to memory of 2012 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe msdcsc.exe PID 1948 wrote to memory of 2012 1948 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe msdcsc.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1416 2012 msdcsc.exe notepad.exe PID 2012 wrote to memory of 1004 2012 msdcsc.exe cmd.exe PID 2012 wrote to memory of 1004 2012 msdcsc.exe cmd.exe PID 2012 wrote to memory of 1004 2012 msdcsc.exe cmd.exe PID 2012 wrote to memory of 1004 2012 msdcsc.exe cmd.exe PID 1956 wrote to memory of 672 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 672 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 672 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe PID 1956 wrote to memory of 1964 1956 chrome.exe chrome.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe"C:\Users\Admin\AppData\Local\Temp\cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef65c4f50,0x7fef65c4f60,0x7fef65c4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1044 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1364 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1732 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2788 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3400 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3688 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3708 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3712 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3596 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4280 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4532 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1028,11429426113943059342,13294453797096719691,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=780 /prefetch:82⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXEFilesize
27.6MB
MD5345fc46071de77ab039482051ef3fcff
SHA1e9e3ace58241d3c4531ac0093579c99a88276751
SHA2566f956e7712bbe4387bb2d7b5028bd7cae4927cf3212b98e3a8cce127cd4e9cb0
SHA512a6d11fab37c1e464f9a9e10324456b20da72cbb74079983919d4f27fd8b750233af03ef46677f6b85aa0a8fe7f15c4688e7883903e345da044055f3b68097081
-
C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXEFilesize
27.6MB
MD5345fc46071de77ab039482051ef3fcff
SHA1e9e3ace58241d3c4531ac0093579c99a88276751
SHA2566f956e7712bbe4387bb2d7b5028bd7cae4927cf3212b98e3a8cce127cd4e9cb0
SHA512a6d11fab37c1e464f9a9e10324456b20da72cbb74079983919d4f27fd8b750233af03ef46677f6b85aa0a8fe7f15c4688e7883903e345da044055f3b68097081
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
28.3MB
MD5668c94eba455cc5ff70d132c321418ec
SHA102b9bc9efda3e7d1269a3c6d9dbcb04691a0416c
SHA256cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429
SHA5124802bdf6cce94b4fd065affc5ff9470cf9a9892a2963df2567a28390ba3603456173f2571a3ae39ce08dc26b059cea5b2ea35865f732c24230059dbd0582185a
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
28.3MB
MD5668c94eba455cc5ff70d132c321418ec
SHA102b9bc9efda3e7d1269a3c6d9dbcb04691a0416c
SHA256cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429
SHA5124802bdf6cce94b4fd065affc5ff9470cf9a9892a2963df2567a28390ba3603456173f2571a3ae39ce08dc26b059cea5b2ea35865f732c24230059dbd0582185a
-
\??\pipe\crashpad_1956_LONWHUJJTLEYKSBTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\CG_LOADER.EXEFilesize
27.6MB
MD5345fc46071de77ab039482051ef3fcff
SHA1e9e3ace58241d3c4531ac0093579c99a88276751
SHA2566f956e7712bbe4387bb2d7b5028bd7cae4927cf3212b98e3a8cce127cd4e9cb0
SHA512a6d11fab37c1e464f9a9e10324456b20da72cbb74079983919d4f27fd8b750233af03ef46677f6b85aa0a8fe7f15c4688e7883903e345da044055f3b68097081
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
28.3MB
MD5668c94eba455cc5ff70d132c321418ec
SHA102b9bc9efda3e7d1269a3c6d9dbcb04691a0416c
SHA256cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429
SHA5124802bdf6cce94b4fd065affc5ff9470cf9a9892a2963df2567a28390ba3603456173f2571a3ae39ce08dc26b059cea5b2ea35865f732c24230059dbd0582185a
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
28.3MB
MD5668c94eba455cc5ff70d132c321418ec
SHA102b9bc9efda3e7d1269a3c6d9dbcb04691a0416c
SHA256cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429
SHA5124802bdf6cce94b4fd065affc5ff9470cf9a9892a2963df2567a28390ba3603456173f2571a3ae39ce08dc26b059cea5b2ea35865f732c24230059dbd0582185a
-
memory/1004-74-0x0000000000000000-mapping.dmp
-
memory/1416-67-0x0000000000000000-mapping.dmp
-
memory/1752-56-0x0000000000000000-mapping.dmp
-
memory/1768-58-0x0000000000000000-mapping.dmp
-
memory/1768-69-0x0000000000F20000-0x0000000002AAC000-memory.dmpFilesize
27.5MB
-
memory/1768-71-0x0000000006D70000-0x0000000007AE8000-memory.dmpFilesize
13.5MB
-
memory/1768-72-0x0000000009EB0000-0x000000000AC2A000-memory.dmpFilesize
13.5MB
-
memory/1768-73-0x00000000002A0000-0x00000000002E4000-memory.dmpFilesize
272KB
-
memory/1828-55-0x0000000000000000-mapping.dmp
-
memory/1948-54-0x0000000075F51000-0x0000000075F53000-memory.dmpFilesize
8KB
-
memory/2012-63-0x0000000000000000-mapping.dmp