Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 14:16
Static task
static1
General
-
Target
file.exe
-
Size
483KB
-
MD5
20aa704ebe3c3f55099ef7a2d622377d
-
SHA1
1f864523711217479188f394d14da0a294b7d20e
-
SHA256
40ad1caa10bdb28b0e175989766dcef91dbf48d13002cdecef7dde3c3f9c03ec
-
SHA512
a3bf39d10544051db3fc18251928864dc5b57b373310a27ca67f3132f72df3be93b9fa2c9e785866f0396e12bbc277dbd0299427374b1d8abffe4dfc87749a1e
-
SSDEEP
6144:K2y+bnr+Cp0yN90QEmRFuFeps2MZAThWz9/Lp7rR15ppUjV6fxhCc0rEQ8t3Z653:SMrWy907OeFlhLo6fxh+EQqEvGJQ
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
luska
77.91.124.55:19071
-
auth_value
a6797888f51a88afbfd8854a79ac9357
Extracted
redline
lada
77.91.124.55:19071
Extracted
smokeloader
up3
Extracted
redline
@ytlogsbot
176.123.4.46:33783
-
auth_value
295b226f1b63bcd55148625381b27b19
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
fabookie
http://app.nnnaajjjgc.com/check/safe
Signatures
-
DcRat 4 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
file.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe 5828 schtasks.exe 5932 schtasks.exe 4512 schtasks.exe -
Detect Fabookie payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/6120-629-0x0000000003110000-0x0000000003241000-memory.dmp family_fabookie -
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\DF96.exe healer behavioral2/memory/5344-283-0x0000000000010000-0x000000000001A000-memory.dmp healer C:\Users\Admin\AppData\Local\Temp\DF96.exe healer -
Glupteba payload 9 IoCs
Processes:
resource yara_rule behavioral2/memory/4604-510-0x0000000004AA0000-0x000000000538B000-memory.dmp family_glupteba behavioral2/memory/4604-532-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/4604-617-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/4604-833-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/4604-850-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/5056-902-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/5056-967-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/2660-1052-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/2660-1062-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba -
Processes:
DF96.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DF96.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" DF96.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" DF96.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" DF96.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" DF96.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" DF96.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5544-295-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral2/memory/5636-548-0x00000000007D0000-0x000000000082A000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explothe.exeF870.exekos1.exekos.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation F870.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation kos1.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation kos.exe -
Executes dropped EXE 36 IoCs
Processes:
v4086797.exea4924546.exeb5658425.exec0637779.exeD91A.exex9435037.exeDA25.exex7886351.exex4902647.exex4718039.exeg8315913.exeDE4D.exeDF96.exebackgroundTaskHost.exeh8940647.exeexplothe.exeF870.exeFCC6.exess41.exetoolspub2.exe31839b57a4f11171d6abc8bbc4451ee4.exetoolspub2.exekos1.exe514.exeset16.exekos.exeis-Q715P.tmppreviewer.exepreviewer.exe31839b57a4f11171d6abc8bbc4451ee4.exeexplothe.execsrss.exeinjector.exewindefender.exewindefender.exeexplothe.exepid process 2284 v4086797.exe 4452 a4924546.exe 3868 b5658425.exe 1468 c0637779.exe 4256 D91A.exe 4112 x9435037.exe 1252 DA25.exe 3828 x7886351.exe 3124 x4902647.exe 4956 x4718039.exe 4288 g8315913.exe 5212 DE4D.exe 5344 DF96.exe 5428 backgroundTaskHost.exe 5476 h8940647.exe 5652 explothe.exe 772 F870.exe 4864 FCC6.exe 6120 ss41.exe 5248 toolspub2.exe 4604 31839b57a4f11171d6abc8bbc4451ee4.exe 4012 toolspub2.exe 932 kos1.exe 5636 514.exe 5996 set16.exe 4884 kos.exe 3036 is-Q715P.tmp 5848 previewer.exe 1236 previewer.exe 5056 31839b57a4f11171d6abc8bbc4451ee4.exe 4728 explothe.exe 2660 csrss.exe 4544 injector.exe 4072 windefender.exe 4452 windefender.exe 5524 explothe.exe -
Loads dropped DLL 4 IoCs
Processes:
is-Q715P.tmprundll32.exepid process 3036 is-Q715P.tmp 3036 is-Q715P.tmp 3036 is-Q715P.tmp 6084 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Processes:
DF96.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" DF96.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
v4086797.exex4718039.exe31839b57a4f11171d6abc8bbc4451ee4.execsrss.exefile.exex9435037.exex7886351.exex4902647.exeD91A.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v4086797.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" x4718039.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x9435037.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x7886351.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x4902647.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" D91A.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
a4924546.exeb5658425.exeDA25.exeg8315913.exeDE4D.exetoolspub2.exeFCC6.exedescription pid process target process PID 4452 set thread context of 4632 4452 a4924546.exe AppLaunch.exe PID 3868 set thread context of 3400 3868 b5658425.exe AppLaunch.exe PID 1252 set thread context of 4392 1252 DA25.exe AppLaunch.exe PID 4288 set thread context of 4676 4288 g8315913.exe cacls.exe PID 5212 set thread context of 5544 5212 DE4D.exe AppLaunch.exe PID 5248 set thread context of 4012 5248 toolspub2.exe toolspub2.exe PID 4864 set thread context of 5812 4864 FCC6.exe vbc.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Program Files directory 7 IoCs
Processes:
is-Q715P.tmpdescription ioc process File opened for modification C:\Program Files (x86)\PA Previewer\previewer.exe is-Q715P.tmp File created C:\Program Files (x86)\PA Previewer\unins000.dat is-Q715P.tmp File created C:\Program Files (x86)\PA Previewer\is-LDEHQ.tmp is-Q715P.tmp File created C:\Program Files (x86)\PA Previewer\is-96MH8.tmp is-Q715P.tmp File created C:\Program Files (x86)\PA Previewer\is-FJ1NM.tmp is-Q715P.tmp File created C:\Program Files (x86)\PA Previewer\is-18I65.tmp is-Q715P.tmp File opened for modification C:\Program Files (x86)\PA Previewer\unins000.dat is-Q715P.tmp -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exe31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 5148 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3156 4452 WerFault.exe a4924546.exe 1840 3868 WerFault.exe b5658425.exe 4868 3400 WerFault.exe AppLaunch.exe 5152 1252 WerFault.exe DA25.exe 5200 4288 WerFault.exe g8315913.exe 5324 4676 WerFault.exe AppLaunch.exe 5644 5212 WerFault.exe DE4D.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
AppLaunch.exetoolspub2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 5828 schtasks.exe 5932 schtasks.exe 4512 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exe31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AppLaunch.exemsedge.exemsedge.exemsedge.exepid process 4632 AppLaunch.exe 4632 AppLaunch.exe 4900 msedge.exe 4900 msedge.exe 2708 msedge.exe 2708 msedge.exe 1972 msedge.exe 1972 msedge.exe 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 3128 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3128 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
toolspub2.exepid process 4632 4012 toolspub2.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
msedge.exepid process 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
DF96.exekos.exedescription pid process Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeDebugPrivilege 5344 DF96.exe Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 Token: SeDebugPrivilege 4884 kos.exe Token: SeShutdownPrivilege 3128 Token: SeCreatePagefilePrivilege 3128 -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe 1972 msedge.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3128 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exev4086797.exea4924546.exeb5658425.exec0637779.execmd.exemsedge.exemsedge.exedescription pid process target process PID 1720 wrote to memory of 2284 1720 file.exe v4086797.exe PID 1720 wrote to memory of 2284 1720 file.exe v4086797.exe PID 1720 wrote to memory of 2284 1720 file.exe v4086797.exe PID 2284 wrote to memory of 4452 2284 v4086797.exe a4924546.exe PID 2284 wrote to memory of 4452 2284 v4086797.exe a4924546.exe PID 2284 wrote to memory of 4452 2284 v4086797.exe a4924546.exe PID 4452 wrote to memory of 4632 4452 a4924546.exe AppLaunch.exe PID 4452 wrote to memory of 4632 4452 a4924546.exe AppLaunch.exe PID 4452 wrote to memory of 4632 4452 a4924546.exe AppLaunch.exe PID 4452 wrote to memory of 4632 4452 a4924546.exe AppLaunch.exe PID 4452 wrote to memory of 4632 4452 a4924546.exe AppLaunch.exe PID 4452 wrote to memory of 4632 4452 a4924546.exe AppLaunch.exe PID 2284 wrote to memory of 3868 2284 v4086797.exe b5658425.exe PID 2284 wrote to memory of 3868 2284 v4086797.exe b5658425.exe PID 2284 wrote to memory of 3868 2284 v4086797.exe b5658425.exe PID 3868 wrote to memory of 1196 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 1196 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 1196 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 1880 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 1880 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 1880 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 3400 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 3400 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 3400 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 3400 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 3400 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 3400 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 3400 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 3400 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 3400 3868 b5658425.exe AppLaunch.exe PID 3868 wrote to memory of 3400 3868 b5658425.exe AppLaunch.exe PID 1720 wrote to memory of 1468 1720 file.exe c0637779.exe PID 1720 wrote to memory of 1468 1720 file.exe c0637779.exe PID 1720 wrote to memory of 1468 1720 file.exe c0637779.exe PID 1468 wrote to memory of 1556 1468 c0637779.exe cmd.exe PID 1468 wrote to memory of 1556 1468 c0637779.exe cmd.exe PID 1556 wrote to memory of 1972 1556 cmd.exe msedge.exe PID 1556 wrote to memory of 1972 1556 cmd.exe msedge.exe PID 1556 wrote to memory of 3760 1556 cmd.exe msedge.exe PID 1556 wrote to memory of 3760 1556 cmd.exe msedge.exe PID 1972 wrote to memory of 2856 1972 msedge.exe msedge.exe PID 1972 wrote to memory of 2856 1972 msedge.exe msedge.exe PID 3760 wrote to memory of 3160 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 3160 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe PID 3760 wrote to memory of 4616 3760 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4086797.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4086797.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4924546.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4924546.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 5924⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b5658425.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b5658425.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 5405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c0637779.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c0637779.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\857C.tmp\857D.tmp\857E.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c0637779.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7fff347046f8,0x7fff34704708,0x7fff347047185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,811740129346272574,3638832946564989750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff347046f8,0x7fff34704708,0x7fff347047185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6723598928754644764,13006191042975661901,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,6723598928754644764,13006191042975661901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4452 -ip 44521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3868 -ip 38681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3400 -ip 34001⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\D91A.exeC:\Users\Admin\AppData\Local\Temp\D91A.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9435037.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9435037.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7886351.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7886351.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4902647.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4902647.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x4718039.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x4718039.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g8315913.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g8315913.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 1527⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h8940647.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h8940647.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\DA25.exeC:\Users\Admin\AppData\Local\Temp\DA25.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 4242⤵
- Program crash
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DBDB.bat" "1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0xe4,0xd8,0x108,0x7fff347046f8,0x7fff34704708,0x7fff347047183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xc0,0x108,0x7fff347046f8,0x7fff34704708,0x7fff347047183⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1252 -ip 12521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4288 -ip 42881⤵
-
C:\Users\Admin\AppData\Local\Temp\DE4D.exeC:\Users\Admin\AppData\Local\Temp\DE4D.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 1522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4676 -ip 46761⤵
-
C:\Users\Admin\AppData\Local\Temp\DF96.exeC:\Users\Admin\AppData\Local\Temp\DF96.exe1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\E10E.exeC:\Users\Admin\AppData\Local\Temp\E10E.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F3⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5212 -ip 52121⤵
-
C:\Users\Admin\AppData\Local\Temp\F870.exeC:\Users\Admin\AppData\Local\Temp\F870.exe1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ss41.exe"C:\Users\Admin\AppData\Local\Temp\ss41.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\kos1.exe"C:\Users\Admin\AppData\Local\Temp\kos1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\set16.exe"C:\Users\Admin\AppData\Local\Temp\set16.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-HM9L1.tmp\is-Q715P.tmp"C:\Users\Admin\AppData\Local\Temp\is-HM9L1.tmp\is-Q715P.tmp" /SL4 $5024E "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 522244⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -i5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -s5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 85⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 86⤵
-
C:\Users\Admin\AppData\Local\Temp\kos.exe"C:\Users\Admin\AppData\Local\Temp\kos.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\FCC6.exeC:\Users\Admin\AppData\Local\Temp\FCC6.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\514.exeC:\Users\Admin\AppData\Local\Temp\514.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
3Impair Defenses
2Disable or Modify Tools
2Scripting
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50987267c265b2de204ac19d29250d6cd
SHA1247b7b1e917d9ad2aa903a497758ae75ae145692
SHA256474887e5292c0cf7d5ed52e3bcd255eedd5347f6f811200080c4b5d813886264
SHA5123b272b8c8d4772e1a4dc68d17a850439ffdd72a6f6b1306eafa18b810b103f3198af2c58d6ed92a1f3c498430c1b351e9f5c114ea5776b65629b1360f7ad13f5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD57c52d0f5e846c58f82fdbb925a60b9e4
SHA11e1840fb75ff35a8a2b6f1e9a76778351876ad35
SHA256a0ad0bec745f636819b2c11b2ce4a9f22cc7b3b8793ec915de015eb6363c14d5
SHA5125223046e6626eb00f7ae1c598db7e30f3ff3ef73e800ae53bba43fff864b4b0857caabd217cffea69bb36f2a1f66228d7735ac04cf7c8a9a2495e692af52e094
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD57bd4067647ff6566524514998ff5c2c0
SHA1933f4bc9e2d7b7b7899e476f5db7928f5ba2512f
SHA2561b62071ccf1a7de1673bc8586a412a39fdc60491fbcd7ae5a0d6727489cfd72a
SHA5129038b17f42f780257dd76ebcb6b20979ba537b024552fef3b2d0121aabf1a20a593698d2c651c21e69de85e485882b76a3b41348543c29fdfd1d74451d92a1b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD50e010e5bb0dd7c5493ad0c34ecade172
SHA173603613a38482b7cf6693ce151aa60af20a66a7
SHA25625db3b6929820ce79f016f17468c3d6c1aef9f87f8e3403b7e7402b3497b57d0
SHA512e74d57098e71ac311aa3d8eaf04c59a1f3f668e4d36b094e92124150f6261a73cba55c2d489aef45b92e83eea7b21b484f6306af3f1e1b72b359b9b195321703
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53a57fd9d513f7937269e1b1da016aa83
SHA1a1c907b960f1bab071b57362fa5861e498b63321
SHA256ebc603cc8d70b889d85b89b83405eff25da44171486a610200f175e2f113eb01
SHA512ac34567cd536fb99343205f841045bc2b0b1eb9c55b2aa0dab499637e9df5b782d0e5d3b83b9a43e8f67c10afdd790ab1ea18ee7729635eef91a87f08159d07f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5e8204ed0830d3835e90dadb588aa0fbb
SHA11ec2ef9c2264987990aad4e1f3063797a4766b14
SHA2566dc96e81c88e09305c580f78a74eff64debafd0b93e8b40653529522aaee3906
SHA512f1c105cfd85413f6721a83b8cf48758e5784234b021c5d75304f64b31cb62e9758412a15dfa1444b5e561a0c04329686ac32de7a251d3a86548d974c8b8654a1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD51c1c6d7860518a46362fd232147d1647
SHA1e3ff148cc7d8958af3cd279427db184d22441abc
SHA25639e5786abd4c252126ef5bb929c001906f1f7c426766bbe12c617e919ea79c53
SHA512a9274d4a0eb5f57ab65d570b55a3e1db6df3252926ff506a39a659bfcdcea1b0c01cd7fda3a9af1e5a8153d6ad5080246f711996a9896590f74c51a8000c47f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5678555f8861c646ee4e424bed61b895f
SHA1d85de747b8ee10325375b3ae289dc13c315f5341
SHA256b0ef31635e5bed8b742303c236b72c5683b3d9edbc44e4e52605d20f1f282fbb
SHA5125a9ede872127aecb96d1d6917c5ded0b239cb1166c1650f38f5754396036257ba288e638a1aa2604e31aae46807676fd43c9adc8f937de4016b258188f0036a6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD54a078fb8a7c67594a6c2aa724e2ac684
SHA192bc5b49985c8588c60f6f85c50a516fae0332f4
SHA256c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee
SHA512188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
872B
MD50dc4f9b091fab3d9c903f251ea3b82d7
SHA1b34e331a327a09feb2caa3d4c07616c07086572d
SHA2560a0abb7d95571e7cbd725f868367eb95763728796bf59f8c4714adbf21333436
SHA512da3ff3d8c0c08785d4ae993b778d70f6d669c31dcb9e1d8a283cbed8fe648835fa2ecc92f678adcea2553a7fcbb0e160dd3cba5111d962d399f0f163180d4e53
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
872B
MD56f37358fc7f4dd45d14abd72f2776dd5
SHA172d29ee2691304e1aec9b8ae8e50e7e1ed145507
SHA256b41f21ac6e78a78a446bfdfb4446230d4b882e94d925a28929583fb5a9918a5a
SHA512e84480c3c639b51831515485d526e3d2cfb37d2cbe40d123c49fbf1ce817e12cbb26e47559b9b8ea0cda54a428cfa8d332c172493c1a982f00e41ad559dd2a04
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5824b9.TMPFilesize
872B
MD5fed8564712034cd0cdecc1c27f83357b
SHA1bf29832f675c71584703b2530b2d80a794d26e6b
SHA256aa0567572ff8b4dbf6217d80b9bd804c50a76bae921f4d13dcb6be617d408998
SHA51299a2c1699d76670fa74ee470b2936c17f20f528d1ba04a00eb7ee65a8729cd931e39ac258e685f3f335bda21166871cf06e412293c580b3f6788faa29667374c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD589e392e9c09e7fb7f19cd38bb8bb6576
SHA19dc61bca70edb444a914bb09ca3c66f6d2c9e166
SHA256117ae070b0ed901003382e4c21ee9f5027b815fa04d90e106d4693585c1121b7
SHA512a3f446e04c2d41ec61d48f526bcbb0c722420087bc76559d57a07a1fa2fed197d25f4d9dcbf1cc391b1353dc43ab060f0b6394a423ff8676c77967e64d150194
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD532d8856c9d12d9fe2f2b30c401b82f41
SHA1ce74d3fb7cf1738f6ff48f30eab4c22b73eab1f3
SHA256ab81f9903a476b9d148c6871dfa9578c3382a508c5f90c128e4c266ecf098fcc
SHA5125adaaaf6cd44ebfc7277342f24f9460ae7b945af5716111e2b61a968a4f73c7cd30075e2827963be20ba3a953d370c4c1b822a55b3a8d08c2f81eaf2ba5c7a4f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5bd4276f18993b8e35e821d3bd79ac6bf
SHA111670fddbcd7eb030e363890f6bba7baf897c5b0
SHA256d2b65bc8a03f78ca5b7deea1f6432a0e834d1ae81fab52822e4b199c514006b9
SHA5122e529d593fb81df0a2b4d961bda66efe27beb2e323d79486a8b34ce149cfd924a207870cfa571a0aafeabb89467ad51d350fbf81686bb1777c7d246d67d6f2b1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD589e392e9c09e7fb7f19cd38bb8bb6576
SHA19dc61bca70edb444a914bb09ca3c66f6d2c9e166
SHA256117ae070b0ed901003382e4c21ee9f5027b815fa04d90e106d4693585c1121b7
SHA512a3f446e04c2d41ec61d48f526bcbb0c722420087bc76559d57a07a1fa2fed197d25f4d9dcbf1cc391b1353dc43ab060f0b6394a423ff8676c77967e64d150194
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD51e64e92b6644c4ea4cc545392f205372
SHA11a39c1a993c3cf4c751bb9391532dac394fb862b
SHA2566bf86c4da8e4dd6faba52853c63f34b29e901c43ffb95cc2eb801aaaacc037ea
SHA51248e06aac5f1f1a1fbf4852ddd0d56bb29d750f05176f50d289a7b0ad450c54a4a30f9b1fde9ffc331bb0b1d53041d2e3458f427ed70f2e9543da67633de12ee4
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD57ea584dc49967de03bebdacec829b18d
SHA13d47f0e88c7473bedeed2f14d7a8db1318b93852
SHA25679232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53
SHA512ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0
-
C:\Users\Admin\AppData\Local\Temp\857C.tmp\857D.tmp\857E.batFilesize
90B
MD55a115a88ca30a9f57fdbb545490c2043
SHA167e90f37fc4c1ada2745052c612818588a5595f4
SHA25652c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d
SHA51217c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe
-
C:\Users\Admin\AppData\Local\Temp\D91A.exeFilesize
1.0MB
MD538245a63ed4c5c803fc8bde8967a88ff
SHA138b412cde27ec02e05f7eb2d61983b74f50ae289
SHA256f09056b42deee674a96cf34a57a8247a1485b559ce5afbffae4942057f5135ab
SHA512e92f5e1a07afbcad8ae829b914ce60edcca7d65128ae1261f1e2715dcd5c30f07aee8263bd2f516205737b52c9178b8d3555a96e7b105fe427a716235b42dcb3
-
C:\Users\Admin\AppData\Local\Temp\D91A.exeFilesize
1.0MB
MD538245a63ed4c5c803fc8bde8967a88ff
SHA138b412cde27ec02e05f7eb2d61983b74f50ae289
SHA256f09056b42deee674a96cf34a57a8247a1485b559ce5afbffae4942057f5135ab
SHA512e92f5e1a07afbcad8ae829b914ce60edcca7d65128ae1261f1e2715dcd5c30f07aee8263bd2f516205737b52c9178b8d3555a96e7b105fe427a716235b42dcb3
-
C:\Users\Admin\AppData\Local\Temp\DA25.exeFilesize
304KB
MD5fcc9fd8995cf85e5dcd90b6181b34dc7
SHA1359fb769a5f8f4569d1e045e87e3cbc8b92f3f78
SHA256bae667ab9c4c87e83a2822d1b809ba141f13ea62746c7aa35ca439d77cf66b39
SHA5125124a405ff3fb97b3715bd75db85c6178a32bcdcd03e4261d98ac05e8caa92434da978bf703282658db61cdd9f5b2d6aded82520faff47cf344e307cb199dd33
-
C:\Users\Admin\AppData\Local\Temp\DA25.exeFilesize
304KB
MD5fcc9fd8995cf85e5dcd90b6181b34dc7
SHA1359fb769a5f8f4569d1e045e87e3cbc8b92f3f78
SHA256bae667ab9c4c87e83a2822d1b809ba141f13ea62746c7aa35ca439d77cf66b39
SHA5125124a405ff3fb97b3715bd75db85c6178a32bcdcd03e4261d98ac05e8caa92434da978bf703282658db61cdd9f5b2d6aded82520faff47cf344e307cb199dd33
-
C:\Users\Admin\AppData\Local\Temp\DBDB.batFilesize
79B
MD5403991c4d18ac84521ba17f264fa79f2
SHA1850cc068de0963854b0fe8f485d951072474fd45
SHA256ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576
-
C:\Users\Admin\AppData\Local\Temp\DE4D.exeFilesize
386KB
MD5b2f74506c29b008e4f76d55593ac3d74
SHA116c9a77d8f4b55710d1756e9983ae030903f2ff5
SHA2563cc8a757b5a6a4d5dbb5bb34165de99d8b4a81602920bf0172299789f6b55a1c
SHA512bf3508b475e1f34b540283bdffab415b842d9fc49bf3a7e534a1def9b87cfe9942dd881ef32d93113323bd1765070883bf58d49a6e8f079745bdeb345078868a
-
C:\Users\Admin\AppData\Local\Temp\DE4D.exeFilesize
386KB
MD5b2f74506c29b008e4f76d55593ac3d74
SHA116c9a77d8f4b55710d1756e9983ae030903f2ff5
SHA2563cc8a757b5a6a4d5dbb5bb34165de99d8b4a81602920bf0172299789f6b55a1c
SHA512bf3508b475e1f34b540283bdffab415b842d9fc49bf3a7e534a1def9b87cfe9942dd881ef32d93113323bd1765070883bf58d49a6e8f079745bdeb345078868a
-
C:\Users\Admin\AppData\Local\Temp\DF96.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\DF96.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\E10E.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\E10E.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\F870.exeFilesize
6.4MB
MD53c81534d635fbe4bfab2861d98422f70
SHA19cc995fa42313cd82eacaad9e3fe818cd3805f58
SHA25688921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f
SHA512132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136
-
C:\Users\Admin\AppData\Local\Temp\F870.exeFilesize
6.4MB
MD53c81534d635fbe4bfab2861d98422f70
SHA19cc995fa42313cd82eacaad9e3fe818cd3805f58
SHA25688921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f
SHA512132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136
-
C:\Users\Admin\AppData\Local\Temp\FCC6.exeFilesize
1.4MB
MD5965fcf373f3e95995f8ae35df758eca1
SHA1a62d2494f6ba8a02a80a02017e7c347f76b18fa6
SHA25682eab1b2cab9f16d77c242e4ff1eb983d7e0a64b78b5dc69d87af2a4016f4f39
SHA51255e9fefbe2a1ed92034573f3c4bb03fe29b0d345ebe834f2f9192d5ddd2237f1bb8e4fb5f9516852e7e0efa42a3122a11d2f0db7c9633b1566901cdd7862ff52
-
C:\Users\Admin\AppData\Local\Temp\FCC6.exeFilesize
1.4MB
MD5965fcf373f3e95995f8ae35df758eca1
SHA1a62d2494f6ba8a02a80a02017e7c347f76b18fa6
SHA25682eab1b2cab9f16d77c242e4ff1eb983d7e0a64b78b5dc69d87af2a4016f4f39
SHA51255e9fefbe2a1ed92034573f3c4bb03fe29b0d345ebe834f2f9192d5ddd2237f1bb8e4fb5f9516852e7e0efa42a3122a11d2f0db7c9633b1566901cdd7862ff52
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c0637779.exeFilesize
89KB
MD521925f03d0b82e9c4517f05e68581778
SHA106a87788412eeaa67088f3f9f72bee84e27b86b0
SHA25654a69244c20d5521668bc37aefb7e1abd1e43c09ceea46eeaab461c00e84b64a
SHA5120f5e67eca9f9e19092344e4d174b254fe46037dfdc2780a74bfc772059ede93aae7d3d81b72fc46b9c75b1d7bb3b0c29cec43ff03d81ce7e5c279ff40e72a273
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c0637779.exeFilesize
89KB
MD521925f03d0b82e9c4517f05e68581778
SHA106a87788412eeaa67088f3f9f72bee84e27b86b0
SHA25654a69244c20d5521668bc37aefb7e1abd1e43c09ceea46eeaab461c00e84b64a
SHA5120f5e67eca9f9e19092344e4d174b254fe46037dfdc2780a74bfc772059ede93aae7d3d81b72fc46b9c75b1d7bb3b0c29cec43ff03d81ce7e5c279ff40e72a273
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4086797.exeFilesize
344KB
MD533711d3a2cc2538ec94a9db2746129d3
SHA1ee03c17c856ed6d9e910d4e6d482f8cbd7d6a315
SHA256f900cbffede65c647e0ccfb75bf930be5710fa837bcb0d23d937f6150905589c
SHA5122c016286cc183ac728f5a063156ccea1cba0f4d3f30ad1c56234fe32cfe424fc9fe7efe6961cb94674554ee80847d63ecf696ae1af8a5644eb80b7fb02092029
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4086797.exeFilesize
344KB
MD533711d3a2cc2538ec94a9db2746129d3
SHA1ee03c17c856ed6d9e910d4e6d482f8cbd7d6a315
SHA256f900cbffede65c647e0ccfb75bf930be5710fa837bcb0d23d937f6150905589c
SHA5122c016286cc183ac728f5a063156ccea1cba0f4d3f30ad1c56234fe32cfe424fc9fe7efe6961cb94674554ee80847d63ecf696ae1af8a5644eb80b7fb02092029
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9435037.exeFilesize
974KB
MD58b8e02e778b926266ef60ea128fd4246
SHA1c2fba20814c9a6b00e10ebd7e6617dfad269de85
SHA256740d0a84b01bd96dd973514f061f71fddcdbbf0da221fd9cdc0738872b5893fa
SHA512c7b0ebeb8cd51cea6f9c098d9c06ccc178f881a2e77e865fd848a57a85c6271c8038ebe4107ef92f3b1bba719a23b350a4c2b25f7236f3a9b118919e8df17758
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9435037.exeFilesize
974KB
MD58b8e02e778b926266ef60ea128fd4246
SHA1c2fba20814c9a6b00e10ebd7e6617dfad269de85
SHA256740d0a84b01bd96dd973514f061f71fddcdbbf0da221fd9cdc0738872b5893fa
SHA512c7b0ebeb8cd51cea6f9c098d9c06ccc178f881a2e77e865fd848a57a85c6271c8038ebe4107ef92f3b1bba719a23b350a4c2b25f7236f3a9b118919e8df17758
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4924546.exeFilesize
194KB
MD5e24edafba34bb6bec2f0e33913daa217
SHA1e2458a46fd698ae356e760c842052b5518ed44ac
SHA256953cdd7ae56a2659f70f97051298bd8920a6eea593164c6d6725cf2d29a60031
SHA5122789d00c1d6d517492a515fd064995f3f21c3dc821f7f654ff32d0bc024e93549af1887c788cced00f1b1c4304a7db8c585f5f02771850303fff736b3005abf4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4924546.exeFilesize
194KB
MD5e24edafba34bb6bec2f0e33913daa217
SHA1e2458a46fd698ae356e760c842052b5518ed44ac
SHA256953cdd7ae56a2659f70f97051298bd8920a6eea593164c6d6725cf2d29a60031
SHA5122789d00c1d6d517492a515fd064995f3f21c3dc821f7f654ff32d0bc024e93549af1887c788cced00f1b1c4304a7db8c585f5f02771850303fff736b3005abf4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b5658425.exeFilesize
304KB
MD5b3bb62cca7af187aaf24bf81cf6fa10d
SHA19a9f0dffe6e781f8b5d29d3396af0f57d5d391dd
SHA256743cefc07d7c37305a272ac4f141f3a6a680d1c2c013480fb6127513e488d375
SHA512b2b083b51d91ee115e646c3b21e907d2a63f2b0ceb76810f8a64a64b3166fde1ec555896b2c9c1542ca762c05195bd52a5162133c6dbfb775c810f5507478be9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b5658425.exeFilesize
304KB
MD5b3bb62cca7af187aaf24bf81cf6fa10d
SHA19a9f0dffe6e781f8b5d29d3396af0f57d5d391dd
SHA256743cefc07d7c37305a272ac4f141f3a6a680d1c2c013480fb6127513e488d375
SHA512b2b083b51d91ee115e646c3b21e907d2a63f2b0ceb76810f8a64a64b3166fde1ec555896b2c9c1542ca762c05195bd52a5162133c6dbfb775c810f5507478be9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7886351.exeFilesize
792KB
MD5918aa4d929aa61a54588a18f72b49c8c
SHA17a8ac5c2944b9b4a250b475bd010a15b5cf5ad3a
SHA256d03d28985143381cd0a1ffe527e7c7a7f6c0d761e4947c6ae60a7d612a3f1a0b
SHA5125dbf3f616d90d3d2cc0a5702787141413cd6ac04647aa2adff1fba2c22571f6db869369b9773392e644e975cfd652093bc0fcc54cd4b716731323adfbb72188e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7886351.exeFilesize
792KB
MD5918aa4d929aa61a54588a18f72b49c8c
SHA17a8ac5c2944b9b4a250b475bd010a15b5cf5ad3a
SHA256d03d28985143381cd0a1ffe527e7c7a7f6c0d761e4947c6ae60a7d612a3f1a0b
SHA5125dbf3f616d90d3d2cc0a5702787141413cd6ac04647aa2adff1fba2c22571f6db869369b9773392e644e975cfd652093bc0fcc54cd4b716731323adfbb72188e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4902647.exeFilesize
529KB
MD5297dd12ccc8eac76a2a9a92dde3807c5
SHA1022a71fa1156e98be31066f99059335b9d99416c
SHA256b4168d6ca0886cbd37d7a4415db937f0cd07b569aa812d3166d4d324b9de2a7f
SHA5121e5629758619fd1ce7628c3175c097ab5ecf88b81d83513d3c7c8e4b7574b951ec0dce04d12975209988bd912417280acdc1d1c9e1b22e2772aedea538d80de4
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4902647.exeFilesize
529KB
MD5297dd12ccc8eac76a2a9a92dde3807c5
SHA1022a71fa1156e98be31066f99059335b9d99416c
SHA256b4168d6ca0886cbd37d7a4415db937f0cd07b569aa812d3166d4d324b9de2a7f
SHA5121e5629758619fd1ce7628c3175c097ab5ecf88b81d83513d3c7c8e4b7574b951ec0dce04d12975209988bd912417280acdc1d1c9e1b22e2772aedea538d80de4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x4718039.exeFilesize
364KB
MD5fc08cbb6100631b04e4bc11cd851d71a
SHA17c011b471bbfd2a5fab5f7ccf133c69db1261b09
SHA256c34fb765bd3fb1c98079f29352354a90f43bcf9ea27a31bde6fb45bbee4024d3
SHA512f758e0598cb1b071a86a2b53cf928038719a7147a4c7abd08818b4548c5fda69c8673559f4910f192037b7f47bc26eb4adbf9d646b9db59641e19856dfa81992
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x4718039.exeFilesize
364KB
MD5fc08cbb6100631b04e4bc11cd851d71a
SHA17c011b471bbfd2a5fab5f7ccf133c69db1261b09
SHA256c34fb765bd3fb1c98079f29352354a90f43bcf9ea27a31bde6fb45bbee4024d3
SHA512f758e0598cb1b071a86a2b53cf928038719a7147a4c7abd08818b4548c5fda69c8673559f4910f192037b7f47bc26eb4adbf9d646b9db59641e19856dfa81992
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g8315913.exeFilesize
304KB
MD5fcc9fd8995cf85e5dcd90b6181b34dc7
SHA1359fb769a5f8f4569d1e045e87e3cbc8b92f3f78
SHA256bae667ab9c4c87e83a2822d1b809ba141f13ea62746c7aa35ca439d77cf66b39
SHA5125124a405ff3fb97b3715bd75db85c6178a32bcdcd03e4261d98ac05e8caa92434da978bf703282658db61cdd9f5b2d6aded82520faff47cf344e307cb199dd33
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g8315913.exeFilesize
304KB
MD5fcc9fd8995cf85e5dcd90b6181b34dc7
SHA1359fb769a5f8f4569d1e045e87e3cbc8b92f3f78
SHA256bae667ab9c4c87e83a2822d1b809ba141f13ea62746c7aa35ca439d77cf66b39
SHA5125124a405ff3fb97b3715bd75db85c6178a32bcdcd03e4261d98ac05e8caa92434da978bf703282658db61cdd9f5b2d6aded82520faff47cf344e307cb199dd33
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g8315913.exeFilesize
304KB
MD5fcc9fd8995cf85e5dcd90b6181b34dc7
SHA1359fb769a5f8f4569d1e045e87e3cbc8b92f3f78
SHA256bae667ab9c4c87e83a2822d1b809ba141f13ea62746c7aa35ca439d77cf66b39
SHA5125124a405ff3fb97b3715bd75db85c6178a32bcdcd03e4261d98ac05e8caa92434da978bf703282658db61cdd9f5b2d6aded82520faff47cf344e307cb199dd33
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h8940647.exeFilesize
174KB
MD53deaf33ce806e8572a34310cb933424c
SHA1db3a2ec27ede5301bb4f0d65d49eb07653c88df2
SHA256baccc7e8f5788d82e6356f1765bace9718546d50d811cfa865a76edf690f5242
SHA5127f60d210522951e9b942aefe3438c1490ff88edc1563376682dd11a13cb197f81769ab5c3835139959d1d2620329a3c84d149d264d0643b000369c5301e48a1e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\h8940647.exeFilesize
174KB
MD53deaf33ce806e8572a34310cb933424c
SHA1db3a2ec27ede5301bb4f0d65d49eb07653c88df2
SHA256baccc7e8f5788d82e6356f1765bace9718546d50d811cfa865a76edf690f5242
SHA5127f60d210522951e9b942aefe3438c1490ff88edc1563376682dd11a13cb197f81769ab5c3835139959d1d2620329a3c84d149d264d0643b000369c5301e48a1e
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeFilesize
116B
MD5ec6aae2bb7d8781226ea61adca8f0586
SHA1d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3
SHA256b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599
SHA512aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zkv1al04.xwo.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\kos.exeFilesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
C:\Users\Admin\AppData\Local\Temp\kos1.exeFilesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
C:\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
C:\Users\Admin\AppData\Local\Temp\ss41.exeFilesize
416KB
MD583330cf6e88ad32365183f31b1fd3bda
SHA11c5b47be2b8713746de64b39390636a81626d264
SHA2567ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e
SHA512e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908
-
C:\Users\Admin\AppData\Local\Temp\ss41.exeFilesize
416KB
MD583330cf6e88ad32365183f31b1fd3bda
SHA11c5b47be2b8713746de64b39390636a81626d264
SHA2567ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e
SHA512e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908
-
C:\Users\Admin\AppData\Local\Temp\ss41.exeFilesize
416KB
MD583330cf6e88ad32365183f31b1fd3bda
SHA11c5b47be2b8713746de64b39390636a81626d264
SHA2567ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e
SHA512e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
338KB
MD5528b5dc5ede359f683b73a684b9c19f6
SHA18bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA2563a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA51287cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
338KB
MD5528b5dc5ede359f683b73a684b9c19f6
SHA18bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA2563a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA51287cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
\??\pipe\LOCAL\crashpad_1972_KNMKAOVHXLBWJXKEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_3760_JGQPYGBYNXFFZPDDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/932-530-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/932-482-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/932-479-0x0000000000D50000-0x0000000000EC4000-memory.dmpFilesize
1.5MB
-
memory/1236-582-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1236-890-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1236-846-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1236-589-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1236-1055-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1236-954-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/2660-1052-0x0000000000400000-0x000000000298D000-memory.dmpFilesize
37.6MB
-
memory/2660-1062-0x0000000000400000-0x000000000298D000-memory.dmpFilesize
37.6MB
-
memory/3036-568-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/3036-649-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/3128-590-0x00000000030C0000-0x00000000030D6000-memory.dmpFilesize
88KB
-
memory/3128-89-0x0000000003230000-0x0000000003246000-memory.dmpFilesize
88KB
-
memory/3400-20-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3400-23-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3400-19-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3400-21-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4012-591-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4012-480-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4012-467-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4012-469-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4392-269-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4392-294-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4392-266-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4392-267-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4604-495-0x00000000046A0000-0x0000000004AA0000-memory.dmpFilesize
4.0MB
-
memory/4604-532-0x0000000000400000-0x000000000298D000-memory.dmpFilesize
37.6MB
-
memory/4604-510-0x0000000004AA0000-0x000000000538B000-memory.dmpFilesize
8.9MB
-
memory/4604-833-0x0000000000400000-0x000000000298D000-memory.dmpFilesize
37.6MB
-
memory/4604-634-0x00000000046A0000-0x0000000004AA0000-memory.dmpFilesize
4.0MB
-
memory/4604-850-0x0000000000400000-0x000000000298D000-memory.dmpFilesize
37.6MB
-
memory/4604-617-0x0000000000400000-0x000000000298D000-memory.dmpFilesize
37.6MB
-
memory/4632-91-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4632-15-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4632-14-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4676-271-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4676-270-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4676-274-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4864-448-0x0000000000400000-0x00000000005BD000-memory.dmpFilesize
1.7MB
-
memory/4864-498-0x0000000000400000-0x00000000005BD000-memory.dmpFilesize
1.7MB
-
memory/4864-525-0x0000000000400000-0x00000000005BD000-memory.dmpFilesize
1.7MB
-
memory/4884-563-0x0000000003200000-0x0000000003210000-memory.dmpFilesize
64KB
-
memory/4884-633-0x00007FFF31A00000-0x00007FFF324C1000-memory.dmpFilesize
10.8MB
-
memory/4884-528-0x0000000000E70000-0x0000000000E78000-memory.dmpFilesize
32KB
-
memory/4884-573-0x00007FFF31A00000-0x00007FFF324C1000-memory.dmpFilesize
10.8MB
-
memory/5056-902-0x0000000000400000-0x000000000298D000-memory.dmpFilesize
37.6MB
-
memory/5056-967-0x0000000000400000-0x000000000298D000-memory.dmpFilesize
37.6MB
-
memory/5248-466-0x0000000002730000-0x0000000002830000-memory.dmpFilesize
1024KB
-
memory/5248-464-0x00000000025F0000-0x00000000025F9000-memory.dmpFilesize
36KB
-
memory/5344-288-0x00007FFF31A00000-0x00007FFF324C1000-memory.dmpFilesize
10.8MB
-
memory/5344-283-0x0000000000010000-0x000000000001A000-memory.dmpFilesize
40KB
-
memory/5344-545-0x00007FFF31A00000-0x00007FFF324C1000-memory.dmpFilesize
10.8MB
-
memory/5344-452-0x00007FFF31A00000-0x00007FFF324C1000-memory.dmpFilesize
10.8MB
-
memory/5476-296-0x0000000000F20000-0x0000000000F50000-memory.dmpFilesize
192KB
-
memory/5476-303-0x00000000032B0000-0x00000000032B6000-memory.dmpFilesize
24KB
-
memory/5476-317-0x0000000005910000-0x000000000594C000-memory.dmpFilesize
240KB
-
memory/5476-325-0x0000000005AA0000-0x0000000005AEC000-memory.dmpFilesize
304KB
-
memory/5476-312-0x0000000005EA0000-0x00000000064B8000-memory.dmpFilesize
6.1MB
-
memory/5476-315-0x00000000032E0000-0x00000000032F0000-memory.dmpFilesize
64KB
-
memory/5476-494-0x00000000032E0000-0x00000000032F0000-memory.dmpFilesize
64KB
-
memory/5476-298-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/5476-457-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/5544-295-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5544-313-0x00000000080A0000-0x00000000081AA000-memory.dmpFilesize
1.0MB
-
memory/5544-316-0x0000000007E70000-0x0000000007E82000-memory.dmpFilesize
72KB
-
memory/5544-310-0x0000000007D90000-0x0000000007D9A000-memory.dmpFilesize
40KB
-
memory/5544-309-0x0000000007E90000-0x0000000007EA0000-memory.dmpFilesize
64KB
-
memory/5544-307-0x0000000007CB0000-0x0000000007D42000-memory.dmpFilesize
584KB
-
memory/5544-304-0x00000000081C0000-0x0000000008764000-memory.dmpFilesize
5.6MB
-
memory/5544-302-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/5544-478-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/5544-493-0x0000000007E90000-0x0000000007EA0000-memory.dmpFilesize
64KB
-
memory/5636-627-0x0000000008DB0000-0x00000000092DC000-memory.dmpFilesize
5.2MB
-
memory/5636-626-0x0000000008BD0000-0x0000000008D92000-memory.dmpFilesize
1.8MB
-
memory/5636-569-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/5636-579-0x00000000077D0000-0x00000000077E0000-memory.dmpFilesize
64KB
-
memory/5636-630-0x00000000093E0000-0x00000000093FE000-memory.dmpFilesize
120KB
-
memory/5636-596-0x0000000008100000-0x0000000008166000-memory.dmpFilesize
408KB
-
memory/5636-548-0x00000000007D0000-0x000000000082A000-memory.dmpFilesize
360KB
-
memory/5636-576-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/5812-554-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/5812-514-0x0000000000C90000-0x0000000000C96000-memory.dmpFilesize
24KB
-
memory/5812-496-0x0000000000140000-0x0000000000170000-memory.dmpFilesize
192KB
-
memory/5812-558-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/5812-616-0x0000000005000000-0x0000000005076000-memory.dmpFilesize
472KB
-
memory/5848-570-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5848-567-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5848-574-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/5996-575-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/5996-513-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/6000-632-0x00000000045E0000-0x0000000004616000-memory.dmpFilesize
216KB
-
memory/6120-628-0x0000000002F90000-0x0000000003101000-memory.dmpFilesize
1.4MB
-
memory/6120-629-0x0000000003110000-0x0000000003241000-memory.dmpFilesize
1.2MB
-
memory/6120-458-0x00007FF7FDFE0000-0x00007FF7FE04A000-memory.dmpFilesize
424KB