Analysis
-
max time kernel
68s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
16-11-2022 12:16
Static task
static1
Behavioral task
behavioral1
Sample
d553d612efd1c730a09343c8adf4a036.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d553d612efd1c730a09343c8adf4a036.exe
Resource
win10v2004-20221111-en
General
-
Target
d553d612efd1c730a09343c8adf4a036.exe
-
Size
225KB
-
MD5
d553d612efd1c730a09343c8adf4a036
-
SHA1
5095701c41ad62d083315d470f89a2839c15743a
-
SHA256
c06b5476a0bda07a9f08eb09f46332ba19d9c88f1f3c5f4381bb4263975b0b8a
-
SHA512
2fce37ff11d3317af4d4df97bd5a4ed3716ea3427cdecd2ba1b89583d06ff5032b412420b8df2b2a1272b568e50773ef3a2a215f34362478fdbec4398b5db5b4
-
SSDEEP
3072:TXOpSkSSPL4sDEHanG7zWUjflOT9JSdzhwyTvqjw/DIRBIRb2Q8XrRv:LMhLPLTEOG7zW2dOSPwIvIEb2/r
Malware Config
Extracted
redline
mario23_10
167.235.252.160:10642
-
auth_value
eca57cfb5172f71dc45986763bb98942
Extracted
djvu
http://fresherlights.com/lancer/get.php
-
extension
.fate
-
offline_id
5IRhyFuF3rXlXBvF6jAWjHEAnAb432icDCcvZyt1
-
payload_url
http://uaery.top/dl/build2.exe
http://fresherlights.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-4wOUlYSwGo Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@fishmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0603Jhyjd
Extracted
vidar
55.7
517
https://t.me/deadftx
https://www.ultimate-guitar.com/u/smbfupkuhrgc1
-
profile_id
517
Extracted
blacknet
v3.7.0 Public
Round3
http://zee.zight.ru
BN[d396d077ee81b07d64cc8bbff27bbccb]
-
antivm
true
-
elevate_uac
false
-
install_name
GPUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
false
-
usb_spread
false
Signatures
-
BlackNET payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/8-311-0x0000000000400000-0x0000000000422000-memory.dmp family_blacknet -
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/8-311-0x0000000000400000-0x0000000000422000-memory.dmp disable_win_def -
Detected Djvu ransomware 10 IoCs
Processes:
resource yara_rule behavioral2/memory/4684-207-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3288-217-0x0000000000ED0000-0x0000000000FEB000-memory.dmp family_djvu behavioral2/memory/4684-211-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4684-209-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4684-218-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4684-223-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4040-235-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4040-237-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4040-242-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4040-284-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Detects Smokeloader packer 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1432-133-0x0000000000840000-0x0000000000849000-memory.dmp family_smokeloader behavioral2/memory/1432-136-0x0000000000840000-0x0000000000849000-memory.dmp family_smokeloader behavioral2/memory/644-182-0x0000000000030000-0x0000000000039000-memory.dmp family_smokeloader behavioral2/memory/2708-202-0x0000000000030000-0x0000000000039000-memory.dmp family_smokeloader -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Processes:
4DCB.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 4DCB.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 4DCB.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 4DCB.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 4DCB.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2636-166-0x0000000000860000-0x00000000008C0000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
4185.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4185.exe -
Downloads MZ/PE file
-
Executes dropped EXE 17 IoCs
Processes:
BC50.exeBE45.exeBF40.exeC22F.exeC3F5.exeC9A4.exeC9A4.exeC9A4.exeC9A4.exebuild2.exebuild2.exebuild3.exemstsca.exe3C25.exe4185.exe4DCB.exe4DCB.exepid process 308 BC50.exe 644 BE45.exe 3416 BF40.exe 2708 C22F.exe 4584 C3F5.exe 3288 C9A4.exe 4684 C9A4.exe 1160 C9A4.exe 4040 C9A4.exe 4216 build2.exe 4892 build2.exe 1092 build3.exe 492 mstsca.exe 4128 3C25.exe 3792 4185.exe 5052 4DCB.exe 8 4DCB.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
4185.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4185.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4185.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
C9A4.exeC9A4.exebuild2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation C9A4.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation C9A4.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation build2.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exebuild2.exepid process 4504 regsvr32.exe 4504 regsvr32.exe 4892 build2.exe 4892 build2.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Processes:
4DCB.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 4DCB.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 4DCB.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
C9A4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\44e41887-c6c2-426a-8571-3f4e7ab36c3d\\C9A4.exe\" --AutoStart" C9A4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
4185.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4185.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 api.2ip.ua 21 api.2ip.ua 32 api.2ip.ua -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
4185.exepid process 3792 4185.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
BC50.exeC9A4.exeC9A4.exebuild2.exe4DCB.exedescription pid process target process PID 308 set thread context of 2636 308 BC50.exe vbc.exe PID 3288 set thread context of 4684 3288 C9A4.exe C9A4.exe PID 1160 set thread context of 4040 1160 C9A4.exe C9A4.exe PID 4216 set thread context of 4892 4216 build2.exe build2.exe PID 5052 set thread context of 8 5052 4DCB.exe 4DCB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5092 308 WerFault.exe BC50.exe 4628 3416 WerFault.exe BF40.exe 2056 2708 WerFault.exe C22F.exe 824 4584 WerFault.exe C3F5.exe 4416 8 WerFault.exe 4DCB.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
BE45.exed553d612efd1c730a09343c8adf4a036.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BE45.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d553d612efd1c730a09343c8adf4a036.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d553d612efd1c730a09343c8adf4a036.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d553d612efd1c730a09343c8adf4a036.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BE45.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BE45.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1356 schtasks.exe 1988 schtasks.exe 3924 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1564 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d553d612efd1c730a09343c8adf4a036.exepid process 1432 d553d612efd1c730a09343c8adf4a036.exe 1432 d553d612efd1c730a09343c8adf4a036.exe 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 668 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 668 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
d553d612efd1c730a09343c8adf4a036.exeBE45.exepid process 1432 d553d612efd1c730a09343c8adf4a036.exe 668 668 668 668 644 BE45.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
Processes:
vbc.exe3C25.exe4DCB.exepowershell.exedescription pid process Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeDebugPrivilege 2636 vbc.exe Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeDebugPrivilege 4128 3C25.exe Token: SeShutdownPrivilege 668 Token: SeCreatePagefilePrivilege 668 Token: SeDebugPrivilege 8 4DCB.exe Token: SeDebugPrivilege 3940 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
4DCB.exepid process 8 4DCB.exe 8 4DCB.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BC50.exeregsvr32.exeC9A4.exeC9A4.exeC9A4.exeC9A4.exedescription pid process target process PID 668 wrote to memory of 308 668 BC50.exe PID 668 wrote to memory of 308 668 BC50.exe PID 668 wrote to memory of 308 668 BC50.exe PID 668 wrote to memory of 644 668 BE45.exe PID 668 wrote to memory of 644 668 BE45.exe PID 668 wrote to memory of 644 668 BE45.exe PID 308 wrote to memory of 2636 308 BC50.exe vbc.exe PID 308 wrote to memory of 2636 308 BC50.exe vbc.exe PID 308 wrote to memory of 2636 308 BC50.exe vbc.exe PID 668 wrote to memory of 3416 668 BF40.exe PID 668 wrote to memory of 3416 668 BF40.exe PID 668 wrote to memory of 3416 668 BF40.exe PID 308 wrote to memory of 2636 308 BC50.exe vbc.exe PID 308 wrote to memory of 2636 308 BC50.exe vbc.exe PID 668 wrote to memory of 2708 668 C22F.exe PID 668 wrote to memory of 2708 668 C22F.exe PID 668 wrote to memory of 2708 668 C22F.exe PID 668 wrote to memory of 4584 668 C3F5.exe PID 668 wrote to memory of 4584 668 C3F5.exe PID 668 wrote to memory of 4584 668 C3F5.exe PID 668 wrote to memory of 2476 668 regsvr32.exe PID 668 wrote to memory of 2476 668 regsvr32.exe PID 2476 wrote to memory of 4504 2476 regsvr32.exe regsvr32.exe PID 2476 wrote to memory of 4504 2476 regsvr32.exe regsvr32.exe PID 2476 wrote to memory of 4504 2476 regsvr32.exe regsvr32.exe PID 668 wrote to memory of 3288 668 C9A4.exe PID 668 wrote to memory of 3288 668 C9A4.exe PID 668 wrote to memory of 3288 668 C9A4.exe PID 668 wrote to memory of 2316 668 explorer.exe PID 668 wrote to memory of 2316 668 explorer.exe PID 668 wrote to memory of 2316 668 explorer.exe PID 668 wrote to memory of 2316 668 explorer.exe PID 668 wrote to memory of 3204 668 explorer.exe PID 668 wrote to memory of 3204 668 explorer.exe PID 668 wrote to memory of 3204 668 explorer.exe PID 3288 wrote to memory of 4684 3288 C9A4.exe C9A4.exe PID 3288 wrote to memory of 4684 3288 C9A4.exe C9A4.exe PID 3288 wrote to memory of 4684 3288 C9A4.exe C9A4.exe PID 3288 wrote to memory of 4684 3288 C9A4.exe C9A4.exe PID 3288 wrote to memory of 4684 3288 C9A4.exe C9A4.exe PID 3288 wrote to memory of 4684 3288 C9A4.exe C9A4.exe PID 3288 wrote to memory of 4684 3288 C9A4.exe C9A4.exe PID 3288 wrote to memory of 4684 3288 C9A4.exe C9A4.exe PID 3288 wrote to memory of 4684 3288 C9A4.exe C9A4.exe PID 3288 wrote to memory of 4684 3288 C9A4.exe C9A4.exe PID 4684 wrote to memory of 1324 4684 C9A4.exe icacls.exe PID 4684 wrote to memory of 1324 4684 C9A4.exe icacls.exe PID 4684 wrote to memory of 1324 4684 C9A4.exe icacls.exe PID 4684 wrote to memory of 1160 4684 C9A4.exe C9A4.exe PID 4684 wrote to memory of 1160 4684 C9A4.exe C9A4.exe PID 4684 wrote to memory of 1160 4684 C9A4.exe C9A4.exe PID 1160 wrote to memory of 4040 1160 C9A4.exe C9A4.exe PID 1160 wrote to memory of 4040 1160 C9A4.exe C9A4.exe PID 1160 wrote to memory of 4040 1160 C9A4.exe C9A4.exe PID 1160 wrote to memory of 4040 1160 C9A4.exe C9A4.exe PID 1160 wrote to memory of 4040 1160 C9A4.exe C9A4.exe PID 1160 wrote to memory of 4040 1160 C9A4.exe C9A4.exe PID 1160 wrote to memory of 4040 1160 C9A4.exe C9A4.exe PID 1160 wrote to memory of 4040 1160 C9A4.exe C9A4.exe PID 1160 wrote to memory of 4040 1160 C9A4.exe C9A4.exe PID 1160 wrote to memory of 4040 1160 C9A4.exe C9A4.exe PID 4040 wrote to memory of 4216 4040 C9A4.exe build2.exe PID 4040 wrote to memory of 4216 4040 C9A4.exe build2.exe PID 4040 wrote to memory of 4216 4040 C9A4.exe build2.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d553d612efd1c730a09343c8adf4a036.exe"C:\Users\Admin\AppData\Local\Temp\d553d612efd1c730a09343c8adf4a036.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\BC50.exeC:\Users\Admin\AppData\Local\Temp\BC50.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 3042⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\BE45.exeC:\Users\Admin\AppData\Local\Temp\BE45.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\BF40.exeC:\Users\Admin\AppData\Local\Temp\BF40.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 2122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 308 -ip 3081⤵
-
C:\Users\Admin\AppData\Local\Temp\C22F.exeC:\Users\Admin\AppData\Local\Temp\C22F.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 3402⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\C3F5.exeC:\Users\Admin\AppData\Local\Temp\C3F5.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 3442⤵
- Program crash
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\C83C.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\C83C.dll2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2708 -ip 27081⤵
-
C:\Users\Admin\AppData\Local\Temp\C9A4.exeC:\Users\Admin\AppData\Local\Temp\C9A4.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C9A4.exeC:\Users\Admin\AppData\Local\Temp\C9A4.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\44e41887-c6c2-426a-8571-3f4e7ab36c3d" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\C9A4.exe"C:\Users\Admin\AppData\Local\Temp\C9A4.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C9A4.exe"C:\Users\Admin\AppData\Local\Temp\C9A4.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build2.exe"C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build2.exe"C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build2.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build2.exe" & exit7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build3.exe"C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build3.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3416 -ip 34161⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"1⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\3C25.exeC:\Users\Admin\AppData\Local\Temp\3C25.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4185.exeC:\Users\Admin\AppData\Local\Temp\4185.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\4DCB.exeC:\Users\Admin\AppData\Local\Temp\4DCB.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\4DCB.exe"C:\Users\Admin\AppData\Local\Temp\4DCB.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 29083⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\RegStart"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\RegStart\RegStart.exe'" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\RegStart\RegStart.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\4DCB.exe" "C:\Users\Admin\AppData\Roaming\RegStart\RegStart.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 8 -ip 81⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
3Disabling Security Tools
2Virtualization/Sandbox Evasion
1File Permissions Modification
1Scripting
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD5b00f59ce59a95f5fe629aff007e982fa
SHA18eb54eb49c540b80dba22e0a863f8122b48df410
SHA256d3559d4f89073b9bd7764d42e0fd258f78d98b5344af368056696f5fb6a87c46
SHA5126317a36087f2166e5a77a5761d7ad662c76b2989840af4e89e8a93845c8c7f47e6a26341be77db39ca687aacb5e50ad3730a5ee4b6d76669637b676a31b0efb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD58245d5e076774cc6f63bf77f4650bf3b
SHA12efdf2d5967e180eb13f9633094b617e4e1a8656
SHA256b4247c5d4cedfc5c553005c58ea254e62b12ced6a28a183fcc3823e4d1cfbc53
SHA512a2eb33bdb4f996bb67508b8add8f042bf26223f427caefa1ef1388cdecd6f15eecbc197d88a59e64f1a0f7e8a14983ab96bbe6463f2cadf39e6637679f34ad54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD5f7988b209dd629182afc2aa38fb88341
SHA1399157526c0e0a2f4528b453a58f91f33da61785
SHA2567670c992aca5fe1c864bd3a2693973258e2cc63be8b76297d1ff3f451ce10dd5
SHA512218ba7ae36db3fc77bbda930c00348b4d6e923a852881f489d2e05207f4b7d674ac6772558a76ab18b109ba8dd7c7c1a77e322560f24ba571008f6ed1778d2e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD5ee62f6021bb3f7bda9a77ea62fc5781f
SHA1dbeb3867651457c92752c5cfb0f163c9713b945e
SHA256ba6ab9aa17cc4ed124f388fc1dfccde6832d0d6445860f9d8eadddc2e26434cb
SHA51225eb50ae7c45033547770096e8a0f67ee07f856639287960d7a675daf0280b9791e4daafcb9eb15307610fbead65c7776a5c6fb5924e7a90437463f2e0c4bde0
-
C:\Users\Admin\AppData\Local\44e41887-c6c2-426a-8571-3f4e7ab36c3d\C9A4.exeFilesize
725KB
MD5a61e3e2554d6c683986b88eee7fe3837
SHA1c62ba9d4593324b0fbe3d7eebae42a97e8ad514c
SHA25651f912eb49cb9f586aca2b800b26cc7b4b08a1868af69e4d8efbaff8270f6d39
SHA5120b8f25fdbaee29d0bde4c8eca3204314c6945ec68af2c9a87e0ca9faf3a0eaabb9d35473c7d4df35b239908812ef557eb606714147256bb97ee588ae425760e2
-
C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build2.exeFilesize
388KB
MD58b401fc82a41458872b2e5345600f46f
SHA161bcf479e850a0cacc646529a3ec919968379a75
SHA2562631ab16a328fb1e677dfffbebe122cf9b96540df841edcac6a5a20bd54d6214
SHA512ee5652cfba1b32bd9baff0ce09d5396a38b44e4b8443d49c0fcbce897399704a05fc202aae19d3090f9164ff45bfa342cbab666a5cd13f0bd5e86d066e4a14bd
-
C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build2.exeFilesize
388KB
MD58b401fc82a41458872b2e5345600f46f
SHA161bcf479e850a0cacc646529a3ec919968379a75
SHA2562631ab16a328fb1e677dfffbebe122cf9b96540df841edcac6a5a20bd54d6214
SHA512ee5652cfba1b32bd9baff0ce09d5396a38b44e4b8443d49c0fcbce897399704a05fc202aae19d3090f9164ff45bfa342cbab666a5cd13f0bd5e86d066e4a14bd
-
C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build2.exeFilesize
388KB
MD58b401fc82a41458872b2e5345600f46f
SHA161bcf479e850a0cacc646529a3ec919968379a75
SHA2562631ab16a328fb1e677dfffbebe122cf9b96540df841edcac6a5a20bd54d6214
SHA512ee5652cfba1b32bd9baff0ce09d5396a38b44e4b8443d49c0fcbce897399704a05fc202aae19d3090f9164ff45bfa342cbab666a5cd13f0bd5e86d066e4a14bd
-
C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\8a7ee9de-2867-4684-99ed-c8380fc2a406\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\Temp\3C25.exeFilesize
330KB
MD58b53ae05c1bd0ab25622193e16f261e1
SHA1fe8e0d14d9e6858ef821b26bdd6d660febf19551
SHA2560837df68aa3d77d073e76471551c77971942d141133784417bf5d5f3220daad8
SHA51243daf52f52da1173dbb118bc8d7163d1fdf2b3a9668a1399cbd645a5463722a24152405217ac0237fe1141c9996634a029b46f50bb788ac6a5ebd69ae24e47b5
-
C:\Users\Admin\AppData\Local\Temp\3C25.exeFilesize
330KB
MD58b53ae05c1bd0ab25622193e16f261e1
SHA1fe8e0d14d9e6858ef821b26bdd6d660febf19551
SHA2560837df68aa3d77d073e76471551c77971942d141133784417bf5d5f3220daad8
SHA51243daf52f52da1173dbb118bc8d7163d1fdf2b3a9668a1399cbd645a5463722a24152405217ac0237fe1141c9996634a029b46f50bb788ac6a5ebd69ae24e47b5
-
C:\Users\Admin\AppData\Local\Temp\4185.exeFilesize
4.2MB
MD5a62965dde47512afd390806c88f6821b
SHA1f389db3ccfd224c398e33375521ae18b5dc6b8fd
SHA256e3277990b72605b6007680f0709c1d6b7e2e178b71d6d3f45635ae1d085b1400
SHA51289dc8bd1ace718ba9326b3b12ac9aeca4e7d32afffd58676657966fa8e6c984eb346e88654e97603f47d0194d452e8da03d97acfd64be34ac10191f7ff30cacf
-
C:\Users\Admin\AppData\Local\Temp\4DCB.exeFilesize
356KB
MD5354d20e21be15dd24eb8a9b2b18a8407
SHA1f3c9182f5a8a45ee8f9cbcf2e4584c38ff670533
SHA2560cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44
SHA5127bcfd0d2bca8a7bc3f0836c012438125cabdac11e7978f3d8a55ace928fe98ceac8ddf7cab146847ad9c9299c9231711df5b52cb0e429bcb5f519fae7353edb5
-
C:\Users\Admin\AppData\Local\Temp\4DCB.exeFilesize
356KB
MD5354d20e21be15dd24eb8a9b2b18a8407
SHA1f3c9182f5a8a45ee8f9cbcf2e4584c38ff670533
SHA2560cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44
SHA5127bcfd0d2bca8a7bc3f0836c012438125cabdac11e7978f3d8a55ace928fe98ceac8ddf7cab146847ad9c9299c9231711df5b52cb0e429bcb5f519fae7353edb5
-
C:\Users\Admin\AppData\Local\Temp\4DCB.exeFilesize
356KB
MD5354d20e21be15dd24eb8a9b2b18a8407
SHA1f3c9182f5a8a45ee8f9cbcf2e4584c38ff670533
SHA2560cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44
SHA5127bcfd0d2bca8a7bc3f0836c012438125cabdac11e7978f3d8a55ace928fe98ceac8ddf7cab146847ad9c9299c9231711df5b52cb0e429bcb5f519fae7353edb5
-
C:\Users\Admin\AppData\Local\Temp\BC50.exeFilesize
456KB
MD5ffdaa25a575d34a97a33a00d7a5ea8e7
SHA19212e5bec1044f778efd7c6f5b476801a645ea33
SHA2564aeb2a312b9110271a96098aa5fa3351ad7e79d5a05517de13928e26a434869a
SHA5126ba9234b1613516e2da4e899b79c7a94db4b7d62f88d7a2b50a7a43b656d497799b0b5e3fe7820238328287eee6c53589b077abc1b1ef5b0dc7888cd9303ee11
-
C:\Users\Admin\AppData\Local\Temp\BC50.exeFilesize
456KB
MD5ffdaa25a575d34a97a33a00d7a5ea8e7
SHA19212e5bec1044f778efd7c6f5b476801a645ea33
SHA2564aeb2a312b9110271a96098aa5fa3351ad7e79d5a05517de13928e26a434869a
SHA5126ba9234b1613516e2da4e899b79c7a94db4b7d62f88d7a2b50a7a43b656d497799b0b5e3fe7820238328287eee6c53589b077abc1b1ef5b0dc7888cd9303ee11
-
C:\Users\Admin\AppData\Local\Temp\BE45.exeFilesize
226KB
MD542e00577b163d4c87b0b758871452ff6
SHA1b829fad325624cba1b1feb07f09cc24d471f47a5
SHA256f335de99ddd439a9cbdcfed4b0a401806af481b789122df20936b9c00991b7e7
SHA5126f89abe6076acd36e410cca7817e0bc33d056a2bfead08c5e8a84649b57a53428f2640b6fd026d52895057193af34e249c1dd071d5a781b35be5a62e30285c16
-
C:\Users\Admin\AppData\Local\Temp\BE45.exeFilesize
226KB
MD542e00577b163d4c87b0b758871452ff6
SHA1b829fad325624cba1b1feb07f09cc24d471f47a5
SHA256f335de99ddd439a9cbdcfed4b0a401806af481b789122df20936b9c00991b7e7
SHA5126f89abe6076acd36e410cca7817e0bc33d056a2bfead08c5e8a84649b57a53428f2640b6fd026d52895057193af34e249c1dd071d5a781b35be5a62e30285c16
-
C:\Users\Admin\AppData\Local\Temp\BF40.exeFilesize
234KB
MD5314d2d2a28498bcf5a4d99d0f03c5485
SHA1d14ba5940992f3be2616ac06d3f75c84d1619b41
SHA256182f8d17c8874c5b72c01d65ebb4132ac44657002b3ee1ef1179642dbcdd8c94
SHA5123d4a5838b52d489b93103e34b1115f20f2765bd6b62e474da9e90d5823195c4bcbbdcb07cbb93409deb322dc9f64f410669e0e1fd07cc57b6650516c28dfb1aa
-
C:\Users\Admin\AppData\Local\Temp\BF40.exeFilesize
234KB
MD5314d2d2a28498bcf5a4d99d0f03c5485
SHA1d14ba5940992f3be2616ac06d3f75c84d1619b41
SHA256182f8d17c8874c5b72c01d65ebb4132ac44657002b3ee1ef1179642dbcdd8c94
SHA5123d4a5838b52d489b93103e34b1115f20f2765bd6b62e474da9e90d5823195c4bcbbdcb07cbb93409deb322dc9f64f410669e0e1fd07cc57b6650516c28dfb1aa
-
C:\Users\Admin\AppData\Local\Temp\C22F.exeFilesize
225KB
MD5a346bda7535accfc9b3479d6aa5ef458
SHA1ca6d68480a880b0c1ac5fc35a3a6806730ef7b3e
SHA256165972fbb7d3c9e53ddc5e7cf1e25575035951978d3c8e2af21c22d049338deb
SHA512c4a513fb42e55aa66efb9de22b481e3fc7285e7af6503cf2cf86a6db0f330f72a1fbdd4c6e300a519d820f6c2aebc86fe4fd11150da4082af78338dbc158f962
-
C:\Users\Admin\AppData\Local\Temp\C22F.exeFilesize
225KB
MD5a346bda7535accfc9b3479d6aa5ef458
SHA1ca6d68480a880b0c1ac5fc35a3a6806730ef7b3e
SHA256165972fbb7d3c9e53ddc5e7cf1e25575035951978d3c8e2af21c22d049338deb
SHA512c4a513fb42e55aa66efb9de22b481e3fc7285e7af6503cf2cf86a6db0f330f72a1fbdd4c6e300a519d820f6c2aebc86fe4fd11150da4082af78338dbc158f962
-
C:\Users\Admin\AppData\Local\Temp\C3F5.exeFilesize
233KB
MD57199c87b3a2dc8ca4dba04995a73bb9b
SHA184b0f8274c326d6f730ee4ea576f070ba1754cb2
SHA25616af1b9b941dfec258b8404c3da01d14520a07b2b8f9fb996540695c9dae4106
SHA512f459cee8b930683e3a260a3d530c4a60ead6d0c4e41ad13916524885ea309c7b6d5969395368848cdaa1175478bac7bd087a06b31e82087f55309eab7b683512
-
C:\Users\Admin\AppData\Local\Temp\C3F5.exeFilesize
233KB
MD57199c87b3a2dc8ca4dba04995a73bb9b
SHA184b0f8274c326d6f730ee4ea576f070ba1754cb2
SHA25616af1b9b941dfec258b8404c3da01d14520a07b2b8f9fb996540695c9dae4106
SHA512f459cee8b930683e3a260a3d530c4a60ead6d0c4e41ad13916524885ea309c7b6d5969395368848cdaa1175478bac7bd087a06b31e82087f55309eab7b683512
-
C:\Users\Admin\AppData\Local\Temp\C83C.dllFilesize
2.2MB
MD5a60046aea068074f1437000336f91c0b
SHA1fb885b1bf919d502d961370eac1b9e5b1eb67702
SHA256dfb5eddd7a01a659a2c223edf9554b5e23fb7c84600d671b89af65e8b67e4e6f
SHA512ec872875ba60bc43ea2a307c5fc83a61fabafa63af08bee3aa6b207310aad2c6b070d0cc390756fbedd06e724357ebb893dee75bb4d9e3c65d63bdf313bc9df2
-
C:\Users\Admin\AppData\Local\Temp\C83C.dllFilesize
2.2MB
MD5a60046aea068074f1437000336f91c0b
SHA1fb885b1bf919d502d961370eac1b9e5b1eb67702
SHA256dfb5eddd7a01a659a2c223edf9554b5e23fb7c84600d671b89af65e8b67e4e6f
SHA512ec872875ba60bc43ea2a307c5fc83a61fabafa63af08bee3aa6b207310aad2c6b070d0cc390756fbedd06e724357ebb893dee75bb4d9e3c65d63bdf313bc9df2
-
C:\Users\Admin\AppData\Local\Temp\C83C.dllFilesize
2.2MB
MD5a60046aea068074f1437000336f91c0b
SHA1fb885b1bf919d502d961370eac1b9e5b1eb67702
SHA256dfb5eddd7a01a659a2c223edf9554b5e23fb7c84600d671b89af65e8b67e4e6f
SHA512ec872875ba60bc43ea2a307c5fc83a61fabafa63af08bee3aa6b207310aad2c6b070d0cc390756fbedd06e724357ebb893dee75bb4d9e3c65d63bdf313bc9df2
-
C:\Users\Admin\AppData\Local\Temp\C9A4.exeFilesize
725KB
MD5a61e3e2554d6c683986b88eee7fe3837
SHA1c62ba9d4593324b0fbe3d7eebae42a97e8ad514c
SHA25651f912eb49cb9f586aca2b800b26cc7b4b08a1868af69e4d8efbaff8270f6d39
SHA5120b8f25fdbaee29d0bde4c8eca3204314c6945ec68af2c9a87e0ca9faf3a0eaabb9d35473c7d4df35b239908812ef557eb606714147256bb97ee588ae425760e2
-
C:\Users\Admin\AppData\Local\Temp\C9A4.exeFilesize
725KB
MD5a61e3e2554d6c683986b88eee7fe3837
SHA1c62ba9d4593324b0fbe3d7eebae42a97e8ad514c
SHA25651f912eb49cb9f586aca2b800b26cc7b4b08a1868af69e4d8efbaff8270f6d39
SHA5120b8f25fdbaee29d0bde4c8eca3204314c6945ec68af2c9a87e0ca9faf3a0eaabb9d35473c7d4df35b239908812ef557eb606714147256bb97ee588ae425760e2
-
C:\Users\Admin\AppData\Local\Temp\C9A4.exeFilesize
725KB
MD5a61e3e2554d6c683986b88eee7fe3837
SHA1c62ba9d4593324b0fbe3d7eebae42a97e8ad514c
SHA25651f912eb49cb9f586aca2b800b26cc7b4b08a1868af69e4d8efbaff8270f6d39
SHA5120b8f25fdbaee29d0bde4c8eca3204314c6945ec68af2c9a87e0ca9faf3a0eaabb9d35473c7d4df35b239908812ef557eb606714147256bb97ee588ae425760e2
-
C:\Users\Admin\AppData\Local\Temp\C9A4.exeFilesize
725KB
MD5a61e3e2554d6c683986b88eee7fe3837
SHA1c62ba9d4593324b0fbe3d7eebae42a97e8ad514c
SHA25651f912eb49cb9f586aca2b800b26cc7b4b08a1868af69e4d8efbaff8270f6d39
SHA5120b8f25fdbaee29d0bde4c8eca3204314c6945ec68af2c9a87e0ca9faf3a0eaabb9d35473c7d4df35b239908812ef557eb606714147256bb97ee588ae425760e2
-
C:\Users\Admin\AppData\Local\Temp\C9A4.exeFilesize
725KB
MD5a61e3e2554d6c683986b88eee7fe3837
SHA1c62ba9d4593324b0fbe3d7eebae42a97e8ad514c
SHA25651f912eb49cb9f586aca2b800b26cc7b4b08a1868af69e4d8efbaff8270f6d39
SHA5120b8f25fdbaee29d0bde4c8eca3204314c6945ec68af2c9a87e0ca9faf3a0eaabb9d35473c7d4df35b239908812ef557eb606714147256bb97ee588ae425760e2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
memory/8-311-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/8-319-0x0000000005800000-0x0000000005856000-memory.dmpFilesize
344KB
-
memory/8-318-0x00000000055D0000-0x00000000055DA000-memory.dmpFilesize
40KB
-
memory/8-315-0x0000000005530000-0x00000000055CC000-memory.dmpFilesize
624KB
-
memory/8-310-0x0000000000000000-mapping.dmp
-
memory/308-158-0x0000000000000000-mapping.dmp
-
memory/408-316-0x0000000000000000-mapping.dmp
-
memory/644-216-0x0000000000400000-0x000000000083C000-memory.dmpFilesize
4.2MB
-
memory/644-182-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/644-184-0x0000000000400000-0x000000000083C000-memory.dmpFilesize
4.2MB
-
memory/644-161-0x0000000000000000-mapping.dmp
-
memory/644-180-0x0000000000997000-0x00000000009AC000-memory.dmpFilesize
84KB
-
memory/668-140-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-152-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-139-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-155-0x0000000002590000-0x00000000025A0000-memory.dmpFilesize
64KB
-
memory/668-154-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-151-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-157-0x0000000002760000-0x0000000002770000-memory.dmpFilesize
64KB
-
memory/668-156-0x0000000002760000-0x0000000002770000-memory.dmpFilesize
64KB
-
memory/668-153-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-138-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-141-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-142-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-143-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-144-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-145-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-146-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-147-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-148-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-149-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/668-150-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/1092-255-0x0000000000000000-mapping.dmp
-
memory/1160-221-0x0000000000000000-mapping.dmp
-
memory/1160-236-0x0000000000C33000-0x0000000000CC5000-memory.dmpFilesize
584KB
-
memory/1324-219-0x0000000000000000-mapping.dmp
-
memory/1356-258-0x0000000000000000-mapping.dmp
-
memory/1432-137-0x0000000000400000-0x000000000083C000-memory.dmpFilesize
4.2MB
-
memory/1432-135-0x0000000000877000-0x000000000088C000-memory.dmpFilesize
84KB
-
memory/1432-133-0x0000000000840000-0x0000000000849000-memory.dmpFilesize
36KB
-
memory/1432-132-0x0000000000877000-0x000000000088C000-memory.dmpFilesize
84KB
-
memory/1432-136-0x0000000000840000-0x0000000000849000-memory.dmpFilesize
36KB
-
memory/1432-134-0x0000000000400000-0x000000000083C000-memory.dmpFilesize
4.2MB
-
memory/1564-283-0x0000000000000000-mapping.dmp
-
memory/1988-287-0x0000000000000000-mapping.dmp
-
memory/2316-193-0x0000000000000000-mapping.dmp
-
memory/2316-199-0x0000000000870000-0x00000000008E5000-memory.dmpFilesize
468KB
-
memory/2316-200-0x0000000000800000-0x000000000086B000-memory.dmpFilesize
428KB
-
memory/2316-214-0x0000000000800000-0x000000000086B000-memory.dmpFilesize
428KB
-
memory/2476-186-0x0000000000000000-mapping.dmp
-
memory/2636-183-0x0000000005080000-0x0000000005092000-memory.dmpFilesize
72KB
-
memory/2636-244-0x0000000008930000-0x0000000008E5C000-memory.dmpFilesize
5.2MB
-
memory/2636-181-0x0000000005190000-0x000000000529A000-memory.dmpFilesize
1.0MB
-
memory/2636-229-0x0000000006760000-0x0000000006D04000-memory.dmpFilesize
5.6MB
-
memory/2636-230-0x0000000005FE0000-0x0000000006072000-memory.dmpFilesize
584KB
-
memory/2636-166-0x0000000000860000-0x00000000008C0000-memory.dmpFilesize
384KB
-
memory/2636-243-0x0000000006480000-0x0000000006642000-memory.dmpFilesize
1.8MB
-
memory/2636-225-0x00000000053F0000-0x0000000005456000-memory.dmpFilesize
408KB
-
memory/2636-185-0x00000000050E0000-0x000000000511C000-memory.dmpFilesize
240KB
-
memory/2636-179-0x00000000056A0000-0x0000000005CB8000-memory.dmpFilesize
6.1MB
-
memory/2636-164-0x0000000000000000-mapping.dmp
-
memory/2708-201-0x0000000000A57000-0x0000000000A6C000-memory.dmpFilesize
84KB
-
memory/2708-204-0x0000000000400000-0x000000000083C000-memory.dmpFilesize
4.2MB
-
memory/2708-202-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/2708-173-0x0000000000000000-mapping.dmp
-
memory/3204-203-0x0000000000ED0000-0x0000000000EDC000-memory.dmpFilesize
48KB
-
memory/3204-198-0x0000000000000000-mapping.dmp
-
memory/3288-217-0x0000000000ED0000-0x0000000000FEB000-memory.dmpFilesize
1.1MB
-
memory/3288-189-0x0000000000000000-mapping.dmp
-
memory/3288-212-0x0000000000D01000-0x0000000000D93000-memory.dmpFilesize
584KB
-
memory/3416-194-0x0000000000400000-0x000000000083E000-memory.dmpFilesize
4.2MB
-
memory/3416-165-0x0000000000000000-mapping.dmp
-
memory/3416-192-0x0000000000A0D000-0x0000000000A23000-memory.dmpFilesize
88KB
-
memory/3452-281-0x0000000000000000-mapping.dmp
-
memory/3792-301-0x0000000000400000-0x0000000000C8F000-memory.dmpFilesize
8.6MB
-
memory/3792-302-0x0000000077B30000-0x0000000077CD3000-memory.dmpFilesize
1.6MB
-
memory/3792-296-0x0000000000400000-0x0000000000C8F000-memory.dmpFilesize
8.6MB
-
memory/3792-297-0x0000000000400000-0x0000000000C8F000-memory.dmpFilesize
8.6MB
-
memory/3792-298-0x0000000000400000-0x0000000000C8F000-memory.dmpFilesize
8.6MB
-
memory/3792-299-0x0000000000400000-0x0000000000C8F000-memory.dmpFilesize
8.6MB
-
memory/3792-300-0x0000000000400000-0x0000000000C8F000-memory.dmpFilesize
8.6MB
-
memory/3792-309-0x0000000000400000-0x0000000000C8F000-memory.dmpFilesize
8.6MB
-
memory/3792-308-0x0000000005A50000-0x0000000005AA0000-memory.dmpFilesize
320KB
-
memory/3792-307-0x00000000059D0000-0x0000000005A46000-memory.dmpFilesize
472KB
-
memory/3792-291-0x0000000000000000-mapping.dmp
-
memory/3924-317-0x0000000000000000-mapping.dmp
-
memory/3940-320-0x0000000000000000-mapping.dmp
-
memory/3940-321-0x0000000002AE0000-0x0000000002B16000-memory.dmpFilesize
216KB
-
memory/3940-322-0x0000000005870000-0x0000000005E98000-memory.dmpFilesize
6.2MB
-
memory/3940-323-0x0000000005650000-0x0000000005672000-memory.dmpFilesize
136KB
-
memory/4040-237-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4040-232-0x0000000000000000-mapping.dmp
-
memory/4040-235-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4040-242-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4040-284-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4128-293-0x0000000000799000-0x00000000007CA000-memory.dmpFilesize
196KB
-
memory/4128-288-0x0000000000000000-mapping.dmp
-
memory/4128-294-0x0000000000700000-0x000000000073E000-memory.dmpFilesize
248KB
-
memory/4128-295-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/4216-251-0x0000000000AC2000-0x0000000000AEE000-memory.dmpFilesize
176KB
-
memory/4216-254-0x0000000000A00000-0x0000000000A4B000-memory.dmpFilesize
300KB
-
memory/4216-245-0x0000000000000000-mapping.dmp
-
memory/4504-215-0x00000000032A0000-0x00000000033BD000-memory.dmpFilesize
1.1MB
-
memory/4504-231-0x00000000032A0000-0x00000000033BD000-memory.dmpFilesize
1.1MB
-
memory/4504-188-0x0000000000000000-mapping.dmp
-
memory/4504-222-0x00000000033C0000-0x000000000348A000-memory.dmpFilesize
808KB
-
memory/4504-213-0x0000000002FF0000-0x0000000003173000-memory.dmpFilesize
1.5MB
-
memory/4504-226-0x0000000003490000-0x0000000003546000-memory.dmpFilesize
728KB
-
memory/4504-197-0x0000000002A30000-0x0000000002C68000-memory.dmpFilesize
2.2MB
-
memory/4564-314-0x0000000000000000-mapping.dmp
-
memory/4584-205-0x0000000000400000-0x000000000083E000-memory.dmpFilesize
4.2MB
-
memory/4584-259-0x0000000000A0D000-0x0000000000A23000-memory.dmpFilesize
88KB
-
memory/4584-176-0x0000000000000000-mapping.dmp
-
memory/4584-210-0x0000000000A0D000-0x0000000000A23000-memory.dmpFilesize
88KB
-
memory/4684-209-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4684-223-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4684-218-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4684-211-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4684-207-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4684-206-0x0000000000000000-mapping.dmp
-
memory/4892-248-0x0000000000000000-mapping.dmp
-
memory/4892-260-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4892-282-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4892-249-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4892-252-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4892-253-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4892-261-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/5024-313-0x0000000000000000-mapping.dmp
-
memory/5052-306-0x0000000000B10000-0x0000000000B6E000-memory.dmpFilesize
376KB
-
memory/5052-303-0x0000000000000000-mapping.dmp