quasar | 164dc81c3d8ac61c788cf466d83487f5878f96915f4a18939d278e249cbdc949

Analysis

max time kernel
190s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Android Tester.exe
Size

22.7MB
MD5

f39cec8c25192d89cab82d32e2645b98
SHA1

8165bc234cfd0fc6dda711d5c032d7c97bb6ee5d
SHA256

82df477a1e5e4105c96c8820385bcd3c1bd54995967d29d2e639d040db5b1574
SHA512

6f194968ceaad61f43ee5a48e433e916746fc485b6e60eb24c67e98e83ea76e8e57f52e4047007d4b58fba1fc38e447ca4dc2942e140e41e3c985538c713d524
SSDEEP

393216:yQLrjCTVOeSCIRClQ2PfWpeN15t4jpnTxk1ACCWEWI2q5VuDXTlxv9S6V6eX:ykPC0eSZwPtuTx/qU+xv93

Score

10^/10

quasar venomrat office04 evasion persistence rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

nibiru3.duckdns.org:7777

Mutex

VNM_MUTEX_ubQkq789WptLUo6CNl

Attributes

encryption_key
GaGctuJ4ar1CIDW3hoKN
install_name
Winstep.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Winstep SpeedLaunch
subdirectory
Winstep SpeedLaunch

Signatures

Contains code to disable Windows Defender 7 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\dllhost.exe	disable_win_def
C:\Users\Admin\AppData\Local\Temp\dllhost.exe	disable_win_def
C:\Users\Admin\AppData\Local\Temp\dllhost.exe	disable_win_def
behavioral2/memory/3512-29-0x0000000000CA0000-0x0000000000D2C000-memory.dmp	disable_win_def
C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe	disable_win_def
C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe	disable_win_def
C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

dllhost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	dllhost.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 7 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\dllhost.exe	family_quasar
C:\Users\Admin\AppData\Local\Temp\dllhost.exe	family_quasar
C:\Users\Admin\AppData\Local\Temp\dllhost.exe	family_quasar
behavioral2/memory/3512-29-0x0000000000CA0000-0x0000000000D2C000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe	family_quasar
C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe	family_quasar
C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Android Tester.exeWinstep.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	Android Tester.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	Winstep.exe

Executes dropped EXE 5 IoCs

Processes:

Apktool Installet1.exedllhost.exeAndroidTester v6.4.6.exeWinstep.exeWinstep.exe

pid process

820 Apktool Installet1.exe
3512 dllhost.exe
2988 AndroidTester v6.4.6.exe
4516 Winstep.exe
2544 Winstep.exe

pid	process
820	Apktool Installet1.exe
3512	dllhost.exe
2988	AndroidTester v6.4.6.exe
4516	Winstep.exe
2544	Winstep.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	dllhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Winstep.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winstep SpeedLaunch = "\"C:\\Users\\Admin\\AppData\\Roaming\\Winstep SpeedLaunch\\Winstep.exe\""	Winstep.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

69 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1648 4516 WerFault.exe Winstep.exe
4548 4516 WerFault.exe Winstep.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2952 schtasks.exe
2228 schtasks.exe

flow	ioc
69	ip-api.com

pid	pid_target	process	target process
1648	4516	WerFault.exe	Winstep.exe
4548	4516	WerFault.exe	Winstep.exe

pid	process
2952	schtasks.exe
2228	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3516 PING.EXE

pid	process
3516	PING.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.exepowershell.exemsedge.exemsedge.exepowershell.exepowershell.exepowershell.exepowershell.exeidentity_helper.exepowershell.exeWinstep.exe

pid	process
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe
1232	powershell.exe
1232	powershell.exe
5016	msedge.exe
5016	msedge.exe
2224	msedge.exe
2224	msedge.exe
4692	powershell.exe
4692	powershell.exe
4692	powershell.exe
760	powershell.exe
760	powershell.exe
760	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
2184	powershell.exe
2184	powershell.exe
2184	powershell.exe
5092	identity_helper.exe
5092	identity_helper.exe
4132	powershell.exe
4132	powershell.exe
4132	powershell.exe
2544	Winstep.exe
2544	Winstep.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2224 msedge.exe
2224 msedge.exe
2224 msedge.exe
2224 msedge.exe
2224 msedge.exe
2224 msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exedllhost.exepowershell.exepowershell.exeWinstep.exepowershell.exeWinstep.exe

description	pid	process
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeDebugPrivilege	3512	dllhost.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	4516	Winstep.exe
Token: SeDebugPrivilege	4516	Winstep.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	2544	Winstep.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe
2224	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Winstep.exe

pid process

4516 Winstep.exe

pid	process
4516	Winstep.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Android Tester.exeApktool Installet1.execmd.execmd.exemsedge.exe

description	pid	process	target process
PID 4300 wrote to memory of 820	4300	Android Tester.exe	Apktool Installet1.exe
PID 4300 wrote to memory of 820	4300	Android Tester.exe	Apktool Installet1.exe
PID 4300 wrote to memory of 820	4300	Android Tester.exe	Apktool Installet1.exe
PID 4300 wrote to memory of 4516	4300	Android Tester.exe	cmd.exe
PID 4300 wrote to memory of 4516	4300	Android Tester.exe	cmd.exe
PID 4300 wrote to memory of 4516	4300	Android Tester.exe	cmd.exe
PID 4300 wrote to memory of 3512	4300	Android Tester.exe	dllhost.exe
PID 4300 wrote to memory of 3512	4300	Android Tester.exe	dllhost.exe
PID 4300 wrote to memory of 3512	4300	Android Tester.exe	dllhost.exe
PID 820 wrote to memory of 4424	820	Apktool Installet1.exe	cmd.exe
PID 820 wrote to memory of 4424	820	Apktool Installet1.exe	cmd.exe
PID 4424 wrote to memory of 856	4424	cmd.exe	cacls.exe
PID 4424 wrote to memory of 856	4424	cmd.exe	cacls.exe
PID 4424 wrote to memory of 1180	4424	cmd.exe	powershell.exe
PID 4424 wrote to memory of 1180	4424	cmd.exe	powershell.exe
PID 4300 wrote to memory of 2988	4300	Android Tester.exe	AndroidTester v6.4.6.exe
PID 4300 wrote to memory of 2988	4300	Android Tester.exe	AndroidTester v6.4.6.exe
PID 4300 wrote to memory of 2988	4300	Android Tester.exe	AndroidTester v6.4.6.exe
PID 4516 wrote to memory of 2224	4516	cmd.exe	msedge.exe
PID 4516 wrote to memory of 2224	4516	cmd.exe	msedge.exe
PID 2224 wrote to memory of 3248	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 3248	2224	msedge.exe	msedge.exe
PID 4424 wrote to memory of 1232	4424	cmd.exe	powershell.exe
PID 4424 wrote to memory of 1232	4424	cmd.exe	powershell.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe
PID 2224 wrote to memory of 4592	2224	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Android Tester.exe
"C:\Users\Admin\AppData\Local\Temp\Android Tester.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\Apktool Installet1.exe
  "C:\Users\Admin\AppData\Local\Temp\Apktool Installet1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\10D4.tmp\10D5.tmp\10D6.bat "C:\Users\Admin\AppData\Local\Temp\Apktool Installet1.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\system32\cacls.exe
      "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
      4⤵
      PID:856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Add-MpPreference -ExclusionExtension ".exe""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"C:\'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"C:\Users\Admin\appdata\local\temp\svchost.exe'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"C:\Users\Admin\appdata\roaming\winstep speedlaunch\winstep.exe'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath '"C:\program files (x86)\nat host\nathost.exe'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\URL.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://allienhacker.webnode.es/?_ga=2.196494636.1688825314.1654326551-1345156272.1652202048
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xdc,0x128,0x7ffc213346f8,0x7ffc21334708,0x7ffc21334718
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1964158908279223297,14688875660201943869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1964158908279223297,14688875660201943869,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1964158908279223297,14688875660201943869,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1964158908279223297,14688875660201943869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1964158908279223297,14688875660201943869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1964158908279223297,14688875660201943869,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
      4⤵
      PID:372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1964158908279223297,14688875660201943869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1964158908279223297,14688875660201943869,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1964158908279223297,14688875660201943869,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1964158908279223297,14688875660201943869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1752 /prefetch:8
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1964158908279223297,14688875660201943869,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1752 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5092
- C:\Users\Admin\AppData\Local\Temp\dllhost.exe
  "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Winstep SpeedLaunch" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\dllhost.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2952
- - C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe
    "C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4516
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Winstep SpeedLaunch" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\m1BABNKgrRbn.bat" "
      4⤵
      PID:4956
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1928
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:3516
    - - C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe
        
        "C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 2228
      4⤵
      Program crash
      PID:1648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 2228
      4⤵
      Program crash
      PID:4548
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Users\Admin\AppData\Local\Temp\AndroidTester v6.4.6.exe
  "C:\Users\Admin\AppData\Local\Temp\AndroidTester v6.4.6.exe"
  2⤵
  - Executes dropped EXE
  PID:2988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4516 -ip 4516
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
e14cd3a7e15622a793aaad92cbc81274

SHA1
527e407aad65ddfc1722c14c14b3d4cbe331b4c2

SHA256
5075255767ae00b76f60e63e017f28a799241092fb2ef2122463ee121c8cd8d5

SHA512
b0957dafe314b03bd0ab0bd560f3bdbed016a83f692166ebbc6a9512de84747f2c7e153f2f15b7b586d96083af29aa16a2be8a7d96376ed9bfe768076476aa5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
876B

MD5
5315f67d11a9b72a00747cfccd2fcc23

SHA1
1524a8f802121530494b590045f616d98f158a8a

SHA256
b8d108b6cd626e6b41f0ae39d51f6f489019da0c179b4092fdc721810cecb5c8

SHA512
151015c85c876078e0aa46eb8862e4a0daa56afed002ad3b2dbeaada9f7bce7eb826e3146f3b1063b138abb45766a8940f7290f41a7eb5881fe8a0afe2760ca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d6a02d75f84a040e1961ca0b5c866b27

SHA1
93d4d530ad6d7384bef60f4cf51c92de691566a9

SHA256
1ece53a4b255b83a5e07dbd2a6f62ffd147ce4d9cdfaccb20b4768b53561c262

SHA512
150a824b8da1e31f56a1396bd3eb46ea7d10dd07e18a2b22ed07026008b7140432f8f5ba4be779d750f394f97b425b9fc085ce89d0200d863e0e6e11c30b930f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11e671959387ef55cd2ca88523ccd218

SHA1
8d949080f3b7d37e7791c774c212462a9b4a071c

SHA256
60c5a6d3bbc7baf3ba1eebb4ff44f132a114882bee140d2a30308b68921885be

SHA512
7e13da32818384f05ff9887ccf54e158835244e2df49a886efa9bf4751575e3eece8ac509d5786967188a987afb826f89804f5a4f99f5786f984d30953d2d14d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
699e3636ed7444d9b47772e4446ccfc1

SHA1
db0459ca6ceeea2e87e0023a6b7ee06aeed6fded

SHA256
9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a

SHA512
d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
83ca37279a05ec6a78a54bfceeb20ac9

SHA1
2bb077611422e5a5891c23cb91918706835fb52f

SHA256
00fc5feb3645eb926edc789ca9947f56f1b1e76e7fe1726d30541a46f6a17e38

SHA512
cbf552390929ac98529642bcc51bb7b2c83704dbb7bf541a14cd786d9906f6da5edf9dee6da13ae3309df1ddb8a9713d040fed80dd110d2b7efee4cc0b4a5cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
b80da1d5db6060d447af94895c97b053

SHA1
7dc74dfaf231ec7e1bab3370d0de70daa5fb4edb

SHA256
420e1753a7680076129b4dc5868977e63e0dc73adb15f46636d1b33b42d3adeb

SHA512
6a0f2dece36502275db64de3b37c41ce193d9dde054c6b4b5ee119b720884740d41d61f3a9390827b7640f6bb56ccde0ebb5d80d7702736615da4131bbdd662c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10D4.tmp\10D5.tmp\10D6.bat

Filesize
1KB

MD5
bcd21aeb88d121e122e032bf667a75ec

SHA1
32269670e39bb393f918c8ef7b57ddceaf6e27b1

SHA256
cb7ed31c658bf88e133e1e1397ee0dbbd56bb7629895a9ccf6dc558c747b18a8

SHA512
2c03bbe713c0fdb4faf5df5d5d54f057ee5df13776fb56f12565c597738ae7d81e6f2dd06c2a6eae583eab40698d2c870c9a349d74f4061b0b41d5387e7bef5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AndroidTester v6.4.6.exe

Filesize
22.5MB

MD5
341dc6721fbc232343b78df9ec9c87b0

SHA1
41efee2cc4d040ac8b636496d652e641f0b18dac

SHA256
d791d092f6dbdb56f9986e9d4560aaecc229fbf6af829608007ea74175711f4b

SHA512
48c4aec0a45913dbd12d4e4070a475be2b4d86dfab91fcb9594affeea85cbf4a00a99fff99090ed8c76e250bddb1f2d1147623d6c450bb3aa1223d799346cdf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\AndroidTester v6.4.6.exe

Filesize
22.5MB

MD5
341dc6721fbc232343b78df9ec9c87b0

SHA1
41efee2cc4d040ac8b636496d652e641f0b18dac

SHA256
d791d092f6dbdb56f9986e9d4560aaecc229fbf6af829608007ea74175711f4b

SHA512
48c4aec0a45913dbd12d4e4070a475be2b4d86dfab91fcb9594affeea85cbf4a00a99fff99090ed8c76e250bddb1f2d1147623d6c450bb3aa1223d799346cdf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\AndroidTester v6.4.6.exe

Filesize
22.5MB

MD5
341dc6721fbc232343b78df9ec9c87b0

SHA1
41efee2cc4d040ac8b636496d652e641f0b18dac

SHA256
d791d092f6dbdb56f9986e9d4560aaecc229fbf6af829608007ea74175711f4b

SHA512
48c4aec0a45913dbd12d4e4070a475be2b4d86dfab91fcb9594affeea85cbf4a00a99fff99090ed8c76e250bddb1f2d1147623d6c450bb3aa1223d799346cdf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Apktool Installet1.exe

Filesize
90KB

MD5
8f020103ca37c36f67a7d4ac20ad2ab8

SHA1
1d63f71056e1e8a934cc7ad3dbaed6a217f7ddac

SHA256
a49d9ea46e96ac378518dee631197a8868da81599441c32e9d33057c2bfef2a2

SHA512
0b03656871ee2f4ca76386ab119675765bc6dbf6271fd5d80a1652cae7c2302cf34241e78f41e8c67214f9f3ed125174edcdd831d06db2490d661306d228e79c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Apktool Installet1.exe

Filesize
90KB

MD5
8f020103ca37c36f67a7d4ac20ad2ab8

SHA1
1d63f71056e1e8a934cc7ad3dbaed6a217f7ddac

SHA256
a49d9ea46e96ac378518dee631197a8868da81599441c32e9d33057c2bfef2a2

SHA512
0b03656871ee2f4ca76386ab119675765bc6dbf6271fd5d80a1652cae7c2302cf34241e78f41e8c67214f9f3ed125174edcdd831d06db2490d661306d228e79c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Apktool Installet1.exe

Filesize
90KB

MD5
8f020103ca37c36f67a7d4ac20ad2ab8

SHA1
1d63f71056e1e8a934cc7ad3dbaed6a217f7ddac

SHA256
a49d9ea46e96ac378518dee631197a8868da81599441c32e9d33057c2bfef2a2

SHA512
0b03656871ee2f4ca76386ab119675765bc6dbf6271fd5d80a1652cae7c2302cf34241e78f41e8c67214f9f3ed125174edcdd831d06db2490d661306d228e79c

Download Submit
C:\Users\Admin\AppData\Local\Temp\URL.bat

Filesize
109B

MD5
ae2b368ac1a2180aa6307c913aba5713

SHA1
9ed2a7fe126d48cbd53c5a3b89cd2dc86b81f921

SHA256
b5d3420d52ea0fe34905cb9269f11b964dd7c2b3a31d58620131194fcd2bf992

SHA512
839f3dff0ddf5ad0bfd8f7fa0d6a98fb7bbc0c0b0baa8b58eb6621c011ac175fb34f1a44587b4fc8a0119ca0491d44109b12ae050eb66cf4dca5a2d75a1113fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hj1fbhrx.vzd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllhost.exe

Filesize
534KB

MD5
3929b52ee76c8c5480e4209cb7f70d5c

SHA1
74ff90a0f1a7561aef81da6202c7355c6b170413

SHA256
53a4d73780e05e99c62c732f3950ac68bbc86c74a90b32b9f9a54590b85be5cc

SHA512
e96374483bbf62ce32e4c75bd3e2ba39f130aa42332f80b71568c01a6a8ea756c8aca53838ac8050d28997ed1181ce7a9923028bba9687d0fcd2c1170a5d6e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllhost.exe

Filesize
534KB

MD5
3929b52ee76c8c5480e4209cb7f70d5c

SHA1
74ff90a0f1a7561aef81da6202c7355c6b170413

SHA256
53a4d73780e05e99c62c732f3950ac68bbc86c74a90b32b9f9a54590b85be5cc

SHA512
e96374483bbf62ce32e4c75bd3e2ba39f130aa42332f80b71568c01a6a8ea756c8aca53838ac8050d28997ed1181ce7a9923028bba9687d0fcd2c1170a5d6e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllhost.exe

Filesize
534KB

MD5
3929b52ee76c8c5480e4209cb7f70d5c

SHA1
74ff90a0f1a7561aef81da6202c7355c6b170413

SHA256
53a4d73780e05e99c62c732f3950ac68bbc86c74a90b32b9f9a54590b85be5cc

SHA512
e96374483bbf62ce32e4c75bd3e2ba39f130aa42332f80b71568c01a6a8ea756c8aca53838ac8050d28997ed1181ce7a9923028bba9687d0fcd2c1170a5d6e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\m1BABNKgrRbn.bat

Filesize
221B

MD5
217e1e043972b7dd7fc71fcf0b2c812c

SHA1
55e88bea89fe8aa7e50f6dd91618821db6716906

SHA256
1d9000accc85436cea92c4938789d51edbfc7148743e2d19f93f06b2173fe33c

SHA512
dac7d1b04dc1d5b4a4059c47ba47385413e00841f298855ef1778c7c6bc8695834296d16997642d28483a55451bdb8c90e05a4e0e1eb935fb8a785dac2069aed

Download Submit
C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe

Filesize
534KB

MD5
3929b52ee76c8c5480e4209cb7f70d5c

SHA1
74ff90a0f1a7561aef81da6202c7355c6b170413

SHA256
53a4d73780e05e99c62c732f3950ac68bbc86c74a90b32b9f9a54590b85be5cc

SHA512
e96374483bbf62ce32e4c75bd3e2ba39f130aa42332f80b71568c01a6a8ea756c8aca53838ac8050d28997ed1181ce7a9923028bba9687d0fcd2c1170a5d6e34

Download Submit
C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe

Filesize
534KB

MD5
3929b52ee76c8c5480e4209cb7f70d5c

SHA1
74ff90a0f1a7561aef81da6202c7355c6b170413

SHA256
53a4d73780e05e99c62c732f3950ac68bbc86c74a90b32b9f9a54590b85be5cc

SHA512
e96374483bbf62ce32e4c75bd3e2ba39f130aa42332f80b71568c01a6a8ea756c8aca53838ac8050d28997ed1181ce7a9923028bba9687d0fcd2c1170a5d6e34

Download Submit
C:\Users\Admin\AppData\Roaming\Winstep SpeedLaunch\Winstep.exe

Filesize
534KB

MD5
3929b52ee76c8c5480e4209cb7f70d5c

SHA1
74ff90a0f1a7561aef81da6202c7355c6b170413

SHA256
53a4d73780e05e99c62c732f3950ac68bbc86c74a90b32b9f9a54590b85be5cc

SHA512
e96374483bbf62ce32e4c75bd3e2ba39f130aa42332f80b71568c01a6a8ea756c8aca53838ac8050d28997ed1181ce7a9923028bba9687d0fcd2c1170a5d6e34

Download Submit
\??\pipe\LOCAL\crashpad_2224_FVQOSVYHZELZGZGA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/760-154-0x00007FFC1F9A0000-0x00007FFC20461000-memory.dmp

Filesize
10.8MB

Download
memory/760-155-0x000002165A930000-0x000002165A940000-memory.dmp

Filesize
64KB

Download
memory/760-156-0x000002165A930000-0x000002165A940000-memory.dmp

Filesize
64KB

Download
memory/760-168-0x00007FFC1F9A0000-0x00007FFC20461000-memory.dmp

Filesize
10.8MB

Download
memory/1180-54-0x0000024647960000-0x0000024647970000-memory.dmp

Filesize
64KB

Download
memory/1180-51-0x0000024647960000-0x0000024647970000-memory.dmp

Filesize
64KB

Download
memory/1180-90-0x00007FFC1F700000-0x00007FFC201C1000-memory.dmp

Filesize
10.8MB

Download
memory/1180-76-0x0000024647960000-0x0000024647970000-memory.dmp

Filesize
64KB

Download
memory/1180-56-0x00007FFC1F700000-0x00007FFC201C1000-memory.dmp

Filesize
10.8MB

Download
memory/1180-49-0x00007FFC1F700000-0x00007FFC201C1000-memory.dmp

Filesize
10.8MB

Download
memory/1180-50-0x000002465FD50000-0x000002465FD72000-memory.dmp

Filesize
136KB

Download
memory/1180-53-0x0000024647960000-0x0000024647970000-memory.dmp

Filesize
64KB

Download
memory/1232-120-0x00007FFC1F9A0000-0x00007FFC20461000-memory.dmp

Filesize
10.8MB

Download
memory/1232-93-0x00000258E0810000-0x00000258E0820000-memory.dmp

Filesize
64KB

Download
memory/1232-94-0x00000258E0810000-0x00000258E0820000-memory.dmp

Filesize
64KB

Download
memory/1232-92-0x00007FFC1F9A0000-0x00007FFC20461000-memory.dmp

Filesize
10.8MB

Download
memory/1232-105-0x00000258E0810000-0x00000258E0820000-memory.dmp

Filesize
64KB

Download
memory/2184-211-0x00007FFC1F9A0000-0x00007FFC20461000-memory.dmp

Filesize
10.8MB

Download
memory/2184-187-0x00007FFC1F9A0000-0x00007FFC20461000-memory.dmp

Filesize
10.8MB

Download
memory/2184-200-0x00000237C0330000-0x00000237C0340000-memory.dmp

Filesize
64KB

Download
memory/2184-188-0x00000237C0330000-0x00000237C0340000-memory.dmp

Filesize
64KB

Download
memory/2544-338-0x00000000735B0000-0x0000000073D60000-memory.dmp

Filesize
7.7MB

Download
memory/2544-350-0x00000000735B0000-0x0000000073D60000-memory.dmp

Filesize
7.7MB

Download
memory/2544-339-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/2544-352-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/2988-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2988-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2988-121-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2988-75-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3512-36-0x00000000057B0000-0x0000000005842000-memory.dmp

Filesize
584KB

Download
memory/3512-35-0x0000000005C60000-0x0000000006204000-memory.dmp

Filesize
5.6MB

Download
memory/3512-29-0x0000000000CA0000-0x0000000000D2C000-memory.dmp

Filesize
560KB

Download
memory/3512-119-0x0000000006750000-0x0000000006762000-memory.dmp

Filesize
72KB

Download
memory/3512-52-0x00000000057A0000-0x00000000057B0000-memory.dmp

Filesize
64KB

Download
memory/3512-55-0x00000000735B0000-0x0000000073D60000-memory.dmp

Filesize
7.7MB

Download
memory/3512-58-0x00000000057A0000-0x00000000057B0000-memory.dmp

Filesize
64KB

Download
memory/3512-28-0x00000000735B0000-0x0000000073D60000-memory.dmp

Filesize
7.7MB

Download
memory/3512-182-0x0000000006B90000-0x0000000006BCC000-memory.dmp

Filesize
240KB

Download
memory/3512-77-0x0000000006380000-0x00000000063E6000-memory.dmp

Filesize
408KB

Download
memory/4132-317-0x0000000005A90000-0x0000000005AAE000-memory.dmp

Filesize
120KB

Download
memory/4132-278-0x0000000004CD0000-0x00000000052F8000-memory.dmp

Filesize
6.2MB

Download
memory/4132-319-0x0000000005B80000-0x0000000005BCC000-memory.dmp

Filesize
304KB

Download
memory/4132-323-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/4132-273-0x0000000002180000-0x00000000021B6000-memory.dmp

Filesize
216KB

Download
memory/4132-274-0x00000000735B0000-0x0000000073D60000-memory.dmp

Filesize
7.7MB

Download
memory/4132-275-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/4132-321-0x00000000735B0000-0x0000000073D60000-memory.dmp

Filesize
7.7MB

Download
memory/4132-295-0x0000000005560000-0x00000000058B4000-memory.dmp

Filesize
3.3MB

Download
memory/4132-283-0x0000000005370000-0x0000000005392000-memory.dmp

Filesize
136KB

Download
memory/4132-284-0x0000000005410000-0x0000000005476000-memory.dmp

Filesize
408KB

Download
memory/4516-255-0x00000000735B0000-0x0000000073D60000-memory.dmp

Filesize
7.7MB

Download
memory/4516-277-0x0000000006A40000-0x0000000006A4A000-memory.dmp

Filesize
40KB

Download
memory/4516-257-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download
memory/4516-272-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download
memory/4516-270-0x00000000735B0000-0x0000000073D60000-memory.dmp

Filesize
7.7MB

Download
memory/4692-127-0x00007FFC1F9A0000-0x00007FFC20461000-memory.dmp

Filesize
10.8MB

Download
memory/4692-128-0x0000016362D70000-0x0000016362D80000-memory.dmp

Filesize
64KB

Download
memory/4692-129-0x0000016362D70000-0x0000016362D80000-memory.dmp

Filesize
64KB

Download
memory/4692-151-0x0000016362D70000-0x0000016362D80000-memory.dmp

Filesize
64KB

Download
memory/4692-153-0x00007FFC1F9A0000-0x00007FFC20461000-memory.dmp

Filesize
10.8MB

Download
memory/4700-186-0x00007FFC1F9A0000-0x00007FFC20461000-memory.dmp

Filesize
10.8MB

Download
memory/4700-169-0x00007FFC1F9A0000-0x00007FFC20461000-memory.dmp

Filesize
10.8MB

Download
memory/4700-171-0x000001ED75DC0000-0x000001ED75DD0000-memory.dmp

Filesize
64KB

Download
memory/4700-170-0x000001ED75DC0000-0x000001ED75DD0000-memory.dmp

Filesize
64KB

Download