lumma | 03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51

Analysis

max time kernel
104s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2023 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe
Size

210KB
MD5

c1421d6a836ddbcd0560462a005a7018
SHA1

d97043fadec45054729cb723bbea2b00db911e15
SHA256

03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51
SHA512

03306e092695be2d28978b8c983b023c934687859590eba8bd7f8e9280a2f69bcd769da2be36d6dbb371e22b14bc49e81f875d4782a894dc87055d7dca558664
SSDEEP

3072:KXW3PspHHs53YoYlffh0arn+oDR0CfFvjKk19cupSr9/i:qxSYoYjF+wxKk19vYr

Score

10^/10

lumma smokeloader backdoor discovery persistence stealer trojan

Malware Config

Extracted

Family

lumma

77.73.134.68

Signatures

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1404-133-0x0000000002D20000-0x0000000002D29000-memory.dmp	family_smokeloader

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

56 396 rundll32.exe
62 396 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

7937.exeF1B4.exe

pid process

3808 7937.exe
2388 F1B4.exe

flow	pid	process
56	396	rundll32.exe
62	396	rundll32.exe

pid	process
3808	7937.exe
2388	F1B4.exe

Sets DLL path for service in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Words\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Words.dll가"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Words\Parameters\ServiceDll = "C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Words.dllȀ"	rundll32.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Words\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService"	rundll32.exe

Loads dropped DLL 2 IoCs

Processes:

rundll32.exesvchost.exe

pid process

396 rundll32.exe
3892 svchost.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
396	rundll32.exe
3892	svchost.exe

Drops file in Program Files directory 12 IoCs

Processes:

rundll32.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\download.svg	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CPDF_Full.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\download.svg	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\TrackedSend.aapp	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\main-high-contrast.css	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\submission_history.gif	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\TrackedSend.aapp	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	rundll32.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\submission_history.gif	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Words.dll	rundll32.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\LogTransport2.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

3756 3808 WerFault.exe 7937.exe
1928 2388 WerFault.exe F1B4.exe
216 4568 WerFault.exe 5e7a7179.exe

pid	pid_target	process	target process
3756	3808	WerFault.exe	7937.exe
1928	2388	WerFault.exe	F1B4.exe
216	4568	WerFault.exe	5e7a7179.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe

pid	process
1404	03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe
1404	03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492
2492

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2492
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe

pid process

1404 03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

rundll32.exe

description pid process

Token: SeShutdownPrivilege 2492
Token: SeCreatePagefilePrivilege 2492
Token: SeDebugPrivilege 396 rundll32.exe

pid	process
2492

description	pid	process
Token: SeShutdownPrivilege	2492
Token: SeCreatePagefilePrivilege	2492
Token: SeDebugPrivilege	396	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

7937.exe

description	pid	process	target process
PID 2492 wrote to memory of 3808	2492		7937.exe
PID 2492 wrote to memory of 3808	2492		7937.exe
PID 2492 wrote to memory of 3808	2492		7937.exe
PID 3808 wrote to memory of 396	3808	7937.exe	rundll32.exe
PID 3808 wrote to memory of 396	3808	7937.exe	rundll32.exe
PID 3808 wrote to memory of 396	3808	7937.exe	rundll32.exe
PID 2492 wrote to memory of 2388	2492		F1B4.exe
PID 2492 wrote to memory of 2388	2492		F1B4.exe
PID 2492 wrote to memory of 2388	2492		F1B4.exe

C:\Users\Admin\AppData\Local\Temp\03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe
"C:\Users\Admin\AppData\Local\Temp\03e90fb4cf597e899563b5b998fcb606d5630ecb7542dffe6771dcb1b88e5d51.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1404

C:\Users\Admin\AppData\Local\Temp\7937.exe
C:\Users\Admin\AppData\Local\Temp\7937.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp",Qowsuiaedfeupa
2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18636
3⤵
PID:4156

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:3008

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:2808

C:\Users\Admin\AppData\Local\Temp\5e7a7179.exe
C:\Users\Admin\AppData\Local\Temp\5e7a7179.exe
3⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 388
4⤵
- Program crash
PID:216

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18636
3⤵
PID:1572

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:2164

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18636
3⤵
PID:4752

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:4344

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18636
3⤵
PID:2232

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:3608

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:4744

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18636
3⤵
PID:4564

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:4368

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:4772

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18636
3⤵
PID:1192

C:\Windows\SysWOW64\schtasks.exe
schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:2768

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
3⤵
PID:2824

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18636
3⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 536
2⤵
- Program crash
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3808 -ip 3808
1⤵
PID:204

C:\Users\Admin\AppData\Local\Temp\F1B4.exe
C:\Users\Admin\AppData\Local\Temp\F1B4.exe
1⤵
- Executes dropped EXE
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 1364
2⤵
- Program crash
PID:1928

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k LocalService
1⤵
- Loads dropped DLL
PID:3892

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\words.dll",KyALVjVia1Bz
2⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2388 -ip 2388
1⤵
PID:3192

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4568 -ip 4568
1⤵
PID:4232

C:\Program Files\Google\Chrome\Application\chrome.exe
"chrome.exe" --no-first-run --no-default-browser-check --silent-launch --restore-last-session --disable-backgrounding-occluded-windows --disable-background-timer-throttling --disable-extensions-http-throttling --disable-renderer-backgrounding --disable-audio-output --disable-crash-reporter --ran-launcher --profile-directory="Default"
1⤵
PID:4812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa44404f50,0x7ffa44404f60,0x7ffa44404f70
2⤵
PID:1484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1652 /prefetch:2
2⤵
PID:1500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=network --disable-audio-output --mojo-platform-channel-handle=1976 /prefetch:8
2⤵
PID:4104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=2284 /prefetch:8
2⤵
PID:4644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=3560 /prefetch:8
2⤵
PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=3856 /prefetch:8
2⤵
PID:3596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --disable-extensions-http-throttling --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
2⤵
PID:5056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --disable-extensions-http-throttling --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
2⤵
PID:4088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --disable-extensions-http-throttling --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
2⤵
PID:4944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=4400 /prefetch:8
2⤵
PID:4116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --disable-gpu-compositing --lang=en-US --disable-extensions-http-throttling --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4384 /prefetch:1
2⤵
PID:5092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=4628 /prefetch:8
2⤵
PID:3908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=4136 /prefetch:8
2⤵
PID:3756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-extensions-http-throttling --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
2⤵
PID:3540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=5112 /prefetch:8
2⤵
PID:1304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=5420 /prefetch:8
2⤵
PID:4444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=5808 /prefetch:8
2⤵
PID:1880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=none --disable-audio-output --mojo-platform-channel-handle=4092 /prefetch:8
2⤵
PID:4368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=5904 /prefetch:8
2⤵
PID:2884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=5784 /prefetch:8
2⤵
PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=utility --disable-audio-output --mojo-platform-channel-handle=5300 /prefetch:8
2⤵
PID:4560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --lang=en-US --service-sandbox-type=none --disable-audio-output --mojo-platform-channel-handle=4412 /prefetch:8
2⤵
PID:4384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-background-timer-throttling --field-trial-handle=1588,8687280704804852944,12827463760241799434,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-extensions-http-throttling --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
2⤵
PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WindowsPowerShell\Modules\Words.dll
Filesize
774KB

MD5
c3f8aa11efdd7173b4d2000907009e5b

SHA1
666a91f03707d0fe79f34bc977279f8272b3f2ff

SHA256
76dadda10eb1aefd5e1c9b72907de80586783b049e5e5493c900e95b3fbbacb9

SHA512
8106ba5013b532b47d85d673ecb2f35c4ee1b5d5b9c808b20fba592002f3b195d5a3291eb7abb91b7d566e39a1dde8ff2b569304a8c2d03fb16581bcb4cd2bbd

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\Words.dll
Filesize
774KB

MD5
c3f8aa11efdd7173b4d2000907009e5b

SHA1
666a91f03707d0fe79f34bc977279f8272b3f2ff

SHA256
76dadda10eb1aefd5e1c9b72907de80586783b049e5e5493c900e95b3fbbacb9

SHA512
8106ba5013b532b47d85d673ecb2f35c4ee1b5d5b9c808b20fba592002f3b195d5a3291eb7abb91b7d566e39a1dde8ff2b569304a8c2d03fb16581bcb4cd2bbd

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml
Filesize
30KB

MD5
98de295b21abe2451f86b82df3be269a

SHA1
1665a23d307748e8c1c0164ba7939275f9fb676c

SHA256
fd3507cd60edf41093c8fe843d1601e33db9cbe1cd36247cec587c265109bcfa

SHA512
230ae283c81771496dcae9ef84787379712106738ea82754b101af9047ae27cadb8b1f4aed00d146a699c22fd1c505c31068418a70d2b535c85c3017726d91cc

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\C2RManifest.proofing.msi.16.en-us.xml
Filesize
1KB

MD5
d23cf0da0462ecbb77509f23f26edc57

SHA1
b0a3353089a1c174a092e7a791d286bb28bb764c

SHA256
9fc823530ff0f81c7064fb67d0f6932ad735897a2f5479a8f1d298075b04817f

SHA512
a113d35757e4abebede230ca695b2163f44910bdca6253ad65d3649ab1cdaa16da966f01dc1c85d782ed775757915c130e39d6aa008ff5b926674ac353d23dff

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe.xml
Filesize
15KB

MD5
2f71d0396b93381c1fd86bf822612868

SHA1
d0801700dd00a51276f32c6ed19f5b713b5db825

SHA256
0543ea8c8efce3d69431f57affc2cfa44df1b9244a25ed080e4b2014d0419026

SHA512
67022ce5c41641799abff9e68cb3f049c5d932aea5c6fd8748469e2e7f51f987f1bdfc7d831a8d11a69d99a77cc363c51db8be6ad50e4014eb63a15c1f25a722

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe.xml
Filesize
15KB

MD5
c73eeb9dedd94a612969e003260e6341

SHA1
0451277183bad12e3179c12c0a14694fab52bc8d

SHA256
1ee54a9294af6727770aff79f2c901cd40ca23dfb4803788042aada54146e355

SHA512
d78542d9c74efeac1d925d9d05c691c5543d04e6b671a5ef160f0fafc3b4444d327cf37206d78f43b607f817b6545cb9673b85d713b8c59d0c97103aee55245a

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\Uqioyhuair.tmp
Filesize
3.5MB

MD5
9fdd4bd92a45fe758f3536f795db13ae

SHA1
3c6c337e02bd93b602ccf700164d6ba5c5d7e4a9

SHA256
75e2c19f61cfb5c30d0d2ef11127f8c50be216f6099394c477a912a97aa6ef08

SHA512
495b754c445a02b8321619aecaaad3052fa26efe0b044de7f12e19a64061d5cd1e84971c1ddf2909a1e63f3bbc593d41988d9de32e6303c8bc6d7256dcc5ecaf

Download Submit
C:\ProgramData\{AD22A7C3-A288-2107-49C0-5B9511BAC117}\wmp.ico
Filesize
110KB

MD5
589ff0b7d4d0d3fced65c3eae6559657

SHA1
4be3e4221a429b347888bbe3635e377271974c7f

SHA256
0e96c027d23a57e95103d1b64e4c5b8a153402f05b756dfcb737459476aaae35

SHA512
4a12bac3f61964d6c5608bbb9067d7673cd5e5a22463f6d16f402954045692f43ef1ea32d405f452d415c859c30b217e9d250a1c5c85cfd629bd393824b6523b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000001
Filesize
36KB

MD5
e5a1f63c3a59566d5efbbfa69e49fb62

SHA1
f7f302caa695a5a99a68b9ffbb28ffe74438b9ac

SHA256
4e5b2316f3332bdfbc8e09941f89f0193657469940444a1e6cb2970c96c12b7e

SHA512
9149ca7515dc96dd87370b833d39efa7a88a307027d705ec2418d8c25d6339ee5826d29306ca8f5dc45c5346e6f708be1c66d9d90f073bd28da6e806e7b5a8ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000002
Filesize
46KB

MD5
9262812dd9643b893311506ff071e5b4

SHA1
f0a898c4b39193e100cb8a4a0f93e011a2a6000e

SHA256
53703833e65dfdb1dd009aa4708a3b404e37220cb5bba3678f7c973108c70b10

SHA512
046a3d076e5e1643b770a7477c0ce4eedd3fe612a3a5dc9bff99e8bbecd88772573ffbb65482520b5f24fdfd4e7c8adaf7b08c94d69675333f03695371045d97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000003
Filesize
35KB

MD5
3dc6b3c0bb1af8db47bd8cdd43543aa7

SHA1
9af4fcc16ff6b8ab30e398c07ef54e1df07768a3

SHA256
f68d1793e65c52c4fd9578e7ffabd7af2d186838787ae9c50665f92a2b17ec25

SHA512
83b72699e64b2f50ab388000de0dbeb14bf2f1ea76d279b3db1686c9d6d168176cd02463dc3995deaa007126b3cd79fbacf16022fcb9f19b25e0fdbc40c75e3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfphnfidboobkpiaioopommeghjmcjjk\7.2.289_0\128.png
Filesize
4KB

MD5
913064adaaa4c4fa2a9d011b66b33183

SHA1
99ea751ac2597a080706c690612aeeee43161fc1

SHA256
afb4ce8882ef7ae80976eba7d87f6e07fcddc8e9e84747e8d747d1e996dea8eb

SHA512
162bf69b1ad5122c6154c111816e4b87a8222e6994a72743ed5382d571d293e1467a2ed2fc6cc27789b644943cf617a56da530b6a6142680c5b2497579a632b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfphnfidboobkpiaioopommeghjmcjjk\7.2.289_0\background.html
Filesize
134B

MD5
65ce5b25fe1583e7de0f5afc598bd249

SHA1
0f4c886bc5c742cd2f4dc3643c934af7d9d3f7be

SHA256
47a72b45362a3cb35d6a70f105e38ab2c4376e9181c37bd169172809b432e2b5

SHA512
397bbdc88d52b2a97abcf2ad338c4ea764dcdbd9731f01cb7c5898f728ae0b6fb4fdf3312bac7891b83d9cb67d7ba7b7f4a9eda834babbce56a68e7ca954b1ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfphnfidboobkpiaioopommeghjmcjjk\7.2.289_0\manifest.json
Filesize
1KB

MD5
084f9dba3258a0c0f0919de187ba494f

SHA1
f520d156cca65fd5c8fdfb6202e66ef2edb593c9

SHA256
c394f997b58b015be33f848b0cbc3cc8a87460069abe228bdd460f1a7694a5df

SHA512
846712ec299ae804de454715a4cd54f8007ac410e12b79e2b8762c27542d2a78ceeb8405cd2f67e51d2d06bddadebb201fe056c5d595313937e6f781de123228

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Filesize
531KB

MD5
6eebed29e6a6301e92a9b8b347807f5f

SHA1
65dfb69b650560551110b33dcba50b25e5b876de

SHA256
04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697

SHA512
fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\craw_window.css
Filesize
1KB

MD5
67bf9aabe17541852f9ddff8245096cd

SHA1
a4ac74dd258e8e0689034faa1b15a5c7c56dc3bb

SHA256
10dfbd2d98950b79ee12f6b8e3885aabe31543048de56ad4fc0a5e34d0d9d4ec

SHA512
298fa132c6f122798fdb9bc6de8024915147adc20355b56a92f0ed9acce4549be6e7f42212e07dca166e31624d4e66e299565845d4ba1c51ca935050641b61fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif
Filesize
68KB

MD5
398abb308eebc355da70bce907b22e29

SHA1
cffb77b8a1724b8f81d98c6d6ad0071d10162252

SHA256
2b73533f47a99ffea9cc405ffafa9c4c53623f62487aebfba415945120b22040

SHA512
fc7a56fc8a61a582161874b54adbad30a84840190008edb0b6fbf84f91393ca58e988e3fe446f11a0c3c691c18249b93aec2904b3d0c4f0857d79034f662385a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png
Filesize
4KB

MD5
4dbc9f9e6f5a08d299bac9e54df07694

SHA1
bb38f5de34b1e0be1109220ba55271087a4d9ea5

SHA256
91c2718dd23b4356d71f88f6146868369033291086df327534546dfa459beb0e

SHA512
a5f2b1f47502836130d8083f757b7773c1e1cb36b76ad298cc29ab2b428c8002d2f15bd839838fc326dac3681c2f48ab25a3e7631d33726c4b25e8ec14170912

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png
Filesize
558B

MD5
fb9c46ea81ad3e456d90d58697c12c06

SHA1
5fc450f7d73ccfac8f0d818cb3392ba4d91b69de

SHA256
016ca659ba080e194fbfc0929602b16506ed60aa6019faa51410c4fd93b583e8

SHA512
add810ee9eb7caec505b5fd90a1f184ce39d8f8c689dcc240f188fe353b9575489492e07d572a3b1c11a1555ce66afca5134903e4c1aa3d54bc7c5ed3e65b50c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
ce6641baa223a7c780129908477786c3

SHA1
558c088741ea8e67184b5dd9af6827dcfe34a7b2

SHA256
882faecae53204d2b4d2f2012b901b99b3629eec76781ae22b42e2af667f4a04

SHA512
28e6b174952386130ee2b9ec0f3b6be9e1d4f82a5e1ce58eb9327025fb617345a340cf89367cd58655019eb52bd8ee0adbbeea69a300444364c50d63da261f49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
697d70199b842117bbd13c28f9d53701

SHA1
519c27a256bfbc2cf2b78891d56a547f12bfa08c

SHA256
02c5fe22183f764c2d17e4f6152748f5d1549e794e14bb643f64c1e93e507fd2

SHA512
33e1dc1a7157b5a572edb606cfd199cc5b56db95ac2dfafcbddf638e1e70a2634b3c01f7f5da92e0ac43dc2ab7bec6680aebb67b40b3ef620f3ce15b972864c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e7a7179.exe
Filesize
2.6MB

MD5
b4985dcbd4cd1e1529a87adbebec34f1

SHA1
0a9d1c53967da5c078e702251a10d4e7a7f3db16

SHA256
5c1b9418f3afac3767d38544a19b3cbcff8ebf91f5bc38273c5b71e040516586

SHA512
4f27d43f280426da183b78e3cd8bf0ac1ac43301cd0af75b5c56adb2ffb213f702e717ddc381ab1122e675e415cd2b7b323ebe7687d7cef9de1c1d753616bdf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e7a7179.exe
Filesize
2.6MB

MD5
b4985dcbd4cd1e1529a87adbebec34f1

SHA1
0a9d1c53967da5c078e702251a10d4e7a7f3db16

SHA256
5c1b9418f3afac3767d38544a19b3cbcff8ebf91f5bc38273c5b71e040516586

SHA512
4f27d43f280426da183b78e3cd8bf0ac1ac43301cd0af75b5c56adb2ffb213f702e717ddc381ab1122e675e415cd2b7b323ebe7687d7cef9de1c1d753616bdf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7937.exe
Filesize
1.1MB

MD5
9cbdebd30262dff137a1b9995d0627d9

SHA1
31be5635d7b6ab5b359db799a00276c35cdd3177

SHA256
ebd03a5a1da8adbde8bf48e710abeee4ea314a28cc423c23eb21029b0e58624f

SHA512
21c3b8963010524b1db58e406827e099f5efd069d0f0ed5b78cddca4ae75a93e9b39372dc7c69416a6f6bf47ed52b059ea12d71ff4778617147478ead9e2ea82

Download Submit
C:\Users\Admin\AppData\Local\Temp\7937.exe
Filesize
1.1MB

MD5
9cbdebd30262dff137a1b9995d0627d9

SHA1
31be5635d7b6ab5b359db799a00276c35cdd3177

SHA256
ebd03a5a1da8adbde8bf48e710abeee4ea314a28cc423c23eb21029b0e58624f

SHA512
21c3b8963010524b1db58e406827e099f5efd069d0f0ed5b78cddca4ae75a93e9b39372dc7c69416a6f6bf47ed52b059ea12d71ff4778617147478ead9e2ea82

Download Submit
C:\Users\Admin\AppData\Local\Temp\F1B4.exe
Filesize
248KB

MD5
8fb1199711c3b6afd7aa7b8595929e7f

SHA1
ff8f1814fff095fa7cfd6c2bb07a1595b83c89c0

SHA256
f30ab3c5c9a72ef605d9e171dc9d22e39d1f1114c36d87c24a16b8ccb4a5f749

SHA512
dbd8765a9fcebee920335e41da43fc1b025460e3c1293a803be4f440a3cd6c0823f1f3bcd618a49ac8c7d07c29876ec8e2023e11c491f32faf16401a60821926

Download Submit
C:\Users\Admin\AppData\Local\Temp\F1B4.exe
Filesize
248KB

MD5
8fb1199711c3b6afd7aa7b8595929e7f

SHA1
ff8f1814fff095fa7cfd6c2bb07a1595b83c89c0

SHA256
f30ab3c5c9a72ef605d9e171dc9d22e39d1f1114c36d87c24a16b8ccb4a5f749

SHA512
dbd8765a9fcebee920335e41da43fc1b025460e3c1293a803be4f440a3cd6c0823f1f3bcd618a49ac8c7d07c29876ec8e2023e11c491f32faf16401a60821926

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Filesize
774KB

MD5
e06fb66bfbe1444cc091f0297b8d32db

SHA1
c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af

SHA256
b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d

SHA512
c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Filesize
774KB

MD5
e06fb66bfbe1444cc091f0297b8d32db

SHA1
c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af

SHA256
b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d

SHA512
c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95

Download Submit
\??\c:\program files (x86)\windowspowershell\modules\words.dll
Filesize
774KB

MD5
c3f8aa11efdd7173b4d2000907009e5b

SHA1
666a91f03707d0fe79f34bc977279f8272b3f2ff

SHA256
76dadda10eb1aefd5e1c9b72907de80586783b049e5e5493c900e95b3fbbacb9

SHA512
8106ba5013b532b47d85d673ecb2f35c4ee1b5d5b9c808b20fba592002f3b195d5a3291eb7abb91b7d566e39a1dde8ff2b569304a8c2d03fb16581bcb4cd2bbd

Download Submit
\??\pipe\crashpad_4812_NZTFPJEVJFHNXKXB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/396-257-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-200-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-168-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-169-0x0000000006FD0000-0x0000000007110000-memory.dmp

Filesize
1.2MB

Download
memory/396-170-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-153-0x00000000050B0000-0x0000000005C05000-memory.dmp

Filesize
11.3MB

Download
memory/396-171-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-240-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-230-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-229-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-228-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-227-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-247-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-215-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-216-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-258-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-148-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-214-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-256-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-185-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-149-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-147-0x00000000050B0000-0x0000000005C05000-memory.dmp

Filesize
11.3MB

Download
memory/396-188-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-189-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-190-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-213-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-246-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-139-0x0000000000000000-mapping.dmp

Download
memory/396-146-0x00000000050B0000-0x0000000005C05000-memory.dmp

Filesize
11.3MB

Download
memory/396-241-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-255-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-202-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-201-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/396-199-0x00000000046D0000-0x0000000004810000-memory.dmp

Filesize
1.2MB

Download
memory/1192-253-0x00000248A03A0000-0x00000248A0655000-memory.dmp

Filesize
2.7MB

Download
memory/1192-251-0x00000248A03A0000-0x00000248A0655000-memory.dmp

Filesize
2.7MB

Download
memory/1192-250-0x00000248A0240000-0x00000248A0380000-memory.dmp

Filesize
1.2MB

Download
memory/1192-249-0x00000248A0240000-0x00000248A0380000-memory.dmp

Filesize
1.2MB

Download
memory/1192-248-0x00007FF68FFA6890-mapping.dmp

Download
memory/1404-133-0x0000000002D20000-0x0000000002D29000-memory.dmp

Filesize
36KB

Download
memory/1404-135-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download
memory/1404-132-0x0000000002F58000-0x0000000002F69000-memory.dmp

Filesize
68KB

Download
memory/1404-134-0x0000000000400000-0x0000000002B9D000-memory.dmp

Filesize
39.6MB

Download
memory/1572-195-0x00000160B0090000-0x00000160B0345000-memory.dmp

Filesize
2.7MB

Download
memory/1572-193-0x00000160B1960000-0x00000160B1AA0000-memory.dmp

Filesize
1.2MB

Download
memory/1572-194-0x00000160B0090000-0x00000160B0345000-memory.dmp

Filesize
2.7MB

Download
memory/1572-192-0x00000160B1960000-0x00000160B1AA0000-memory.dmp

Filesize
1.2MB

Download
memory/1572-191-0x00007FF68FFA6890-mapping.dmp

Download
memory/1928-262-0x0000020EACE20000-0x0000020EAD0D5000-memory.dmp

Filesize
2.7MB

Download
memory/1928-259-0x00007FF68FFA6890-mapping.dmp

Download
memory/1928-261-0x0000020EAE880000-0x0000020EAE9C0000-memory.dmp

Filesize
1.2MB

Download
memory/1928-260-0x0000020EAE880000-0x0000020EAE9C0000-memory.dmp

Filesize
1.2MB

Download
memory/2164-197-0x0000000000000000-mapping.dmp

Download
memory/2232-217-0x00007FF68FFA6890-mapping.dmp

Download
memory/2232-224-0x000001C84F0E0000-0x000001C84F395000-memory.dmp

Filesize
2.7MB

Download
memory/2232-221-0x000001C84F0E0000-0x000001C84F395000-memory.dmp

Filesize
2.7MB

Download
memory/2232-219-0x000001C84EF60000-0x000001C84F0A0000-memory.dmp

Filesize
1.2MB

Download
memory/2232-218-0x000001C84EF60000-0x000001C84F0A0000-memory.dmp

Filesize
1.2MB

Download
memory/2388-175-0x0000000002BF9000-0x0000000002C13000-memory.dmp

Filesize
104KB

Download
memory/2388-183-0x0000000000400000-0x0000000002BA6000-memory.dmp

Filesize
39.6MB

Download
memory/2388-178-0x0000000000400000-0x0000000002BA6000-memory.dmp

Filesize
39.6MB

Download
memory/2388-176-0x0000000002D20000-0x0000000002D4A000-memory.dmp

Filesize
168KB

Download
memory/2388-150-0x0000000000000000-mapping.dmp

Download
memory/2492-211-0x000000000E2F3000-0x000000000E2FC000-memory.dmp

Filesize
36KB

Download
memory/2492-220-0x000000000EE30000-0x000000000F09B000-memory.dmp

Filesize
2.4MB

Download
memory/2492-237-0x000000000EE30000-0x000000000F09B000-memory.dmp

Filesize
2.4MB

Download
memory/2768-252-0x0000000000000000-mapping.dmp

Download
memory/2776-166-0x0000000004630000-0x0000000005185000-memory.dmp

Filesize
11.3MB

Download
memory/2776-163-0x0000000000000000-mapping.dmp

Download
memory/2776-198-0x0000000004630000-0x0000000005185000-memory.dmp

Filesize
11.3MB

Download
memory/2776-167-0x0000000004630000-0x0000000005185000-memory.dmp

Filesize
11.3MB

Download
memory/2808-182-0x0000000000000000-mapping.dmp

Download
memory/2824-254-0x0000000000000000-mapping.dmp

Download
memory/3008-177-0x0000000000000000-mapping.dmp

Download
memory/3608-222-0x0000000000000000-mapping.dmp

Download
memory/3808-143-0x00000000049A0000-0x0000000004ACE000-memory.dmp

Filesize
1.2MB

Download
memory/3808-145-0x0000000000400000-0x0000000002C76000-memory.dmp

Filesize
40.5MB

Download
memory/3808-144-0x0000000000400000-0x0000000002C76000-memory.dmp

Filesize
40.5MB

Download
memory/3808-142-0x00000000048B5000-0x000000000499E000-memory.dmp

Filesize
932KB

Download
memory/3808-136-0x0000000000000000-mapping.dmp

Download
memory/3892-165-0x0000000004010000-0x0000000004B65000-memory.dmp

Filesize
11.3MB

Download
memory/3892-157-0x0000000004010000-0x0000000004B65000-memory.dmp

Filesize
11.3MB

Download
memory/3892-196-0x0000000004010000-0x0000000004B65000-memory.dmp

Filesize
11.3MB

Download
memory/4156-172-0x00007FF68FFA6890-mapping.dmp

Download
memory/4156-181-0x000001CB985A0000-0x000001CB98855000-memory.dmp

Filesize
2.7MB

Download
memory/4156-173-0x000001CB9A010000-0x000001CB9A150000-memory.dmp

Filesize
1.2MB

Download
memory/4156-174-0x000001CB9A010000-0x000001CB9A150000-memory.dmp

Filesize
1.2MB

Download
memory/4156-179-0x0000000000300000-0x00000000005A4000-memory.dmp

Filesize
2.6MB

Download
memory/4156-180-0x000001CB985A0000-0x000001CB98855000-memory.dmp

Filesize
2.7MB

Download
memory/4344-207-0x0000000000000000-mapping.dmp

Download
memory/4368-236-0x0000000000000000-mapping.dmp

Download
memory/4564-231-0x00007FF68FFA6890-mapping.dmp

Download
memory/4564-239-0x00000257F81C0000-0x00000257F8475000-memory.dmp

Filesize
2.7MB

Download
memory/4564-233-0x00000257F9C20000-0x00000257F9D60000-memory.dmp

Filesize
1.2MB

Download
memory/4564-232-0x00000257F9C20000-0x00000257F9D60000-memory.dmp

Filesize
1.2MB

Download
memory/4564-234-0x00000257F81C0000-0x00000257F8475000-memory.dmp

Filesize
2.7MB

Download
memory/4568-184-0x0000000000000000-mapping.dmp

Download
memory/4568-210-0x0000000004DF0000-0x0000000005066000-memory.dmp

Filesize
2.5MB

Download
memory/4568-209-0x0000000004B78000-0x0000000004DEE000-memory.dmp

Filesize
2.5MB

Download
memory/4568-212-0x0000000000400000-0x0000000002E03000-memory.dmp

Filesize
42.0MB

Download
memory/4568-223-0x0000000000400000-0x0000000002E03000-memory.dmp

Filesize
42.0MB

Download
memory/4744-225-0x0000000000000000-mapping.dmp

Download
memory/4752-206-0x000001BD2E480000-0x000001BD2E735000-memory.dmp

Filesize
2.7MB

Download
memory/4752-205-0x000001BD2FEE0000-0x000001BD30020000-memory.dmp

Filesize
1.2MB

Download
memory/4752-203-0x00007FF68FFA6890-mapping.dmp

Download
memory/4752-204-0x000001BD2FEE0000-0x000001BD30020000-memory.dmp

Filesize
1.2MB

Download
memory/4752-208-0x000001BD2E480000-0x000001BD2E735000-memory.dmp

Filesize
2.7MB

Download
memory/4772-238-0x0000000000000000-mapping.dmp

Download