Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2022 12:46
Static task
static1
Behavioral task
behavioral1
Sample
e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exe
Resource
win10v2004-20221111-en
General
-
Target
e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exe
-
Size
215KB
-
MD5
1542de23f9c468e2daec29e738266e44
-
SHA1
2a2d5d626872cc455986b0d692f10b0a2e760d54
-
SHA256
e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16
-
SHA512
29f642d8fd09c0234d872372e100dd7c56a6e100777079b570178a45ea959fd1df2da47a830a392294a545e6ca241ac4985161f408826ff7d7ff4ca7633575b3
-
SSDEEP
3072:2dFrCopLqYIRQdqvqmtyI00Bro5yUG7V/E8/g3xoZdjjG3ERWR3L9:AFrPpLqb8IuWR/Rg3CZdjCU0VB
Malware Config
Extracted
redline
mario23_10
167.235.252.160:10642
-
auth_value
eca57cfb5172f71dc45986763bb98942
Extracted
djvu
http://abibiall.com/lancer/get.php
-
extension
.bttu
-
offline_id
8p2Go5ZmkbFk0DF2oJ6E8vGEogpBqqaGCWjto1t1
-
payload_url
http://uaery.top/dl/build2.exe
http://abibiall.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-Q5EougBEbU Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0619JOsie
Extracted
danabot
49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535
-
type
loader
Signatures
-
Detected Djvu ransomware 10 IoCs
Processes:
resource yara_rule behavioral1/memory/4764-175-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4764-179-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4764-177-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3688-180-0x00000000021A0000-0x00000000022BB000-memory.dmp family_djvu behavioral1/memory/4764-183-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4764-191-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1868-198-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1868-200-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1868-206-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1868-221-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Detects Smokeloader packer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4600-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader behavioral1/memory/1964-171-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2092-143-0x0000000000400000-0x0000000000460000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 15 IoCs
Processes:
D3A0.exeD45D.exeD950.exeDC2F.exeDE43.exeDE43.exeDE43.exeDE43.exebuild2.exebuild3.exebuild2.exe5ECE.exemstsca.exeOrwtaofpwtre.exe7D64.exepid process 4360 D3A0.exe 4296 D45D.exe 1964 D950.exe 4664 DC2F.exe 3688 DE43.exe 4764 DE43.exe 744 DE43.exe 1868 DE43.exe 4060 build2.exe 3400 build3.exe 916 build2.exe 4672 5ECE.exe 552 mstsca.exe 3108 Orwtaofpwtre.exe 4284 7D64.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DE43.exeDE43.exebuild2.exe5ECE.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation DE43.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation DE43.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation build2.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 5ECE.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
DE43.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\7bfa9ae1-8b31-443f-8bd4-8c2493c72ea9\\DE43.exe\" --AutoStart" DE43.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 api.2ip.ua 26 api.2ip.ua 38 api.2ip.ua -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
D3A0.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 D3A0.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
chrome.exepid process 772 4748 chrome.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
D45D.exeDE43.exeDE43.exebuild2.exe5ECE.exedescription pid process target process PID 4296 set thread context of 2092 4296 D45D.exe AppLaunch.exe PID 3688 set thread context of 4764 3688 DE43.exe DE43.exe PID 744 set thread context of 1868 744 DE43.exe DE43.exe PID 4060 set thread context of 916 4060 build2.exe build2.exe PID 4672 set thread context of 3612 4672 5ECE.exe rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2468 4296 WerFault.exe D45D.exe 4004 4664 WerFault.exe DC2F.exe 4324 3612 WerFault.exe rundll32.exe 1324 4284 WerFault.exe 7D64.exe 1020 4748 WerFault.exe chrome.exe 5028 4672 WerFault.exe 5ECE.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
D950.exee4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D950.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D950.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D950.exe -
Checks processor information in registry 2 TTPs 55 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exe5ECE.exebuild2.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5ECE.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 5ECE.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5ECE.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 5ECE.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision 5ECE.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 5ECE.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision 5ECE.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 5ECE.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet 5ECE.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4844 schtasks.exe 2260 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1760 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exepid process 4600 e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exe 4600 e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exe 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
7D64.exepid process 772 4284 7D64.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exeD950.exepid process 4600 e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exe 772 772 772 772 1964 D950.exe -
Suspicious use of AdjustPrivilegeToken 55 IoCs
Processes:
AppLaunch.exeOrwtaofpwtre.exedescription pid process Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeDebugPrivilege 2092 AppLaunch.exe Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeDebugPrivilege 3108 Orwtaofpwtre.exe Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeDebugPrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Orwtaofpwtre.exechrome.exepid process 3108 Orwtaofpwtre.exe 4748 chrome.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Orwtaofpwtre.exepid process 3108 Orwtaofpwtre.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
chrome.exepid process 4748 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
D45D.exeDE43.exeDE43.exeDE43.exeDE43.exebuild3.exebuild2.exedescription pid process target process PID 772 wrote to memory of 4360 772 D3A0.exe PID 772 wrote to memory of 4360 772 D3A0.exe PID 772 wrote to memory of 4360 772 D3A0.exe PID 772 wrote to memory of 4296 772 D45D.exe PID 772 wrote to memory of 4296 772 D45D.exe PID 772 wrote to memory of 4296 772 D45D.exe PID 4296 wrote to memory of 2092 4296 D45D.exe AppLaunch.exe PID 4296 wrote to memory of 2092 4296 D45D.exe AppLaunch.exe PID 4296 wrote to memory of 2092 4296 D45D.exe AppLaunch.exe PID 4296 wrote to memory of 2092 4296 D45D.exe AppLaunch.exe PID 4296 wrote to memory of 2092 4296 D45D.exe AppLaunch.exe PID 772 wrote to memory of 1964 772 D950.exe PID 772 wrote to memory of 1964 772 D950.exe PID 772 wrote to memory of 1964 772 D950.exe PID 772 wrote to memory of 4664 772 DC2F.exe PID 772 wrote to memory of 4664 772 DC2F.exe PID 772 wrote to memory of 4664 772 DC2F.exe PID 772 wrote to memory of 3688 772 DE43.exe PID 772 wrote to memory of 3688 772 DE43.exe PID 772 wrote to memory of 3688 772 DE43.exe PID 772 wrote to memory of 4592 772 explorer.exe PID 772 wrote to memory of 4592 772 explorer.exe PID 772 wrote to memory of 4592 772 explorer.exe PID 772 wrote to memory of 4592 772 explorer.exe PID 772 wrote to memory of 4556 772 explorer.exe PID 772 wrote to memory of 4556 772 explorer.exe PID 772 wrote to memory of 4556 772 explorer.exe PID 3688 wrote to memory of 4764 3688 DE43.exe DE43.exe PID 3688 wrote to memory of 4764 3688 DE43.exe DE43.exe PID 3688 wrote to memory of 4764 3688 DE43.exe DE43.exe PID 3688 wrote to memory of 4764 3688 DE43.exe DE43.exe PID 3688 wrote to memory of 4764 3688 DE43.exe DE43.exe PID 3688 wrote to memory of 4764 3688 DE43.exe DE43.exe PID 3688 wrote to memory of 4764 3688 DE43.exe DE43.exe PID 3688 wrote to memory of 4764 3688 DE43.exe DE43.exe PID 3688 wrote to memory of 4764 3688 DE43.exe DE43.exe PID 3688 wrote to memory of 4764 3688 DE43.exe DE43.exe PID 4764 wrote to memory of 4704 4764 DE43.exe icacls.exe PID 4764 wrote to memory of 4704 4764 DE43.exe icacls.exe PID 4764 wrote to memory of 4704 4764 DE43.exe icacls.exe PID 4764 wrote to memory of 744 4764 DE43.exe DE43.exe PID 4764 wrote to memory of 744 4764 DE43.exe DE43.exe PID 4764 wrote to memory of 744 4764 DE43.exe DE43.exe PID 744 wrote to memory of 1868 744 DE43.exe DE43.exe PID 744 wrote to memory of 1868 744 DE43.exe DE43.exe PID 744 wrote to memory of 1868 744 DE43.exe DE43.exe PID 744 wrote to memory of 1868 744 DE43.exe DE43.exe PID 744 wrote to memory of 1868 744 DE43.exe DE43.exe PID 744 wrote to memory of 1868 744 DE43.exe DE43.exe PID 744 wrote to memory of 1868 744 DE43.exe DE43.exe PID 744 wrote to memory of 1868 744 DE43.exe DE43.exe PID 744 wrote to memory of 1868 744 DE43.exe DE43.exe PID 744 wrote to memory of 1868 744 DE43.exe DE43.exe PID 1868 wrote to memory of 4060 1868 DE43.exe build2.exe PID 1868 wrote to memory of 4060 1868 DE43.exe build2.exe PID 1868 wrote to memory of 4060 1868 DE43.exe build2.exe PID 1868 wrote to memory of 3400 1868 DE43.exe build3.exe PID 1868 wrote to memory of 3400 1868 DE43.exe build3.exe PID 1868 wrote to memory of 3400 1868 DE43.exe build3.exe PID 3400 wrote to memory of 4844 3400 build3.exe schtasks.exe PID 3400 wrote to memory of 4844 3400 build3.exe schtasks.exe PID 3400 wrote to memory of 4844 3400 build3.exe schtasks.exe PID 4060 wrote to memory of 916 4060 build2.exe build2.exe PID 4060 wrote to memory of 916 4060 build2.exe build2.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exe"C:\Users\Admin\AppData\Local\Temp\e4a175e396a087f94f876773627d0cda0b4defa322ab5b91f534a5ba9bb35a16.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4600
-
C:\Users\Admin\AppData\Local\Temp\D3A0.exeC:\Users\Admin\AppData\Local\Temp\D3A0.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4360
-
C:\Users\Admin\AppData\Local\Temp\D45D.exeC:\Users\Admin\AppData\Local\Temp\D45D.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 5082⤵
- Program crash
PID:2468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4296 -ip 42961⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\D950.exeC:\Users\Admin\AppData\Local\Temp\D950.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1964
-
C:\Users\Admin\AppData\Local\Temp\DC2F.exeC:\Users\Admin\AppData\Local\Temp\DC2F.exe1⤵
- Executes dropped EXE
PID:4664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 3402⤵
- Program crash
PID:4004
-
C:\Users\Admin\AppData\Local\Temp\DE43.exeC:\Users\Admin\AppData\Local\Temp\DE43.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\DE43.exeC:\Users\Admin\AppData\Local\Temp\DE43.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\7bfa9ae1-8b31-443f-8bd4-8c2493c72ea9" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\DE43.exe"C:\Users\Admin\AppData\Local\Temp\DE43.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\DE43.exe"C:\Users\Admin\AppData\Local\Temp\DE43.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build2.exe"C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build2.exe"C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build2.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Checks processor information in registry
PID:916 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build2.exe" & exit7⤵PID:4640
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:1760 -
C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build3.exe"C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"6⤵
- Creates scheduled task(s)
PID:4844
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:4592
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4664 -ip 46641⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\5ECE.exeC:\Users\Admin\AppData\Local\Temp\5ECE.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Checks processor information in registry
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exe"C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3108 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
PID:3612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 13163⤵
- Program crash
PID:4324 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 14122⤵
- Program crash
PID:5028
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
PID:552 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
PID:2260
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4748 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd76f4f50,0x7ffbd76f4f60,0x7ffbd76f4f702⤵PID:4860
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1596,12866111395737710441,15391588378583481968,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:22⤵PID:1660
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,12866111395737710441,15391588378583481968,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1756 /prefetch:82⤵PID:2572
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1596,12866111395737710441,15391588378583481968,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 /prefetch:82⤵PID:3520
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,12866111395737710441,15391588378583481968,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3548 /prefetch:82⤵PID:444
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4748 -s 36242⤵
- Program crash
PID:1020
-
C:\Users\Admin\AppData\Local\Temp\7D64.exeC:\Users\Admin\AppData\Local\Temp\7D64.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4284 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 2522⤵
- Program crash
PID:1324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3612 -ip 36121⤵PID:724
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4284 -ip 42841⤵PID:1256
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 4748 -ip 47481⤵PID:3980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4672 -ip 46721⤵PID:3472
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD5602cebd424613d514b439fe78f14a48d
SHA1d5d7580e513e9b4af91e1a8bcdd5401ab98636f6
SHA25629fabef3eb6d67f8ff9b015375b8fa6b6bced5e8c1651f2199fcb183f33578aa
SHA512fb2cda553e81eee089a166a0da126f9b4cff2ce5dba999ea87a4bfd1d396198f93e17391f408b2b5fa76e5a021717c4c349dede102e3e7eb1f51b44d407cb8b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD513ed5d9cdfe44b69986cdcda2709fae4
SHA16f1ac25238f31888d91eda34e7b2dd92a4f379db
SHA256c19bb0d55abcc511665e003cb64e5900a9a93dea9e6a8261356ea9f7f02d8126
SHA5128b34e9dea82332ad2098fe1fdc24f9be1c2722b07d6c8427c4b8348b5dd014780933b369bdf97408e473d84259925c4427a005e86df3a83bd9cae3a93d5f3982
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD5b6a521e9d0fab8f262508a67b4033156
SHA1dc6d3340a2ca1491afbc32a170bb1356c101cd3f
SHA256427e8743fc76dfb8c22cbd1d9c28d753f9e2e3cd073ea8b330b59bccf58c4bdb
SHA512b53d9fd965c6940f69f6155eb2192c0f5b1eafa8f73a401303340b310b11b0a9a9bbacdd16eeb8b5ceb4881e502c8c81b4e2298f1f38b58bd8c5233984ef68b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD58ae1db965177cf8037e1f5d719859088
SHA132fe4f16f0d7dee4d87b7d4450b6c71b358b8395
SHA256ce79ee994b99347ea1978e3cecc8ff0b075f9b30f40581f4c6ca0ae29c90d80e
SHA512b2b5bbd27981d0f2abdd6126e1efc9a6c1db05e900985bd4881c5f5be96ce70b94526a08154b80edb98d4918a5950bf7e3c9bfc0f3860cc78113f26d28c2e13d
-
C:\Users\Admin\AppData\Local\7bfa9ae1-8b31-443f-8bd4-8c2493c72ea9\DE43.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Local\Temp\5ECE.exeFilesize
4.2MB
MD5cfaaa5cabda253b88f2d604ae795482b
SHA1fb0b26c9b26075a5d37ce149f7543abc9b3d627d
SHA2565f26f24cad1606deacc2fbe98ddf96cda8a3257c27863c2ba4e84eff2aab6de5
SHA51202e9b8c013994e7e3642b7a508464b6e4e72a5012a7c8c658bd401e8404db9c1a8a5e61e802ecc9b4e0834ae09c7d101eff4f67e808e5219fa69e3f8b8b6c0ae
-
C:\Users\Admin\AppData\Local\Temp\5ECE.exeFilesize
4.2MB
MD5cfaaa5cabda253b88f2d604ae795482b
SHA1fb0b26c9b26075a5d37ce149f7543abc9b3d627d
SHA2565f26f24cad1606deacc2fbe98ddf96cda8a3257c27863c2ba4e84eff2aab6de5
SHA51202e9b8c013994e7e3642b7a508464b6e4e72a5012a7c8c658bd401e8404db9c1a8a5e61e802ecc9b4e0834ae09c7d101eff4f67e808e5219fa69e3f8b8b6c0ae
-
C:\Users\Admin\AppData\Local\Temp\7D64.exeFilesize
1.5MB
MD5cef3a3bce13fff2783b8994a70b95037
SHA1fc868a722827e7e667aff71fe977cfdc643ace62
SHA2567de5993155dddb0d9c365832842b1702b1d3a7a3a0818cc18de65ae5f3abfd15
SHA5128058840bc568bcddf1252f440eb048889b5c3faabe9f6d6b0a7e17cb0139142ec5381b3d06e1aa3941562592693e1bc55a178a1fdbabd51cc1c6f0315eed45e7
-
C:\Users\Admin\AppData\Local\Temp\7D64.exeFilesize
1.5MB
MD5cef3a3bce13fff2783b8994a70b95037
SHA1fc868a722827e7e667aff71fe977cfdc643ace62
SHA2567de5993155dddb0d9c365832842b1702b1d3a7a3a0818cc18de65ae5f3abfd15
SHA5128058840bc568bcddf1252f440eb048889b5c3faabe9f6d6b0a7e17cb0139142ec5381b3d06e1aa3941562592693e1bc55a178a1fdbabd51cc1c6f0315eed45e7
-
C:\Users\Admin\AppData\Local\Temp\D3A0.exeFilesize
552KB
MD527503351226b133437242663d8f339a3
SHA197baa24723a0eae9c9926839332e057e76c77013
SHA256d588d7eda98a8ecff42e69e50568996d8350f96b1d40eb1c969c3afc48d55bfe
SHA512527191d9a83f61966e07b3a825c48a4b6d278d91fc48e4bbf7cf0b75ccdb65d47814e1d7f6b768b582dd3ad9f410865d59c584015b96e1acef5eedba8dfd0cb8
-
C:\Users\Admin\AppData\Local\Temp\D3A0.exeFilesize
552KB
MD527503351226b133437242663d8f339a3
SHA197baa24723a0eae9c9926839332e057e76c77013
SHA256d588d7eda98a8ecff42e69e50568996d8350f96b1d40eb1c969c3afc48d55bfe
SHA512527191d9a83f61966e07b3a825c48a4b6d278d91fc48e4bbf7cf0b75ccdb65d47814e1d7f6b768b582dd3ad9f410865d59c584015b96e1acef5eedba8dfd0cb8
-
C:\Users\Admin\AppData\Local\Temp\D45D.exeFilesize
439KB
MD58c01c494909c5e86efe02129c6005bc4
SHA1d81808d116e1a4f452f3e6c5470e05cef2e2ee6d
SHA25696dc67006f0d893778cbd09597baffe543d5433c55cd797a48865d6f8dd11272
SHA512faf103ce0052c6f907ece6f701dc79604344cbc0e8d3c649faa2f7291d55fae10c7d28e504e6f00bc9ab7a6da117551a665159e82224a41c3fbdb3fe5ce24d22
-
C:\Users\Admin\AppData\Local\Temp\D45D.exeFilesize
439KB
MD58c01c494909c5e86efe02129c6005bc4
SHA1d81808d116e1a4f452f3e6c5470e05cef2e2ee6d
SHA25696dc67006f0d893778cbd09597baffe543d5433c55cd797a48865d6f8dd11272
SHA512faf103ce0052c6f907ece6f701dc79604344cbc0e8d3c649faa2f7291d55fae10c7d28e504e6f00bc9ab7a6da117551a665159e82224a41c3fbdb3fe5ce24d22
-
C:\Users\Admin\AppData\Local\Temp\D950.exeFilesize
215KB
MD5d7c8a5eb9bcb94291de4e60dd864bd30
SHA14d503c1800af4e0cb7dae8154f1fcd0171f2013a
SHA256635b68b0b86d18c671dc71eea1c95acffa69c367f749124f2ce44ffe1dd12235
SHA51237c0e32210be0d58e099f8c6ae7662d3c261ff459f2a82252be8d2eb6a3046ba4f399c083409d3961e6ec6ffa94fbc9ba017b26811d86e6bfdf05b1dab3a7d66
-
C:\Users\Admin\AppData\Local\Temp\D950.exeFilesize
215KB
MD5d7c8a5eb9bcb94291de4e60dd864bd30
SHA14d503c1800af4e0cb7dae8154f1fcd0171f2013a
SHA256635b68b0b86d18c671dc71eea1c95acffa69c367f749124f2ce44ffe1dd12235
SHA51237c0e32210be0d58e099f8c6ae7662d3c261ff459f2a82252be8d2eb6a3046ba4f399c083409d3961e6ec6ffa94fbc9ba017b26811d86e6bfdf05b1dab3a7d66
-
C:\Users\Admin\AppData\Local\Temp\DC2F.exeFilesize
215KB
MD51b5839200d61b75247362f4e5d776034
SHA11d7a87f2670436c2314f0e3d6f6af2675d3c7d12
SHA25683a6d3afbfefe962fa8a71ed9cdcb26dd4ffc54ddb640565f6261f4b12721e56
SHA512afa921e0f7dc567d1d3d3c2bbcd12595d76236e3e7fed6b585b6be9e8ee36d1e870a7e1bcbac5f366136611e40adc78a83183433cceda16fb20ec5dfd7de14f9
-
C:\Users\Admin\AppData\Local\Temp\DC2F.exeFilesize
215KB
MD51b5839200d61b75247362f4e5d776034
SHA11d7a87f2670436c2314f0e3d6f6af2675d3c7d12
SHA25683a6d3afbfefe962fa8a71ed9cdcb26dd4ffc54ddb640565f6261f4b12721e56
SHA512afa921e0f7dc567d1d3d3c2bbcd12595d76236e3e7fed6b585b6be9e8ee36d1e870a7e1bcbac5f366136611e40adc78a83183433cceda16fb20ec5dfd7de14f9
-
C:\Users\Admin\AppData\Local\Temp\DE43.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Local\Temp\DE43.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Local\Temp\DE43.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Local\Temp\DE43.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Local\Temp\DE43.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exeFilesize
1.2MB
MD550e03c260a0f6db796aa22d7443aa105
SHA1573a47d22475dc990d57cdd33b0952b721e4ddd9
SHA2565b71ae23c39fbcd56d58ad59d4b13b0346f1f162bc5089b3ea4be35c0e621065
SHA5124528944754d4f6fae49d63c30377913ea4cf6741a37da8c91fc8ad1006fde8065de9aa96c5de03c84b78a27aecffbf43de9daa94f25408c866c605394a71d434
-
C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exeFilesize
1.2MB
MD550e03c260a0f6db796aa22d7443aa105
SHA1573a47d22475dc990d57cdd33b0952b721e4ddd9
SHA2565b71ae23c39fbcd56d58ad59d4b13b0346f1f162bc5089b3ea4be35c0e621065
SHA5124528944754d4f6fae49d63c30377913ea4cf6741a37da8c91fc8ad1006fde8065de9aa96c5de03c84b78a27aecffbf43de9daa94f25408c866c605394a71d434
-
C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build2.exeFilesize
370KB
MD56a7892ece7e8bf85628e0e769560b7cb
SHA1e13140e719218b14dd168467a63d481c7259df8c
SHA256363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844
SHA5120091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f
-
C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build2.exeFilesize
370KB
MD56a7892ece7e8bf85628e0e769560b7cb
SHA1e13140e719218b14dd168467a63d481c7259df8c
SHA256363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844
SHA5120091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f
-
C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build2.exeFilesize
370KB
MD56a7892ece7e8bf85628e0e769560b7cb
SHA1e13140e719218b14dd168467a63d481c7259df8c
SHA256363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844
SHA5120091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f
-
C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\b098eb88-c28e-495b-b4d4-a6eabc4f7ce9\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
\??\pipe\crashpad_4748_GCEHTJMWNVXCOUBLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/744-199-0x000000000060B000-0x000000000069C000-memory.dmpFilesize
580KB
-
memory/744-189-0x0000000000000000-mapping.dmp
-
memory/772-234-0x000000000AE90000-0x000000000AFB6000-memory.dmpFilesize
1.1MB
-
memory/772-263-0x000000000AE90000-0x000000000AFB6000-memory.dmpFilesize
1.1MB
-
memory/772-246-0x000000000AE90000-0x000000000AFB6000-memory.dmpFilesize
1.1MB
-
memory/916-220-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/916-215-0x0000000000000000-mapping.dmp
-
memory/916-216-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/916-222-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1760-223-0x0000000000000000-mapping.dmp
-
memory/1868-198-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1868-221-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1868-206-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1868-195-0x0000000000000000-mapping.dmp
-
memory/1868-200-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1964-171-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/1964-170-0x0000000000483000-0x0000000000494000-memory.dmpFilesize
68KB
-
memory/1964-194-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1964-172-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1964-148-0x0000000000000000-mapping.dmp
-
memory/2092-151-0x000000000A6F0000-0x000000000AD08000-memory.dmpFilesize
6.1MB
-
memory/2092-188-0x000000000AD10000-0x000000000AD76000-memory.dmpFilesize
408KB
-
memory/2092-187-0x000000000A630000-0x000000000A6C2000-memory.dmpFilesize
584KB
-
memory/2092-186-0x000000000B2C0000-0x000000000B864000-memory.dmpFilesize
5.6MB
-
memory/2092-192-0x000000000BA40000-0x000000000BC02000-memory.dmpFilesize
1.8MB
-
memory/2092-193-0x000000000C140000-0x000000000C66C000-memory.dmpFilesize
5.2MB
-
memory/2092-143-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/2092-157-0x000000000A1D0000-0x000000000A20C000-memory.dmpFilesize
240KB
-
memory/2092-142-0x0000000000000000-mapping.dmp
-
memory/2092-153-0x000000000A170000-0x000000000A182000-memory.dmpFilesize
72KB
-
memory/2092-152-0x000000000A240000-0x000000000A34A000-memory.dmpFilesize
1.0MB
-
memory/2260-229-0x0000000000000000-mapping.dmp
-
memory/3108-230-0x0000000000000000-mapping.dmp
-
memory/3400-211-0x0000000000000000-mapping.dmp
-
memory/3612-253-0x00000000030D0000-0x00000000037F6000-memory.dmpFilesize
7.1MB
-
memory/3612-251-0x00000000038C0000-0x0000000003A00000-memory.dmpFilesize
1.2MB
-
memory/3612-252-0x00000000038C0000-0x0000000003A00000-memory.dmpFilesize
1.2MB
-
memory/3612-250-0x0000000001000000-0x0000000001606000-memory.dmpFilesize
6.0MB
-
memory/3612-249-0x00000000030D0000-0x00000000037F6000-memory.dmpFilesize
7.1MB
-
memory/3612-248-0x0000000000000000-mapping.dmp
-
memory/3612-254-0x00000000038C0000-0x0000000003A00000-memory.dmpFilesize
1.2MB
-
memory/3612-255-0x00000000038C0000-0x0000000003A00000-memory.dmpFilesize
1.2MB
-
memory/3612-260-0x00000000030D0000-0x00000000037F6000-memory.dmpFilesize
7.1MB
-
memory/3688-159-0x0000000000000000-mapping.dmp
-
memory/3688-180-0x00000000021A0000-0x00000000022BB000-memory.dmpFilesize
1.1MB
-
memory/3688-178-0x00000000007C0000-0x0000000000851000-memory.dmpFilesize
580KB
-
memory/4060-218-0x00000000006C2000-0x00000000006F3000-memory.dmpFilesize
196KB
-
memory/4060-208-0x0000000000000000-mapping.dmp
-
memory/4060-219-0x00000000007F0000-0x0000000000847000-memory.dmpFilesize
348KB
-
memory/4284-257-0x0000000000000000-mapping.dmp
-
memory/4296-139-0x0000000000000000-mapping.dmp
-
memory/4360-164-0x00000000005C0000-0x000000000062B000-memory.dmpFilesize
428KB
-
memory/4360-165-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/4360-205-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/4360-136-0x0000000000000000-mapping.dmp
-
memory/4360-158-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/4360-163-0x00000000007D3000-0x0000000000834000-memory.dmpFilesize
388KB
-
memory/4360-207-0x00000000007D3000-0x0000000000834000-memory.dmpFilesize
388KB
-
memory/4556-167-0x00000000001A0000-0x00000000001AC000-memory.dmpFilesize
48KB
-
memory/4556-166-0x0000000000000000-mapping.dmp
-
memory/4592-169-0x0000000000390000-0x00000000003FB000-memory.dmpFilesize
428KB
-
memory/4592-162-0x0000000000000000-mapping.dmp
-
memory/4592-173-0x0000000000390000-0x00000000003FB000-memory.dmpFilesize
428KB
-
memory/4592-168-0x0000000000600000-0x0000000000675000-memory.dmpFilesize
468KB
-
memory/4600-132-0x0000000000772000-0x0000000000782000-memory.dmpFilesize
64KB
-
memory/4600-134-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4600-135-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4600-133-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/4664-181-0x00000000007C3000-0x00000000007D4000-memory.dmpFilesize
68KB
-
memory/4664-182-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4664-154-0x0000000000000000-mapping.dmp
-
memory/4672-235-0x00000000028C0000-0x0000000002D22000-memory.dmpFilesize
4.4MB
-
memory/4672-224-0x0000000000000000-mapping.dmp
-
memory/4672-264-0x0000000000400000-0x0000000000866000-memory.dmpFilesize
4.4MB
-
memory/4672-243-0x0000000006F30000-0x0000000007070000-memory.dmpFilesize
1.2MB
-
memory/4672-240-0x0000000006F30000-0x0000000007070000-memory.dmpFilesize
1.2MB
-
memory/4672-247-0x0000000006F30000-0x0000000007070000-memory.dmpFilesize
1.2MB
-
memory/4672-237-0x0000000006520000-0x0000000006C46000-memory.dmpFilesize
7.1MB
-
memory/4672-262-0x0000000006520000-0x0000000006C46000-memory.dmpFilesize
7.1MB
-
memory/4672-236-0x0000000000400000-0x0000000000866000-memory.dmpFilesize
4.4MB
-
memory/4672-261-0x0000000000400000-0x0000000000866000-memory.dmpFilesize
4.4MB
-
memory/4672-242-0x0000000006F30000-0x0000000007070000-memory.dmpFilesize
1.2MB
-
memory/4672-241-0x0000000006F30000-0x0000000007070000-memory.dmpFilesize
1.2MB
-
memory/4672-238-0x0000000006F30000-0x0000000007070000-memory.dmpFilesize
1.2MB
-
memory/4672-245-0x0000000006F30000-0x0000000007070000-memory.dmpFilesize
1.2MB
-
memory/4672-244-0x0000000006520000-0x0000000006C46000-memory.dmpFilesize
7.1MB
-
memory/4672-233-0x0000000000AC8000-0x0000000000EDE000-memory.dmpFilesize
4.1MB
-
memory/4672-239-0x0000000006F30000-0x0000000007070000-memory.dmpFilesize
1.2MB
-
memory/4704-184-0x0000000000000000-mapping.dmp
-
memory/4764-175-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4764-191-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4764-183-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4764-174-0x0000000000000000-mapping.dmp
-
memory/4764-179-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4764-177-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4844-214-0x0000000000000000-mapping.dmp