Analysis
-
max time kernel
593s -
max time network
600s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-01-2023 12:52
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry.js
Resource
win7-20220901-en
General
-
Target
Inquiry.js
-
Size
1.3MB
-
MD5
443caa6bef67a2be0e4bcec86619683e
-
SHA1
24801da9b7ee6f3bea3a877b4f2e1e5592d27a7c
-
SHA256
772fd8b1137becb5b3697fb1e10ba79f31367c7402d06235f96fc214d0338327
-
SHA512
eccc636da9661159c0e500e4eaa3cda94f1ceb220c766459e97ca759c289a0e70522f4cd12d60a4aa6d1ac98a2ef8594c0aff49976087397711cf3b1edbfe6d6
-
SSDEEP
24576:dwgFD4BiYRWfbd/RgU+FnkCt3fANRbonYMk37CMYY3lPg:dwgFD2ic6hRgU+1RuPoeYYK
Malware Config
Signatures
-
Blocklisted process makes network request 61 IoCs
Processes:
wscript.exeflow pid process 5 1864 wscript.exe 16 1864 wscript.exe 17 1864 wscript.exe 19 1864 wscript.exe 20 1864 wscript.exe 22 1864 wscript.exe 24 1864 wscript.exe 25 1864 wscript.exe 26 1864 wscript.exe 28 1864 wscript.exe 29 1864 wscript.exe 30 1864 wscript.exe 32 1864 wscript.exe 33 1864 wscript.exe 34 1864 wscript.exe 36 1864 wscript.exe 37 1864 wscript.exe 38 1864 wscript.exe 40 1864 wscript.exe 41 1864 wscript.exe 42 1864 wscript.exe 44 1864 wscript.exe 45 1864 wscript.exe 46 1864 wscript.exe 48 1864 wscript.exe 49 1864 wscript.exe 50 1864 wscript.exe 52 1864 wscript.exe 53 1864 wscript.exe 54 1864 wscript.exe 56 1864 wscript.exe 57 1864 wscript.exe 58 1864 wscript.exe 60 1864 wscript.exe 61 1864 wscript.exe 62 1864 wscript.exe 64 1864 wscript.exe 65 1864 wscript.exe 66 1864 wscript.exe 68 1864 wscript.exe 69 1864 wscript.exe 70 1864 wscript.exe 72 1864 wscript.exe 73 1864 wscript.exe 74 1864 wscript.exe 76 1864 wscript.exe 77 1864 wscript.exe 78 1864 wscript.exe 80 1864 wscript.exe 81 1864 wscript.exe 82 1864 wscript.exe 84 1864 wscript.exe 85 1864 wscript.exe 86 1864 wscript.exe 88 1864 wscript.exe 89 1864 wscript.exe 90 1864 wscript.exe 92 1864 wscript.exe 93 1864 wscript.exe 94 1864 wscript.exe 96 1864 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
Payload (3).exepid process 1712 Payload (3).exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ygXhKsdexe.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ygXhKsdexe.js wscript.exe -
Loads dropped DLL 5 IoCs
Processes:
WerFault.exepid process 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe 1168 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Payload (3).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payload (3).exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payload (3).exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payload (3).exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ipinfo.io 7 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1168 1712 WerFault.exe Payload (3).exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Payload (3).exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Payload (3).exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Payload (3).exe -
Processes:
Payload (3).exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Payload (3).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Payload (3).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Payload (3).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Payload (3).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Payload (3).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Payload (3).exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Payload (3).exedescription pid process Token: SeDebugPrivilege 1712 Payload (3).exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
wscript.exePayload (3).exedescription pid process target process PID 1972 wrote to memory of 1864 1972 wscript.exe wscript.exe PID 1972 wrote to memory of 1864 1972 wscript.exe wscript.exe PID 1972 wrote to memory of 1864 1972 wscript.exe wscript.exe PID 1972 wrote to memory of 1712 1972 wscript.exe Payload (3).exe PID 1972 wrote to memory of 1712 1972 wscript.exe Payload (3).exe PID 1972 wrote to memory of 1712 1972 wscript.exe Payload (3).exe PID 1972 wrote to memory of 1712 1972 wscript.exe Payload (3).exe PID 1712 wrote to memory of 1168 1712 Payload (3).exe WerFault.exe PID 1712 wrote to memory of 1168 1712 Payload (3).exe WerFault.exe PID 1712 wrote to memory of 1168 1712 Payload (3).exe WerFault.exe PID 1712 wrote to memory of 1168 1712 Payload (3).exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
Payload (3).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payload (3).exe -
outlook_win_path 1 IoCs
Processes:
Payload (3).exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payload (3).exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Inquiry.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\ygXhKsdexe.js"2⤵
- Blocklisted process makes network request
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\Payload (3).exe"C:\Users\Admin\AppData\Local\Temp\Payload (3).exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 19163⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Payload (3).exeFilesize
755KB
MD53e8af9fffb1b980b193508f6a8a8cdc3
SHA1e91e6f525952ae5a812d3cd3a795c6aeca94e527
SHA256ba055f5ffcf5c345e37307673717f11319326e5c4b621f336b76c4826b09f7cc
SHA512072bac20632cc30aa99715e4d5f508eab6a5b143704a0cdbbf0f5f22f86f4c02204efb1eb4acf8eeca97622c074bed2aa333119e842040e34ab55bff219a1f11
-
C:\Users\Admin\AppData\Local\Temp\Payload (3).exeFilesize
755KB
MD53e8af9fffb1b980b193508f6a8a8cdc3
SHA1e91e6f525952ae5a812d3cd3a795c6aeca94e527
SHA256ba055f5ffcf5c345e37307673717f11319326e5c4b621f336b76c4826b09f7cc
SHA512072bac20632cc30aa99715e4d5f508eab6a5b143704a0cdbbf0f5f22f86f4c02204efb1eb4acf8eeca97622c074bed2aa333119e842040e34ab55bff219a1f11
-
C:\Users\Admin\AppData\Roaming\ygXhKsdexe.jsFilesize
6KB
MD5f5900623d262e28b5b5169d4307406df
SHA11eba3a193e440e9373133f69cff2f9cff6373189
SHA2569530c305096a7bc5443c50079a77e7aee12d6dea1770f279ccf8f6e5f149f334
SHA512d0ed8912d5ff927bfa0f05616f4712dbf6a60349839d4722691c02eb7cb0ebf2d1f1cbbe8becd1a77b5c71821b623323811d9255d1f8b9060cb928f31a996f97
-
\Users\Admin\AppData\Local\Temp\Payload (3).exeFilesize
755KB
MD53e8af9fffb1b980b193508f6a8a8cdc3
SHA1e91e6f525952ae5a812d3cd3a795c6aeca94e527
SHA256ba055f5ffcf5c345e37307673717f11319326e5c4b621f336b76c4826b09f7cc
SHA512072bac20632cc30aa99715e4d5f508eab6a5b143704a0cdbbf0f5f22f86f4c02204efb1eb4acf8eeca97622c074bed2aa333119e842040e34ab55bff219a1f11
-
\Users\Admin\AppData\Local\Temp\Payload (3).exeFilesize
755KB
MD53e8af9fffb1b980b193508f6a8a8cdc3
SHA1e91e6f525952ae5a812d3cd3a795c6aeca94e527
SHA256ba055f5ffcf5c345e37307673717f11319326e5c4b621f336b76c4826b09f7cc
SHA512072bac20632cc30aa99715e4d5f508eab6a5b143704a0cdbbf0f5f22f86f4c02204efb1eb4acf8eeca97622c074bed2aa333119e842040e34ab55bff219a1f11
-
\Users\Admin\AppData\Local\Temp\Payload (3).exeFilesize
755KB
MD53e8af9fffb1b980b193508f6a8a8cdc3
SHA1e91e6f525952ae5a812d3cd3a795c6aeca94e527
SHA256ba055f5ffcf5c345e37307673717f11319326e5c4b621f336b76c4826b09f7cc
SHA512072bac20632cc30aa99715e4d5f508eab6a5b143704a0cdbbf0f5f22f86f4c02204efb1eb4acf8eeca97622c074bed2aa333119e842040e34ab55bff219a1f11
-
\Users\Admin\AppData\Local\Temp\Payload (3).exeFilesize
755KB
MD53e8af9fffb1b980b193508f6a8a8cdc3
SHA1e91e6f525952ae5a812d3cd3a795c6aeca94e527
SHA256ba055f5ffcf5c345e37307673717f11319326e5c4b621f336b76c4826b09f7cc
SHA512072bac20632cc30aa99715e4d5f508eab6a5b143704a0cdbbf0f5f22f86f4c02204efb1eb4acf8eeca97622c074bed2aa333119e842040e34ab55bff219a1f11
-
\Users\Admin\AppData\Local\Temp\Payload (3).exeFilesize
755KB
MD53e8af9fffb1b980b193508f6a8a8cdc3
SHA1e91e6f525952ae5a812d3cd3a795c6aeca94e527
SHA256ba055f5ffcf5c345e37307673717f11319326e5c4b621f336b76c4826b09f7cc
SHA512072bac20632cc30aa99715e4d5f508eab6a5b143704a0cdbbf0f5f22f86f4c02204efb1eb4acf8eeca97622c074bed2aa333119e842040e34ab55bff219a1f11
-
memory/1168-65-0x0000000000000000-mapping.dmp
-
memory/1712-61-0x0000000000D50000-0x0000000000E14000-memory.dmpFilesize
784KB
-
memory/1712-62-0x0000000075D71000-0x0000000075D73000-memory.dmpFilesize
8KB
-
memory/1712-63-0x00000000008A0000-0x00000000008AE000-memory.dmpFilesize
56KB
-
memory/1712-64-0x0000000008940000-0x00000000089F2000-memory.dmpFilesize
712KB
-
memory/1712-57-0x0000000000000000-mapping.dmp
-
memory/1864-55-0x0000000000000000-mapping.dmp
-
memory/1972-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmpFilesize
8KB