Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-01-2023 08:56
Static task
static1
Behavioral task
behavioral1
Sample
ad1fb953033027b94ab896423a375bdd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ad1fb953033027b94ab896423a375bdd.exe
Resource
win10v2004-20220812-en
General
-
Target
ad1fb953033027b94ab896423a375bdd.exe
-
Size
312KB
-
MD5
ad1fb953033027b94ab896423a375bdd
-
SHA1
689cfa8078808d59e9be9904f54a5d62640449e4
-
SHA256
645f812cbd4127e6cf898910e2726957d6aa5ac5a0f8faba580beb6231137375
-
SHA512
5fb6b8bfddc3c9bfc5848181736b58b528ef60ded550d095157aef999720be89abe5be960d570c13c472d5168d96cff9cf96457a97dff56b4a9bdce72c21bb1b
-
SSDEEP
3072:bWJQLSWbck56A1ET6WHxxqPZuruvn4lunaENrOKbIxe01Cz5Mqdqujodd/Jc579h:FLSWsycfiZu6wunYyIxZ1WqqdS09h
Malware Config
Extracted
amadey
3.65
77.73.134.27/8bmdh3Slb2/index.php
Extracted
djvu
http://spaceris.com/lancer/get.php
-
extension
.zouu
-
offline_id
7hl6KB3alcoZ6n4DhS2rApCezkIMzShntAiXWMt1
-
payload_url
http://uaery.top/dl/build2.exe
http://spaceris.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-N3pXlaPXFm Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0631JOsie
Extracted
vidar
1.8
494
https://t.me/year2023start
https://steamcommunity.com/profiles/76561199467421923
-
profile_id
494
Extracted
socelars
https://hdbywe.s3.us-west-2.amazonaws.com/adwwe09/
Extracted
vidar
2
19
https://t.me/tgdatapacks
https://steamcommunity.com/profiles/76561199469677637
-
profile_id
19
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detected Djvu ransomware 10 IoCs
Processes:
resource yara_rule behavioral2/memory/1640-160-0x00000000048F0000-0x0000000004A0B000-memory.dmp family_djvu behavioral2/memory/3676-164-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3676-166-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3676-167-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3676-173-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3676-194-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4152-202-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4152-204-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4152-205-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4152-252-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Detects Smokeloader packer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5108-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader behavioral2/memory/1752-243-0x0000000002CC0000-0x0000000002CC9000-memory.dmp family_smokeloader -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1980 2404 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4476 2404 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3048 2404 rundll32.exe -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000029001\handdiy_1.exe family_socelars C:\Users\Admin\AppData\Local\Temp\1000029001\handdiy_1.exe family_socelars -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 216 3848 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 28 IoCs
Processes:
EBAD.exeF11C.exePlayer3.exeFB6E.exewangjj.exenbveek.exebuild_2023-01-06_10-15_protected.exeEBAD.exewangjj.exepb1111.exeEBAD.exeEBAD.exe34EE.exePlayer3.exewangjj.exe38C7.exebuild2.exe3B0A.exerandom.exewangjj.exebuild3.exerandom.exehanddiy_1.exebuild2.exemstsca.exenbveek.exeC3E2.exenbveek.exepid process 1640 EBAD.exe 2120 F11C.exe 1500 Player3.exe 3312 FB6E.exe 2704 wangjj.exe 1572 nbveek.exe 2732 build_2023-01-06_10-15_protected.exe 3676 EBAD.exe 4488 wangjj.exe 2664 pb1111.exe 428 EBAD.exe 4152 EBAD.exe 1636 34EE.exe 1464 Player3.exe 1648 wangjj.exe 2912 38C7.exe 260 build2.exe 1752 3B0A.exe 2372 random.exe 4932 wangjj.exe 1540 build3.exe 3912 random.exe 4832 handdiy_1.exe 3456 build2.exe 1664 mstsca.exe 1908 nbveek.exe 1280 C3E2.exe 1640 nbveek.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000027001\pb1111.exe vmprotect C:\Users\Admin\AppData\Local\Temp\1000027001\pb1111.exe vmprotect behavioral2/memory/2664-184-0x0000000140000000-0x000000014061F000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
EBAD.exewangjj.exerandom.exeEBAD.exe34EE.exenbveek.exewangjj.exebuild2.exeF11C.exePlayer3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation EBAD.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wangjj.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation random.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation EBAD.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 34EE.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation nbveek.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wangjj.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation build2.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation F11C.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Player3.exe -
Loads dropped DLL 8 IoCs
Processes:
rundll32.exerundll32.exerundll32.exebuild2.exerundll32.exerundll32.exerundll32.exepid process 4480 rundll32.exe 2660 rundll32.exe 4508 rundll32.exe 3456 build2.exe 3456 build2.exe 3848 rundll32.exe 4296 rundll32.exe 4376 rundll32.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
EBAD.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ad749fa1-11f2-4079-b2d4-ece9fab2ed89\\EBAD.exe\" --AutoStart" EBAD.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 21 api.2ip.ua 23 api.2ip.ua 60 api.2ip.ua -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
FB6E.exepid process 3312 FB6E.exe 3312 FB6E.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
EBAD.exeEBAD.exebuild2.exerundll32.exedescription pid process target process PID 1640 set thread context of 3676 1640 EBAD.exe EBAD.exe PID 428 set thread context of 4152 428 EBAD.exe EBAD.exe PID 260 set thread context of 3456 260 build2.exe build2.exe PID 3848 set thread context of 3576 3848 rundll32.exe rundll32.exe -
Drops file in Program Files directory 10 IoCs
Processes:
handdiy_1.exedescription ioc process File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json handdiy_1.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html handdiy_1.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js handdiy_1.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js handdiy_1.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js handdiy_1.exe File opened for modification C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js handdiy_1.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png handdiy_1.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js handdiy_1.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js handdiy_1.exe File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js handdiy_1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3836 4480 WerFault.exe rundll32.exe 3704 1636 WerFault.exe 34EE.exe 4032 2660 WerFault.exe rundll32.exe 1912 4508 WerFault.exe rundll32.exe 4220 2912 WerFault.exe 38C7.exe 4660 2732 WerFault.exe build_2023-01-06_10-15_protected.exe 1940 1280 WerFault.exe C3E2.exe 3096 4376 WerFault.exe rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ad1fb953033027b94ab896423a375bdd.exe3B0A.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ad1fb953033027b94ab896423a375bdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3B0A.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3B0A.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3B0A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ad1fb953033027b94ab896423a375bdd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ad1fb953033027b94ab896423a375bdd.exe -
Checks processor information in registry 2 TTPs 29 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exebuild2.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2704 schtasks.exe 4716 schtasks.exe 1812 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 260 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1468 taskkill.exe -
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Toolbar Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 -
Modifies registry class 30 IoCs
Processes:
rundll32.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000002d56344f100054656d7000003a0009000400efbe0c55ec982d56384f2e000000000000000000000000000000000000000000000000001ec9f300540065006d007000000014000000 Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 35 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 81 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 83 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
pid process 2432 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ad1fb953033027b94ab896423a375bdd.exepid process 5108 ad1fb953033027b94ab896423a375bdd.exe 5108 ad1fb953033027b94ab896423a375bdd.exe 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 2432 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2432 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
ad1fb953033027b94ab896423a375bdd.exe3B0A.exepid process 5108 ad1fb953033027b94ab896423a375bdd.exe 1752 3B0A.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
handdiy_1.exedescription pid process Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeShutdownPrivilege 2432 Token: SeCreatePagefilePrivilege 2432 Token: SeCreateTokenPrivilege 4832 handdiy_1.exe Token: SeAssignPrimaryTokenPrivilege 4832 handdiy_1.exe Token: SeLockMemoryPrivilege 4832 handdiy_1.exe Token: SeIncreaseQuotaPrivilege 4832 handdiy_1.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
chrome.exerundll32.exepid process 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2432 3576 rundll32.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe 2900 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
pid process 2432 2432 2432 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
F11C.exePlayer3.exeEBAD.exenbveek.exewangjj.execmd.exeEBAD.exedescription pid process target process PID 2432 wrote to memory of 1640 2432 EBAD.exe PID 2432 wrote to memory of 1640 2432 EBAD.exe PID 2432 wrote to memory of 1640 2432 EBAD.exe PID 2432 wrote to memory of 2120 2432 F11C.exe PID 2432 wrote to memory of 2120 2432 F11C.exe PID 2432 wrote to memory of 2120 2432 F11C.exe PID 2120 wrote to memory of 1500 2120 F11C.exe Player3.exe PID 2120 wrote to memory of 1500 2120 F11C.exe Player3.exe PID 2120 wrote to memory of 1500 2120 F11C.exe Player3.exe PID 2432 wrote to memory of 3312 2432 FB6E.exe PID 2432 wrote to memory of 3312 2432 FB6E.exe PID 2432 wrote to memory of 3312 2432 FB6E.exe PID 2120 wrote to memory of 2704 2120 F11C.exe wangjj.exe PID 2120 wrote to memory of 2704 2120 F11C.exe wangjj.exe PID 2120 wrote to memory of 2704 2120 F11C.exe wangjj.exe PID 1500 wrote to memory of 1572 1500 Player3.exe nbveek.exe PID 1500 wrote to memory of 1572 1500 Player3.exe nbveek.exe PID 1500 wrote to memory of 1572 1500 Player3.exe nbveek.exe PID 2120 wrote to memory of 2732 2120 F11C.exe build_2023-01-06_10-15_protected.exe PID 2120 wrote to memory of 2732 2120 F11C.exe build_2023-01-06_10-15_protected.exe PID 2120 wrote to memory of 2732 2120 F11C.exe build_2023-01-06_10-15_protected.exe PID 1640 wrote to memory of 3676 1640 EBAD.exe EBAD.exe PID 1640 wrote to memory of 3676 1640 EBAD.exe EBAD.exe PID 1640 wrote to memory of 3676 1640 EBAD.exe EBAD.exe PID 1640 wrote to memory of 3676 1640 EBAD.exe EBAD.exe PID 1640 wrote to memory of 3676 1640 EBAD.exe EBAD.exe PID 1640 wrote to memory of 3676 1640 EBAD.exe EBAD.exe PID 1640 wrote to memory of 3676 1640 EBAD.exe EBAD.exe PID 1640 wrote to memory of 3676 1640 EBAD.exe EBAD.exe PID 1640 wrote to memory of 3676 1640 EBAD.exe EBAD.exe PID 1640 wrote to memory of 3676 1640 EBAD.exe EBAD.exe PID 1572 wrote to memory of 1812 1572 nbveek.exe schtasks.exe PID 1572 wrote to memory of 1812 1572 nbveek.exe schtasks.exe PID 1572 wrote to memory of 1812 1572 nbveek.exe schtasks.exe PID 2704 wrote to memory of 4488 2704 wangjj.exe wangjj.exe PID 2704 wrote to memory of 4488 2704 wangjj.exe wangjj.exe PID 2704 wrote to memory of 4488 2704 wangjj.exe wangjj.exe PID 1572 wrote to memory of 672 1572 nbveek.exe cmd.exe PID 1572 wrote to memory of 672 1572 nbveek.exe cmd.exe PID 1572 wrote to memory of 672 1572 nbveek.exe cmd.exe PID 672 wrote to memory of 4936 672 cmd.exe cmd.exe PID 672 wrote to memory of 4936 672 cmd.exe cmd.exe PID 672 wrote to memory of 4936 672 cmd.exe cmd.exe PID 672 wrote to memory of 1972 672 cmd.exe cacls.exe PID 672 wrote to memory of 1972 672 cmd.exe cacls.exe PID 672 wrote to memory of 1972 672 cmd.exe cacls.exe PID 3676 wrote to memory of 396 3676 EBAD.exe icacls.exe PID 3676 wrote to memory of 396 3676 EBAD.exe icacls.exe PID 3676 wrote to memory of 396 3676 EBAD.exe icacls.exe PID 672 wrote to memory of 4948 672 cmd.exe cacls.exe PID 672 wrote to memory of 4948 672 cmd.exe cacls.exe PID 672 wrote to memory of 4948 672 cmd.exe cacls.exe PID 672 wrote to memory of 1876 672 cmd.exe cmd.exe PID 672 wrote to memory of 1876 672 cmd.exe cmd.exe PID 672 wrote to memory of 1876 672 cmd.exe cmd.exe PID 672 wrote to memory of 3864 672 cmd.exe cacls.exe PID 672 wrote to memory of 3864 672 cmd.exe cacls.exe PID 672 wrote to memory of 3864 672 cmd.exe cacls.exe PID 672 wrote to memory of 3824 672 cmd.exe cacls.exe PID 672 wrote to memory of 3824 672 cmd.exe cacls.exe PID 672 wrote to memory of 3824 672 cmd.exe cacls.exe PID 1572 wrote to memory of 2664 1572 nbveek.exe pb1111.exe PID 1572 wrote to memory of 2664 1572 nbveek.exe pb1111.exe PID 3676 wrote to memory of 428 3676 EBAD.exe EBAD.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1fb953033027b94ab896423a375bdd.exe"C:\Users\Admin\AppData\Local\Temp\ad1fb953033027b94ab896423a375bdd.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\EBAD.exeC:\Users\Admin\AppData\Local\Temp\EBAD.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EBAD.exeC:\Users\Admin\AppData\Local\Temp\EBAD.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\ad749fa1-11f2-4079-b2d4-ece9fab2ed89" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\EBAD.exe"C:\Users\Admin\AppData\Local\Temp\EBAD.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\EBAD.exe"C:\Users\Admin\AppData\Local\Temp\EBAD.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build2.exe"C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build2.exe"C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build2.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build2.exe" & exit7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build3.exe"C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build3.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\F11C.exeC:\Users\Admin\AppData\Local\Temp\F11C.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Player3.exe"C:\Users\Admin\AppData\Local\Temp\Player3.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "nbveek.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "nbveek.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\16de06bfb4" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\16de06bfb4" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000027001\pb1111.exe"C:\Users\Admin\AppData\Local\Temp\1000027001\pb1111.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000028001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000028001\random.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\1000028001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000028001\random.exe" -h5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000029001\handdiy_1.exe"C:\Users\Admin\AppData\Local\Temp\1000029001\handdiy_1.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8cc364f50,0x7ff8cc364f60,0x7ff8cc364f706⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1668 /prefetch:26⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1896 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2284 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5132 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5296 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5836 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5920 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5924 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5908 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1472 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,933763211894211212,16623270332352459633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:86⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main5⤵
- Loads dropped DLL
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4376 -s 6806⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\wangjj.exe"C:\Users\Admin\AppData\Local\Temp\wangjj.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wangjj.exe"C:\Users\Admin\AppData\Local\Temp\wangjj.exe" -h3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\build_2023-01-06_10-15_protected.exe"C:\Users\Admin\AppData\Local\Temp\build_2023-01-06_10-15_protected.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 5803⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exeC:\Users\Admin\AppData\Local\Temp\FB6E.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4480 -ip 44801⤵
-
C:\Users\Admin\AppData\Local\Temp\34EE.exeC:\Users\Admin\AppData\Local\Temp\34EE.exe1⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\Player3.exe"C:\Users\Admin\AppData\Local\Temp\Player3.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 16002⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\wangjj.exe"C:\Users\Admin\AppData\Local\Temp\wangjj.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\wangjj.exe"C:\Users\Admin\AppData\Local\Temp\wangjj.exe" -h3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\38C7.exeC:\Users\Admin\AppData\Local\Temp\38C7.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 3442⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\3B0A.exeC:\Users\Admin\AppData\Local\Temp\3B0A.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1636 -ip 16361⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 6003⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2660 -ip 26601⤵
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeC:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 6082⤵
- Program crash
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4508 -ip 45081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2912 -ip 29121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2732 -ip 27321⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\C3E2.exeC:\Users\Admin\AppData\Local\Temp\C3E2.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Rruwtqrefy.tmp",Uuhpdwiyer2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 171883⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 2842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1280 -ip 12801⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 556 -p 4376 -ip 43761⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeC:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.pngFilesize
6KB
MD5362695f3dd9c02c83039898198484188
SHA185dcacc66a106feca7a94a42fc43e08c806a0322
SHA25640cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca
SHA512a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.jsFilesize
3KB
MD5e4f23ca32cacfb4de268eb194cc21143
SHA18d747bec1f49e0de55efefe79765870ea5b1b27c
SHA2561fa3f358c7877cd49011adc35d8ac163b3b7dfa5703ac840ae01777c379cb71c
SHA512ecc4c7da2b69b9badec1fb378ad1d8773142d2fa6377ff0ab2d825568a950205cfb48752c84479863eedf3f362b84aecc9bc6c542eb8fb26f136b8df364162ca
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.jsFilesize
84KB
MD5a09e13ee94d51c524b7e2a728c7d4039
SHA10dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA256160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
SHA512f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
-
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.jsonFilesize
1KB
MD505bfb082915ee2b59a7f32fa3cc79432
SHA1c1acd799ae271bcdde50f30082d25af31c1208c3
SHA25604392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1
SHA5126feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
2KB
MD5601b920be0ad16def87b9ec3e1a91938
SHA1aba2e6c5da479ff7380f714a8536bd9a9cdec729
SHA2562ba194594a0d55b2bc4efc4b8eb5432b2788e1eb7192b83326fcdca28e9ce2b8
SHA5121b91d61b37d9276967f0940e81fd844a9295bac488a9923dfcfd586175597e4573d8817dbf711808a5dad7d32e21b953c872501f23b39051b1332ee174f7e387
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
1KB
MD55ab2ae90a7737ff9868f2cd67b2a4480
SHA1c1bb6d9a6785587ec61f8c72302ddfc3dd36cdc3
SHA256a5d983b7cbbc88ca9947355648a78593a6f1fe31f8bee558641213b00e8d5d84
SHA512c82df76e226c5c395cacdd26ee1924f7b80c90c35397cd37aa32dc8d2bf36cb262fd76771db30cfee533d3eb79e9c77a8bc076c82b716c0bcc5f739495716822
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DFilesize
488B
MD51393bfb6213f8118bcac40ffa07de046
SHA148e35fdb2927dcf2b76aeb2c2e29d967bb71079a
SHA256020bf4296e6f100a73dd762b9d8c889984ab329a3ef66df1430f500ed2bc9d02
SHA512bfe9de73d43d5fe546b93656baebf2e4d110cb430a4cfff51a9fd26040c16deac3ab1476220001303b3bff49aa2a520ecba2fe686731da4e4b40fa737c76be66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EFilesize
482B
MD5a543d363aeaced4701c42e42fab91ab9
SHA1af64a5a472cb5519fae28b8adae6428e773e278d
SHA256b954660f5fc743154e3762c657ee0787a962d069aa9f977dc55cc98648122c26
SHA512f2d562e896c8f8cde062f994a26e4d6eed864630d546c8ee658bf52cc0662c2e54181dca5ad676d0997fd8e0415e984cc2e1b62876134825338c8ff88e8a2afa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD5e5220b36979d6c685be7daa42ef4ef09
SHA1e3831a20c64db49a6166283bfe18d69b0b57cd3f
SHA2566d346ca654bf71802c02db8be42efebcf184070872478cdfc275a50c5ad9040d
SHA512183cf11556e9cf34a17646e8b76f48e586aacd3ccc539d2aaa93b45685831a58b338c0c07b0e5b257d68185bef4933ad1bb5d9469be2797da259dc5339862c65
-
C:\Users\Admin\AppData\Local\Temp\1000027001\pb1111.exeFilesize
3.5MB
MD5f5da35f30b7f43779e799bc37fe77dc7
SHA13f7238201d9fc4a97faded1e765f022a90657884
SHA256ae8ed0840c29fa1d5b68c68b2b4aa007b9a92095356c35cdd702756fed845844
SHA5125f5d349328cab5b0ee33e3037a1d2127c34c341f9a695548394276a763af2975e6acc12ad25559059237445fe62c6dae2269f25b6a07e95d3d0ca2fef95c68c1
-
C:\Users\Admin\AppData\Local\Temp\1000027001\pb1111.exeFilesize
3.5MB
MD5f5da35f30b7f43779e799bc37fe77dc7
SHA13f7238201d9fc4a97faded1e765f022a90657884
SHA256ae8ed0840c29fa1d5b68c68b2b4aa007b9a92095356c35cdd702756fed845844
SHA5125f5d349328cab5b0ee33e3037a1d2127c34c341f9a695548394276a763af2975e6acc12ad25559059237445fe62c6dae2269f25b6a07e95d3d0ca2fef95c68c1
-
C:\Users\Admin\AppData\Local\Temp\1000028001\random.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\1000028001\random.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\1000028001\random.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\1000029001\handdiy_1.exeFilesize
1.4MB
MD58d7cafd05442b87e91fb9c24335525b8
SHA1477fbd2601b80b9dfc1b3892795e522b5fc35fb9
SHA2562de8ce3d1833d91ffab371ccaf50852efa3c3c8c5442c595ca500edebbccd45d
SHA51205e76ec79e201bcbd5801361889ab8318052e45bc7b24a5f6eb6c772652b6894a23bb525b5472a5eb177a9e25a9f22530f3b078e6c0a5ed7eb554882ba1066f8
-
C:\Users\Admin\AppData\Local\Temp\1000029001\handdiy_1.exeFilesize
1.4MB
MD58d7cafd05442b87e91fb9c24335525b8
SHA1477fbd2601b80b9dfc1b3892795e522b5fc35fb9
SHA2562de8ce3d1833d91ffab371ccaf50852efa3c3c8c5442c595ca500edebbccd45d
SHA51205e76ec79e201bcbd5801361889ab8318052e45bc7b24a5f6eb6c772652b6894a23bb525b5472a5eb177a9e25a9f22530f3b078e6c0a5ed7eb554882ba1066f8
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\34EE.exeFilesize
5.8MB
MD52216166931f6637107d3476fe0665bc1
SHA1d1cf4af3c1374c28e599b8268e26575408fe097f
SHA256ee7bcbe03b47dc97be9ff40d314819a99dae85cfa544f726bbd59d2a4d770585
SHA512210bde96383317a907c214d4f342ff4e71ee8252bf8dc2b271ec7b245e74ff4946b4074230fe09a99f5a3d05d619d1559dc00e64309f2fc088e71b5ad673ff35
-
C:\Users\Admin\AppData\Local\Temp\34EE.exeFilesize
5.8MB
MD52216166931f6637107d3476fe0665bc1
SHA1d1cf4af3c1374c28e599b8268e26575408fe097f
SHA256ee7bcbe03b47dc97be9ff40d314819a99dae85cfa544f726bbd59d2a4d770585
SHA512210bde96383317a907c214d4f342ff4e71ee8252bf8dc2b271ec7b245e74ff4946b4074230fe09a99f5a3d05d619d1559dc00e64309f2fc088e71b5ad673ff35
-
C:\Users\Admin\AppData\Local\Temp\38C7.exeFilesize
282KB
MD5715c4452221ba039c901672a1d271773
SHA1e2f1d436dc2e749ee765782f9517e58961644cd9
SHA2567c613b3d6583421f012a5c43a4d6dc66ba1f0196ff9dc955a2923253d4379541
SHA5120fb1584c01d8c78e8e3887df5e1d1a40014c79f2f4156d27c8f958ccf1739202ce9cf1db1b5271136e57abf0a707b07175d07a8c40416f3cb45c8859f579a0a0
-
C:\Users\Admin\AppData\Local\Temp\38C7.exeFilesize
282KB
MD5715c4452221ba039c901672a1d271773
SHA1e2f1d436dc2e749ee765782f9517e58961644cd9
SHA2567c613b3d6583421f012a5c43a4d6dc66ba1f0196ff9dc955a2923253d4379541
SHA5120fb1584c01d8c78e8e3887df5e1d1a40014c79f2f4156d27c8f958ccf1739202ce9cf1db1b5271136e57abf0a707b07175d07a8c40416f3cb45c8859f579a0a0
-
C:\Users\Admin\AppData\Local\Temp\3B0A.exeFilesize
264KB
MD5365771354a23474b449cf4126a12e4ea
SHA110a906b12c4db92759cb986dc2ccadca4408fc2b
SHA256c6b524d45360adb79c36e5a380388b5b7814211100d751118d30c8c5723f68a9
SHA512b283a552b2285e67fcab4429d596b7bce6942f4dd6cc6b8a7c7e3fda46e3f7e7b91df8a65d7e97413ad75181b1ed28ca6a03a8c934477c0a4090f13ff330918f
-
C:\Users\Admin\AppData\Local\Temp\3B0A.exeFilesize
264KB
MD5365771354a23474b449cf4126a12e4ea
SHA110a906b12c4db92759cb986dc2ccadca4408fc2b
SHA256c6b524d45360adb79c36e5a380388b5b7814211100d751118d30c8c5723f68a9
SHA512b283a552b2285e67fcab4429d596b7bce6942f4dd6cc6b8a7c7e3fda46e3f7e7b91df8a65d7e97413ad75181b1ed28ca6a03a8c934477c0a4090f13ff330918f
-
C:\Users\Admin\AppData\Local\Temp\EBAD.exeFilesize
786KB
MD5da78a57999afef70c72a9fde567980cd
SHA1da5b1a14120237318ba4e291b47ee8a44e4bb079
SHA2566e1ca6495681df88bde3b571b83ded3a3597d643acfcd366871e5e7e9f3ef4aa
SHA512692be29a15941be606355477aafeb51db6c8408e12c8b0d94eb478ed83a4b104a36fd2e11d649bdf4e20fe4523ed4338825090edb0f069a30b5d94233a395dae
-
C:\Users\Admin\AppData\Local\Temp\EBAD.exeFilesize
786KB
MD5da78a57999afef70c72a9fde567980cd
SHA1da5b1a14120237318ba4e291b47ee8a44e4bb079
SHA2566e1ca6495681df88bde3b571b83ded3a3597d643acfcd366871e5e7e9f3ef4aa
SHA512692be29a15941be606355477aafeb51db6c8408e12c8b0d94eb478ed83a4b104a36fd2e11d649bdf4e20fe4523ed4338825090edb0f069a30b5d94233a395dae
-
C:\Users\Admin\AppData\Local\Temp\EBAD.exeFilesize
786KB
MD5da78a57999afef70c72a9fde567980cd
SHA1da5b1a14120237318ba4e291b47ee8a44e4bb079
SHA2566e1ca6495681df88bde3b571b83ded3a3597d643acfcd366871e5e7e9f3ef4aa
SHA512692be29a15941be606355477aafeb51db6c8408e12c8b0d94eb478ed83a4b104a36fd2e11d649bdf4e20fe4523ed4338825090edb0f069a30b5d94233a395dae
-
C:\Users\Admin\AppData\Local\Temp\EBAD.exeFilesize
786KB
MD5da78a57999afef70c72a9fde567980cd
SHA1da5b1a14120237318ba4e291b47ee8a44e4bb079
SHA2566e1ca6495681df88bde3b571b83ded3a3597d643acfcd366871e5e7e9f3ef4aa
SHA512692be29a15941be606355477aafeb51db6c8408e12c8b0d94eb478ed83a4b104a36fd2e11d649bdf4e20fe4523ed4338825090edb0f069a30b5d94233a395dae
-
C:\Users\Admin\AppData\Local\Temp\EBAD.exeFilesize
786KB
MD5da78a57999afef70c72a9fde567980cd
SHA1da5b1a14120237318ba4e291b47ee8a44e4bb079
SHA2566e1ca6495681df88bde3b571b83ded3a3597d643acfcd366871e5e7e9f3ef4aa
SHA512692be29a15941be606355477aafeb51db6c8408e12c8b0d94eb478ed83a4b104a36fd2e11d649bdf4e20fe4523ed4338825090edb0f069a30b5d94233a395dae
-
C:\Users\Admin\AppData\Local\Temp\F11C.exeFilesize
5.8MB
MD52216166931f6637107d3476fe0665bc1
SHA1d1cf4af3c1374c28e599b8268e26575408fe097f
SHA256ee7bcbe03b47dc97be9ff40d314819a99dae85cfa544f726bbd59d2a4d770585
SHA512210bde96383317a907c214d4f342ff4e71ee8252bf8dc2b271ec7b245e74ff4946b4074230fe09a99f5a3d05d619d1559dc00e64309f2fc088e71b5ad673ff35
-
C:\Users\Admin\AppData\Local\Temp\F11C.exeFilesize
5.8MB
MD52216166931f6637107d3476fe0665bc1
SHA1d1cf4af3c1374c28e599b8268e26575408fe097f
SHA256ee7bcbe03b47dc97be9ff40d314819a99dae85cfa544f726bbd59d2a4d770585
SHA512210bde96383317a907c214d4f342ff4e71ee8252bf8dc2b271ec7b245e74ff4946b4074230fe09a99f5a3d05d619d1559dc00e64309f2fc088e71b5ad673ff35
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exeFilesize
6.4MB
MD57a8394ee6e35e27349d08304fc2bfc0a
SHA11721f413bbf575be68df8847d2594cd646f3d9a3
SHA256951405920462017efdec538cd4b34f95ad3f3f82c7a1689ad15c7cfa5761159d
SHA51202b06481b9ea0b8318ddb302b62e284e03992da3dff3a49fc63eac9722cdad197d8f733577edb980913d8de1727552c9eb80b7f2c736ce19cc188f550c875942
-
C:\Users\Admin\AppData\Local\Temp\FB6E.exeFilesize
6.4MB
MD57a8394ee6e35e27349d08304fc2bfc0a
SHA11721f413bbf575be68df8847d2594cd646f3d9a3
SHA256951405920462017efdec538cd4b34f95ad3f3f82c7a1689ad15c7cfa5761159d
SHA51202b06481b9ea0b8318ddb302b62e284e03992da3dff3a49fc63eac9722cdad197d8f733577edb980913d8de1727552c9eb80b7f2c736ce19cc188f550c875942
-
C:\Users\Admin\AppData\Local\Temp\Player3.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\Player3.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\Player3.exeFilesize
244KB
MD543a3e1c9723e124a9b495cd474a05dcb
SHA1d293f427eaa8efc18bb8929a9f54fb61e03bdd89
SHA256619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
SHA5126717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7
-
C:\Users\Admin\AppData\Local\Temp\build_2023-01-06_10-15_protected.exeFilesize
5.4MB
MD58ddbffe44165d9aaa1278b9042b0d041
SHA1a4a7d68b7bd88fff878df1f68791650024de8873
SHA2567422caf5591db9f4db9450fa7999a62be9cb9925449df1a1ea2a844d6d584af9
SHA5128d53534ce423db3f4e95b020ae8c4f45caf896c489906bd4d0ccb194a7419376b2b79a40159d6814e661e89ee0395e6725eefd81fd48d72ca9ca40e9c7e862c9
-
C:\Users\Admin\AppData\Local\Temp\build_2023-01-06_10-15_protected.exeFilesize
5.4MB
MD58ddbffe44165d9aaa1278b9042b0d041
SHA1a4a7d68b7bd88fff878df1f68791650024de8873
SHA2567422caf5591db9f4db9450fa7999a62be9cb9925449df1a1ea2a844d6d584af9
SHA5128d53534ce423db3f4e95b020ae8c4f45caf896c489906bd4d0ccb194a7419376b2b79a40159d6814e661e89ee0395e6725eefd81fd48d72ca9ca40e9c7e862c9
-
C:\Users\Admin\AppData\Local\Temp\db.datFilesize
557KB
MD530d5f615722d12fdda4f378048221909
SHA1e94e3e3a6fae8b29f0f80128761ad1b69304a7eb
SHA256b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628
SHA512a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2
-
C:\Users\Admin\AppData\Local\Temp\db.datFilesize
557KB
MD530d5f615722d12fdda4f378048221909
SHA1e94e3e3a6fae8b29f0f80128761ad1b69304a7eb
SHA256b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628
SHA512a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2
-
C:\Users\Admin\AppData\Local\Temp\db.datFilesize
557KB
MD530d5f615722d12fdda4f378048221909
SHA1e94e3e3a6fae8b29f0f80128761ad1b69304a7eb
SHA256b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628
SHA512a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD50b35335b70b96d31633d0caa207d71f9
SHA1996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA256ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
SHA512ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD50b35335b70b96d31633d0caa207d71f9
SHA1996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA256ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
SHA512ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD50b35335b70b96d31633d0caa207d71f9
SHA1996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA256ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
SHA512ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD50b35335b70b96d31633d0caa207d71f9
SHA1996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA256ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
SHA512ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD50b35335b70b96d31633d0caa207d71f9
SHA1996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA256ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
SHA512ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
-
C:\Users\Admin\AppData\Local\Temp\db.dllFilesize
52KB
MD50b35335b70b96d31633d0caa207d71f9
SHA1996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA256ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
SHA512ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
-
C:\Users\Admin\AppData\Local\Temp\wangjj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\wangjj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\wangjj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\wangjj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\wangjj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\Temp\wangjj.exeFilesize
160KB
MD5b9363486500e209c05f97330226bbf8a
SHA1bfe2d0072d09b30ec66dee072dde4e7af26e4633
SHA25601138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
SHA5126d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534
-
C:\Users\Admin\AppData\Local\ad749fa1-11f2-4079-b2d4-ece9fab2ed89\EBAD.exeFilesize
786KB
MD5da78a57999afef70c72a9fde567980cd
SHA1da5b1a14120237318ba4e291b47ee8a44e4bb079
SHA2566e1ca6495681df88bde3b571b83ded3a3597d643acfcd366871e5e7e9f3ef4aa
SHA512692be29a15941be606355477aafeb51db6c8408e12c8b0d94eb478ed83a4b104a36fd2e11d649bdf4e20fe4523ed4338825090edb0f069a30b5d94233a395dae
-
C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build2.exeFilesize
422KB
MD5866933fee5234be619d89a6d6a60bd88
SHA1fd279d026264dbb75ea46be965ea163d94d67f0c
SHA256ab6396ad69a961a9f879e58725ed66fa01f7add478b61cbaf4db1f26a9e47185
SHA512fab7b9cfa5c38cff35068334b8525fcc1c6a5ca694f379db3322fc1bd8df9bbfa3446504297fec4c42c55e805fee2be9f96a3eff8eed7db72816a080aff7933d
-
C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build2.exeFilesize
422KB
MD5866933fee5234be619d89a6d6a60bd88
SHA1fd279d026264dbb75ea46be965ea163d94d67f0c
SHA256ab6396ad69a961a9f879e58725ed66fa01f7add478b61cbaf4db1f26a9e47185
SHA512fab7b9cfa5c38cff35068334b8525fcc1c6a5ca694f379db3322fc1bd8df9bbfa3446504297fec4c42c55e805fee2be9f96a3eff8eed7db72816a080aff7933d
-
C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build2.exeFilesize
422KB
MD5866933fee5234be619d89a6d6a60bd88
SHA1fd279d026264dbb75ea46be965ea163d94d67f0c
SHA256ab6396ad69a961a9f879e58725ed66fa01f7add478b61cbaf4db1f26a9e47185
SHA512fab7b9cfa5c38cff35068334b8525fcc1c6a5ca694f379db3322fc1bd8df9bbfa3446504297fec4c42c55e805fee2be9f96a3eff8eed7db72816a080aff7933d
-
C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\bd667698-028b-449a-ae35-db9c75976452\build3.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
\??\pipe\crashpad_2900_AEJNUTDNGXHAPWZQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/260-221-0x0000000000000000-mapping.dmp
-
memory/260-302-0x0000000000000000-mapping.dmp
-
memory/260-258-0x00000000004CD000-0x00000000004FA000-memory.dmpFilesize
180KB
-
memory/260-259-0x00000000020D0000-0x000000000211C000-memory.dmpFilesize
304KB
-
memory/396-176-0x0000000000000000-mapping.dmp
-
memory/428-193-0x0000000000000000-mapping.dmp
-
memory/428-203-0x0000000004859000-0x00000000048EA000-memory.dmpFilesize
580KB
-
memory/672-172-0x0000000000000000-mapping.dmp
-
memory/1280-305-0x0000000002162000-0x0000000002246000-memory.dmpFilesize
912KB
-
memory/1280-303-0x0000000000000000-mapping.dmp
-
memory/1280-306-0x0000000002300000-0x0000000002424000-memory.dmpFilesize
1.1MB
-
memory/1280-307-0x0000000000400000-0x0000000000525000-memory.dmpFilesize
1.1MB
-
memory/1464-213-0x0000000000000000-mapping.dmp
-
memory/1468-269-0x0000000000000000-mapping.dmp
-
memory/1500-144-0x0000000000000000-mapping.dmp
-
memory/1540-233-0x0000000000000000-mapping.dmp
-
memory/1572-152-0x0000000000000000-mapping.dmp
-
memory/1636-210-0x0000000000000000-mapping.dmp
-
memory/1640-160-0x00000000048F0000-0x0000000004A0B000-memory.dmpFilesize
1.1MB
-
memory/1640-137-0x0000000000000000-mapping.dmp
-
memory/1640-159-0x0000000004823000-0x00000000048B4000-memory.dmpFilesize
580KB
-
memory/1648-215-0x0000000000000000-mapping.dmp
-
memory/1752-242-0x0000000002CED000-0x0000000002CFD000-memory.dmpFilesize
64KB
-
memory/1752-243-0x0000000002CC0000-0x0000000002CC9000-memory.dmpFilesize
36KB
-
memory/1752-224-0x0000000000000000-mapping.dmp
-
memory/1752-270-0x0000000000400000-0x0000000002BAA000-memory.dmpFilesize
39.7MB
-
memory/1752-244-0x0000000000400000-0x0000000002BAA000-memory.dmpFilesize
39.7MB
-
memory/1812-168-0x0000000000000000-mapping.dmp
-
memory/1876-178-0x0000000000000000-mapping.dmp
-
memory/1972-175-0x0000000000000000-mapping.dmp
-
memory/2120-140-0x0000000000000000-mapping.dmp
-
memory/2120-143-0x0000000000C10000-0x00000000011E4000-memory.dmpFilesize
5.8MB
-
memory/2372-227-0x0000000000000000-mapping.dmp
-
memory/2660-247-0x0000000000000000-mapping.dmp
-
memory/2664-181-0x0000000000000000-mapping.dmp
-
memory/2664-184-0x0000000140000000-0x000000014061F000-memory.dmpFilesize
6.1MB
-
memory/2704-150-0x0000000000000000-mapping.dmp
-
memory/2704-236-0x0000000000000000-mapping.dmp
-
memory/2732-279-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/2732-198-0x0000000000400000-0x0000000002C57000-memory.dmpFilesize
40.3MB
-
memory/2732-197-0x0000000002FB0000-0x0000000002FFC000-memory.dmpFilesize
304KB
-
memory/2732-153-0x0000000000000000-mapping.dmp
-
memory/2732-278-0x0000000002CF6000-0x0000000002D23000-memory.dmpFilesize
180KB
-
memory/2732-196-0x0000000002CF6000-0x0000000002D23000-memory.dmpFilesize
180KB
-
memory/2912-267-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2912-216-0x0000000000000000-mapping.dmp
-
memory/2912-266-0x00000000007CD000-0x00000000007E2000-memory.dmpFilesize
84KB
-
memory/3312-161-0x0000000000400000-0x0000000000E0C000-memory.dmpFilesize
10.0MB
-
memory/3312-217-0x0000000000400000-0x0000000000E0C000-memory.dmpFilesize
10.0MB
-
memory/3312-170-0x0000000000400000-0x0000000000E0C000-memory.dmpFilesize
10.0MB
-
memory/3312-147-0x0000000000000000-mapping.dmp
-
memory/3312-271-0x0000000000400000-0x0000000000E0C000-memory.dmpFilesize
10.0MB
-
memory/3456-299-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/3456-280-0x0000000050950000-0x00000000509E2000-memory.dmpFilesize
584KB
-
memory/3456-254-0x0000000000000000-mapping.dmp
-
memory/3456-255-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/3456-265-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/3456-257-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/3456-301-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/3456-260-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/3576-318-0x00007FF7733D6890-mapping.dmp
-
memory/3576-320-0x000001E69E700000-0x000001E69E840000-memory.dmpFilesize
1.2MB
-
memory/3576-319-0x000001E69E700000-0x000001E69E840000-memory.dmpFilesize
1.2MB
-
memory/3576-321-0x00000000009B0000-0x0000000000C48000-memory.dmpFilesize
2.6MB
-
memory/3576-322-0x000001E69CCB0000-0x000001E69CF59000-memory.dmpFilesize
2.7MB
-
memory/3676-194-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3676-166-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3676-164-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3676-167-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3676-173-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3676-162-0x0000000000000000-mapping.dmp
-
memory/3740-300-0x0000000000000000-mapping.dmp
-
memory/3824-180-0x0000000000000000-mapping.dmp
-
memory/3848-314-0x0000000004F30000-0x0000000005070000-memory.dmpFilesize
1.2MB
-
memory/3848-304-0x0000000000000000-mapping.dmp
-
memory/3848-323-0x0000000006C70000-0x000000000779F000-memory.dmpFilesize
11.2MB
-
memory/3848-311-0x0000000006C70000-0x000000000779F000-memory.dmpFilesize
11.2MB
-
memory/3848-310-0x0000000006C70000-0x000000000779F000-memory.dmpFilesize
11.2MB
-
memory/3848-312-0x0000000004F30000-0x0000000005070000-memory.dmpFilesize
1.2MB
-
memory/3848-313-0x0000000004F30000-0x0000000005070000-memory.dmpFilesize
1.2MB
-
memory/3848-315-0x0000000004F30000-0x0000000005070000-memory.dmpFilesize
1.2MB
-
memory/3848-317-0x0000000004F30000-0x0000000005070000-memory.dmpFilesize
1.2MB
-
memory/3848-316-0x0000000004F30000-0x0000000005070000-memory.dmpFilesize
1.2MB
-
memory/3864-179-0x0000000000000000-mapping.dmp
-
memory/3912-237-0x0000000000000000-mapping.dmp
-
memory/4128-268-0x0000000000000000-mapping.dmp
-
memory/4152-199-0x0000000000000000-mapping.dmp
-
memory/4152-252-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4152-205-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4152-204-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4152-202-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4296-308-0x0000000000000000-mapping.dmp
-
memory/4376-309-0x0000000000000000-mapping.dmp
-
memory/4480-190-0x0000000000000000-mapping.dmp
-
memory/4488-169-0x0000000000000000-mapping.dmp
-
memory/4508-251-0x0000000000000000-mapping.dmp
-
memory/4716-264-0x0000000000000000-mapping.dmp
-
memory/4832-239-0x0000000000000000-mapping.dmp
-
memory/4932-231-0x0000000000000000-mapping.dmp
-
memory/4936-174-0x0000000000000000-mapping.dmp
-
memory/4948-177-0x0000000000000000-mapping.dmp
-
memory/5108-132-0x0000000000692000-0x00000000006A7000-memory.dmpFilesize
84KB
-
memory/5108-136-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/5108-133-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/5108-134-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/5108-135-0x0000000000692000-0x00000000006A7000-memory.dmpFilesize
84KB