Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 07:25
Static task
static1
General
-
Target
file.exe
-
Size
925KB
-
MD5
a5b2e122a91c3e82082c51687c48fd2e
-
SHA1
9dcd8e1b951f05528d3145d5fa7a4e4cfd1bdd0e
-
SHA256
0278cd0d16def73d5d75106ad62ca0d62eadc9b511c59f7c5bbb68c1b0befda8
-
SHA512
6d95ff04631db3086785309c231bed4ad37cec5060d228daf3a576169e36b6587076e59a1206a121f0de455cf64b524fba71a7b6bb46d0ec366c262ed9e58dd9
-
SSDEEP
24576:Yyw6Kp/I0qTlSdFjzUEFLwR0TRolu1R2BWb6/:fw6KJ1ylSzjzLR+6Rolu184m
Malware Config
Extracted
redline
genda
77.91.124.55:19071
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
larek
77.91.124.55:19071
Extracted
smokeloader
up3
Extracted
redline
@ytlogsbot
176.123.4.46:33783
-
auth_value
295b226f1b63bcd55148625381b27b19
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
fabookie
http://app.nnnaajjjgc.com/check/safe
Signatures
-
DcRat 4 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe 5760 schtasks.exe 5436 schtasks.exe 4108 schtasks.exe -
Detect Fabookie payload 1 IoCs
resource yara_rule behavioral2/memory/5512-591-0x0000000003910000-0x0000000003A41000-memory.dmp family_fabookie -
Detects Healer an antivirus disabler dropper 6 IoCs
resource yara_rule behavioral2/files/0x0007000000023256-26.dat healer behavioral2/files/0x0007000000023256-27.dat healer behavioral2/memory/4308-28-0x0000000000D10000-0x0000000000D1A000-memory.dmp healer behavioral2/files/0x00070000000232d5-314.dat healer behavioral2/files/0x00070000000232d5-316.dat healer behavioral2/files/0x00070000000232d5-315.dat healer -
Glupteba payload 8 IoCs
resource yara_rule behavioral2/memory/5860-454-0x0000000004BE0000-0x00000000054CB000-memory.dmp family_glupteba behavioral2/memory/5860-482-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/5860-580-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/5860-815-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/5860-867-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/6020-891-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/6020-977-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba behavioral2/memory/6080-1024-0x0000000000400000-0x000000000298D000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 0004180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 0004180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 0004180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 212.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 212.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 0004180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 0004180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 0004180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 212.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 212.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 212.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
resource yara_rule behavioral2/memory/864-48-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral2/memory/5272-382-0x0000000000200000-0x000000000023E000-memory.dmp family_redline behavioral2/memory/4600-515-0x00000000007C0000-0x000000000081A000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 5016 netsh.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation kos1.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation kos.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation Jn21gx.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation 1B69.exe -
Executes dropped EXE 40 IoCs
pid Process 4028 Ay6lL22.exe 3212 Ry5ac36.exe 1208 sr4xY60.exe 4308 0004180.exe 4148 8620214.exe 4360 Hq80FT3.exe 4440 yx387MX.exe 5012 zIR4cS5.exe 4184 FB09.exe 3964 Gs2nk2Lc.exe 3788 FCEF.exe 4916 IN4Tk4cT.exe 3956 cY6Eg9xY.exe 876 Ps1dG7Lt.exe 1692 IM2ly51.exe 5164 146.exe 5188 Jn21gx.exe 5284 212.exe 5476 417.exe 5504 explothe.exe 5588 LI279Qb.exe 5272 Lj226Mc.exe 5488 1B69.exe 5512 ss41.exe 4272 toolspub2.exe 5860 31839b57a4f11171d6abc8bbc4451ee4.exe 5996 kos1.exe 6016 toolspub2.exe 6084 2194.exe 2768 set16.exe 4600 msedge.exe 5148 kos.exe 2332 is-0124D.tmp 180 previewer.exe 3956 previewer.exe 5484 explothe.exe 6020 31839b57a4f11171d6abc8bbc4451ee4.exe 6080 csrss.exe 5740 injector.exe 6012 explothe.exe -
Loads dropped DLL 6 IoCs
pid Process 2332 is-0124D.tmp 2332 is-0124D.tmp 2332 is-0124D.tmp 4600 msedge.exe 4600 msedge.exe 3292 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 0004180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 212.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Ay6lL22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Ry5ac36.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Gs2nk2Lc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" IN4Tk4cT.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" cY6Eg9xY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" Ps1dG7Lt.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" sr4xY60.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" FB09.exe Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 4148 set thread context of 2152 4148 8620214.exe 98 PID 4360 set thread context of 3812 4360 Hq80FT3.exe 103 PID 4440 set thread context of 864 4440 yx387MX.exe 110 PID 3788 set thread context of 2200 3788 FCEF.exe 188 PID 5164 set thread context of 5716 5164 146.exe 173 PID 5588 set thread context of 6052 5588 LI279Qb.exe 179 PID 4272 set thread context of 6016 4272 toolspub2.exe 195 PID 6084 set thread context of 3016 6084 2194.exe 209 -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files (x86)\PA Previewer\unins000.dat is-0124D.tmp File created C:\Program Files (x86)\PA Previewer\is-OUSJ3.tmp is-0124D.tmp File created C:\Program Files (x86)\PA Previewer\is-DUDRF.tmp is-0124D.tmp File created C:\Program Files (x86)\PA Previewer\is-N83TG.tmp is-0124D.tmp File created C:\Program Files (x86)\PA Previewer\is-3KP10.tmp is-0124D.tmp File opened for modification C:\Program Files (x86)\PA Previewer\unins000.dat is-0124D.tmp File opened for modification C:\Program Files (x86)\PA Previewer\previewer.exe is-0124D.tmp -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 8 IoCs
pid pid_target Process procid_target 1716 4148 WerFault.exe 96 2840 4360 WerFault.exe 101 3288 3812 WerFault.exe 103 4252 4440 WerFault.exe 108 5140 3788 WerFault.exe 143 5944 5164 WerFault.exe 155 2920 5588 WerFault.exe 166 5696 4600 WerFault.exe 198 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5760 schtasks.exe 5436 schtasks.exe 4108 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4308 0004180.exe 4308 0004180.exe 2152 AppLaunch.exe 2152 AppLaunch.exe 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 2520 msedge.exe 2520 msedge.exe 3216 Process not Found 3216 Process not Found 5024 msedge.exe 5024 msedge.exe 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 4304 msedge.exe 4304 msedge.exe 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found 3216 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3216 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2152 AppLaunch.exe 6016 toolspub2.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4308 0004180.exe Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeDebugPrivilege 5284 212.exe Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeDebugPrivilege 5148 kos.exe Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found Token: SeCreatePagefilePrivilege 3216 Process not Found Token: SeShutdownPrivilege 3216 Process not Found -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3216 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 4028 2200 file.exe 86 PID 2200 wrote to memory of 4028 2200 file.exe 86 PID 2200 wrote to memory of 4028 2200 file.exe 86 PID 4028 wrote to memory of 3212 4028 Ay6lL22.exe 87 PID 4028 wrote to memory of 3212 4028 Ay6lL22.exe 87 PID 4028 wrote to memory of 3212 4028 Ay6lL22.exe 87 PID 3212 wrote to memory of 1208 3212 Ry5ac36.exe 88 PID 3212 wrote to memory of 1208 3212 Ry5ac36.exe 88 PID 3212 wrote to memory of 1208 3212 Ry5ac36.exe 88 PID 1208 wrote to memory of 4308 1208 sr4xY60.exe 89 PID 1208 wrote to memory of 4308 1208 sr4xY60.exe 89 PID 1208 wrote to memory of 4148 1208 sr4xY60.exe 96 PID 1208 wrote to memory of 4148 1208 sr4xY60.exe 96 PID 1208 wrote to memory of 4148 1208 sr4xY60.exe 96 PID 4148 wrote to memory of 2152 4148 8620214.exe 98 PID 4148 wrote to memory of 2152 4148 8620214.exe 98 PID 4148 wrote to memory of 2152 4148 8620214.exe 98 PID 4148 wrote to memory of 2152 4148 8620214.exe 98 PID 4148 wrote to memory of 2152 4148 8620214.exe 98 PID 4148 wrote to memory of 2152 4148 8620214.exe 98 PID 3212 wrote to memory of 4360 3212 Ry5ac36.exe 101 PID 3212 wrote to memory of 4360 3212 Ry5ac36.exe 101 PID 3212 wrote to memory of 4360 3212 Ry5ac36.exe 101 PID 4360 wrote to memory of 3812 4360 Hq80FT3.exe 103 PID 4360 wrote to memory of 3812 4360 Hq80FT3.exe 103 PID 4360 wrote to memory of 3812 4360 Hq80FT3.exe 103 PID 4360 wrote to memory of 3812 4360 Hq80FT3.exe 103 PID 4360 wrote to memory of 3812 4360 Hq80FT3.exe 103 PID 4360 wrote to memory of 3812 4360 Hq80FT3.exe 103 PID 4360 wrote to memory of 3812 4360 Hq80FT3.exe 103 PID 4360 wrote to memory of 3812 4360 Hq80FT3.exe 103 PID 4360 wrote to memory of 3812 4360 Hq80FT3.exe 103 PID 4360 wrote to memory of 3812 4360 Hq80FT3.exe 103 PID 4028 wrote to memory of 4440 4028 Ay6lL22.exe 108 PID 4028 wrote to memory of 4440 4028 Ay6lL22.exe 108 PID 4028 wrote to memory of 4440 4028 Ay6lL22.exe 108 PID 4440 wrote to memory of 864 4440 yx387MX.exe 110 PID 4440 wrote to memory of 864 4440 yx387MX.exe 110 PID 4440 wrote to memory of 864 4440 yx387MX.exe 110 PID 4440 wrote to memory of 864 4440 yx387MX.exe 110 PID 4440 wrote to memory of 864 4440 yx387MX.exe 110 PID 4440 wrote to memory of 864 4440 yx387MX.exe 110 PID 4440 wrote to memory of 864 4440 yx387MX.exe 110 PID 4440 wrote to memory of 864 4440 yx387MX.exe 110 PID 2200 wrote to memory of 5012 2200 file.exe 113 PID 2200 wrote to memory of 5012 2200 file.exe 113 PID 2200 wrote to memory of 5012 2200 file.exe 113 PID 5012 wrote to memory of 752 5012 zIR4cS5.exe 115 PID 5012 wrote to memory of 752 5012 zIR4cS5.exe 115 PID 752 wrote to memory of 4304 752 cmd.exe 116 PID 752 wrote to memory of 4304 752 cmd.exe 116 PID 4304 wrote to memory of 4380 4304 msedge.exe 118 PID 4304 wrote to memory of 4380 4304 msedge.exe 118 PID 752 wrote to memory of 1852 752 cmd.exe 119 PID 752 wrote to memory of 1852 752 cmd.exe 119 PID 1852 wrote to memory of 4324 1852 msedge.exe 120 PID 1852 wrote to memory of 4324 1852 msedge.exe 120 PID 1852 wrote to memory of 4944 1852 msedge.exe 124 PID 1852 wrote to memory of 4944 1852 msedge.exe 124 PID 1852 wrote to memory of 4944 1852 msedge.exe 124 PID 1852 wrote to memory of 4944 1852 msedge.exe 124 PID 1852 wrote to memory of 4944 1852 msedge.exe 124 PID 1852 wrote to memory of 4944 1852 msedge.exe 124 PID 1852 wrote to memory of 4944 1852 msedge.exe 124 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 5926⤵
- Program crash
PID:1716
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵PID:3812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 5406⤵
- Program crash
PID:3288
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 1525⤵
- Program crash
PID:2840
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1524⤵
- Program crash
PID:4252
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A78A.tmp\A78B.tmp\A78C.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffbdae546f8,0x7ffbdae54708,0x7ffbdae547185⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:25⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:85⤵PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:15⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:15⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:15⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:85⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:85⤵PID:2252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:15⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:15⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:15⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:15⤵PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:15⤵PID:5436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:15⤵PID:5680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:15⤵PID:5908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17945872952553546920,5182803929707162697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4600
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/4⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffbdae546f8,0x7ffbdae54708,0x7ffbdae547185⤵PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,3185097068016162589,2036762265779224046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:2520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,3185097068016162589,2036762265779224046,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:25⤵PID:4944
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4148 -ip 41481⤵PID:1932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4360 -ip 43601⤵PID:4160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3812 -ip 38121⤵PID:2852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4440 -ip 44401⤵PID:3184
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4176
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\FB09.exeC:\Users\Admin\AppData\Local\Temp\FB09.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gs2nk2Lc.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gs2nk2Lc.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN4Tk4cT.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN4Tk4cT.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cY6Eg9xY.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cY6Eg9xY.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Ps1dG7Lt.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Ps1dG7Lt.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:876 -
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IM2ly51.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IM2ly51.exe6⤵
- Executes dropped EXE
PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\Jn21gx.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\Jn21gx.exe6⤵
- Checks computer location settings
- Executes dropped EXE
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
PID:5504 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F8⤵
- DcRat
- Creates scheduled task(s)
PID:5760
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit8⤵PID:5844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"9⤵PID:5160
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"9⤵PID:5184
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E9⤵PID:5216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"9⤵PID:4124
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"9⤵PID:2200
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E9⤵PID:5280
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main8⤵
- Loads dropped DLL
PID:3292
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LI279Qb.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LI279Qb.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5588 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:6052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 6006⤵
- Program crash
PID:2920
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Lj226Mc.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Lj226Mc.exe4⤵
- Executes dropped EXE
PID:5272
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FCEF.exeC:\Users\Admin\AppData\Local\Temp\FCEF.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3788 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 1522⤵
- Program crash
PID:5140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FF13.bat" "1⤵PID:3028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login2⤵PID:5276
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbdae546f8,0x7ffbdae54708,0x7ffbdae547183⤵PID:5332
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/2⤵PID:5516
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbdae546f8,0x7ffbdae54708,0x7ffbdae547183⤵PID:5544
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3788 -ip 37881⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\146.exeC:\Users\Admin\AppData\Local\Temp\146.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5164 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5668
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5692
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5708
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 4362⤵
- Program crash
PID:5944
-
-
C:\Users\Admin\AppData\Local\Temp\212.exeC:\Users\Admin\AppData\Local\Temp\212.exe1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:5284
-
C:\Users\Admin\AppData\Local\Temp\417.exeC:\Users\Admin\AppData\Local\Temp\417.exe1⤵
- Executes dropped EXE
PID:5476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5164 -ip 51641⤵PID:5832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5588 -ip 55881⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\1B69.exeC:\Users\Admin\AppData\Local\Temp\1B69.exe1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\ss41.exe"C:\Users\Admin\AppData\Local\Temp\ss41.exe"2⤵
- Executes dropped EXE
PID:5512
-
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6016
-
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"2⤵
- Executes dropped EXE
PID:5860 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:5068
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:6020 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2100
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵PID:4620
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
PID:5016
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4108
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5224
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
PID:6080 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1752
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
PID:5436
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵PID:1804
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5964
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5764
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
PID:5740
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
PID:4108
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kos1.exe"C:\Users\Admin\AppData\Local\Temp\kos1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\set16.exe"C:\Users\Admin\AppData\Local\Temp\set16.exe"3⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\is-PFAUL.tmp\is-0124D.tmp"C:\Users\Admin\AppData\Local\Temp\is-PFAUL.tmp\is-0124D.tmp" /SL4 $10258 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 522244⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2332 -
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -s5⤵
- Executes dropped EXE
PID:3956
-
-
C:\Program Files (x86)\PA Previewer\previewer.exe"C:\Program Files (x86)\PA Previewer\previewer.exe" -i5⤵
- Executes dropped EXE
PID:180
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 85⤵PID:1252
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\kos.exe"C:\Users\Admin\AppData\Local\Temp\kos.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5148
-
-
-
C:\Users\Admin\AppData\Local\Temp\2194.exeC:\Users\Admin\AppData\Local\Temp\2194.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6084 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:3016
-
-
C:\Users\Admin\AppData\Local\Temp\2425.exeC:\Users\Admin\AppData\Local\Temp\2425.exe1⤵PID:4600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 7922⤵
- Program crash
PID:5696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4600 -ip 46001⤵PID:6044
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 81⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:5484
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:6012
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Scripting
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
Filesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
Filesize
152B
MD50987267c265b2de204ac19d29250d6cd
SHA1247b7b1e917d9ad2aa903a497758ae75ae145692
SHA256474887e5292c0cf7d5ed52e3bcd255eedd5347f6f811200080c4b5d813886264
SHA5123b272b8c8d4772e1a4dc68d17a850439ffdd72a6f6b1306eafa18b810b103f3198af2c58d6ed92a1f3c498430c1b351e9f5c114ea5776b65629b1360f7ad13f5
-
Filesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
Filesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
Filesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
Filesize
152B
MD5f95638730ec51abd55794c140ca826c9
SHA177c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA5120eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD585b5dc9367f5377c142d30b65afdc328
SHA147ff550183fe0d3dd5ea00d8295a928d944cd6fc
SHA25677b88cde57ec1de730aa9d75b6b47f36a4b1358030c3f25e4d537242fab9b6bd
SHA5123135b52b318e3c7df287445c40293f85ff553fabe22d8dbac921a2bbe5bb614524602991e5f5f7f3a9edf4d5329e6214598b065b354686ce5c0178f44fcc9dc1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD55704cbf49d6aea08288a69e3eaa2e046
SHA16780cd93f9a8f854e85f7818ca5bfb0881b8c94e
SHA256cc3db3527e49ccb56fbdba8dccd3ad3d6388864ab915944af40f05aa2732b31d
SHA512fdf3edcee83e98d4e14f434ea6602cd9784cf824376e79a44b43165967611a16a3ff112890638a31106d3ae3b4b82b20448e67124525148a6a408bebe37139b7
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1KB
MD58132512bac53e98479e25c3365b93754
SHA120ca22391083b9003e1a67374b445ebada568512
SHA2564005437ad07c06bceaf677b02cb74caac114a7aa95d308efd6a3e276f050f629
SHA5128bd10e3afc4bcd7b49f48f67a0109e7d31953ae1354d4fcaaba9efb4d58e401c7c8e723d93379edc6c91f775cbed202cbd29ee3d5199ae30c26d41ab4fb2aa81
-
Filesize
7KB
MD58229972ccafcddee450ec8d38d9646b5
SHA1670687633c503f263f870c9339269df213cfd993
SHA256c9adb9e2729fc700d42e1cef257a5d7d86a23b1135256817e3947446d3e3c91b
SHA5128d083313c3bb4e7a1f62f5f805e809199e8bbebb1232d33495ee4fd3f8c37af661a32672d3d9126951e5182bf88b76bfa899d089cf9c9f35fdc5ae754e3f20cc
-
Filesize
6KB
MD540912cbd82bf078db2b1d888d2414ec4
SHA17cbcff0e1df536a0cb8072eeea389a635c969085
SHA2567751f193b380cab96d7cbc1ec3b7969866b8f20576739696b56846af4cf2381f
SHA512da70f7970198e2131076c591b471e3e5b2da3532752392fd8e39be8bf3f6ea748c38c677083bb2f789b00ed5c1f612c2066f0674b2b74cf9f3369552c84d463e
-
Filesize
5KB
MD557a7cfd67a39815534fce95d3c30e4ae
SHA1addb60916f836a1474fb77d48d84cea47d6dd0dd
SHA256e76d9786edc0fa9f04720aa21ee873d9dbd87629e7306797aae88ff37df74593
SHA5126b212c7fa369e48b26c5deb96f16f712be4171bb27fb55eec1ac8330ac5e07de99b4dc8dd4b290436d93856b102a1ab810afd8a25f2f298d3b1f9311eb241546
-
Filesize
6KB
MD5a411efc60adb9a7e60d321fc1e88b709
SHA1f2ce4d12c7b640fc66b44e10663c97012fcd4d61
SHA256b51e8a915944e388237b77e1bfd3f954d5d822ab9825457d3c0cfe61dbcacb60
SHA51216327aece7090bfa8a502586c614a91cecfaa723b79388cd347a2927b6eaa870bb7829ef04de54d9c48bcda7f58a8acba69202c55f28d1431ac9cae65262a83d
-
Filesize
24KB
MD54a078fb8a7c67594a6c2aa724e2ac684
SHA192bc5b49985c8588c60f6f85c50a516fae0332f4
SHA256c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee
SHA512188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6
-
Filesize
872B
MD57af30df06a5f7286eca06ee890110341
SHA1a48b41566af145e5ad789752a41b24168f57223b
SHA256642d8a7b5e3eeb3369be0e50ad885c3e488e4e3567da0b11398842bef9ea6c59
SHA5129aa3a02d9c924f1d08b4ca2de4dd6891e42c766102ec60b8b1f4a981d49c63e45ca72723c80b2ff9c0c5a1911ef8661fa6f50b4900c2ff6e530ec6aa5a4d1595
-
Filesize
872B
MD59f2d0289df915bc0ab14c59560b14a56
SHA16840092bb20202f1fc5b4a9ac60a611eaf6d6e23
SHA2565aa419af6fb4fcd38a49a0afa14ff836a4ad6130b6ce0b002d3958bb5a7e5fbc
SHA5124dfcc3bbad7334b66622e07c42649ac2478126efc5ab51c0de52662611b56c3b0e78013bd2cdffa57393aadb6070f88a0256ad5d3a2fb492e1d7a7caf3d08478
-
Filesize
872B
MD5f87f7c4cda014337ede88bec24c7ae95
SHA12882b3762908e7ca83b86a1781b8a8dd93468789
SHA256c28498333291f25efc040fad23b185bf2fc72eddd986333803058abd8b9b78c1
SHA512a0f8880596803dc51cecd5d0efe4713aeed51da3c33e18d53163c6d2f7548fed69c8aaf8c1a488673ab30ab04b7106beda202f47c9fdb634489df678b9721c0d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD57a75ee918ddf63a7126baa09691b6c74
SHA1b9fbdafb9c7240fcfa38345d5fe1215640a73aee
SHA256aa6085a344b9d02ea1d5bb88e8f1de609533e183a88cad15bcead7ea4a7cf5f6
SHA512c72818a9ed7190675706f9927698baec30fffad5f6982748d218da3e1e2119821151e464f6191e0a70f99160aaed15263f9860f1b2974774cd3171c7e10118da
-
Filesize
10KB
MD5850d0f3269af77053a740a995f34e054
SHA1a101d49635ba31009ac315815be0f8181299c584
SHA2566db13c59084e5a93d262cc7b7e3f091eba1e82f56e3f58c41d40a2e9b93cf1b7
SHA5122bec9bfe364e1de812f03809422379f81016151b4866895141341ffdff86f6d84a62e034c9ba611688f38b73f870c61c6a646ab87da694d8b8d8b7417f3118b4
-
Filesize
10KB
MD5b7fba4b8b15eba5f0845b1df34bf2393
SHA1df377cc1c5642b035d2a6b21f2fb4c9833e78883
SHA2564ff0f0e31e7598952f0748e065e516ec446c41922f6ab53d35bdeed574730d97
SHA5126edf3ad9ee455c8010e64d05203149651a0ca30f7483acb429a27e0a1e3c7aa7cb04c0c292a609fb8fce8ed2da301105a354e28e11a2deb320e46fa865a9ef58
-
Filesize
2KB
MD536ba391369cfe43d38f768e395a22e7b
SHA1abe3f50e7af15aa0ab9d44d3a394c7075f41f2db
SHA2565dda06105c04f14971c021e4192e3c9fc3b41fe1365905155c758540dbc7a92d
SHA512efa8d99927d0c36da6fe1536c09064eaf5c9bdadccf68383d42a9aab0d76b2e32099e5756820681774f2b31001a6dd1a202c2242ec45786942b14058e9784a32
-
Filesize
2KB
MD536ba391369cfe43d38f768e395a22e7b
SHA1abe3f50e7af15aa0ab9d44d3a394c7075f41f2db
SHA2565dda06105c04f14971c021e4192e3c9fc3b41fe1365905155c758540dbc7a92d
SHA512efa8d99927d0c36da6fe1536c09064eaf5c9bdadccf68383d42a9aab0d76b2e32099e5756820681774f2b31001a6dd1a202c2242ec45786942b14058e9784a32
-
Filesize
386KB
MD5e807b615389cd0c7d8d2334b0eb6fd86
SHA1f84e547a8e30c1a31ecf3e0f71f98bd3f246e74f
SHA256512ac913ac02033f24682c72c5ba10d3d304e9dbfec5ce0f528bd9024851dbcc
SHA51297814ec9ec09438f6f83d3ac4d6793a4b2338585f5945e90ba3f2faf656a756c99701366b0b9e947269158b8455742ae3e74a91fdda7c8f1f8863e5563045069
-
Filesize
386KB
MD5e807b615389cd0c7d8d2334b0eb6fd86
SHA1f84e547a8e30c1a31ecf3e0f71f98bd3f246e74f
SHA256512ac913ac02033f24682c72c5ba10d3d304e9dbfec5ce0f528bd9024851dbcc
SHA51297814ec9ec09438f6f83d3ac4d6793a4b2338585f5945e90ba3f2faf656a756c99701366b0b9e947269158b8455742ae3e74a91fdda7c8f1f8863e5563045069
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
4.2MB
MD57ea584dc49967de03bebdacec829b18d
SHA13d47f0e88c7473bedeed2f14d7a8db1318b93852
SHA25679232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53
SHA512ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
Filesize
90B
MD55a115a88ca30a9f57fdbb545490c2043
SHA167e90f37fc4c1ada2745052c612818588a5595f4
SHA25652c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d
SHA51217c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe
-
Filesize
1.1MB
MD5099b3d4378bb94aa106135ed1fc4d922
SHA12f9609032c3aea88a01321ce705a5fcded2a74d8
SHA256271baf68891b775c19ff448ad18177a1dd25956d7a8d6c9a1a04cd454b84f9db
SHA51250ce310246854d65e902f0d8e586732e2d94d4b9f713edf4be070a2d1de57bd551f885cc5d3df869180aa0d9e0920ca2d474f3919281025340e750249a06fdfe
-
Filesize
1.1MB
MD5099b3d4378bb94aa106135ed1fc4d922
SHA12f9609032c3aea88a01321ce705a5fcded2a74d8
SHA256271baf68891b775c19ff448ad18177a1dd25956d7a8d6c9a1a04cd454b84f9db
SHA51250ce310246854d65e902f0d8e586732e2d94d4b9f713edf4be070a2d1de57bd551f885cc5d3df869180aa0d9e0920ca2d474f3919281025340e750249a06fdfe
-
Filesize
304KB
MD5681a1edcbe145ff2480a0eff775117f0
SHA19d3ac177ae0166f168b06711c10495065ac460f5
SHA256c55d8e4cc82489e37fdef80c7c9438e99d43f877bcdeb0fefa9cd077fdd4ee41
SHA5124abe92527b95af849140c2fa8c192d0bf14adb1d5ddd5d339d6047b5b8371fa2b8a856490902ba06bf9c6cabae257cadc0be525ea76d6202da020ca698fa23e4
-
Filesize
304KB
MD5681a1edcbe145ff2480a0eff775117f0
SHA19d3ac177ae0166f168b06711c10495065ac460f5
SHA256c55d8e4cc82489e37fdef80c7c9438e99d43f877bcdeb0fefa9cd077fdd4ee41
SHA5124abe92527b95af849140c2fa8c192d0bf14adb1d5ddd5d339d6047b5b8371fa2b8a856490902ba06bf9c6cabae257cadc0be525ea76d6202da020ca698fa23e4
-
Filesize
79B
MD5403991c4d18ac84521ba17f264fa79f2
SHA1850cc068de0963854b0fe8f485d951072474fd45
SHA256ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576
-
Filesize
785KB
MD561841312daa6742993b4126d3ae4f167
SHA1233d112a31030e6c3093af86d0f461d15fd9c341
SHA256851fcac47381d066915761750df5ccf83d493c597fc60ec9dcf65bba16e0c806
SHA512b261afce2247b3e5aeb49f4956dddb6204adf370be5b57fe4f33e8e3b3c054aad1713c8ef6829d2bed08953d14fc89720f1d2f69d0ce924788a8ece67206a38f
-
Filesize
785KB
MD561841312daa6742993b4126d3ae4f167
SHA1233d112a31030e6c3093af86d0f461d15fd9c341
SHA256851fcac47381d066915761750df5ccf83d493c597fc60ec9dcf65bba16e0c806
SHA512b261afce2247b3e5aeb49f4956dddb6204adf370be5b57fe4f33e8e3b3c054aad1713c8ef6829d2bed08953d14fc89720f1d2f69d0ce924788a8ece67206a38f
-
Filesize
973KB
MD5a67fb4171f897930464e5f48ca226432
SHA1596933d03d071a6653c67e01cc047c934649aba2
SHA25628038eb5c01bf791e49727f20826e6fad223d116b70238261696539425719669
SHA5126ffa5b0a6ff9c514c001dc407c4ca5ba69c5bb9337296387dde3fba167e5b7935885565dab84260e8d2ad380a6dff83e92a0650272563c48bcb38923b09d6c52
-
Filesize
973KB
MD5a67fb4171f897930464e5f48ca226432
SHA1596933d03d071a6653c67e01cc047c934649aba2
SHA25628038eb5c01bf791e49727f20826e6fad223d116b70238261696539425719669
SHA5126ffa5b0a6ff9c514c001dc407c4ca5ba69c5bb9337296387dde3fba167e5b7935885565dab84260e8d2ad380a6dff83e92a0650272563c48bcb38923b09d6c52
-
Filesize
89KB
MD574382ae3fbf697a0e1a7148a3a73f2b9
SHA149ca121aca985e9d57d9806106c6bc8c19bfc6cf
SHA256bbaaf3ebdf3226d835973f3f58d8e9471f27bfb1976b4d11ed8ef216bff59bdf
SHA51213ac5423e4c41e46de440827f58f812d4013af8f5768f40116b2da5c7ded0ef58096410dd58a49115d729f0bdb63ad72d073ccb861889fe6cefd1537c9f014ba
-
Filesize
89KB
MD574382ae3fbf697a0e1a7148a3a73f2b9
SHA149ca121aca985e9d57d9806106c6bc8c19bfc6cf
SHA256bbaaf3ebdf3226d835973f3f58d8e9471f27bfb1976b4d11ed8ef216bff59bdf
SHA51213ac5423e4c41e46de440827f58f812d4013af8f5768f40116b2da5c7ded0ef58096410dd58a49115d729f0bdb63ad72d073ccb861889fe6cefd1537c9f014ba
-
Filesize
89KB
MD51cc82a989aa185bc3ec20ac7c0f5b2bd
SHA1cc9f19e35e75ca0ad8509393c03812a4d4495f6a
SHA256fd5ca9431ede48010e4043f6d1ec3377584f332bbf4f5040ca2352af5e8834f5
SHA51212d338e13539b137bd8446d8d4526194296295ff1c55cb6ff943ead716a8334c8ed7c6fad52f64873bc2448b08f3aa692998b994075c0c7466662caa41c26c63
-
Filesize
522KB
MD5b706493ed4d8b02a37d591adb06d73d9
SHA1cb9dcff12282d4699784d4e4f72809cc4dabab03
SHA256344d6421de7f538849e61df2abc739f19d09dbc3807c26e0d0ec2a4a2d5153ce
SHA5127f7061fda4ae4a460d08a2182a1abdf40f4f5c26684d63b5b22055859be16163070665f66d0f9895549fddf12607b2b06008d229dc6b79eda1d8023286a8ee71
-
Filesize
522KB
MD5b706493ed4d8b02a37d591adb06d73d9
SHA1cb9dcff12282d4699784d4e4f72809cc4dabab03
SHA256344d6421de7f538849e61df2abc739f19d09dbc3807c26e0d0ec2a4a2d5153ce
SHA5127f7061fda4ae4a460d08a2182a1abdf40f4f5c26684d63b5b22055859be16163070665f66d0f9895549fddf12607b2b06008d229dc6b79eda1d8023286a8ee71
-
Filesize
386KB
MD5fac2a62a7ac2bdb7ca84bd505d29a72e
SHA1a35e400030ff0d25096e347916d053ad6f74b9e3
SHA256d70c1d81046d4de5bd5077d6eda5561ac862da802aff5383bbf909661a7b8cef
SHA512dcbb5ba644ab0b1ecea20e250c37547eb1f511e87333f917eacab43b2a851c64e1b45c4833739924f3ae8f4c6ea7a75f8ed889c059c8178520c1df665fe99bf5
-
Filesize
386KB
MD5fac2a62a7ac2bdb7ca84bd505d29a72e
SHA1a35e400030ff0d25096e347916d053ad6f74b9e3
SHA256d70c1d81046d4de5bd5077d6eda5561ac862da802aff5383bbf909661a7b8cef
SHA512dcbb5ba644ab0b1ecea20e250c37547eb1f511e87333f917eacab43b2a851c64e1b45c4833739924f3ae8f4c6ea7a75f8ed889c059c8178520c1df665fe99bf5
-
Filesize
304KB
MD5834d615f463f293bce13357a6dc509ae
SHA10abb45ba1d8e9a7d858db3dfac4c7097551b0b77
SHA2566dcea16ada6ebb3e334ee94ed52d85e139ca06496de1e6b8da320a9f1b762e25
SHA5121a49d0de326004b8e66484c7b034781605ae3946402b15f382e6c1150ae5f96b6130b3e5f163072a032b96223ac37b945c0e3d76693f1af21392f39ceb656c74
-
Filesize
304KB
MD5834d615f463f293bce13357a6dc509ae
SHA10abb45ba1d8e9a7d858db3dfac4c7097551b0b77
SHA2566dcea16ada6ebb3e334ee94ed52d85e139ca06496de1e6b8da320a9f1b762e25
SHA5121a49d0de326004b8e66484c7b034781605ae3946402b15f382e6c1150ae5f96b6130b3e5f163072a032b96223ac37b945c0e3d76693f1af21392f39ceb656c74
-
Filesize
715KB
MD524a8217ddd7bb28c2aabe78e51ae4b7c
SHA13a521565cd894883b72b73bdfc2053aa1a60bbf6
SHA2568a379a26434d4c79d0dd51288fbeb8227f665cdfb02742de105a9b1a7f8f1d7b
SHA5125a17a45a5e8ac9b0bf76686751fe061482f4b43eb23b2f954b26c49313013ea419921eb46d6e98d84056767e1af72cb105c1cf3bf39c1ab5583c8f325df8a903
-
Filesize
715KB
MD524a8217ddd7bb28c2aabe78e51ae4b7c
SHA13a521565cd894883b72b73bdfc2053aa1a60bbf6
SHA2568a379a26434d4c79d0dd51288fbeb8227f665cdfb02742de105a9b1a7f8f1d7b
SHA5125a17a45a5e8ac9b0bf76686751fe061482f4b43eb23b2f954b26c49313013ea419921eb46d6e98d84056767e1af72cb105c1cf3bf39c1ab5583c8f325df8a903
-
Filesize
264KB
MD55af6cda954aedb3576dfefc7a4fb7867
SHA18727aa8ee58833ea241d484cd5931339bd2e9adb
SHA2569f77e2c85eefacf19de48d05416a98ab2c5544e8481e4bb851e4a92705d3b75c
SHA5126cdd491eaf37a9ff178232bd3fdddeaf7c93c095a515fa6da94b85596d18f76f7eadf5b9873422694d3d2476f41de6b8e2a0ba4e314b62eb16036ed133091790
-
Filesize
264KB
MD55af6cda954aedb3576dfefc7a4fb7867
SHA18727aa8ee58833ea241d484cd5931339bd2e9adb
SHA2569f77e2c85eefacf19de48d05416a98ab2c5544e8481e4bb851e4a92705d3b75c
SHA5126cdd491eaf37a9ff178232bd3fdddeaf7c93c095a515fa6da94b85596d18f76f7eadf5b9873422694d3d2476f41de6b8e2a0ba4e314b62eb16036ed133091790
-
Filesize
11KB
MD5d0ca53edd2573f99ec6b54e391860a7e
SHA13f0dd462e293e2bb7bf12c79b1ac32ec00c774e7
SHA2563939112be72ceafe74305a47754cb2e48b3ebce12068a8fa6d549180ab234f19
SHA51274d07cdd3c95de593c15e925a6cf38be06b6b14dc47feeedb207b3a0fc69d563f4e5c046c05679331e3d9762197c32432b15f859e4e9ad795c0e3d4c6726b6d0
-
Filesize
11KB
MD5d0ca53edd2573f99ec6b54e391860a7e
SHA13f0dd462e293e2bb7bf12c79b1ac32ec00c774e7
SHA2563939112be72ceafe74305a47754cb2e48b3ebce12068a8fa6d549180ab234f19
SHA51274d07cdd3c95de593c15e925a6cf38be06b6b14dc47feeedb207b3a0fc69d563f4e5c046c05679331e3d9762197c32432b15f859e4e9ad795c0e3d4c6726b6d0
-
Filesize
194KB
MD55eb083e864de9176aef7782341c8f7cd
SHA183ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA25627096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e
-
Filesize
194KB
MD55eb083e864de9176aef7782341c8f7cd
SHA183ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA25627096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e
-
Filesize
541KB
MD5852c0f3c1b7ce4d69fffd93b5e02a93f
SHA1d58b19886548efa210002ff03eb900c336c5d2e2
SHA256ddbfe58547bb89c62e41eb7e04df2db155ae635a410982eccdd03364d72570fa
SHA512ea9820107653520c862447f51c600094e37c6ef711eb55c071f830d0c559b34cb535099083d03b52efb322bf1426ebdc42c6645e70ccf9c151edf447538a2df4
-
Filesize
541KB
MD5852c0f3c1b7ce4d69fffd93b5e02a93f
SHA1d58b19886548efa210002ff03eb900c336c5d2e2
SHA256ddbfe58547bb89c62e41eb7e04df2db155ae635a410982eccdd03364d72570fa
SHA512ea9820107653520c862447f51c600094e37c6ef711eb55c071f830d0c559b34cb535099083d03b52efb322bf1426ebdc42c6645e70ccf9c151edf447538a2df4
-
Filesize
386KB
MD530dd294af58c1b8e5b95055f90755d5a
SHA184dfdbaf07fc2803450a3857e81128c86da01aaf
SHA2568bdbc5b417eb2e0931735842f6e9d656704e36e37ae15c84ad5f36f2e8170ad2
SHA5129b0010115567db9c019c32d02809fd72d631b50efedba77a333dbdb65ffa6a6a56b2130e7bd45db93e283863691206b96ff9ef2babed414dede5995df9f73f29
-
Filesize
386KB
MD530dd294af58c1b8e5b95055f90755d5a
SHA184dfdbaf07fc2803450a3857e81128c86da01aaf
SHA2568bdbc5b417eb2e0931735842f6e9d656704e36e37ae15c84ad5f36f2e8170ad2
SHA5129b0010115567db9c019c32d02809fd72d631b50efedba77a333dbdb65ffa6a6a56b2130e7bd45db93e283863691206b96ff9ef2babed414dede5995df9f73f29
-
Filesize
279KB
MD57f6112421b9caa7f2b9f690297d3dc26
SHA1de8a94e43e7943fef6a2d5e27b87a334fb30fb89
SHA256753df5549a1e75d223204cf4f8979bbaad9086a0cdf3182cac159550e98f12c0
SHA5120f8de918907e1ea96c1758c4157ce85ef10039ebdb901f65c7a68cc7696bbf6d1b085d2f650677b9337407cc8409b7fd4b3d224e52d6efb42b234b1df058a1bb
-
Filesize
279KB
MD57f6112421b9caa7f2b9f690297d3dc26
SHA1de8a94e43e7943fef6a2d5e27b87a334fb30fb89
SHA256753df5549a1e75d223204cf4f8979bbaad9086a0cdf3182cac159550e98f12c0
SHA5120f8de918907e1ea96c1758c4157ce85ef10039ebdb901f65c7a68cc7696bbf6d1b085d2f650677b9337407cc8409b7fd4b3d224e52d6efb42b234b1df058a1bb
-
Filesize
140KB
MD56de25e4bd7e214f28e993a708dd8a3fe
SHA1c7dde639c9b312d47acf3ff82a965a321294622b
SHA256e8e358201efff005592a27f48dcafb7cfe9a12bb2840ce96350eab806ef00003
SHA51293b3c6b5380c3d4e59c5da69ba7f17d2246e1f9fe8351ca3877bcaf8fe6701dce845f064cb2a2e3a25a0b329d8c665a2fa15933543cae850a220cc3179ac38f7
-
Filesize
140KB
MD56de25e4bd7e214f28e993a708dd8a3fe
SHA1c7dde639c9b312d47acf3ff82a965a321294622b
SHA256e8e358201efff005592a27f48dcafb7cfe9a12bb2840ce96350eab806ef00003
SHA51293b3c6b5380c3d4e59c5da69ba7f17d2246e1f9fe8351ca3877bcaf8fe6701dce845f064cb2a2e3a25a0b329d8c665a2fa15933543cae850a220cc3179ac38f7
-
Filesize
219KB
MD506e9db049239b88264bb41e6c189c2db
SHA16c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d
-
Filesize
219KB
MD506e9db049239b88264bb41e6c189c2db
SHA16c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d
-
Filesize
116B
MD5ec6aae2bb7d8781226ea61adca8f0586
SHA1d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3
SHA256b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599
SHA512aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
219KB
MD506e9db049239b88264bb41e6c189c2db
SHA16c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d
-
Filesize
219KB
MD506e9db049239b88264bb41e6c189c2db
SHA16c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d
-
Filesize
219KB
MD506e9db049239b88264bb41e6c189c2db
SHA16c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d
-
Filesize
8KB
MD5076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA17b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA51275e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b
-
Filesize
1.4MB
MD585b698363e74ba3c08fc16297ddc284e
SHA1171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA25678efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA5127e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796
-
Filesize
1.4MB
MD522d5269955f256a444bd902847b04a3b
SHA141a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c
-
Filesize
416KB
MD583330cf6e88ad32365183f31b1fd3bda
SHA11c5b47be2b8713746de64b39390636a81626d264
SHA2567ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e
SHA512e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908
-
Filesize
338KB
MD5528b5dc5ede359f683b73a684b9c19f6
SHA18bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA2563a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA51287cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb
-
Filesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
Filesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9