Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19-10-2022 06:30
Static task
static1
Behavioral task
behavioral1
Sample
d199df5116446417372082be7c4f7c8e.exe
Resource
win7-20220901-en
General
-
Target
d199df5116446417372082be7c4f7c8e.exe
-
Size
300KB
-
MD5
d199df5116446417372082be7c4f7c8e
-
SHA1
17f277eaf2fb5ed78a1c9228526243c857bc6f94
-
SHA256
bf45d7d41cf421da9cf70d0616d2e2ed599829a190fbfc6b6fd1170cecc5657a
-
SHA512
06901506c965fa2006113bbeca6521391f9a088a4d44a2bfa13f3b5b05098a75fc1917e63bf9a87aaea4bbe7d4474c5398dcde4d0c8bff64dfc6eaca19aa42da
-
SSDEEP
3072:el5BwFKLCSdgCb9HICw6EHIzcfbPrk+sGF9X77LA3Di0S8NIPMH/A31TYpOh9bs:Ezfz+62jjgDyA3cPM43OpEbs
Malware Config
Extracted
quasar
1.4.0
SKYNET
173.225.115.99:7702
938cda17-a814-4925-8420-83a35a350164
-
encryption_key
F04A75E6507173FAEEC2BB82C564030A5E8413FF
-
install_name
FileHistory.exe
-
log_directory
Logs
-
reconnect_delay
4000
-
startup_key
FileHistory
-
subdirectory
FileHistory
Extracted
orcus
146.70.143.176:81
712d31c7a3f54904a08d968a15b836e9
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\orc\orc.exe
-
reconnect_delay
10000
-
registry_keyname
orc
-
taskscheduler_taskname
orc
-
watchdog_path
AppData\Watchdog.exe
Signatures
-
Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\sqls844.exe disable_win_def C:\Users\Admin\AppData\Local\Temp\sqls844.exe disable_win_def behavioral1/memory/948-67-0x0000000000300000-0x000000000030A000-memory.dmp disable_win_def -
Processes:
sqls844.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sqls844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sqls844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sqls844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sqls844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sqls844.exe -
Modifies security service 2 TTPs 2 IoCs
Processes:
sqls844.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" sqls844.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WinDefend\Start = "4" sqls844.exe -
Orcus main payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\orc.exe family_orcus C:\Users\Admin\AppData\Local\Temp\orc.exe family_orcus C:\Program Files\orc\orc.exe family_orcus C:\Program Files\orc\orc.exe family_orcus C:\Program Files\orc\orc.exe family_orcus -
Quasar payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\FileHistory.exe family_quasar C:\Users\Admin\AppData\Local\Temp\FileHistory.exe family_quasar behavioral1/memory/1668-84-0x00000000010D0000-0x000000000139A000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\FileHistory\FileHistory.exe family_quasar C:\Users\Admin\AppData\Roaming\FileHistory\FileHistory.exe family_quasar behavioral1/memory/2028-100-0x00000000013E0000-0x00000000016AA000-memory.dmp family_quasar -
Orcurs Rat Executable 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\orc.exe orcus C:\Users\Admin\AppData\Local\Temp\orc.exe orcus C:\Program Files\orc\orc.exe orcus behavioral1/memory/2020-140-0x0000000001210000-0x00000000012FA000-memory.dmp orcus C:\Program Files\orc\orc.exe orcus C:\Program Files\orc\orc.exe orcus -
PlagueBot Executable 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\Downloads\plage.exe plaguebot C:\Users\Admin\Downloads\plage.exe plaguebot \Users\Admin\AppData\Roaming\discordnitro\winmgr.exe plaguebot \Users\Admin\AppData\Roaming\discordnitro\winmgr.exe plaguebot C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe plaguebot -
Downloads MZ/PE file
-
Executes dropped EXE 19 IoCs
Processes:
joined.exesqls844.exenitrsso64.exeFileHistory.exeorc.exeplage.exeFileHistory.exeblmkgrp.exeblmkgrp.exewinmgr.exeWindowsInput.exeWindowsInput.exeorc.exeWatchdog.exeWatchdog.exeorc.exenitrsso64.exenitrsso64.exepid process 840 joined.exe 948 sqls844.exe 296 nitrsso64.exe 1668 FileHistory.exe 2004 orc.exe 1908 plage.exe 2028 FileHistory.exe 2000 blmkgrp.exe 708 blmkgrp.exe 364 winmgr.exe 1220 1752 WindowsInput.exe 1556 WindowsInput.exe 2020 orc.exe 1476 Watchdog.exe 1940 Watchdog.exe 640 orc.exe 1512 nitrsso64.exe 1612 nitrsso64.exe -
Drops startup file 2 IoCs
Processes:
plage.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe plage.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winmgr.exe plage.exe -
Loads dropped DLL 7 IoCs
Processes:
d199df5116446417372082be7c4f7c8e.exeblmkgrp.exeplage.exeblmkgrp.exetaskeng.exepid process 1536 d199df5116446417372082be7c4f7c8e.exe 1536 d199df5116446417372082be7c4f7c8e.exe 2000 blmkgrp.exe 1908 plage.exe 1908 plage.exe 708 blmkgrp.exe 1720 taskeng.exe -
Processes:
sqls844.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features sqls844.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" sqls844.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
plage.exeorc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinManager = "C:\\Users\\Admin\\AppData\\Roaming\\discordnitro\\winmgr.exe" plage.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\orc = "\"C:\\Program Files\\orc\\orc.exe\"" orc.exe -
Drops file in System32 directory 3 IoCs
Processes:
orc.exeWindowsInput.exedescription ioc process File created C:\Windows\SysWOW64\WindowsInput.exe orc.exe File created C:\Windows\SysWOW64\WindowsInput.exe.config orc.exe File created C:\Windows\SysWOW64\WindowsInput.InstallState WindowsInput.exe -
Drops file in Program Files directory 3 IoCs
Processes:
orc.exedescription ioc process File created C:\Program Files\orc\orc.exe orc.exe File opened for modification C:\Program Files\orc\orc.exe orc.exe File created C:\Program Files\orc\orc.exe.config orc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1116 schtasks.exe 1268 schtasks.exe 1372 schtasks.exe 1900 schtasks.exe 516 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeWatchdog.exeorc.exepid process 1716 powershell.exe 1940 Watchdog.exe 1940 Watchdog.exe 1940 Watchdog.exe 2020 orc.exe 2020 orc.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe 2020 orc.exe 1940 Watchdog.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
d199df5116446417372082be7c4f7c8e.exepowershell.exenitrsso64.exeFileHistory.exeFileHistory.exeWatchdog.exeWatchdog.exeorc.exenitrsso64.exenitrsso64.exedescription pid process Token: SeDebugPrivilege 1536 d199df5116446417372082be7c4f7c8e.exe Token: SeDebugPrivilege 1716 powershell.exe Token: SeDebugPrivilege 296 nitrsso64.exe Token: SeDebugPrivilege 1668 FileHistory.exe Token: SeDebugPrivilege 2028 FileHistory.exe Token: SeDebugPrivilege 1476 Watchdog.exe Token: SeDebugPrivilege 1940 Watchdog.exe Token: SeDebugPrivilege 2020 orc.exe Token: SeDebugPrivilege 1512 nitrsso64.exe Token: SeDebugPrivilege 1612 nitrsso64.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
nitrsso64.exeFileHistory.exenitrsso64.exepid process 296 nitrsso64.exe 2028 FileHistory.exe 1612 nitrsso64.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d199df5116446417372082be7c4f7c8e.exejoined.exesqls844.exenitrsso64.exeFileHistory.exeplage.exeFileHistory.exeblmkgrp.exeorc.execsc.exedescription pid process target process PID 1536 wrote to memory of 840 1536 d199df5116446417372082be7c4f7c8e.exe joined.exe PID 1536 wrote to memory of 840 1536 d199df5116446417372082be7c4f7c8e.exe joined.exe PID 1536 wrote to memory of 840 1536 d199df5116446417372082be7c4f7c8e.exe joined.exe PID 840 wrote to memory of 948 840 joined.exe sqls844.exe PID 840 wrote to memory of 948 840 joined.exe sqls844.exe PID 840 wrote to memory of 948 840 joined.exe sqls844.exe PID 840 wrote to memory of 948 840 joined.exe sqls844.exe PID 948 wrote to memory of 1716 948 sqls844.exe powershell.exe PID 948 wrote to memory of 1716 948 sqls844.exe powershell.exe PID 948 wrote to memory of 1716 948 sqls844.exe powershell.exe PID 948 wrote to memory of 1716 948 sqls844.exe powershell.exe PID 948 wrote to memory of 1116 948 sqls844.exe schtasks.exe PID 948 wrote to memory of 1116 948 sqls844.exe schtasks.exe PID 948 wrote to memory of 1116 948 sqls844.exe schtasks.exe PID 948 wrote to memory of 1116 948 sqls844.exe schtasks.exe PID 1536 wrote to memory of 296 1536 d199df5116446417372082be7c4f7c8e.exe nitrsso64.exe PID 1536 wrote to memory of 296 1536 d199df5116446417372082be7c4f7c8e.exe nitrsso64.exe PID 1536 wrote to memory of 296 1536 d199df5116446417372082be7c4f7c8e.exe nitrsso64.exe PID 296 wrote to memory of 1268 296 nitrsso64.exe schtasks.exe PID 296 wrote to memory of 1268 296 nitrsso64.exe schtasks.exe PID 296 wrote to memory of 1268 296 nitrsso64.exe schtasks.exe PID 1536 wrote to memory of 1668 1536 d199df5116446417372082be7c4f7c8e.exe FileHistory.exe PID 1536 wrote to memory of 1668 1536 d199df5116446417372082be7c4f7c8e.exe FileHistory.exe PID 1536 wrote to memory of 1668 1536 d199df5116446417372082be7c4f7c8e.exe FileHistory.exe PID 1536 wrote to memory of 2004 1536 d199df5116446417372082be7c4f7c8e.exe orc.exe PID 1536 wrote to memory of 2004 1536 d199df5116446417372082be7c4f7c8e.exe orc.exe PID 1536 wrote to memory of 2004 1536 d199df5116446417372082be7c4f7c8e.exe orc.exe PID 1668 wrote to memory of 1372 1668 FileHistory.exe schtasks.exe PID 1668 wrote to memory of 1372 1668 FileHistory.exe schtasks.exe PID 1668 wrote to memory of 1372 1668 FileHistory.exe schtasks.exe PID 1536 wrote to memory of 1908 1536 d199df5116446417372082be7c4f7c8e.exe plage.exe PID 1536 wrote to memory of 1908 1536 d199df5116446417372082be7c4f7c8e.exe plage.exe PID 1536 wrote to memory of 1908 1536 d199df5116446417372082be7c4f7c8e.exe plage.exe PID 1536 wrote to memory of 1908 1536 d199df5116446417372082be7c4f7c8e.exe plage.exe PID 1908 wrote to memory of 1900 1908 plage.exe schtasks.exe PID 1908 wrote to memory of 1900 1908 plage.exe schtasks.exe PID 1908 wrote to memory of 1900 1908 plage.exe schtasks.exe PID 1908 wrote to memory of 1900 1908 plage.exe schtasks.exe PID 1668 wrote to memory of 2028 1668 FileHistory.exe FileHistory.exe PID 1668 wrote to memory of 2028 1668 FileHistory.exe FileHistory.exe PID 1668 wrote to memory of 2028 1668 FileHistory.exe FileHistory.exe PID 1908 wrote to memory of 524 1908 plage.exe schtasks.exe PID 1908 wrote to memory of 524 1908 plage.exe schtasks.exe PID 1908 wrote to memory of 524 1908 plage.exe schtasks.exe PID 1908 wrote to memory of 524 1908 plage.exe schtasks.exe PID 1536 wrote to memory of 2000 1536 d199df5116446417372082be7c4f7c8e.exe blmkgrp.exe PID 1536 wrote to memory of 2000 1536 d199df5116446417372082be7c4f7c8e.exe blmkgrp.exe PID 1536 wrote to memory of 2000 1536 d199df5116446417372082be7c4f7c8e.exe blmkgrp.exe PID 2028 wrote to memory of 516 2028 FileHistory.exe schtasks.exe PID 2028 wrote to memory of 516 2028 FileHistory.exe schtasks.exe PID 2028 wrote to memory of 516 2028 FileHistory.exe schtasks.exe PID 2000 wrote to memory of 708 2000 blmkgrp.exe blmkgrp.exe PID 2000 wrote to memory of 708 2000 blmkgrp.exe blmkgrp.exe PID 2000 wrote to memory of 708 2000 blmkgrp.exe blmkgrp.exe PID 1908 wrote to memory of 364 1908 plage.exe winmgr.exe PID 1908 wrote to memory of 364 1908 plage.exe winmgr.exe PID 1908 wrote to memory of 364 1908 plage.exe winmgr.exe PID 1908 wrote to memory of 364 1908 plage.exe winmgr.exe PID 2004 wrote to memory of 1276 2004 orc.exe csc.exe PID 2004 wrote to memory of 1276 2004 orc.exe csc.exe PID 2004 wrote to memory of 1276 2004 orc.exe csc.exe PID 1276 wrote to memory of 980 1276 csc.exe cvtres.exe PID 1276 wrote to memory of 980 1276 csc.exe cvtres.exe PID 1276 wrote to memory of 980 1276 csc.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d199df5116446417372082be7c4f7c8e.exe"C:\Users\Admin\AppData\Local\Temp\d199df5116446417372082be7c4f7c8e.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\joined.exe"C:\Users\Admin\AppData\Local\Temp\joined.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sqls844.exe"C:\Users\Admin\AppData\Local\Temp\sqls844.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\sqls844.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\nitrsso64.exe"C:\Users\Admin\AppData\Local\Temp\nitrsso64.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 1 /tn "nitro64" /tr "C:\Users\Admin\AppData\Local\nitrsso64.exe"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\FileHistory.exe"C:\Users\Admin\AppData\Local\Temp\FileHistory.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "FileHistory" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\FileHistory.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\FileHistory\FileHistory.exe"C:\Users\Admin\AppData\Roaming\FileHistory\FileHistory.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "FileHistory" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\FileHistory\FileHistory.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\orc.exe"C:\Users\Admin\AppData\Local\Temp\orc.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eai_3ldt.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES907E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC907D.tmp"4⤵
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install3⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Program Files\orc\orc.exe"C:\Program Files\orc\orc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Watchdog.exe"C:\Users\Admin\AppData\Roaming\Watchdog.exe" /launchSelfAndExit "C:\Program Files\orc\orc.exe" 2020 /protectFile4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Watchdog.exe"C:\Users\Admin\AppData\Roaming\Watchdog.exe" /watchProcess "C:\Program Files\orc\orc.exe" 2020 "/protectFile"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\plage.exe"C:\Users\Admin\Downloads\plage.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Query /FO "LIST" /TN "WinManager"3⤵
-
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe"C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe" /wait3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\blmkgrp.exe"C:\Users\Admin\AppData\Local\Temp\blmkgrp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\blmkgrp.exe"C:\Users\Admin\AppData\Local\Temp\blmkgrp.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskeng.exetaskeng.exe {C755767A-8ED2-4B95-9DC2-72CF46F57CF7} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
- Loads dropped DLL
-
C:\Program Files\orc\orc.exe"C:\Program Files\orc\orc.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\nitrsso64.exeC:\Users\Admin\AppData\Local\nitrsso64.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\nitrsso64.exeC:\Users\Admin\AppData\Local\nitrsso64.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\orc\orc.exeFilesize
916KB
MD5ac0431f34683bcbbb2cf23aaf29ea8cf
SHA1275ec0e362cb074d5f080aaa41c25a8ecebe3205
SHA2561780430ff5ad71b8c89b9c59d2924b16cb7fd07da479b8b394846c792f7523cb
SHA512156da3158d29d293daf9a74cf04d855ec162836fef87473afcc861688630f2da01234e1f40a4f84235ba457c0a6ae1770c3cc55fb0375cbea6813d0186a87b9c
-
C:\Program Files\orc\orc.exeFilesize
916KB
MD5ac0431f34683bcbbb2cf23aaf29ea8cf
SHA1275ec0e362cb074d5f080aaa41c25a8ecebe3205
SHA2561780430ff5ad71b8c89b9c59d2924b16cb7fd07da479b8b394846c792f7523cb
SHA512156da3158d29d293daf9a74cf04d855ec162836fef87473afcc861688630f2da01234e1f40a4f84235ba457c0a6ae1770c3cc55fb0375cbea6813d0186a87b9c
-
C:\Program Files\orc\orc.exeFilesize
916KB
MD5ac0431f34683bcbbb2cf23aaf29ea8cf
SHA1275ec0e362cb074d5f080aaa41c25a8ecebe3205
SHA2561780430ff5ad71b8c89b9c59d2924b16cb7fd07da479b8b394846c792f7523cb
SHA512156da3158d29d293daf9a74cf04d855ec162836fef87473afcc861688630f2da01234e1f40a4f84235ba457c0a6ae1770c3cc55fb0375cbea6813d0186a87b9c
-
C:\Program Files\orc\orc.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
C:\Users\Admin\AppData\Local\Temp\FileHistory.exeFilesize
2.8MB
MD5a73e083297e46d8e23f012d66a08f3a3
SHA183527df5a484494894ad2c71908a170a115751af
SHA2560ef4667fb2bd5b2184048913181bd7b03bf63d0e7959214b879efa4d6b75ad5d
SHA51278c2231eb48ed1f246b960b1afbd2b6b1c9b99495b2a1e8b45ea1aa90a21fbd23fd10223dbc7eba9aa057b5932290e20cdcfe2df583b1a93d2cea2bf350495f2
-
C:\Users\Admin\AppData\Local\Temp\FileHistory.exeFilesize
2.8MB
MD5a73e083297e46d8e23f012d66a08f3a3
SHA183527df5a484494894ad2c71908a170a115751af
SHA2560ef4667fb2bd5b2184048913181bd7b03bf63d0e7959214b879efa4d6b75ad5d
SHA51278c2231eb48ed1f246b960b1afbd2b6b1c9b99495b2a1e8b45ea1aa90a21fbd23fd10223dbc7eba9aa057b5932290e20cdcfe2df583b1a93d2cea2bf350495f2
-
C:\Users\Admin\AppData\Local\Temp\NewTask.xmlFilesize
1KB
MD559192e9ec089c8fe16809d1504e57e55
SHA11e08b206733c0bb5dd0af1df84020890aa0db42b
SHA2566ce58e68b69461ed088aaebf5c15fbfc0db97169e86c45e7467baec050fa9994
SHA512079d475763591e6f7f19dc99d8c01128f2293634674534a2e84f4de7141a845b40e6ce4d271ff410ef783fb6afd91e8ce0206a48706ecc108654f5b80d9168cc
-
C:\Users\Admin\AppData\Local\Temp\RES907E.tmpFilesize
1KB
MD5f79911e296ba4de4f8bf2f3f8bc1cb83
SHA12fce1fd919db22ba19e2ffcd7e3cdadf1539d843
SHA256f82fa0440581126b59532c2dfd1db4d6a0809e462a1ee9f437975596469dc768
SHA5122a8902f7403a07c256d41245863da6627ea91bae038ea21072cdce13b132fdd23931deef5f6f69fcec522ac47cae16240d6e4c45748c84b01b2183918f1633cd
-
C:\Users\Admin\AppData\Local\Temp\blmkgrp.exeFilesize
7.6MB
MD5cb565c1afd8469f43dd6917af55b733f
SHA1e71a56a7b13536d686ab9f4f2492d60c02a7790e
SHA2564a6b790629a17abb31de40da6a9faafdedbbc794f3e23816776621a83b068056
SHA512d4ae535bdc800581c0fbcd186edd9d03067c08280376f06ec2e96e3118eb682663de260be6e756a85c4f6240fa9ba2c1ab265b54a56b57865b273af68d650645
-
C:\Users\Admin\AppData\Local\Temp\blmkgrp.exeFilesize
7.6MB
MD5cb565c1afd8469f43dd6917af55b733f
SHA1e71a56a7b13536d686ab9f4f2492d60c02a7790e
SHA2564a6b790629a17abb31de40da6a9faafdedbbc794f3e23816776621a83b068056
SHA512d4ae535bdc800581c0fbcd186edd9d03067c08280376f06ec2e96e3118eb682663de260be6e756a85c4f6240fa9ba2c1ab265b54a56b57865b273af68d650645
-
C:\Users\Admin\AppData\Local\Temp\blmkgrp.exeFilesize
7.6MB
MD5cb565c1afd8469f43dd6917af55b733f
SHA1e71a56a7b13536d686ab9f4f2492d60c02a7790e
SHA2564a6b790629a17abb31de40da6a9faafdedbbc794f3e23816776621a83b068056
SHA512d4ae535bdc800581c0fbcd186edd9d03067c08280376f06ec2e96e3118eb682663de260be6e756a85c4f6240fa9ba2c1ab265b54a56b57865b273af68d650645
-
C:\Users\Admin\AppData\Local\Temp\eai_3ldt.dllFilesize
76KB
MD5cc7224aea84eacbe05662c417339e65f
SHA136e581155757a66e3f7fca2861ecd4f216650046
SHA2568882195e60fd6a28074b71d80745bf091a5c3c12327b438079873e2187fb652b
SHA5125ae721f3773e60ac428b4932fe88c473eec84d06a6e0ff2ff87f56e1f01e7c3a4a421c96a86cb927957e768fe29e3ac8fc46ba02b4ed8e3c34d3c23e0ca9ca07
-
C:\Users\Admin\AppData\Local\Temp\github.com_Blank-c_20002\python310.dllFilesize
1.5MB
MD5e06ce8146da66871aa8aeedc950fd12b
SHA16ee749bdd0bc857a41ac8018c5553e895784b961
SHA256aabd51782e4edb80561dd2ff065079a8381c7c86a6db1c6884bc09c73cde07a4
SHA5120d8c16832d5242595eff4993a1563de09f1eba988ca6e9bcd9afdb0891a164ea2972ac9df40f575e8e1021d535c3b807ce025bc15788f08f84c71246d64f1198
-
C:\Users\Admin\AppData\Local\Temp\joined.exeFilesize
56KB
MD5cf96dc2c8aa103b404761701c0e9e38e
SHA184c300ec07b1182ee095e9550395e1d5669934ca
SHA2566dc79af279e0324e3afb2621d812510d47fe29226cf3af1b37beee37fe2cada8
SHA5122e66127e212f014da3cb2f2e0fd2b969639d3e7ffb18d343e107e0449d889ebc262d96ac7b47ca8b95909790d7175afd509b9e3a1d7f34d5cb0bcb49058a9ca5
-
C:\Users\Admin\AppData\Local\Temp\joined.exeFilesize
56KB
MD5cf96dc2c8aa103b404761701c0e9e38e
SHA184c300ec07b1182ee095e9550395e1d5669934ca
SHA2566dc79af279e0324e3afb2621d812510d47fe29226cf3af1b37beee37fe2cada8
SHA5122e66127e212f014da3cb2f2e0fd2b969639d3e7ffb18d343e107e0449d889ebc262d96ac7b47ca8b95909790d7175afd509b9e3a1d7f34d5cb0bcb49058a9ca5
-
C:\Users\Admin\AppData\Local\Temp\nitrsso64.exeFilesize
54KB
MD5ebd7887003feaad033856253c14de51c
SHA11ef092f6c79df2e57c8a49469e4b44815d384948
SHA256faca607d5b505b97923a02c6a7b92517aaa6523d611126609663b0deaf23a315
SHA512969b45cad215ce2632e044b0d5712a7dfdd1c43083477fc1277a981d3771d2738e0972dc81c82cc8fb198c345b5afa235c306ffb85b8c5f493482fc70d8d929a
-
C:\Users\Admin\AppData\Local\Temp\nitrsso64.exeFilesize
54KB
MD5ebd7887003feaad033856253c14de51c
SHA11ef092f6c79df2e57c8a49469e4b44815d384948
SHA256faca607d5b505b97923a02c6a7b92517aaa6523d611126609663b0deaf23a315
SHA512969b45cad215ce2632e044b0d5712a7dfdd1c43083477fc1277a981d3771d2738e0972dc81c82cc8fb198c345b5afa235c306ffb85b8c5f493482fc70d8d929a
-
C:\Users\Admin\AppData\Local\Temp\orc.exeFilesize
916KB
MD5ac0431f34683bcbbb2cf23aaf29ea8cf
SHA1275ec0e362cb074d5f080aaa41c25a8ecebe3205
SHA2561780430ff5ad71b8c89b9c59d2924b16cb7fd07da479b8b394846c792f7523cb
SHA512156da3158d29d293daf9a74cf04d855ec162836fef87473afcc861688630f2da01234e1f40a4f84235ba457c0a6ae1770c3cc55fb0375cbea6813d0186a87b9c
-
C:\Users\Admin\AppData\Local\Temp\orc.exeFilesize
916KB
MD5ac0431f34683bcbbb2cf23aaf29ea8cf
SHA1275ec0e362cb074d5f080aaa41c25a8ecebe3205
SHA2561780430ff5ad71b8c89b9c59d2924b16cb7fd07da479b8b394846c792f7523cb
SHA512156da3158d29d293daf9a74cf04d855ec162836fef87473afcc861688630f2da01234e1f40a4f84235ba457c0a6ae1770c3cc55fb0375cbea6813d0186a87b9c
-
C:\Users\Admin\AppData\Local\Temp\sqls844.exeFilesize
16KB
MD5d7f2c50640108c104286ef71923c70d7
SHA17ccd84daed8ca9572ae3a8c98c38adf753fb8f33
SHA25653aef6261df3f802393d9196a5c87e69d1e07e2aaff45a606344b91f5801255a
SHA512eeb34a038920d0ff833f3140afd256dd6a0ea589052223d9bf61135d4557e8302e582782893348a7d40ef07af0c68a3068a052822d244ad65b7365cd0aeea0f0
-
C:\Users\Admin\AppData\Local\Temp\sqls844.exeFilesize
16KB
MD5d7f2c50640108c104286ef71923c70d7
SHA17ccd84daed8ca9572ae3a8c98c38adf753fb8f33
SHA25653aef6261df3f802393d9196a5c87e69d1e07e2aaff45a606344b91f5801255a
SHA512eeb34a038920d0ff833f3140afd256dd6a0ea589052223d9bf61135d4557e8302e582782893348a7d40ef07af0c68a3068a052822d244ad65b7365cd0aeea0f0
-
C:\Users\Admin\AppData\Local\nitrsso64.exeFilesize
54KB
MD5ebd7887003feaad033856253c14de51c
SHA11ef092f6c79df2e57c8a49469e4b44815d384948
SHA256faca607d5b505b97923a02c6a7b92517aaa6523d611126609663b0deaf23a315
SHA512969b45cad215ce2632e044b0d5712a7dfdd1c43083477fc1277a981d3771d2738e0972dc81c82cc8fb198c345b5afa235c306ffb85b8c5f493482fc70d8d929a
-
C:\Users\Admin\AppData\Local\nitrsso64.exeFilesize
54KB
MD5ebd7887003feaad033856253c14de51c
SHA11ef092f6c79df2e57c8a49469e4b44815d384948
SHA256faca607d5b505b97923a02c6a7b92517aaa6523d611126609663b0deaf23a315
SHA512969b45cad215ce2632e044b0d5712a7dfdd1c43083477fc1277a981d3771d2738e0972dc81c82cc8fb198c345b5afa235c306ffb85b8c5f493482fc70d8d929a
-
C:\Users\Admin\AppData\Local\nitrsso64.exeFilesize
54KB
MD5ebd7887003feaad033856253c14de51c
SHA11ef092f6c79df2e57c8a49469e4b44815d384948
SHA256faca607d5b505b97923a02c6a7b92517aaa6523d611126609663b0deaf23a315
SHA512969b45cad215ce2632e044b0d5712a7dfdd1c43083477fc1277a981d3771d2738e0972dc81c82cc8fb198c345b5afa235c306ffb85b8c5f493482fc70d8d929a
-
C:\Users\Admin\AppData\Roaming\FileHistory\FileHistory.exeFilesize
2.8MB
MD5a73e083297e46d8e23f012d66a08f3a3
SHA183527df5a484494894ad2c71908a170a115751af
SHA2560ef4667fb2bd5b2184048913181bd7b03bf63d0e7959214b879efa4d6b75ad5d
SHA51278c2231eb48ed1f246b960b1afbd2b6b1c9b99495b2a1e8b45ea1aa90a21fbd23fd10223dbc7eba9aa057b5932290e20cdcfe2df583b1a93d2cea2bf350495f2
-
C:\Users\Admin\AppData\Roaming\FileHistory\FileHistory.exeFilesize
2.8MB
MD5a73e083297e46d8e23f012d66a08f3a3
SHA183527df5a484494894ad2c71908a170a115751af
SHA2560ef4667fb2bd5b2184048913181bd7b03bf63d0e7959214b879efa4d6b75ad5d
SHA51278c2231eb48ed1f246b960b1afbd2b6b1c9b99495b2a1e8b45ea1aa90a21fbd23fd10223dbc7eba9aa057b5932290e20cdcfe2df583b1a93d2cea2bf350495f2
-
C:\Users\Admin\AppData\Roaming\Watchdog.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\AppData\Roaming\Watchdog.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\AppData\Roaming\Watchdog.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\AppData\Roaming\Watchdog.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exeFilesize
967KB
MD5b63bb68654e7be72058398809d6c4754
SHA14a7b43488029a2d4c960c9ee4431b99c8640a4b0
SHA2568db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe
SHA512c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a
-
C:\Users\Admin\Downloads\plage.exeFilesize
967KB
MD5b03ccade490854df220914c4430967e2
SHA11911a59e8c4b427d3fbc8fc9c794886bd2d81305
SHA25681cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961
SHA5120c05ff99f2d2f448c431073b9a339e6dc1ccab43c9442be44edfd493c3d4d9bd604a0deb792b91295571817113c309bafc6d230b470a4874493561bd5aa9bc36
-
C:\Users\Admin\Downloads\plage.exeFilesize
967KB
MD5b03ccade490854df220914c4430967e2
SHA11911a59e8c4b427d3fbc8fc9c794886bd2d81305
SHA25681cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961
SHA5120c05ff99f2d2f448c431073b9a339e6dc1ccab43c9442be44edfd493c3d4d9bd604a0deb792b91295571817113c309bafc6d230b470a4874493561bd5aa9bc36
-
C:\Windows\SysWOW64\WindowsInput.exeFilesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
-
C:\Windows\SysWOW64\WindowsInput.exeFilesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
-
C:\Windows\SysWOW64\WindowsInput.exeFilesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
-
C:\Windows\SysWOW64\WindowsInput.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
\??\c:\Users\Admin\AppData\Local\Temp\CSC907D.tmpFilesize
676B
MD531c300bbd630dcf0fb1a02cb69a9707e
SHA18b6e29bd5f978864a65a992942a63361a06a0020
SHA2562ee3a3e0d02511d909566341126ce9ae434837ea0db1fdf58c97e4c64e9831ed
SHA51230fcc363ba5a6dccfa75ba9007a94081aa78f31825f2194ee842d262fb485fae96758b443f5ffd5c7f558d89ac08cffac47a9140a9807692ea5559a64bb538c1
-
\??\c:\Users\Admin\AppData\Local\Temp\eai_3ldt.0.csFilesize
208KB
MD56011503497b1b9250a05debf9690e52c
SHA1897aea61e9bffc82d7031f1b3da12fb83efc6d82
SHA25608f42b8d57bb61bc8f9628c8a80953b06ca4149d50108083fca6dc26bdd49434
SHA512604c33e82e8b5bb5c54389c2899c81e5482a06e69db08268173a5b4574327ee5de656d312011d07e50a2e398a4c9b0cd79029013f76e05e18cf67ce5a916ffd9
-
\??\c:\Users\Admin\AppData\Local\Temp\eai_3ldt.cmdlineFilesize
349B
MD53d936ef04ce8c2106ec3eb0f428c419a
SHA1d8f72ebf2bdb0d1bfdca8aa4f6af55f2136d5310
SHA256633dd59b1709e76a3b806137f79509de429301b55cb8f9580edbeadbb66afae7
SHA512564bf5f29093007be560e107cf80c0d0ae94aa69b7febe3ee124323c57f167ce702be4f63cf92e04e69d5daf4a636a11bc685f6bf303b01ea95def31f7bac821
-
\Users\Admin\AppData\Local\Temp\blmkgrp.exeFilesize
7.6MB
MD5cb565c1afd8469f43dd6917af55b733f
SHA1e71a56a7b13536d686ab9f4f2492d60c02a7790e
SHA2564a6b790629a17abb31de40da6a9faafdedbbc794f3e23816776621a83b068056
SHA512d4ae535bdc800581c0fbcd186edd9d03067c08280376f06ec2e96e3118eb682663de260be6e756a85c4f6240fa9ba2c1ab265b54a56b57865b273af68d650645
-
\Users\Admin\AppData\Local\Temp\blmkgrp.exeFilesize
7.6MB
MD5cb565c1afd8469f43dd6917af55b733f
SHA1e71a56a7b13536d686ab9f4f2492d60c02a7790e
SHA2564a6b790629a17abb31de40da6a9faafdedbbc794f3e23816776621a83b068056
SHA512d4ae535bdc800581c0fbcd186edd9d03067c08280376f06ec2e96e3118eb682663de260be6e756a85c4f6240fa9ba2c1ab265b54a56b57865b273af68d650645
-
\Users\Admin\AppData\Local\Temp\blmkgrp.exeFilesize
7.6MB
MD5cb565c1afd8469f43dd6917af55b733f
SHA1e71a56a7b13536d686ab9f4f2492d60c02a7790e
SHA2564a6b790629a17abb31de40da6a9faafdedbbc794f3e23816776621a83b068056
SHA512d4ae535bdc800581c0fbcd186edd9d03067c08280376f06ec2e96e3118eb682663de260be6e756a85c4f6240fa9ba2c1ab265b54a56b57865b273af68d650645
-
\Users\Admin\AppData\Local\Temp\github.com_Blank-c_20002\python310.dllFilesize
1.5MB
MD5e06ce8146da66871aa8aeedc950fd12b
SHA16ee749bdd0bc857a41ac8018c5553e895784b961
SHA256aabd51782e4edb80561dd2ff065079a8381c7c86a6db1c6884bc09c73cde07a4
SHA5120d8c16832d5242595eff4993a1563de09f1eba988ca6e9bcd9afdb0891a164ea2972ac9df40f575e8e1021d535c3b807ce025bc15788f08f84c71246d64f1198
-
\Users\Admin\AppData\Local\Temp\nitrsso64.exeFilesize
54KB
MD5ebd7887003feaad033856253c14de51c
SHA11ef092f6c79df2e57c8a49469e4b44815d384948
SHA256faca607d5b505b97923a02c6a7b92517aaa6523d611126609663b0deaf23a315
SHA512969b45cad215ce2632e044b0d5712a7dfdd1c43083477fc1277a981d3771d2738e0972dc81c82cc8fb198c345b5afa235c306ffb85b8c5f493482fc70d8d929a
-
\Users\Admin\AppData\Local\nitrsso64.exeFilesize
54KB
MD5ebd7887003feaad033856253c14de51c
SHA11ef092f6c79df2e57c8a49469e4b44815d384948
SHA256faca607d5b505b97923a02c6a7b92517aaa6523d611126609663b0deaf23a315
SHA512969b45cad215ce2632e044b0d5712a7dfdd1c43083477fc1277a981d3771d2738e0972dc81c82cc8fb198c345b5afa235c306ffb85b8c5f493482fc70d8d929a
-
\Users\Admin\AppData\Roaming\discordnitro\winmgr.exeFilesize
967KB
MD5b63bb68654e7be72058398809d6c4754
SHA14a7b43488029a2d4c960c9ee4431b99c8640a4b0
SHA2568db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe
SHA512c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a
-
\Users\Admin\AppData\Roaming\discordnitro\winmgr.exeFilesize
967KB
MD5b63bb68654e7be72058398809d6c4754
SHA14a7b43488029a2d4c960c9ee4431b99c8640a4b0
SHA2568db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe
SHA512c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a
-
memory/296-78-0x00000000006E0000-0x00000000006F6000-memory.dmpFilesize
88KB
-
memory/296-79-0x0000000000C30000-0x0000000000C3A000-memory.dmpFilesize
40KB
-
memory/296-74-0x0000000000000000-mapping.dmp
-
memory/296-77-0x0000000001120000-0x0000000001132000-memory.dmpFilesize
72KB
-
memory/364-117-0x0000000000000000-mapping.dmp
-
memory/516-109-0x0000000000000000-mapping.dmp
-
memory/524-103-0x0000000000000000-mapping.dmp
-
memory/640-156-0x0000000000000000-mapping.dmp
-
memory/708-111-0x0000000000000000-mapping.dmp
-
memory/708-121-0x000007FEEA790000-0x000007FEEABFF000-memory.dmpFilesize
4.4MB
-
memory/840-61-0x000007FEECF60000-0x000007FEED983000-memory.dmpFilesize
10.1MB
-
memory/840-57-0x0000000000000000-mapping.dmp
-
memory/948-64-0x0000000000000000-mapping.dmp
-
memory/948-67-0x0000000000300000-0x000000000030A000-memory.dmpFilesize
40KB
-
memory/980-126-0x0000000000000000-mapping.dmp
-
memory/1116-72-0x0000000000000000-mapping.dmp
-
memory/1268-80-0x0000000000000000-mapping.dmp
-
memory/1276-123-0x0000000000000000-mapping.dmp
-
memory/1372-89-0x0000000000000000-mapping.dmp
-
memory/1476-151-0x00000000003F0000-0x00000000003F8000-memory.dmpFilesize
32KB
-
memory/1476-147-0x0000000000000000-mapping.dmp
-
memory/1512-159-0x0000000000000000-mapping.dmp
-
memory/1512-162-0x0000000000C40000-0x0000000000C52000-memory.dmpFilesize
72KB
-
memory/1536-55-0x0000000000660000-0x000000000068A000-memory.dmpFilesize
168KB
-
memory/1536-56-0x000007FEFBB71000-0x000007FEFBB73000-memory.dmpFilesize
8KB
-
memory/1536-62-0x0000000002350000-0x0000000002358000-memory.dmpFilesize
32KB
-
memory/1536-60-0x00000000022A0000-0x00000000022B8000-memory.dmpFilesize
96KB
-
memory/1536-54-0x000000013FA20000-0x000000013FA6E000-memory.dmpFilesize
312KB
-
memory/1612-165-0x0000000001280000-0x0000000001292000-memory.dmpFilesize
72KB
-
memory/1612-163-0x0000000000000000-mapping.dmp
-
memory/1668-84-0x00000000010D0000-0x000000000139A000-memory.dmpFilesize
2.8MB
-
memory/1668-81-0x0000000000000000-mapping.dmp
-
memory/1716-70-0x0000000071590000-0x0000000071B3B000-memory.dmpFilesize
5.7MB
-
memory/1716-68-0x0000000000000000-mapping.dmp
-
memory/1716-69-0x0000000075681000-0x0000000075683000-memory.dmpFilesize
8KB
-
memory/1716-71-0x0000000071590000-0x0000000071B3B000-memory.dmpFilesize
5.7MB
-
memory/1752-134-0x00000000011A0000-0x00000000011AC000-memory.dmpFilesize
48KB
-
memory/1752-130-0x0000000000000000-mapping.dmp
-
memory/1900-96-0x0000000000000000-mapping.dmp
-
memory/1908-91-0x0000000000000000-mapping.dmp
-
memory/1940-153-0x0000000000000000-mapping.dmp
-
memory/2000-105-0x0000000000000000-mapping.dmp
-
memory/2004-90-0x000007FEEBCA0000-0x000007FEEC6C3000-memory.dmpFilesize
10.1MB
-
memory/2004-94-0x000007FEEAC00000-0x000007FEEBC96000-memory.dmpFilesize
16.6MB
-
memory/2004-86-0x0000000000000000-mapping.dmp
-
memory/2020-142-0x00000000002C0000-0x00000000002CE000-memory.dmpFilesize
56KB
-
memory/2020-145-0x0000000000D50000-0x0000000000D68000-memory.dmpFilesize
96KB
-
memory/2020-144-0x0000000000AB0000-0x0000000000AFE000-memory.dmpFilesize
312KB
-
memory/2020-143-0x0000000000480000-0x0000000000492000-memory.dmpFilesize
72KB
-
memory/2020-141-0x0000000000A50000-0x0000000000AAC000-memory.dmpFilesize
368KB
-
memory/2020-140-0x0000000001210000-0x00000000012FA000-memory.dmpFilesize
936KB
-
memory/2020-136-0x0000000000000000-mapping.dmp
-
memory/2020-155-0x000000001AFA6000-0x000000001AFC5000-memory.dmpFilesize
124KB
-
memory/2020-146-0x000000001ADB0000-0x000000001ADC0000-memory.dmpFilesize
64KB
-
memory/2028-100-0x00000000013E0000-0x00000000016AA000-memory.dmpFilesize
2.8MB
-
memory/2028-97-0x0000000000000000-mapping.dmp