Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
14-12-2022 15:07
Static task
static1
Behavioral task
behavioral1
Sample
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe
Resource
win10v2004-20221111-en
General
-
Target
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe
-
Size
233KB
-
MD5
6cf78b93ea34e9eb07a574d238e9ed11
-
SHA1
6d8c7a63e98463c3beaa69ee5c5376fd7009a287
-
SHA256
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8
-
SHA512
1da9dd07da41442ee67396598ad502483088797cebe57bd6b7ab137c5097056df580d6e2a60b3a78b3cea5b0f021bf1eb643c10a083c5408db33b735ba018d51
-
SSDEEP
3072:vmBZdp/nU8MLODf4s8fB9z5U9HL8vLJOjqmN3fZlNBKYIsXhVQdl6py:vmVp/nyLC4s8fe5L8DwuyNY2+l6o
Malware Config
Extracted
djvu
http://abibiall.com/lancer/get.php
-
extension
.matu
-
offline_id
M6quF9d1g2LNWnBiQpTSgbW26JwEOrFwFfT1xGt1
-
payload_url
http://uaery.top/dl/build2.exe
http://abibiall.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-67n37yZLXk Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0616JOsie
Extracted
redline
mario23_10
167.235.252.160:10642
-
auth_value
eca57cfb5172f71dc45986763bb98942
Extracted
raccoon
ec7a54fb6492ff3a52d09504b8ecf082
http://88.119.161.188
http://88.119.161.19
Extracted
amadey
3.60
62.204.41.79/fb73jc3/index.php
Signatures
-
Detected Djvu ransomware 10 IoCs
Processes:
resource yara_rule behavioral2/memory/3112-169-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4508-168-0x00000000020C0000-0x00000000021DB000-memory.dmp family_djvu behavioral2/memory/3112-166-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3112-164-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3112-181-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3112-206-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/5076-213-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/5076-211-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/5076-221-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/5076-241-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Detects Smokeloader packer 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4328-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader behavioral2/memory/4460-183-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader behavioral2/memory/828-196-0x00000000004A0000-0x00000000004A9000-memory.dmp family_smokeloader -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4900-175-0x0000000000510000-0x0000000000570000-memory.dmp family_redline behavioral2/memory/824-182-0x0000000000F10000-0x0000000000F79000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 16 IoCs
Processes:
D2F5.exeD43E.exeD613.exeD951.exeDD2A.exeE123.exeE5F6.exeD613.exeD613.exeD613.exebuild2.exebuild3.exebuild2.exemstsca.exeA5C8.exegntuud.exepid process 2564 D2F5.exe 2624 D43E.exe 4508 D613.exe 4460 D951.exe 828 DD2A.exe 2212 E123.exe 824 E5F6.exe 3112 D613.exe 1096 D613.exe 5076 D613.exe 1992 build2.exe 4716 build3.exe 2532 build2.exe 4380 mstsca.exe 3912 A5C8.exe 2848 gntuud.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
gntuud.exeD613.exeD613.exebuild2.exeA5C8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation gntuud.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation D613.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation D613.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation build2.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation A5C8.exe -
Loads dropped DLL 2 IoCs
Processes:
build2.exepid process 2532 build2.exe 2532 build2.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
D613.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a4966ff1-f564-4ff6-ac26-f25c8e4a0c77\\D613.exe\" --AutoStart" D613.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 21 api.2ip.ua 22 api.2ip.ua 37 api.2ip.ua -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
D2F5.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 D2F5.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
D613.exeE5F6.exeD43E.exeD613.exebuild2.exedescription pid process target process PID 4508 set thread context of 3112 4508 D613.exe D613.exe PID 824 set thread context of 4900 824 E5F6.exe AppLaunch.exe PID 2624 set thread context of 1908 2624 D43E.exe InstallUtil.exe PID 1096 set thread context of 5076 1096 D613.exe D613.exe PID 1992 set thread context of 2532 1992 build2.exe build2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4496 824 WerFault.exe E5F6.exe 3396 828 WerFault.exe DD2A.exe 4136 2212 WerFault.exe E123.exe 3800 3912 WerFault.exe A5C8.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
D951.exe9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D951.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D951.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D951.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 3360 schtasks.exe 1160 schtasks.exe 2152 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4660 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exepid process 4328 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe 4328 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1952 -
Suspicious behavior: MapViewOfSection 18 IoCs
Processes:
9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exeD951.exepid process 4328 9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe 1952 1952 1952 1952 4460 D951.exe 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 1952 -
Suspicious use of AdjustPrivilegeToken 38 IoCs
Processes:
D43E.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 2624 D43E.exe Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeDebugPrivilege 4900 AppLaunch.exe Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 Token: SeShutdownPrivilege 1952 Token: SeCreatePagefilePrivilege 1952 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
D613.exeE5F6.exeD43E.exeD613.exeD613.exedescription pid process target process PID 1952 wrote to memory of 2564 1952 D2F5.exe PID 1952 wrote to memory of 2564 1952 D2F5.exe PID 1952 wrote to memory of 2564 1952 D2F5.exe PID 1952 wrote to memory of 2624 1952 D43E.exe PID 1952 wrote to memory of 2624 1952 D43E.exe PID 1952 wrote to memory of 4508 1952 D613.exe PID 1952 wrote to memory of 4508 1952 D613.exe PID 1952 wrote to memory of 4508 1952 D613.exe PID 1952 wrote to memory of 4460 1952 D951.exe PID 1952 wrote to memory of 4460 1952 D951.exe PID 1952 wrote to memory of 4460 1952 D951.exe PID 1952 wrote to memory of 828 1952 DD2A.exe PID 1952 wrote to memory of 828 1952 DD2A.exe PID 1952 wrote to memory of 828 1952 DD2A.exe PID 1952 wrote to memory of 2212 1952 E123.exe PID 1952 wrote to memory of 2212 1952 E123.exe PID 1952 wrote to memory of 2212 1952 E123.exe PID 1952 wrote to memory of 824 1952 E5F6.exe PID 1952 wrote to memory of 824 1952 E5F6.exe PID 1952 wrote to memory of 824 1952 E5F6.exe PID 1952 wrote to memory of 3160 1952 explorer.exe PID 1952 wrote to memory of 3160 1952 explorer.exe PID 1952 wrote to memory of 3160 1952 explorer.exe PID 1952 wrote to memory of 3160 1952 explorer.exe PID 4508 wrote to memory of 3112 4508 D613.exe D613.exe PID 4508 wrote to memory of 3112 4508 D613.exe D613.exe PID 4508 wrote to memory of 3112 4508 D613.exe D613.exe PID 4508 wrote to memory of 3112 4508 D613.exe D613.exe PID 4508 wrote to memory of 3112 4508 D613.exe D613.exe PID 4508 wrote to memory of 3112 4508 D613.exe D613.exe PID 4508 wrote to memory of 3112 4508 D613.exe D613.exe PID 4508 wrote to memory of 3112 4508 D613.exe D613.exe PID 4508 wrote to memory of 3112 4508 D613.exe D613.exe PID 4508 wrote to memory of 3112 4508 D613.exe D613.exe PID 1952 wrote to memory of 860 1952 explorer.exe PID 1952 wrote to memory of 860 1952 explorer.exe PID 1952 wrote to memory of 860 1952 explorer.exe PID 824 wrote to memory of 4900 824 E5F6.exe AppLaunch.exe PID 824 wrote to memory of 4900 824 E5F6.exe AppLaunch.exe PID 824 wrote to memory of 4900 824 E5F6.exe AppLaunch.exe PID 824 wrote to memory of 4900 824 E5F6.exe AppLaunch.exe PID 824 wrote to memory of 4900 824 E5F6.exe AppLaunch.exe PID 2624 wrote to memory of 1908 2624 D43E.exe InstallUtil.exe PID 2624 wrote to memory of 1908 2624 D43E.exe InstallUtil.exe PID 2624 wrote to memory of 1908 2624 D43E.exe InstallUtil.exe PID 2624 wrote to memory of 1908 2624 D43E.exe InstallUtil.exe PID 2624 wrote to memory of 1908 2624 D43E.exe InstallUtil.exe PID 2624 wrote to memory of 1908 2624 D43E.exe InstallUtil.exe PID 2624 wrote to memory of 1908 2624 D43E.exe InstallUtil.exe PID 2624 wrote to memory of 1908 2624 D43E.exe InstallUtil.exe PID 2624 wrote to memory of 1908 2624 D43E.exe InstallUtil.exe PID 2624 wrote to memory of 1908 2624 D43E.exe InstallUtil.exe PID 3112 wrote to memory of 1320 3112 D613.exe icacls.exe PID 3112 wrote to memory of 1320 3112 D613.exe icacls.exe PID 3112 wrote to memory of 1320 3112 D613.exe icacls.exe PID 3112 wrote to memory of 1096 3112 D613.exe D613.exe PID 3112 wrote to memory of 1096 3112 D613.exe D613.exe PID 3112 wrote to memory of 1096 3112 D613.exe D613.exe PID 1096 wrote to memory of 5076 1096 D613.exe D613.exe PID 1096 wrote to memory of 5076 1096 D613.exe D613.exe PID 1096 wrote to memory of 5076 1096 D613.exe D613.exe PID 1096 wrote to memory of 5076 1096 D613.exe D613.exe PID 1096 wrote to memory of 5076 1096 D613.exe D613.exe PID 1096 wrote to memory of 5076 1096 D613.exe D613.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe"C:\Users\Admin\AppData\Local\Temp\9f3012b4ff0d9488fd23233d6beeaf128fd0e83bfa5038bb71e2f1365853aeb8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D2F5.exeC:\Users\Admin\AppData\Local\Temp\D2F5.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\D43E.exeC:\Users\Admin\AppData\Local\Temp\D43E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\D613.exeC:\Users\Admin\AppData\Local\Temp\D613.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\D613.exeC:\Users\Admin\AppData\Local\Temp\D613.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\a4966ff1-f564-4ff6-ac26-f25c8e4a0c77" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\D613.exe"C:\Users\Admin\AppData\Local\Temp\D613.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\D613.exe"C:\Users\Admin\AppData\Local\Temp\D613.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build2.exe"C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build2.exe"C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build2.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build2.exe" & exit7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build3.exe"C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build3.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\D951.exeC:\Users\Admin\AppData\Local\Temp\D951.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\DD2A.exeC:\Users\Admin\AppData\Local\Temp\DD2A.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 3402⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\E123.exeC:\Users\Admin\AppData\Local\Temp\E123.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 3402⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\E5F6.exeC:\Users\Admin\AppData\Local\Temp\E5F6.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 1402⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 824 -ip 8241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 828 -ip 8281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2212 -ip 22121⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\A5C8.exeC:\Users\Admin\AppData\Local\Temp\A5C8.exe1⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "gntuud.exe" /P "Admin:N"&&CACLS "gntuud.exe" /P "Admin:R" /E&&echo Y|CACLS "..\2c33368f7d" /P "Admin:N"&&CACLS "..\2c33368f7d" /P "Admin:R" /E&&Exit3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "gntuud.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "gntuud.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\2c33368f7d" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\2c33368f7d" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 11362⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3912 -ip 39121⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
C:\ProgramData\nss3.dllFilesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD5a3ba06b0a900ef1f790d2d1faa188e08
SHA151f7daf4a2bd9c1a9d52bbb62989c7208b71cd98
SHA25630d532e2ce3f53e0865186393000a9a8af1318ab251ebabb168b0bc84bebe4b9
SHA5129ad7d398badf9c48caa8473f4e120a82eba1c37f4885fe19ec34d173821456653a14185bb628338555155035fd77c782525b32385036317140eadaf4918b8e5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD559e98119dbb289e1c12576b7f5f58831
SHA1d8e74af395a1976a9232d626215333931a3f23ce
SHA256fa68e1f0d87d4ed9a1891e1760cc6c9c6c015547a982e8fb07e58f4d14e38c8f
SHA512672d7926f26f36a8d2c3c3871d8c37249b2d376b2cad82ad01280d9680d0d18bdf65626db48120b7bca1a59ccc49c36b84a7e454235634376e14de03ce11b39c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD5b5c46dcb7679b13d924adb02013d0f32
SHA13f9383ca600d272e4c81b8b9671ccef8b4e3edb8
SHA256662282739bbac170c00bb7e94765f3332776e19f2df3743dd188ce6647e747d8
SHA512224a0003177d8e74e833a931d9884fd49bcbdd2f01a32307d1a73127815683c08b87c0cd110ef21798f6204031e51211dc460b31cdc41c02f31d422c8a705bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD5fd563d072db831585ee35dad33fdba75
SHA1090f96aecdceba414e81af6c4245c366e1105e1c
SHA256ba1b289f90ed05305b85558bb703dc1f1bd38828b276fe438be80e83eb5fd72b
SHA51266dd07b2e2b91a61647345b75cec4acbf982887a47124425e0b52d82e7257fa706d49d18f47ad69a78ef78d0d7dcaf98b0cc02bac141c223844a6f5cbce6e0b6
-
C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build2.exeFilesize
370KB
MD56a7892ece7e8bf85628e0e769560b7cb
SHA1e13140e719218b14dd168467a63d481c7259df8c
SHA256363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844
SHA5120091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f
-
C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build2.exeFilesize
370KB
MD56a7892ece7e8bf85628e0e769560b7cb
SHA1e13140e719218b14dd168467a63d481c7259df8c
SHA256363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844
SHA5120091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f
-
C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build2.exeFilesize
370KB
MD56a7892ece7e8bf85628e0e769560b7cb
SHA1e13140e719218b14dd168467a63d481c7259df8c
SHA256363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844
SHA5120091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f
-
C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\3c76be8a-75f9-48b9-b445-82a3d8c452bb\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exeFilesize
293KB
MD5e4a77ff9693cb1e46d00903ae2875821
SHA1a5a44a288493968954f89c4ad0a09f67823bfc8e
SHA2561be995f2c3ddc8138b3e218d2be1b9051d7a6bdfa32343f6460a7e04dcab761b
SHA51259db9fdce917683477f39e23a1abc1cf00c635da82f130ec092842e49a15db8f038f76fafd34a8f64fef18eef0e3b9a17c938e7f3de919178885510c05f14809
-
C:\Users\Admin\AppData\Local\Temp\2c33368f7d\gntuud.exeFilesize
293KB
MD5e4a77ff9693cb1e46d00903ae2875821
SHA1a5a44a288493968954f89c4ad0a09f67823bfc8e
SHA2561be995f2c3ddc8138b3e218d2be1b9051d7a6bdfa32343f6460a7e04dcab761b
SHA51259db9fdce917683477f39e23a1abc1cf00c635da82f130ec092842e49a15db8f038f76fafd34a8f64fef18eef0e3b9a17c938e7f3de919178885510c05f14809
-
C:\Users\Admin\AppData\Local\Temp\A5C8.exeFilesize
293KB
MD5e4a77ff9693cb1e46d00903ae2875821
SHA1a5a44a288493968954f89c4ad0a09f67823bfc8e
SHA2561be995f2c3ddc8138b3e218d2be1b9051d7a6bdfa32343f6460a7e04dcab761b
SHA51259db9fdce917683477f39e23a1abc1cf00c635da82f130ec092842e49a15db8f038f76fafd34a8f64fef18eef0e3b9a17c938e7f3de919178885510c05f14809
-
C:\Users\Admin\AppData\Local\Temp\A5C8.exeFilesize
293KB
MD5e4a77ff9693cb1e46d00903ae2875821
SHA1a5a44a288493968954f89c4ad0a09f67823bfc8e
SHA2561be995f2c3ddc8138b3e218d2be1b9051d7a6bdfa32343f6460a7e04dcab761b
SHA51259db9fdce917683477f39e23a1abc1cf00c635da82f130ec092842e49a15db8f038f76fafd34a8f64fef18eef0e3b9a17c938e7f3de919178885510c05f14809
-
C:\Users\Admin\AppData\Local\Temp\D2F5.exeFilesize
617KB
MD57e71c7ca1a538848ae6b99da9c28820f
SHA1ee2d89ec09fb5801aa551c0426a3c88922917bd5
SHA256f41ec993ac93ae257e20ba8953a6b87104fc2fdfb7c0a532c4d43b4e17ccfe34
SHA512b472b0b2a7f89fbaa2f2cc8d008313a2e7aef20fa7f2741537963f59a9829a4d33862beedd658686e37d034bab89d0bbb41e2e5ec36f5d6f05c1b139fdfecc78
-
C:\Users\Admin\AppData\Local\Temp\D2F5.exeFilesize
617KB
MD57e71c7ca1a538848ae6b99da9c28820f
SHA1ee2d89ec09fb5801aa551c0426a3c88922917bd5
SHA256f41ec993ac93ae257e20ba8953a6b87104fc2fdfb7c0a532c4d43b4e17ccfe34
SHA512b472b0b2a7f89fbaa2f2cc8d008313a2e7aef20fa7f2741537963f59a9829a4d33862beedd658686e37d034bab89d0bbb41e2e5ec36f5d6f05c1b139fdfecc78
-
C:\Users\Admin\AppData\Local\Temp\D43E.exeFilesize
588KB
MD59bb6fc051ce66030059a1c1123b13cca
SHA18731879c637aacaf09c38fc3893d44b626907971
SHA2562e5c01e5bb7c4b180a9dee8f8c13aec1c6eccbe0f8b02ca03251bdb196cd169f
SHA512bb88ba24b415b5da29625f4d48fb4a6f0de6c9226ea79b325ec07a5da745c62dc95803f16e3cdd74b2c2c714c1f93a0b81538ed4147b0bdc40b6d3a3524a7e24
-
C:\Users\Admin\AppData\Local\Temp\D43E.exeFilesize
588KB
MD59bb6fc051ce66030059a1c1123b13cca
SHA18731879c637aacaf09c38fc3893d44b626907971
SHA2562e5c01e5bb7c4b180a9dee8f8c13aec1c6eccbe0f8b02ca03251bdb196cd169f
SHA512bb88ba24b415b5da29625f4d48fb4a6f0de6c9226ea79b325ec07a5da745c62dc95803f16e3cdd74b2c2c714c1f93a0b81538ed4147b0bdc40b6d3a3524a7e24
-
C:\Users\Admin\AppData\Local\Temp\D613.exeFilesize
753KB
MD512ece92300a223ba77c71cba58651c53
SHA13127645259940e2a2dd036761787953742950da1
SHA256f5a52005261d6aea68566f7f6feef1f8296d9c9e341ebaa58f6e6dda939323f4
SHA512d3a2865d08a5527830b98271d989395863c68d5815db83f04e1d0a1b2b0997e8f2648be5cf316fadd3564d979e29d3e8d2eed93f152693c344bdb8a08791664d
-
C:\Users\Admin\AppData\Local\Temp\D613.exeFilesize
753KB
MD512ece92300a223ba77c71cba58651c53
SHA13127645259940e2a2dd036761787953742950da1
SHA256f5a52005261d6aea68566f7f6feef1f8296d9c9e341ebaa58f6e6dda939323f4
SHA512d3a2865d08a5527830b98271d989395863c68d5815db83f04e1d0a1b2b0997e8f2648be5cf316fadd3564d979e29d3e8d2eed93f152693c344bdb8a08791664d
-
C:\Users\Admin\AppData\Local\Temp\D613.exeFilesize
753KB
MD512ece92300a223ba77c71cba58651c53
SHA13127645259940e2a2dd036761787953742950da1
SHA256f5a52005261d6aea68566f7f6feef1f8296d9c9e341ebaa58f6e6dda939323f4
SHA512d3a2865d08a5527830b98271d989395863c68d5815db83f04e1d0a1b2b0997e8f2648be5cf316fadd3564d979e29d3e8d2eed93f152693c344bdb8a08791664d
-
C:\Users\Admin\AppData\Local\Temp\D613.exeFilesize
753KB
MD512ece92300a223ba77c71cba58651c53
SHA13127645259940e2a2dd036761787953742950da1
SHA256f5a52005261d6aea68566f7f6feef1f8296d9c9e341ebaa58f6e6dda939323f4
SHA512d3a2865d08a5527830b98271d989395863c68d5815db83f04e1d0a1b2b0997e8f2648be5cf316fadd3564d979e29d3e8d2eed93f152693c344bdb8a08791664d
-
C:\Users\Admin\AppData\Local\Temp\D613.exeFilesize
753KB
MD512ece92300a223ba77c71cba58651c53
SHA13127645259940e2a2dd036761787953742950da1
SHA256f5a52005261d6aea68566f7f6feef1f8296d9c9e341ebaa58f6e6dda939323f4
SHA512d3a2865d08a5527830b98271d989395863c68d5815db83f04e1d0a1b2b0997e8f2648be5cf316fadd3564d979e29d3e8d2eed93f152693c344bdb8a08791664d
-
C:\Users\Admin\AppData\Local\Temp\D951.exeFilesize
235KB
MD59e57ead37b1e5d5acee9a421d8bbb282
SHA149643cd9199636c399098bda68f371c10577e222
SHA256def3f0fbfeb392153ca45153e8bf92c1bd312c28efa67983dff929f66b4bb751
SHA512a64c2ea214c22f2de63bc03922c6f91941435876565484e5a26ae5c3afe2677455258b4bd75484f425d4019f58f30d199a6e174a60b6464c3f61cb60da6082d4
-
C:\Users\Admin\AppData\Local\Temp\D951.exeFilesize
235KB
MD59e57ead37b1e5d5acee9a421d8bbb282
SHA149643cd9199636c399098bda68f371c10577e222
SHA256def3f0fbfeb392153ca45153e8bf92c1bd312c28efa67983dff929f66b4bb751
SHA512a64c2ea214c22f2de63bc03922c6f91941435876565484e5a26ae5c3afe2677455258b4bd75484f425d4019f58f30d199a6e174a60b6464c3f61cb60da6082d4
-
C:\Users\Admin\AppData\Local\Temp\DD2A.exeFilesize
235KB
MD5486f367aff89c81e26c4f5c99adafcb8
SHA1df100614dc72d1121e97dc918d8cb1539887f2cd
SHA25604b0601a18d27105b71c35d5623d9f93b1860b07cc262fcdebe54ec99f9a05ce
SHA51242039d218184b951f97eee5444a31f0d38a2f788472fc81a6f2beb80a0fd12ff9aedb12afb3206d6e52236a88abc8da5d0e2c2b630ebb0e300a5b654b3d33b4a
-
C:\Users\Admin\AppData\Local\Temp\DD2A.exeFilesize
235KB
MD5486f367aff89c81e26c4f5c99adafcb8
SHA1df100614dc72d1121e97dc918d8cb1539887f2cd
SHA25604b0601a18d27105b71c35d5623d9f93b1860b07cc262fcdebe54ec99f9a05ce
SHA51242039d218184b951f97eee5444a31f0d38a2f788472fc81a6f2beb80a0fd12ff9aedb12afb3206d6e52236a88abc8da5d0e2c2b630ebb0e300a5b654b3d33b4a
-
C:\Users\Admin\AppData\Local\Temp\E123.exeFilesize
233KB
MD52b39d686d7ef3fa0b226541fe8343017
SHA16f07f48c6b6d2f33d3799e7e4b37b56e5335713b
SHA256f8105341ddd20cafd107efd0af40f4eee3ba48353ae70b640c9b1e88f9930848
SHA512f28bbee30fd40bf8b4555bbce51c246d766711e76fbc77e8c335a19005294a948d8772af173f0edf53ba5568c17e889391a4eea10e75474b9b17322eafa08334
-
C:\Users\Admin\AppData\Local\Temp\E123.exeFilesize
233KB
MD52b39d686d7ef3fa0b226541fe8343017
SHA16f07f48c6b6d2f33d3799e7e4b37b56e5335713b
SHA256f8105341ddd20cafd107efd0af40f4eee3ba48353ae70b640c9b1e88f9930848
SHA512f28bbee30fd40bf8b4555bbce51c246d766711e76fbc77e8c335a19005294a948d8772af173f0edf53ba5568c17e889391a4eea10e75474b9b17322eafa08334
-
C:\Users\Admin\AppData\Local\Temp\E5F6.exeFilesize
408KB
MD598552eb4257cb3f0cc646bc48cca07f3
SHA12a86d8f2bcc25f11f5d3e79bf90afbbca6aeb782
SHA256e475a91abd7ac9518100aa7e934399f81bff275d70a84295aa43f0134d6aa6bf
SHA512277a384a70d51e88762254fa6fa213705279cdb6799f666646fec35200b946303b0503523bfd7bf7dd362b6a370a6ec67a748ffbcbb7e15c3a080d6ce1fd2da8
-
C:\Users\Admin\AppData\Local\Temp\E5F6.exeFilesize
408KB
MD598552eb4257cb3f0cc646bc48cca07f3
SHA12a86d8f2bcc25f11f5d3e79bf90afbbca6aeb782
SHA256e475a91abd7ac9518100aa7e934399f81bff275d70a84295aa43f0134d6aa6bf
SHA512277a384a70d51e88762254fa6fa213705279cdb6799f666646fec35200b946303b0503523bfd7bf7dd362b6a370a6ec67a748ffbcbb7e15c3a080d6ce1fd2da8
-
C:\Users\Admin\AppData\Local\a4966ff1-f564-4ff6-ac26-f25c8e4a0c77\D613.exeFilesize
753KB
MD512ece92300a223ba77c71cba58651c53
SHA13127645259940e2a2dd036761787953742950da1
SHA256f5a52005261d6aea68566f7f6feef1f8296d9c9e341ebaa58f6e6dda939323f4
SHA512d3a2865d08a5527830b98271d989395863c68d5815db83f04e1d0a1b2b0997e8f2648be5cf316fadd3564d979e29d3e8d2eed93f152693c344bdb8a08791664d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
memory/824-182-0x0000000000F10000-0x0000000000F79000-memory.dmpFilesize
420KB
-
memory/824-160-0x0000000000000000-mapping.dmp
-
memory/828-150-0x0000000000000000-mapping.dmp
-
memory/828-198-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/828-193-0x0000000000573000-0x0000000000584000-memory.dmpFilesize
68KB
-
memory/828-196-0x00000000004A0000-0x00000000004A9000-memory.dmpFilesize
36KB
-
memory/860-172-0x0000000000000000-mapping.dmp
-
memory/860-178-0x0000000000760000-0x000000000076C000-memory.dmpFilesize
48KB
-
memory/1052-297-0x0000000000000000-mapping.dmp
-
memory/1096-204-0x0000000000000000-mapping.dmp
-
memory/1096-212-0x0000000000784000-0x0000000000816000-memory.dmpFilesize
584KB
-
memory/1160-269-0x0000000000000000-mapping.dmp
-
memory/1320-199-0x0000000000000000-mapping.dmp
-
memory/1908-190-0x000000000040779C-mapping.dmp
-
memory/1908-189-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1908-195-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1908-202-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1992-236-0x0000000000772000-0x00000000007A3000-memory.dmpFilesize
196KB
-
memory/1992-238-0x0000000002100000-0x0000000002157000-memory.dmpFilesize
348KB
-
memory/1992-226-0x0000000000000000-mapping.dmp
-
memory/2116-302-0x0000000001200000-0x0000000001222000-memory.dmpFilesize
136KB
-
memory/2116-293-0x0000000000000000-mapping.dmp
-
memory/2116-303-0x0000000000FB0000-0x0000000000FD7000-memory.dmpFilesize
156KB
-
memory/2152-291-0x0000000000000000-mapping.dmp
-
memory/2212-200-0x00000000007D3000-0x00000000007E3000-memory.dmpFilesize
64KB
-
memory/2212-156-0x0000000000000000-mapping.dmp
-
memory/2212-201-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2212-295-0x0000000000000000-mapping.dmp
-
memory/2532-242-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/2532-234-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2532-240-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2532-233-0x0000000000000000-mapping.dmp
-
memory/2532-239-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2532-263-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2532-237-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2532-265-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2564-153-0x000000000074B000-0x00000000007AC000-memory.dmpFilesize
388KB
-
memory/2564-154-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2564-157-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2564-136-0x0000000000000000-mapping.dmp
-
memory/2564-220-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2564-219-0x000000000074B000-0x00000000007AC000-memory.dmpFilesize
388KB
-
memory/2564-155-0x0000000000640000-0x00000000006AB000-memory.dmpFilesize
428KB
-
memory/2620-299-0x0000000000000000-mapping.dmp
-
memory/2624-139-0x0000000000000000-mapping.dmp
-
memory/2624-142-0x0000022EB7AD0000-0x0000022EB7B66000-memory.dmpFilesize
600KB
-
memory/2624-146-0x00007FFF1CE80000-0x00007FFF1D941000-memory.dmpFilesize
10.8MB
-
memory/2624-197-0x00007FFF1CE80000-0x00007FFF1D941000-memory.dmpFilesize
10.8MB
-
memory/2848-300-0x0000000000583000-0x00000000005A2000-memory.dmpFilesize
124KB
-
memory/2848-279-0x0000000000000000-mapping.dmp
-
memory/2848-301-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3112-163-0x0000000000000000-mapping.dmp
-
memory/3112-206-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3112-169-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3112-166-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3112-164-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3112-181-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3160-170-0x0000000000DD0000-0x0000000000E45000-memory.dmpFilesize
468KB
-
memory/3160-194-0x00000000008F0000-0x000000000095B000-memory.dmpFilesize
428KB
-
memory/3160-162-0x0000000000000000-mapping.dmp
-
memory/3160-173-0x00000000008F0000-0x000000000095B000-memory.dmpFilesize
428KB
-
memory/3276-296-0x0000000000000000-mapping.dmp
-
memory/3360-232-0x0000000000000000-mapping.dmp
-
memory/3460-278-0x0000000000550000-0x000000000055F000-memory.dmpFilesize
60KB
-
memory/3460-277-0x0000000000560000-0x0000000000569000-memory.dmpFilesize
36KB
-
memory/3460-276-0x0000000000000000-mapping.dmp
-
memory/3664-275-0x00000000010C0000-0x00000000010CB000-memory.dmpFilesize
44KB
-
memory/3664-274-0x00000000010D0000-0x00000000010D7000-memory.dmpFilesize
28KB
-
memory/3664-273-0x0000000000000000-mapping.dmp
-
memory/3876-264-0x0000000000000000-mapping.dmp
-
memory/3912-283-0x0000000000583000-0x00000000005A2000-memory.dmpFilesize
124KB
-
memory/3912-285-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3912-270-0x0000000000000000-mapping.dmp
-
memory/3912-284-0x0000000000520000-0x000000000055E000-memory.dmpFilesize
248KB
-
memory/4020-290-0x00000000009C0000-0x00000000009CC000-memory.dmpFilesize
48KB
-
memory/4020-289-0x00000000009D0000-0x00000000009D6000-memory.dmpFilesize
24KB
-
memory/4020-288-0x0000000000000000-mapping.dmp
-
memory/4328-132-0x00000000006D2000-0x00000000006E2000-memory.dmpFilesize
64KB
-
memory/4328-133-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/4328-134-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/4328-135-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/4460-184-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4460-191-0x0000000000703000-0x0000000000714000-memory.dmpFilesize
68KB
-
memory/4460-147-0x0000000000000000-mapping.dmp
-
memory/4460-207-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4460-183-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/4480-304-0x0000000000000000-mapping.dmp
-
memory/4508-143-0x0000000000000000-mapping.dmp
-
memory/4508-168-0x00000000020C0000-0x00000000021DB000-memory.dmpFilesize
1.1MB
-
memory/4508-167-0x0000000000782000-0x0000000000814000-memory.dmpFilesize
584KB
-
memory/4596-286-0x0000000000920000-0x0000000000925000-memory.dmpFilesize
20KB
-
memory/4596-287-0x0000000000910000-0x0000000000919000-memory.dmpFilesize
36KB
-
memory/4596-282-0x0000000000000000-mapping.dmp
-
memory/4660-266-0x0000000000000000-mapping.dmp
-
memory/4716-229-0x0000000000000000-mapping.dmp
-
memory/4900-223-0x0000000006250000-0x00000000067F4000-memory.dmpFilesize
5.6MB
-
memory/4900-174-0x0000000000000000-mapping.dmp
-
memory/4900-186-0x0000000004C80000-0x0000000004D8A000-memory.dmpFilesize
1.0MB
-
memory/4900-185-0x0000000005190000-0x00000000057A8000-memory.dmpFilesize
6.1MB
-
memory/4900-188-0x0000000004BD0000-0x0000000004C0C000-memory.dmpFilesize
240KB
-
memory/4900-222-0x0000000005A50000-0x0000000005AE2000-memory.dmpFilesize
584KB
-
memory/4900-224-0x0000000005F80000-0x0000000006142000-memory.dmpFilesize
1.8MB
-
memory/4900-218-0x0000000004EC0000-0x0000000004F26000-memory.dmpFilesize
408KB
-
memory/4900-187-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4900-175-0x0000000000510000-0x0000000000570000-memory.dmpFilesize
384KB
-
memory/4900-225-0x0000000008420000-0x000000000894C000-memory.dmpFilesize
5.2MB
-
memory/4924-298-0x0000000000000000-mapping.dmp
-
memory/5000-292-0x0000000000000000-mapping.dmp
-
memory/5032-294-0x0000000000000000-mapping.dmp
-
memory/5076-213-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5076-221-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5076-208-0x0000000000000000-mapping.dmp
-
memory/5076-211-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5076-241-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB