Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2022 19:08
Static task
static1
Behavioral task
behavioral1
Sample
81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exe
Resource
win10v2004-20221111-en
General
-
Target
81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exe
-
Size
214KB
-
MD5
2209b486f66c659550388c0a10f2a192
-
SHA1
928a22cba3b6f234663b183716b85082ad434887
-
SHA256
81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3
-
SHA512
ce7622b64d7fae08f119010d6e51f7602313e98a72625df582839264e7f4f940524805b1cbeb6359269288cab10d25118c41122dc049e73a4fd7e4888221f947
-
SSDEEP
6144:zWzcdLkHf2j6zSbLov4OQg9lhug3CauGU0V6:Sz0Ai6mQv4OQwlfSBXO
Malware Config
Extracted
redline
mario23_10
167.235.252.160:10642
-
auth_value
eca57cfb5172f71dc45986763bb98942
Extracted
djvu
http://abibiall.com/lancer/get.php
-
extension
.bttu
-
offline_id
8p2Go5ZmkbFk0DF2oJ6E8vGEogpBqqaGCWjto1t1
-
payload_url
http://uaery.top/dl/build2.exe
http://abibiall.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-Q5EougBEbU Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0619JOsie
Extracted
raccoon
ec7a54fb6492ff3a52d09504b8ecf082
http://88.119.161.188
http://88.119.161.19
Signatures
-
Detected Djvu ransomware 10 IoCs
Processes:
resource yara_rule behavioral1/memory/4316-182-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3520-185-0x00000000020E0000-0x00000000021FB000-memory.dmp family_djvu behavioral1/memory/4316-184-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4316-180-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4316-186-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4316-198-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1192-209-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1192-211-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1192-217-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1192-234-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Detects Smokeloader packer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1136-133-0x00000000006C0000-0x00000000006C9000-memory.dmp family_smokeloader behavioral1/memory/2368-176-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1340-143-0x0000000000500000-0x0000000000560000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 18 IoCs
Processes:
D873.exeD93F.exeDC4D.exeDE71.exeE102.exeE52A.exeE102.exeE102.exeE102.exebuild2.exebuild3.exebuild2.exe7083.exeOrwtaofpwtre.exeA204.exeervjwawmstsca.exedfvjwawpid process 3544 D873.exe 3560 D93F.exe 2368 DC4D.exe 4180 DE71.exe 3520 E102.exe 3752 E52A.exe 4316 E102.exe 2608 E102.exe 1192 E102.exe 3012 build2.exe 2804 build3.exe 4688 build2.exe 1900 7083.exe 624 Orwtaofpwtre.exe 4440 A204.exe 2592 ervjwaw 4080 mstsca.exe 4928 dfvjwaw -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
E102.exeE102.exebuild2.exe7083.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation E102.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation E102.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation build2.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 7083.exe -
Loads dropped DLL 2 IoCs
Processes:
build2.exepid process 4688 build2.exe 4688 build2.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
E102.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b201d272-0ccb-4558-8c8e-23cd8cc3ae2e\\E102.exe\" --AutoStart" E102.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 29 api.2ip.ua 30 api.2ip.ua 45 api.2ip.ua -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
D873.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 D873.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
chrome.exepid process 1108 2452 chrome.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
D93F.exeE102.exeE52A.exeE102.exebuild2.exe7083.exedescription pid process target process PID 3560 set thread context of 1340 3560 D93F.exe AppLaunch.exe PID 3520 set thread context of 4316 3520 E102.exe E102.exe PID 3752 set thread context of 3604 3752 E52A.exe InstallUtil.exe PID 2608 set thread context of 1192 2608 E102.exe E102.exe PID 3012 set thread context of 4688 3012 build2.exe build2.exe PID 1900 set thread context of 3560 1900 7083.exe rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3860 3560 WerFault.exe D93F.exe 560 4180 WerFault.exe DE71.exe 3864 3560 WerFault.exe rundll32.exe 3568 4440 WerFault.exe A204.exe 976 2452 WerFault.exe chrome.exe 3152 4928 WerFault.exe dfvjwaw 3636 1900 WerFault.exe 7083.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exeDC4D.exeervjwawdescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DC4D.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DC4D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ervjwaw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ervjwaw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ervjwaw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DC4D.exe -
Checks processor information in registry 2 TTPs 44 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
7083.exerundll32.exebuild2.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 7083.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7083.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 7083.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 7083.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3120 schtasks.exe 4788 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3152 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
description ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Toolbar Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser -
Modifies registry class 64 IoCs
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic" Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "3" Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 78003100000000006b557d6c1100557365727300640009000400efbe874f774891551da12e000000c70500000000010000000000000000003a0000000000d967240055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 50003100000000006b552874100041646d696e003c0009000400efbe6b557d6c91551da12e0000007ee10100000001000000000000000000000000000000ae8a6600410064006d0069006e00000014000000 Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48" Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic" Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000 Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 020000000100000000000000ffffffff Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2\0 = 5a00310000000000915516a1100053797374656d33320000420009000400efbe874f7748915516a12e000000b90c000000000100000000000000000000000000000004208700530079007300740065006d0033003200000018000000 Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2\0\NodeSlot = "8" Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2\0\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f80cb859f6720028040b29b5540cc05aab60000 Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668} Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}" Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2\MRUListEx = ffffffff Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616209" Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 0100000000000000ffffffff Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
pid process 1108 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exepid process 1136 81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exe 1136 81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exe 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
A204.exepid process 1108 4440 A204.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exeDC4D.exeervjwawpid process 1136 81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exe 1108 1108 1108 1108 2368 DC4D.exe 2592 ervjwaw -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
E52A.exeAppLaunch.exedescription pid process Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeDebugPrivilege 3752 E52A.exe Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeDebugPrivilege 1340 AppLaunch.exe Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 Token: SeShutdownPrivilege 1108 Token: SeCreatePagefilePrivilege 1108 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Orwtaofpwtre.exechrome.exepid process 624 Orwtaofpwtre.exe 2452 chrome.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Orwtaofpwtre.exepid process 624 Orwtaofpwtre.exe -
Suspicious use of SetWindowsHookEx 23 IoCs
Processes:
chrome.exepid process 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 2452 chrome.exe 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 1108 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 1108 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
D93F.exeE102.exeE102.exeE52A.exeE102.exedescription pid process target process PID 1108 wrote to memory of 3544 1108 D873.exe PID 1108 wrote to memory of 3544 1108 D873.exe PID 1108 wrote to memory of 3544 1108 D873.exe PID 1108 wrote to memory of 3560 1108 D93F.exe PID 1108 wrote to memory of 3560 1108 D93F.exe PID 1108 wrote to memory of 3560 1108 D93F.exe PID 3560 wrote to memory of 1340 3560 D93F.exe AppLaunch.exe PID 3560 wrote to memory of 1340 3560 D93F.exe AppLaunch.exe PID 3560 wrote to memory of 1340 3560 D93F.exe AppLaunch.exe PID 3560 wrote to memory of 1340 3560 D93F.exe AppLaunch.exe PID 1108 wrote to memory of 2368 1108 DC4D.exe PID 1108 wrote to memory of 2368 1108 DC4D.exe PID 1108 wrote to memory of 2368 1108 DC4D.exe PID 3560 wrote to memory of 1340 3560 D93F.exe AppLaunch.exe PID 1108 wrote to memory of 4180 1108 DE71.exe PID 1108 wrote to memory of 4180 1108 DE71.exe PID 1108 wrote to memory of 4180 1108 DE71.exe PID 1108 wrote to memory of 3520 1108 E102.exe PID 1108 wrote to memory of 3520 1108 E102.exe PID 1108 wrote to memory of 3520 1108 E102.exe PID 1108 wrote to memory of 3752 1108 E52A.exe PID 1108 wrote to memory of 3752 1108 E52A.exe PID 1108 wrote to memory of 3080 1108 explorer.exe PID 1108 wrote to memory of 3080 1108 explorer.exe PID 1108 wrote to memory of 3080 1108 explorer.exe PID 1108 wrote to memory of 3080 1108 explorer.exe PID 1108 wrote to memory of 4944 1108 explorer.exe PID 1108 wrote to memory of 4944 1108 explorer.exe PID 1108 wrote to memory of 4944 1108 explorer.exe PID 3520 wrote to memory of 4316 3520 E102.exe E102.exe PID 3520 wrote to memory of 4316 3520 E102.exe E102.exe PID 3520 wrote to memory of 4316 3520 E102.exe E102.exe PID 3520 wrote to memory of 4316 3520 E102.exe E102.exe PID 3520 wrote to memory of 4316 3520 E102.exe E102.exe PID 3520 wrote to memory of 4316 3520 E102.exe E102.exe PID 3520 wrote to memory of 4316 3520 E102.exe E102.exe PID 3520 wrote to memory of 4316 3520 E102.exe E102.exe PID 3520 wrote to memory of 4316 3520 E102.exe E102.exe PID 3520 wrote to memory of 4316 3520 E102.exe E102.exe PID 4316 wrote to memory of 2884 4316 E102.exe icacls.exe PID 4316 wrote to memory of 2884 4316 E102.exe icacls.exe PID 4316 wrote to memory of 2884 4316 E102.exe icacls.exe PID 4316 wrote to memory of 2608 4316 E102.exe E102.exe PID 4316 wrote to memory of 2608 4316 E102.exe E102.exe PID 4316 wrote to memory of 2608 4316 E102.exe E102.exe PID 3752 wrote to memory of 3604 3752 E52A.exe InstallUtil.exe PID 3752 wrote to memory of 3604 3752 E52A.exe InstallUtil.exe PID 3752 wrote to memory of 3604 3752 E52A.exe InstallUtil.exe PID 3752 wrote to memory of 3604 3752 E52A.exe InstallUtil.exe PID 3752 wrote to memory of 3604 3752 E52A.exe InstallUtil.exe PID 3752 wrote to memory of 3604 3752 E52A.exe InstallUtil.exe PID 3752 wrote to memory of 3604 3752 E52A.exe InstallUtil.exe PID 3752 wrote to memory of 3604 3752 E52A.exe InstallUtil.exe PID 3752 wrote to memory of 3604 3752 E52A.exe InstallUtil.exe PID 3752 wrote to memory of 3604 3752 E52A.exe InstallUtil.exe PID 2608 wrote to memory of 1192 2608 E102.exe E102.exe PID 2608 wrote to memory of 1192 2608 E102.exe E102.exe PID 2608 wrote to memory of 1192 2608 E102.exe E102.exe PID 2608 wrote to memory of 1192 2608 E102.exe E102.exe PID 2608 wrote to memory of 1192 2608 E102.exe E102.exe PID 2608 wrote to memory of 1192 2608 E102.exe E102.exe PID 2608 wrote to memory of 1192 2608 E102.exe E102.exe PID 2608 wrote to memory of 1192 2608 E102.exe E102.exe PID 2608 wrote to memory of 1192 2608 E102.exe E102.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exe"C:\Users\Admin\AppData\Local\Temp\81910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D873.exeC:\Users\Admin\AppData\Local\Temp\D873.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\D93F.exeC:\Users\Admin\AppData\Local\Temp\D93F.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 5162⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\DC4D.exeC:\Users\Admin\AppData\Local\Temp\DC4D.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3560 -ip 35601⤵
-
C:\Users\Admin\AppData\Local\Temp\DE71.exeC:\Users\Admin\AppData\Local\Temp\DE71.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 3402⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\E102.exeC:\Users\Admin\AppData\Local\Temp\E102.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E102.exeC:\Users\Admin\AppData\Local\Temp\E102.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\b201d272-0ccb-4558-8c8e-23cd8cc3ae2e" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\E102.exe"C:\Users\Admin\AppData\Local\Temp\E102.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E102.exe"C:\Users\Admin\AppData\Local\Temp\E102.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build2.exe"C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build2.exe"C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build2.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build2.exe" & exit7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build3.exe"C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build3.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\E52A.exeC:\Users\Admin\AppData\Local\Temp\E52A.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4180 -ip 41801⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\7083.exeC:\Users\Admin\AppData\Local\Temp\7083.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exe"C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 13283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 14282⤵
- Program crash
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e32e4f50,0x7ff8e32e4f60,0x7ff8e32e4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1652,13079931159285672695,8643282439880375059,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1664 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,13079931159285672695,8643282439880375059,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2064 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1652,13079931159285672695,8643282439880375059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,13079931159285672695,8643282439880375059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3616 /prefetch:82⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2452 -s 36522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3560 -ip 35601⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\A204.exeC:\Users\Admin\AppData\Local\Temp\A204.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 2682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4440 -ip 44401⤵
-
C:\Users\Admin\AppData\Roaming\ervjwawC:\Users\Admin\AppData\Roaming\ervjwaw1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 500 -p 2452 -ip 24521⤵
-
C:\Users\Admin\AppData\Roaming\dfvjwawC:\Users\Admin\AppData\Roaming\dfvjwaw1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 3402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4928 -ip 49281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1900 -ip 19001⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
C:\ProgramData\nss3.dllFilesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD5602cebd424613d514b439fe78f14a48d
SHA1d5d7580e513e9b4af91e1a8bcdd5401ab98636f6
SHA25629fabef3eb6d67f8ff9b015375b8fa6b6bced5e8c1651f2199fcb183f33578aa
SHA512fb2cda553e81eee089a166a0da126f9b4cff2ce5dba999ea87a4bfd1d396198f93e17391f408b2b5fa76e5a021717c4c349dede102e3e7eb1f51b44d407cb8b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD513ed5d9cdfe44b69986cdcda2709fae4
SHA16f1ac25238f31888d91eda34e7b2dd92a4f379db
SHA256c19bb0d55abcc511665e003cb64e5900a9a93dea9e6a8261356ea9f7f02d8126
SHA5128b34e9dea82332ad2098fe1fdc24f9be1c2722b07d6c8427c4b8348b5dd014780933b369bdf97408e473d84259925c4427a005e86df3a83bd9cae3a93d5f3982
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD58f3d3994da94f9f28abb72f7662a2280
SHA1cb10db22014db30786a7cf12521030f316061026
SHA2562977a0d9c3ace776e8384cc2e3f4d694a2c013f4040f8c9275ff2685b1a8f3fe
SHA5126bf87111707c7703340613297778a38dd3786711fc2f67ca62f2ccf5e77923b5efce603127efb386a210383757bb399a1455274d78f756350cc8b17ff5300745
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD55848eff3f819a010f666a0f2d65a1051
SHA1edcc8d4f70cba412abfd94a1982acfd1fb04e916
SHA2564a1b3fc2ecc6b98df44f05ec1ea50813afe42741783908cb255611bab878d4fb
SHA512d882bc20c0054f44fbd9ccde39f1b6194deef34ccced6a2ac7a46b6a2b9a3e3dcea34b3cd488c27f2ab6071bd4ad8687a654f42ef8c327d6e0cc8e3bb116710f
-
C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build2.exeFilesize
370KB
MD56a7892ece7e8bf85628e0e769560b7cb
SHA1e13140e719218b14dd168467a63d481c7259df8c
SHA256363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844
SHA5120091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f
-
C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build2.exeFilesize
370KB
MD56a7892ece7e8bf85628e0e769560b7cb
SHA1e13140e719218b14dd168467a63d481c7259df8c
SHA256363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844
SHA5120091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f
-
C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build2.exeFilesize
370KB
MD56a7892ece7e8bf85628e0e769560b7cb
SHA1e13140e719218b14dd168467a63d481c7259df8c
SHA256363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844
SHA5120091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f
-
C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\95474ec4-737b-4c23-ba79-bef1408b7f26\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\Temp\7083.exeFilesize
4.2MB
MD5cc4b391886bf4238e70772704b2c97ca
SHA1aa0cf46c73caac0019a6f5e7f172f4540d33d525
SHA2560290bb1ffcb644899aeb89c8aafdf2dba92aae13b251738163d2d16087f32c4d
SHA512379148eaef2495c9518dfb98fc1c1924e310270e4c9965d42b80fd97531fbccafbec04c3fa67d7cec29140a83e37667426092ac6b60b95313cfccaa626df9072
-
C:\Users\Admin\AppData\Local\Temp\7083.exeFilesize
4.2MB
MD5cc4b391886bf4238e70772704b2c97ca
SHA1aa0cf46c73caac0019a6f5e7f172f4540d33d525
SHA2560290bb1ffcb644899aeb89c8aafdf2dba92aae13b251738163d2d16087f32c4d
SHA512379148eaef2495c9518dfb98fc1c1924e310270e4c9965d42b80fd97531fbccafbec04c3fa67d7cec29140a83e37667426092ac6b60b95313cfccaa626df9072
-
C:\Users\Admin\AppData\Local\Temp\A204.exeFilesize
1.4MB
MD58fe166e995bbb1f5b9ed97a6b858cb17
SHA134b173b2ee5db7694c69732af29bdc92eb528888
SHA256e3ac933f39d5fa387a5f844d1d29379d88c4421aa72ac4e9b50d8bc1d5b40fa4
SHA51262a132abe46d212be81f0bd65184b397c80d87c46bd1728d9ec14cd40babd2d6ff61f6a3fe8d8d49be44e00ce28bae355b2059db8f95dfa918b8ac548f5a6432
-
C:\Users\Admin\AppData\Local\Temp\A204.exeFilesize
1.4MB
MD58fe166e995bbb1f5b9ed97a6b858cb17
SHA134b173b2ee5db7694c69732af29bdc92eb528888
SHA256e3ac933f39d5fa387a5f844d1d29379d88c4421aa72ac4e9b50d8bc1d5b40fa4
SHA51262a132abe46d212be81f0bd65184b397c80d87c46bd1728d9ec14cd40babd2d6ff61f6a3fe8d8d49be44e00ce28bae355b2059db8f95dfa918b8ac548f5a6432
-
C:\Users\Admin\AppData\Local\Temp\D873.exeFilesize
552KB
MD527503351226b133437242663d8f339a3
SHA197baa24723a0eae9c9926839332e057e76c77013
SHA256d588d7eda98a8ecff42e69e50568996d8350f96b1d40eb1c969c3afc48d55bfe
SHA512527191d9a83f61966e07b3a825c48a4b6d278d91fc48e4bbf7cf0b75ccdb65d47814e1d7f6b768b582dd3ad9f410865d59c584015b96e1acef5eedba8dfd0cb8
-
C:\Users\Admin\AppData\Local\Temp\D873.exeFilesize
552KB
MD527503351226b133437242663d8f339a3
SHA197baa24723a0eae9c9926839332e057e76c77013
SHA256d588d7eda98a8ecff42e69e50568996d8350f96b1d40eb1c969c3afc48d55bfe
SHA512527191d9a83f61966e07b3a825c48a4b6d278d91fc48e4bbf7cf0b75ccdb65d47814e1d7f6b768b582dd3ad9f410865d59c584015b96e1acef5eedba8dfd0cb8
-
C:\Users\Admin\AppData\Local\Temp\D93F.exeFilesize
439KB
MD58c01c494909c5e86efe02129c6005bc4
SHA1d81808d116e1a4f452f3e6c5470e05cef2e2ee6d
SHA25696dc67006f0d893778cbd09597baffe543d5433c55cd797a48865d6f8dd11272
SHA512faf103ce0052c6f907ece6f701dc79604344cbc0e8d3c649faa2f7291d55fae10c7d28e504e6f00bc9ab7a6da117551a665159e82224a41c3fbdb3fe5ce24d22
-
C:\Users\Admin\AppData\Local\Temp\D93F.exeFilesize
439KB
MD58c01c494909c5e86efe02129c6005bc4
SHA1d81808d116e1a4f452f3e6c5470e05cef2e2ee6d
SHA25696dc67006f0d893778cbd09597baffe543d5433c55cd797a48865d6f8dd11272
SHA512faf103ce0052c6f907ece6f701dc79604344cbc0e8d3c649faa2f7291d55fae10c7d28e504e6f00bc9ab7a6da117551a665159e82224a41c3fbdb3fe5ce24d22
-
C:\Users\Admin\AppData\Local\Temp\DC4D.exeFilesize
214KB
MD5c342eab00ac3254a68018062272d0dc2
SHA1af897a70db8914112aa4e03c8d0ecb33dbe11f27
SHA25666a0878648463450f486d63c66b48d9781a526b705222bc0dbf40836b371522f
SHA5128a572cca7fa9695434c464e3e56b3eefe8ec7d79dca2872f1af8a2268b9443d4deda7c63521ad50f5d31d2b1c68f6fa87290dec6da077ff976be9e2053d40abd
-
C:\Users\Admin\AppData\Local\Temp\DC4D.exeFilesize
214KB
MD5c342eab00ac3254a68018062272d0dc2
SHA1af897a70db8914112aa4e03c8d0ecb33dbe11f27
SHA25666a0878648463450f486d63c66b48d9781a526b705222bc0dbf40836b371522f
SHA5128a572cca7fa9695434c464e3e56b3eefe8ec7d79dca2872f1af8a2268b9443d4deda7c63521ad50f5d31d2b1c68f6fa87290dec6da077ff976be9e2053d40abd
-
C:\Users\Admin\AppData\Local\Temp\DE71.exeFilesize
215KB
MD51b5839200d61b75247362f4e5d776034
SHA11d7a87f2670436c2314f0e3d6f6af2675d3c7d12
SHA25683a6d3afbfefe962fa8a71ed9cdcb26dd4ffc54ddb640565f6261f4b12721e56
SHA512afa921e0f7dc567d1d3d3c2bbcd12595d76236e3e7fed6b585b6be9e8ee36d1e870a7e1bcbac5f366136611e40adc78a83183433cceda16fb20ec5dfd7de14f9
-
C:\Users\Admin\AppData\Local\Temp\DE71.exeFilesize
215KB
MD51b5839200d61b75247362f4e5d776034
SHA11d7a87f2670436c2314f0e3d6f6af2675d3c7d12
SHA25683a6d3afbfefe962fa8a71ed9cdcb26dd4ffc54ddb640565f6261f4b12721e56
SHA512afa921e0f7dc567d1d3d3c2bbcd12595d76236e3e7fed6b585b6be9e8ee36d1e870a7e1bcbac5f366136611e40adc78a83183433cceda16fb20ec5dfd7de14f9
-
C:\Users\Admin\AppData\Local\Temp\E102.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Local\Temp\E102.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Local\Temp\E102.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Local\Temp\E102.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Local\Temp\E102.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Local\Temp\E52A.exeFilesize
588KB
MD59bb6fc051ce66030059a1c1123b13cca
SHA18731879c637aacaf09c38fc3893d44b626907971
SHA2562e5c01e5bb7c4b180a9dee8f8c13aec1c6eccbe0f8b02ca03251bdb196cd169f
SHA512bb88ba24b415b5da29625f4d48fb4a6f0de6c9226ea79b325ec07a5da745c62dc95803f16e3cdd74b2c2c714c1f93a0b81538ed4147b0bdc40b6d3a3524a7e24
-
C:\Users\Admin\AppData\Local\Temp\E52A.exeFilesize
588KB
MD59bb6fc051ce66030059a1c1123b13cca
SHA18731879c637aacaf09c38fc3893d44b626907971
SHA2562e5c01e5bb7c4b180a9dee8f8c13aec1c6eccbe0f8b02ca03251bdb196cd169f
SHA512bb88ba24b415b5da29625f4d48fb4a6f0de6c9226ea79b325ec07a5da745c62dc95803f16e3cdd74b2c2c714c1f93a0b81538ed4147b0bdc40b6d3a3524a7e24
-
C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exeFilesize
1.2MB
MD550e03c260a0f6db796aa22d7443aa105
SHA1573a47d22475dc990d57cdd33b0952b721e4ddd9
SHA2565b71ae23c39fbcd56d58ad59d4b13b0346f1f162bc5089b3ea4be35c0e621065
SHA5124528944754d4f6fae49d63c30377913ea4cf6741a37da8c91fc8ad1006fde8065de9aa96c5de03c84b78a27aecffbf43de9daa94f25408c866c605394a71d434
-
C:\Users\Admin\AppData\Local\Temp\Orwtaofpwtre.exeFilesize
1.2MB
MD550e03c260a0f6db796aa22d7443aa105
SHA1573a47d22475dc990d57cdd33b0952b721e4ddd9
SHA2565b71ae23c39fbcd56d58ad59d4b13b0346f1f162bc5089b3ea4be35c0e621065
SHA5124528944754d4f6fae49d63c30377913ea4cf6741a37da8c91fc8ad1006fde8065de9aa96c5de03c84b78a27aecffbf43de9daa94f25408c866c605394a71d434
-
C:\Users\Admin\AppData\Local\b201d272-0ccb-4558-8c8e-23cd8cc3ae2e\E102.exeFilesize
733KB
MD584ddcfcb55c1aa1dfdce65c841fd3193
SHA1c88b590c9b54f72148143a68c09906ad93aa5904
SHA2564dc44761b41ba73b7f39b59deb8814f8ba4e8e40a81ea3118ba77a799fac2037
SHA512a5bf595f8b511c0586c1858628907db17938c82eb404b704c2556124ecc6f5908c92ff426fd79c9ca03c328eb861ff3d94299ed2e26e3db2c13068d1a77c7dda
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\dfvjwawFilesize
214KB
MD5c342eab00ac3254a68018062272d0dc2
SHA1af897a70db8914112aa4e03c8d0ecb33dbe11f27
SHA25666a0878648463450f486d63c66b48d9781a526b705222bc0dbf40836b371522f
SHA5128a572cca7fa9695434c464e3e56b3eefe8ec7d79dca2872f1af8a2268b9443d4deda7c63521ad50f5d31d2b1c68f6fa87290dec6da077ff976be9e2053d40abd
-
C:\Users\Admin\AppData\Roaming\dfvjwawFilesize
214KB
MD5c342eab00ac3254a68018062272d0dc2
SHA1af897a70db8914112aa4e03c8d0ecb33dbe11f27
SHA25666a0878648463450f486d63c66b48d9781a526b705222bc0dbf40836b371522f
SHA5128a572cca7fa9695434c464e3e56b3eefe8ec7d79dca2872f1af8a2268b9443d4deda7c63521ad50f5d31d2b1c68f6fa87290dec6da077ff976be9e2053d40abd
-
C:\Users\Admin\AppData\Roaming\ervjwawFilesize
214KB
MD52209b486f66c659550388c0a10f2a192
SHA1928a22cba3b6f234663b183716b85082ad434887
SHA25681910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3
SHA512ce7622b64d7fae08f119010d6e51f7602313e98a72625df582839264e7f4f940524805b1cbeb6359269288cab10d25118c41122dc049e73a4fd7e4888221f947
-
C:\Users\Admin\AppData\Roaming\ervjwawFilesize
214KB
MD52209b486f66c659550388c0a10f2a192
SHA1928a22cba3b6f234663b183716b85082ad434887
SHA25681910914f9c114800e294dd081e79b1608abbc88e8cc935cb46e15b7d7597de3
SHA512ce7622b64d7fae08f119010d6e51f7602313e98a72625df582839264e7f4f940524805b1cbeb6359269288cab10d25118c41122dc049e73a4fd7e4888221f947
-
\??\pipe\crashpad_2452_MSETNTDJSZEKGBGPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/624-263-0x0000000000000000-mapping.dmp
-
memory/1108-269-0x000000000D7B1000-0x000000000D7B3000-memory.dmpFilesize
8KB
-
memory/1108-277-0x0000000013970000-0x0000000013A96000-memory.dmpFilesize
1.1MB
-
memory/1108-303-0x000000000D7B1000-0x000000000D7B3000-memory.dmpFilesize
8KB
-
memory/1108-304-0x0000000013970000-0x0000000013A96000-memory.dmpFilesize
1.1MB
-
memory/1136-133-0x00000000006C0000-0x00000000006C9000-memory.dmpFilesize
36KB
-
memory/1136-132-0x0000000000742000-0x0000000000752000-memory.dmpFilesize
64KB
-
memory/1136-134-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1136-135-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1192-234-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1192-217-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1192-209-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1192-211-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1192-206-0x0000000000000000-mapping.dmp
-
memory/1340-155-0x0000000005080000-0x0000000005698000-memory.dmpFilesize
6.1MB
-
memory/1340-191-0x0000000004FB0000-0x0000000005016000-memory.dmpFilesize
408KB
-
memory/1340-190-0x0000000006140000-0x00000000066E4000-memory.dmpFilesize
5.6MB
-
memory/1340-189-0x0000000004EA0000-0x0000000004F32000-memory.dmpFilesize
584KB
-
memory/1340-194-0x0000000005F60000-0x0000000006122000-memory.dmpFilesize
1.8MB
-
memory/1340-195-0x0000000008310000-0x000000000883C000-memory.dmpFilesize
5.2MB
-
memory/1340-158-0x0000000004BD0000-0x0000000004CDA000-memory.dmpFilesize
1.0MB
-
memory/1340-142-0x0000000000000000-mapping.dmp
-
memory/1340-143-0x0000000000500000-0x0000000000560000-memory.dmpFilesize
384KB
-
memory/1340-159-0x0000000004B00000-0x0000000004B12000-memory.dmpFilesize
72KB
-
memory/1340-160-0x0000000004B60000-0x0000000004B9C000-memory.dmpFilesize
240KB
-
memory/1900-271-0x0000000006420000-0x0000000006B46000-memory.dmpFilesize
7.1MB
-
memory/1900-273-0x0000000006E00000-0x0000000006F40000-memory.dmpFilesize
1.2MB
-
memory/1900-310-0x0000000000400000-0x0000000000866000-memory.dmpFilesize
4.4MB
-
memory/1900-270-0x0000000006420000-0x0000000006B46000-memory.dmpFilesize
7.1MB
-
memory/1900-268-0x0000000000400000-0x0000000000866000-memory.dmpFilesize
4.4MB
-
memory/1900-267-0x00000000028B0000-0x0000000002D12000-memory.dmpFilesize
4.4MB
-
memory/1900-266-0x0000000000AB5000-0x0000000000ECB000-memory.dmpFilesize
4.1MB
-
memory/1900-272-0x0000000006E00000-0x0000000006F40000-memory.dmpFilesize
1.2MB
-
memory/1900-260-0x0000000000000000-mapping.dmp
-
memory/1900-275-0x0000000006E00000-0x0000000006F40000-memory.dmpFilesize
1.2MB
-
memory/1900-274-0x0000000006E00000-0x0000000006F40000-memory.dmpFilesize
1.2MB
-
memory/1900-302-0x0000000006420000-0x0000000006B46000-memory.dmpFilesize
7.1MB
-
memory/1900-301-0x0000000000400000-0x0000000000866000-memory.dmpFilesize
4.4MB
-
memory/1900-276-0x0000000006E00000-0x0000000006F40000-memory.dmpFilesize
1.2MB
-
memory/1900-278-0x0000000006E00000-0x0000000006F40000-memory.dmpFilesize
1.2MB
-
memory/1900-279-0x0000000006E00000-0x0000000006F40000-memory.dmpFilesize
1.2MB
-
memory/1900-280-0x0000000006E00000-0x0000000006F40000-memory.dmpFilesize
1.2MB
-
memory/2064-257-0x0000000000000000-mapping.dmp
-
memory/2368-175-0x00000000005B3000-0x00000000005C4000-memory.dmpFilesize
68KB
-
memory/2368-176-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/2368-147-0x0000000000000000-mapping.dmp
-
memory/2368-197-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/2368-177-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/2592-308-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/2592-307-0x00000000005C3000-0x00000000005D4000-memory.dmpFilesize
68KB
-
memory/2592-309-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/2608-196-0x0000000000000000-mapping.dmp
-
memory/2608-210-0x0000000000676000-0x0000000000707000-memory.dmpFilesize
580KB
-
memory/2804-222-0x0000000000000000-mapping.dmp
-
memory/2884-192-0x0000000000000000-mapping.dmp
-
memory/3012-219-0x0000000000000000-mapping.dmp
-
memory/3012-231-0x00000000020D0000-0x0000000002127000-memory.dmpFilesize
348KB
-
memory/3012-230-0x0000000000512000-0x0000000000543000-memory.dmpFilesize
196KB
-
memory/3080-171-0x0000000000850000-0x00000000008BB000-memory.dmpFilesize
428KB
-
memory/3080-178-0x0000000000850000-0x00000000008BB000-memory.dmpFilesize
428KB
-
memory/3080-165-0x0000000000000000-mapping.dmp
-
memory/3080-170-0x0000000000D20000-0x0000000000D95000-memory.dmpFilesize
468KB
-
memory/3120-225-0x0000000000000000-mapping.dmp
-
memory/3152-259-0x0000000000000000-mapping.dmp
-
memory/3520-183-0x0000000000684000-0x0000000000715000-memory.dmpFilesize
580KB
-
memory/3520-185-0x00000000020E0000-0x00000000021FB000-memory.dmpFilesize
1.1MB
-
memory/3520-154-0x0000000000000000-mapping.dmp
-
memory/3544-136-0x0000000000000000-mapping.dmp
-
memory/3544-167-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/3544-174-0x0000000000533000-0x0000000000594000-memory.dmpFilesize
388KB
-
memory/3544-168-0x0000000000810000-0x000000000087B000-memory.dmpFilesize
428KB
-
memory/3544-218-0x0000000000533000-0x0000000000594000-memory.dmpFilesize
388KB
-
memory/3544-216-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/3544-169-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/3560-287-0x0000000002DF0000-0x0000000002F30000-memory.dmpFilesize
1.2MB
-
memory/3560-286-0x0000000002640000-0x0000000002D66000-memory.dmpFilesize
7.1MB
-
memory/3560-290-0x0000000002640000-0x0000000002D66000-memory.dmpFilesize
7.1MB
-
memory/3560-288-0x0000000002DF0000-0x0000000002F30000-memory.dmpFilesize
1.2MB
-
memory/3560-283-0x0000000000600000-0x0000000000C06000-memory.dmpFilesize
6.0MB
-
memory/3560-285-0x0000000002DF0000-0x0000000002F30000-memory.dmpFilesize
1.2MB
-
memory/3560-139-0x0000000000000000-mapping.dmp
-
memory/3560-284-0x0000000002DF0000-0x0000000002F30000-memory.dmpFilesize
1.2MB
-
memory/3560-282-0x0000000002640000-0x0000000002D66000-memory.dmpFilesize
7.1MB
-
memory/3560-281-0x0000000000000000-mapping.dmp
-
memory/3604-200-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/3604-201-0x000000000040779C-mapping.dmp
-
memory/3604-203-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/3604-205-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/3752-161-0x0000000000000000-mapping.dmp
-
memory/3752-166-0x00007FF8E0830000-0x00007FF8E12F1000-memory.dmpFilesize
10.8MB
-
memory/3752-164-0x000002A3F9540000-0x000002A3F95D6000-memory.dmpFilesize
600KB
-
memory/3752-204-0x00007FF8E0830000-0x00007FF8E12F1000-memory.dmpFilesize
10.8MB
-
memory/4180-151-0x0000000000000000-mapping.dmp
-
memory/4180-187-0x00000000005F3000-0x0000000000604000-memory.dmpFilesize
68KB
-
memory/4180-188-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4316-182-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4316-198-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4316-179-0x0000000000000000-mapping.dmp
-
memory/4316-184-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4316-186-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4316-180-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4440-291-0x0000000000000000-mapping.dmp
-
memory/4688-227-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4688-229-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4688-232-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4688-233-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4688-226-0x0000000000000000-mapping.dmp
-
memory/4688-235-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/4688-256-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4688-258-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/4788-298-0x0000000000000000-mapping.dmp
-
memory/4928-305-0x00000000004C3000-0x00000000004D4000-memory.dmpFilesize
68KB
-
memory/4928-306-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/4944-172-0x0000000000000000-mapping.dmp
-
memory/4944-173-0x0000000000530000-0x000000000053C000-memory.dmpFilesize
48KB