Analysis

  • max time kernel
    1800s
  • max time network
    1804s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2023 15:12

General

  • Target

    deploy.exe

  • Size

    63KB

  • MD5

    6f92c594e253457f848f01bac27814d5

  • SHA1

    9d29ff1372582e71bfcf37b9eba3063cc7febc08

  • SHA256

    1f41ecd3c862c4957dc7e09fede95bddcf43ebcab44fe946d72ff6abb75d030a

  • SHA512

    30573565a27010e037c06741577bf5fb5bf1069f518d81e9b62fc207968974a038a7f5dabbcd5a40f0fc0e2d0ecfab3aebe2e88ef5bbbf105c55d0edcaf7662c

  • SSDEEP

    768:Rd5nVhwdjndk78TQC8A+XiuazcBRL5JTk1+T4KSBGHmDbD/ph0oX9ASuAdpqKYhg:ZnSdsNdSJYUbdh99HuAdpqKmY7

Malware Config

Extracted

Family

asyncrat

Botnet

Default

Mutex

H伊8jWaCωdcΓP8吾קtרXovNF3

Attributes
  • delay

    1

  • install

    true

  • install_file

    daemon.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/L7WhRmt9

aes.plain

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

146.19.230.52:4456

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Async RAT payload 10 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 58 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 20 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\deploy.exe
    "C:\Users\Admin\AppData\Local\Temp\deploy.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5028
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "daemon" /tr '"C:\Users\Admin\AppData\Roaming\daemon.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:404
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "daemon" /tr '"C:\Users\Admin\AppData\Roaming\daemon.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:3908
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp366.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:412
      • C:\Users\Admin\AppData\Roaming\daemon.exe
        "C:\Users\Admin\AppData\Roaming\daemon.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:3596
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2920
          • C:\Windows\system32\PING.EXE
            ping cloudflare.com
            5⤵
            • Runs ping.exe
            PID:1580
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ubiopn.exe"' & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4608
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ubiopn.exe"'
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:332
            • C:\Users\Admin\AppData\Local\Temp\ubiopn.exe
              "C:\Users\Admin\AppData\Local\Temp\ubiopn.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:2000
              • C:\Windows\Dllhost.exe
                "C:\Windows\Dllhost.exe"
                7⤵
                • Drops startup file
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:3540
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\3552883"
                  8⤵
                    PID:3920
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
            4⤵
              PID:716
              • C:\Windows\system32\chcp.com
                chcp 65001
                5⤵
                  PID:2244
                • C:\Windows\system32\netsh.exe
                  netsh wlan show profile
                  5⤵
                    PID:1612
                  • C:\Windows\system32\findstr.exe
                    findstr All
                    5⤵
                      PID:4476
                  • C:\Windows\SYSTEM32\cmd.exe
                    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                    4⤵
                      PID:4316
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        5⤵
                          PID:2512
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show networks mode=bssid
                          5⤵
                            PID:5564
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd"
                          4⤵
                            PID:5180
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic cpu get caption
                              5⤵
                                PID:5200
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd"
                              4⤵
                                PID:3480
                        • C:\Windows\system32\taskmgr.exe
                          "C:\Windows\system32\taskmgr.exe" /4
                          1⤵
                            PID:2704
                          • C:\Windows\SysWOW64\DllHost.exe
                            C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                            1⤵
                              PID:1812
                            • C:\Windows\explorer.exe
                              C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                              1⤵
                              • Checks processor information in registry
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious behavior: AddClipboardFormatListener
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              PID:412
                            • C:\Windows\SysWOW64\DllHost.exe
                              C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                              1⤵
                                PID:4948
                              • C:\Windows\system32\mmc.exe
                                "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
                                1⤵
                                • Drops file in System32 directory
                                • Drops file in Windows directory
                                • Checks SCSI registry key(s)
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of SetWindowsHookEx
                                PID:4976
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                1⤵
                                • Enumerates system info in registry
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of WriteProcessMemory
                                PID:3156
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffdbc859758,0x7ffdbc859768,0x7ffdbc859778
                                  2⤵
                                    PID:2332
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:8
                                    2⤵
                                      PID:1588
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:2
                                      2⤵
                                        PID:2992
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:8
                                        2⤵
                                          PID:1832
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3120 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                          2⤵
                                            PID:2396
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                            2⤵
                                              PID:656
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4652 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                              2⤵
                                                PID:4640
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4776 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:8
                                                2⤵
                                                  PID:1540
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4900 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:8
                                                  2⤵
                                                    PID:2956
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4956 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                                    2⤵
                                                      PID:3828
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3396 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                                      2⤵
                                                        PID:1124
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:8
                                                        2⤵
                                                          PID:2084
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5000 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                                          2⤵
                                                            PID:4080
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5640 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                                            2⤵
                                                              PID:1984
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4784 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                                              2⤵
                                                                PID:2280
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5984 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                                                2⤵
                                                                  PID:4928
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5916 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                                                  2⤵
                                                                    PID:4696
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6476 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                                                    2⤵
                                                                      PID:2892
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6356 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                                                      2⤵
                                                                        PID:1092
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6236 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                                                        2⤵
                                                                          PID:2960
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=7056 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:1
                                                                          2⤵
                                                                            PID:5196
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7244 --field-trial-handle=1916,i,3256368676407802205,8344109765142389448,131072 /prefetch:8
                                                                            2⤵
                                                                              PID:5436
                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                            1⤵
                                                                              PID:1072
                                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                                              "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\SetWatch.gif
                                                                              1⤵
                                                                              • Modifies Internet Explorer settings
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:5804
                                                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5804 CREDAT:17410 /prefetch:2
                                                                                2⤵
                                                                                • Modifies Internet Explorer settings
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:5900
                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                              C:\Windows\system32\AUDIODG.EXE 0x490 0x150
                                                                              1⤵
                                                                                PID:3448
                                                                              • C:\Windows\SysWOW64\DllHost.exe
                                                                                C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                1⤵
                                                                                  PID:4560
                                                                                • C:\Windows\explorer.exe
                                                                                  C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                                                                                  1⤵
                                                                                  • Checks processor information in registry
                                                                                  • Modifies Internet Explorer settings
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  PID:1284
                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                                                  1⤵
                                                                                    PID:3348

                                                                                  Network

                                                                                  MITRE ATT&CK Enterprise v15

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3d15fe58-6b30-4440-b56a-9328ffeea114.tmp

                                                                                    Filesize

                                                                                    214KB

                                                                                    MD5

                                                                                    795015f142709fa6089b2321d47d2486

                                                                                    SHA1

                                                                                    9bee09b441ededcaeb74dc4ce1fe093764b1014d

                                                                                    SHA256

                                                                                    2ad352af06f99e3ca85b9a76d2df974c26e22f7f6628d4bc30649246dafe17ef

                                                                                    SHA512

                                                                                    26f3738ea3c38a6cf30a6ac7582e26313b8a9a27d3b6e48f6e09b3c16d58d4320e588586c4dfb7346bb02f62273c914542b642f6f3886433989a4b59be1db95d

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    4a6ae5cdd48991abea116fcdbb96b53d

                                                                                    SHA1

                                                                                    ae5449643a0c7c5ac793affaa433c8b51dc091be

                                                                                    SHA256

                                                                                    944bf43318a9eb6e1d998286c3a65fdc12bb774dcb8f2f2b770f741bde913e65

                                                                                    SHA512

                                                                                    bd52d762db07621901655c68936d10eee8a2117bff8135877601b63adee747f88b81859009bbdbc9acd963a5f364ac222e0f3d2197f04cb2da230b5cc5b43b42

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

                                                                                    Filesize

                                                                                    148KB

                                                                                    MD5

                                                                                    08c1405bb88892c6b11cab3ac01aea48

                                                                                    SHA1

                                                                                    fdf9ebf1f5d224c09367d137b2058af516d2b189

                                                                                    SHA256

                                                                                    aa2631f8a8c28d797cb41c1be7367a35d49e824f0a3e0e36664c1fdafbdaf4e5

                                                                                    SHA512

                                                                                    7f20070b3c185d3cdda799076ec53c8a76efb3d4304d068b4a47a244a5cade2adf6f2c2f21c5c645682fc1243ad245d41533f5e3c86cb48756fbb725ea7abc3b

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

                                                                                    Filesize

                                                                                    28KB

                                                                                    MD5

                                                                                    5819f7d446fa6567376fc40af5a6496f

                                                                                    SHA1

                                                                                    a80be4c53ef2ddaf0e725bc1c335f442c573130a

                                                                                    SHA256

                                                                                    57417cefd9e1d1d057461b1ff3505369f52e258ed9c48820f8c7b21260a7256b

                                                                                    SHA512

                                                                                    367a54f96c337315b5f9f1f579e0c392e83dbf8833db46d29b7ff05f541b7752a925da9a4ac58106a9338c016464b87d29cddafe7935afcc2c76f99c90fd45b9

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                    Filesize

                                                                                    9KB

                                                                                    MD5

                                                                                    b7b68b1e6904a475329199ba5b926943

                                                                                    SHA1

                                                                                    82cc83a3f9ce03c3d78a1a95a16f9bb8c0bbdf1d

                                                                                    SHA256

                                                                                    1341cf9ff429ba2ee8977987219b85727ac8662697d33e5c94f4cb26e5114289

                                                                                    SHA512

                                                                                    8dc00599bb896e13b50e810c1ca3a708ddaf6c68312085335641fcd3bb9ba3db02382614d54c3785c2b202d8a4b0970ab7f4d0c63ece3ca86eacb96c6058b55e

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    32c398ec30175351b426f3b87423812f

                                                                                    SHA1

                                                                                    ed8eef6cb2b5c597ebfe053d878562c4daa5d82b

                                                                                    SHA256

                                                                                    88031992d3c270f810b3a4d00f9c0b618f62e4c2c78106139e72b20ba06b5623

                                                                                    SHA512

                                                                                    d7573c3990999eb3b94f815bd57608a84cbe65187d2025e4df9b357b6f50c5d373b59b93302c074989812a260d3cc4697e725066c0ee2fe29547bdc04c951dfc

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    f6cb7ea41f05db0529370f044a9ce583

                                                                                    SHA1

                                                                                    2add3a58ed4eb1b5f8ac35eb407ac4ab6a18670e

                                                                                    SHA256

                                                                                    68d49014ae66ae418110014558dad279c108e05efc1233b5fc27723ee489d9fc

                                                                                    SHA512

                                                                                    fcf124f6eb9a6ddd7f44bdbc228dd3063c83640e96939e0b453e6d098cde71ec4c4baed3e68aa3bd01841c6675f8b8d48def8ec7f8fcae71ddec5666e7f65aa6

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                    Filesize

                                                                                    5KB

                                                                                    MD5

                                                                                    1a528de544406313a6d7a5e47c67fb46

                                                                                    SHA1

                                                                                    0194f3b049e572dd724a835b6bfe207213c7c429

                                                                                    SHA256

                                                                                    7f3ade6532fd1b0f443ec595264a8906a670c22f79a7c24c2ce5796886dbc424

                                                                                    SHA512

                                                                                    101e032633b07231a39bf1f821569b51231e785f6f3d65313e5be5aff99421de36c149d5e3ef70b5ab40254607c6cf074fdcfb73b5ed18a453628cec014be877

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                    Filesize

                                                                                    6KB

                                                                                    MD5

                                                                                    5238faa390b9aa1e362922f8c681a87a

                                                                                    SHA1

                                                                                    ab9376a0c11b423b0eb8b4498966bd060008fa1b

                                                                                    SHA256

                                                                                    fc67c8b9e36e272de5c69373be4ef46df5ec923ad81859231dcdeeb0325cd9c1

                                                                                    SHA512

                                                                                    b3a6c8cf17096f51397894f5748afb871e52aa5e7f78b8d61dca529e3a7368ad86fde58bae65cf8e8b053fadb64ac42e0ffeb10e5816ea41a5ecbbf6a5b6059a

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                    Filesize

                                                                                    6KB

                                                                                    MD5

                                                                                    2dcf57b271b282eeb5f0ccb68f143fd0

                                                                                    SHA1

                                                                                    31f812f21201f38f90e25e20509fecab46248a17

                                                                                    SHA256

                                                                                    a04b529525bc328d5ea870a15f7eb10216d5e9ae4d2a01afa5bde57fa8f21571

                                                                                    SHA512

                                                                                    34aa79eba566eb8000ec01239a313d78fc5b92d1dcddd812b8506f1b9c4a4e478914b6e9fd0f04a7f1b825633de1304e96d0d479f9441103b6617862bbecbaec

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                    Filesize

                                                                                    214KB

                                                                                    MD5

                                                                                    8fb62f36defde9d06e3f9460a444aa64

                                                                                    SHA1

                                                                                    de10b9f36561d7e491fd7e6dec1f48b5a912d403

                                                                                    SHA256

                                                                                    e7c0d4917ef869c5c2f7985d5bd7505b11e8eadd6a6badc4c775400bd2d218e4

                                                                                    SHA512

                                                                                    2044211b628b4bfec1cbd2024bf2a5fb523887f50b31661d1526c10eaebf73feb5f9b0d4da8eb421c21c2a675fc214e3679dcf72cacd6cf46c3857aa5d863e86

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                    Filesize

                                                                                    214KB

                                                                                    MD5

                                                                                    795015f142709fa6089b2321d47d2486

                                                                                    SHA1

                                                                                    9bee09b441ededcaeb74dc4ce1fe093764b1014d

                                                                                    SHA256

                                                                                    2ad352af06f99e3ca85b9a76d2df974c26e22f7f6628d4bc30649246dafe17ef

                                                                                    SHA512

                                                                                    26f3738ea3c38a6cf30a6ac7582e26313b8a9a27d3b6e48f6e09b3c16d58d4320e588586c4dfb7346bb02f62273c914542b642f6f3886433989a4b59be1db95d

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                                                    Filesize

                                                                                    264KB

                                                                                    MD5

                                                                                    cabd903700714207c7fd8cc5396a4ad4

                                                                                    SHA1

                                                                                    71eed2eb47a1cf063cf9f3f7fa53c5f1baf14f0d

                                                                                    SHA256

                                                                                    7a1c38177694d4bd0a89a19694a630e6969cd1a38249b6c217695405d46f505e

                                                                                    SHA512

                                                                                    839a2868b2052fa2b79ee302fb6ade36edcd1420989b873df865703388f2ab2394380585252848f4dfd04b2308d6b6f8e320e6bb1e05791bd7b078402a61461a

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                                                    Filesize

                                                                                    2B

                                                                                    MD5

                                                                                    99914b932bd37a50b983c5e7c90ae93b

                                                                                    SHA1

                                                                                    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                    SHA256

                                                                                    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                    SHA512

                                                                                    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                  • C:\Users\Admin\AppData\Local\Temp\3552883

                                                                                    Filesize

                                                                                    96B

                                                                                    MD5

                                                                                    4f0f313d090a031e7bfffba76d78ecab

                                                                                    SHA1

                                                                                    0d577bc0155b493820fb9fd842e3dde629b90459

                                                                                    SHA256

                                                                                    a7546c5d43a26481aae0052942b9a7cdcfa3a5a8452c535fcbe0c62cd1df005e

                                                                                    SHA512

                                                                                    51824c60159f4ed3023af2a00dacb7889dad1efeae30cdd515bf16b456c610e0b83d4d326edc75b2eb925d510b36180e147b5bb54ccd2f102fe449676d223693

                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nxkz0khb.uro.ps1

                                                                                    Filesize

                                                                                    60B

                                                                                    MD5

                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                    SHA1

                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                    SHA256

                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                    SHA512

                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                  • C:\Users\Admin\AppData\Local\Temp\places.raw

                                                                                    Filesize

                                                                                    5.0MB

                                                                                    MD5

                                                                                    c65a5ec2f7cb73f8b07a7a4c2b4d0dd7

                                                                                    SHA1

                                                                                    ec48f83662a188a8e781eb1064d5e9742eea805c

                                                                                    SHA256

                                                                                    808bef1d0266bd27eb035b1cde7a60155b98dab7f7a784d3cef0af8e0d8a5f78

                                                                                    SHA512

                                                                                    bcc6e5e824fec004e7aa9b44148937fe2469a590dad102aee39444784451d4e9cec25d8cb98b21cfeebd8e56f3f6c984a4d8e336fbeca6bc2b10ba3b3a69df45

                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp366.tmp.bat

                                                                                    Filesize

                                                                                    149B

                                                                                    MD5

                                                                                    45b0675d208b1d3d0112e192f9921399

                                                                                    SHA1

                                                                                    81fc92d006682e30bb7ddbc72e625109870780c6

                                                                                    SHA256

                                                                                    795b6a92e02da7332f2dc31badf9c66202f2e9bbd1a69c8a31c7938889264958

                                                                                    SHA512

                                                                                    263c1611ef8991ca604e42eb1899d6e90038bb44d14d927dc05538dbc76b124fce18a42deecdd08855096c4696003f29ebdf4175fdfd4284b287da0fe4405b63

                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp6931.tmp.dat

                                                                                    Filesize

                                                                                    92KB

                                                                                    MD5

                                                                                    a1916d46bdcfc6da28e7264e80531a25

                                                                                    SHA1

                                                                                    65680db48ad5945daabbe130a1f71d11b7203466

                                                                                    SHA256

                                                                                    1dda7ecfe80d22c8f009e1ba936263836bedfbd361c0c22d25651e6a8c604366

                                                                                    SHA512

                                                                                    564966772c3b2b33539bfa0a64da13150b9a980af061870a5e02d2a69836a52baef34b7cfe0d1833076cabb62ce92f3aaa89439adafe8496b71a43396eeba740

                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp6932.tmp.dat

                                                                                    Filesize

                                                                                    46KB

                                                                                    MD5

                                                                                    02d2c46697e3714e49f46b680b9a6b83

                                                                                    SHA1

                                                                                    84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                                                    SHA256

                                                                                    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                                                    SHA512

                                                                                    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp6933.tmp.dat

                                                                                    Filesize

                                                                                    28KB

                                                                                    MD5

                                                                                    5819f7d446fa6567376fc40af5a6496f

                                                                                    SHA1

                                                                                    a80be4c53ef2ddaf0e725bc1c335f442c573130a

                                                                                    SHA256

                                                                                    57417cefd9e1d1d057461b1ff3505369f52e258ed9c48820f8c7b21260a7256b

                                                                                    SHA512

                                                                                    367a54f96c337315b5f9f1f579e0c392e83dbf8833db46d29b7ff05f541b7752a925da9a4ac58106a9338c016464b87d29cddafe7935afcc2c76f99c90fd45b9

                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp6944.tmp.dat

                                                                                    Filesize

                                                                                    148KB

                                                                                    MD5

                                                                                    08c1405bb88892c6b11cab3ac01aea48

                                                                                    SHA1

                                                                                    fdf9ebf1f5d224c09367d137b2058af516d2b189

                                                                                    SHA256

                                                                                    aa2631f8a8c28d797cb41c1be7367a35d49e824f0a3e0e36664c1fdafbdaf4e5

                                                                                    SHA512

                                                                                    7f20070b3c185d3cdda799076ec53c8a76efb3d4304d068b4a47a244a5cade2adf6f2c2f21c5c645682fc1243ad245d41533f5e3c86cb48756fbb725ea7abc3b

                                                                                  • C:\Users\Admin\AppData\Local\Temp\tmp69AB.tmp.dat

                                                                                    Filesize

                                                                                    96KB

                                                                                    MD5

                                                                                    d367ddfda80fdcf578726bc3b0bc3e3c

                                                                                    SHA1

                                                                                    23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

                                                                                    SHA256

                                                                                    0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

                                                                                    SHA512

                                                                                    40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

                                                                                  • C:\Users\Admin\AppData\Local\Temp\ubiopn.exe

                                                                                    Filesize

                                                                                    43KB

                                                                                    MD5

                                                                                    a463c96ab06522c82bf208e024dea808

                                                                                    SHA1

                                                                                    97f88b3f7369e2a6b4ebe984f2d5205bd42c8730

                                                                                    SHA256

                                                                                    f77b0622c90ed9b471255f247a329022811b39bfde2cfe8ed764faa169147aa6

                                                                                    SHA512

                                                                                    59238793842d50c4ee68cc8e8f85c82c871717d1c18bb924a932cb51ab9a786a3eeb4284b1b96da86196466c9446830687aef22b5d01db2ea706ee665d8ae8d3

                                                                                  • C:\Users\Admin\AppData\Local\Temp\ubiopn.exe

                                                                                    Filesize

                                                                                    43KB

                                                                                    MD5

                                                                                    a463c96ab06522c82bf208e024dea808

                                                                                    SHA1

                                                                                    97f88b3f7369e2a6b4ebe984f2d5205bd42c8730

                                                                                    SHA256

                                                                                    f77b0622c90ed9b471255f247a329022811b39bfde2cfe8ed764faa169147aa6

                                                                                    SHA512

                                                                                    59238793842d50c4ee68cc8e8f85c82c871717d1c18bb924a932cb51ab9a786a3eeb4284b1b96da86196466c9446830687aef22b5d01db2ea706ee665d8ae8d3

                                                                                  • C:\Users\Admin\AppData\Local\d393223438ae649f98d07ac4eab53931\Admin@TPTLJPNX_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt

                                                                                    Filesize

                                                                                    105B

                                                                                    MD5

                                                                                    2e9d094dda5cdc3ce6519f75943a4ff4

                                                                                    SHA1

                                                                                    5d989b4ac8b699781681fe75ed9ef98191a5096c

                                                                                    SHA256

                                                                                    c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                                                                                    SHA512

                                                                                    d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                                                                                  • C:\Users\Admin\AppData\Local\d393223438ae649f98d07ac4eab53931\Admin@TPTLJPNX_en-US\System\Process.txt

                                                                                    Filesize

                                                                                    537B

                                                                                    MD5

                                                                                    c45e92b49cefd822dcad5307b93742b9

                                                                                    SHA1

                                                                                    6f177e99d7ba3da15a9d48f7501b9852e5aae5cf

                                                                                    SHA256

                                                                                    594dffe5b5babf5dabec1c3e44eecd82e08a5cfab7bdfec036e215edc1ff254d

                                                                                    SHA512

                                                                                    1589ca8ff5b8772cb46ed35f9c86909ce417dc41c8f1c7e7a93775049c76de3e774e87b66a0d4b6c0394d608a9c9a1207355d9f675185bb86813b44cd38edc01

                                                                                  • C:\Users\Admin\AppData\Local\d393223438ae649f98d07ac4eab53931\Admin@TPTLJPNX_en-US\System\Process.txt

                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    6bd0f1a45810883d075cef9c02545103

                                                                                    SHA1

                                                                                    3596130fb98ab71914a3cfa34da3fb3d89eabd98

                                                                                    SHA256

                                                                                    6705e7a6079f141a6af87e416d04c2d18d48baaa6820780baae424beabdeda04

                                                                                    SHA512

                                                                                    4bcb0dd32f681c71f3e3591810e7928315485283cbc975fadf08b1a0ec2c9ec74cd2f67a66a143f52f6aaa9659ad7cd7931d908848082353d2f4192b3a0881f8

                                                                                  • C:\Users\Admin\AppData\Local\d393223438ae649f98d07ac4eab53931\Admin@TPTLJPNX_en-US\System\Process.txt

                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    529ea0290ba5b3b0ae6395fe76702246

                                                                                    SHA1

                                                                                    c68402680ae9c02bf950df0fb32f13203d45a3fe

                                                                                    SHA256

                                                                                    98337f6a4f06c3c67eb49eefc9dd2fb9a7f91c04825f8bfb8f3dd659e98b05fa

                                                                                    SHA512

                                                                                    80ef1e2ba3374897c7f08fe4a24de19cce6eb9422ffdaf084cba89e9e8c2084fae1987bb2cd7524a6710ee41f0ae0a4a91f23a27f1468a2d8cc22b224e90982c

                                                                                  • C:\Users\Admin\AppData\Local\d393223438ae649f98d07ac4eab53931\Admin@TPTLJPNX_en-US\System\Process.txt

                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    3090c96f7d51f90d0bafa5192f95669b

                                                                                    SHA1

                                                                                    e525c67bdbc7085d2b999da9505526d9f0dbee87

                                                                                    SHA256

                                                                                    6d00150f81bf508bedd06988f8cde6a310092951062a141cf204f37d5df9d452

                                                                                    SHA512

                                                                                    b5793d515d65cfc64ebe449aaa3e0e23f032b5700bcfa9f5241157d22b39d5041e2b826420fe324bdfc4295b4e023f2de83760b7ee2c7d1a24f8c733c43a621f

                                                                                  • C:\Users\Admin\AppData\Local\d393223438ae649f98d07ac4eab53931\Admin@TPTLJPNX_en-US\System\Process.txt

                                                                                    Filesize

                                                                                    3KB

                                                                                    MD5

                                                                                    f4b1d92405ca45b7ad0b0afaebe6b28d

                                                                                    SHA1

                                                                                    546703100a113153d439abba13951d21feb5bccd

                                                                                    SHA256

                                                                                    32cdefd333f5f9fcb0d548abbe5aa9fdc521ccd9095de77ab70dfe605e6bb9c7

                                                                                    SHA512

                                                                                    e1b0aeb701eded20e6cce84dac7d1814ea1b6796e7bb6418ce4bd9f4708b41b914f42c22bb201d139da58be3925a40121705f92b699c9b4ec40e46165c7d973c

                                                                                  • C:\Users\Admin\AppData\Local\d393223438ae649f98d07ac4eab53931\Admin@TPTLJPNX_en-US\System\Process.txt

                                                                                    Filesize

                                                                                    3KB

                                                                                    MD5

                                                                                    ddb12b5a703d028d1db9049fcd1c9389

                                                                                    SHA1

                                                                                    e18f1cbe3d92d7b4569d8e4eb625a3da80cd8fc4

                                                                                    SHA256

                                                                                    65cac3ed6fb71250d187d27b065233b5f469dbb252a6f973e8760962c5dd17db

                                                                                    SHA512

                                                                                    f5cdfa20e8216247e1472c6389b6fef8523d0465ac287c4b797e87f3035ed3fec2f9c712975e775a22f247cebe582ae57a4c47c0072512693fa89c2b488efab2

                                                                                  • C:\Users\Admin\AppData\Local\d393223438ae649f98d07ac4eab53931\Admin@TPTLJPNX_en-US\System\Process.txt

                                                                                    Filesize

                                                                                    4KB

                                                                                    MD5

                                                                                    b29c299302f6bf152e97f54c7dfc1d6f

                                                                                    SHA1

                                                                                    24fc81371958de96f0fd17a68c3239004e30dd6b

                                                                                    SHA256

                                                                                    bec2381ab2269615dfa991b28d37c45cce04ee6e2ca99828208ed3ce247db028

                                                                                    SHA512

                                                                                    bd3715d0497db6d7a47c94a3d32f8f128ad9911a467dcbcda456d1f3b4dfb77c2b0ab6edaa5f0a2d5987c2a60cdc08d54e245955f05a7c699fe826327d7a92fd

                                                                                  • C:\Users\Admin\AppData\Roaming\daemon.exe

                                                                                    Filesize

                                                                                    63KB

                                                                                    MD5

                                                                                    6f92c594e253457f848f01bac27814d5

                                                                                    SHA1

                                                                                    9d29ff1372582e71bfcf37b9eba3063cc7febc08

                                                                                    SHA256

                                                                                    1f41ecd3c862c4957dc7e09fede95bddcf43ebcab44fe946d72ff6abb75d030a

                                                                                    SHA512

                                                                                    30573565a27010e037c06741577bf5fb5bf1069f518d81e9b62fc207968974a038a7f5dabbcd5a40f0fc0e2d0ecfab3aebe2e88ef5bbbf105c55d0edcaf7662c

                                                                                  • C:\Users\Admin\AppData\Roaming\daemon.exe

                                                                                    Filesize

                                                                                    63KB

                                                                                    MD5

                                                                                    6f92c594e253457f848f01bac27814d5

                                                                                    SHA1

                                                                                    9d29ff1372582e71bfcf37b9eba3063cc7febc08

                                                                                    SHA256

                                                                                    1f41ecd3c862c4957dc7e09fede95bddcf43ebcab44fe946d72ff6abb75d030a

                                                                                    SHA512

                                                                                    30573565a27010e037c06741577bf5fb5bf1069f518d81e9b62fc207968974a038a7f5dabbcd5a40f0fc0e2d0ecfab3aebe2e88ef5bbbf105c55d0edcaf7662c

                                                                                  • C:\Windows\Dllhost.exe

                                                                                    Filesize

                                                                                    43KB

                                                                                    MD5

                                                                                    a463c96ab06522c82bf208e024dea808

                                                                                    SHA1

                                                                                    97f88b3f7369e2a6b4ebe984f2d5205bd42c8730

                                                                                    SHA256

                                                                                    f77b0622c90ed9b471255f247a329022811b39bfde2cfe8ed764faa169147aa6

                                                                                    SHA512

                                                                                    59238793842d50c4ee68cc8e8f85c82c871717d1c18bb924a932cb51ab9a786a3eeb4284b1b96da86196466c9446830687aef22b5d01db2ea706ee665d8ae8d3

                                                                                  • C:\Windows\Dllhost.exe

                                                                                    Filesize

                                                                                    43KB

                                                                                    MD5

                                                                                    a463c96ab06522c82bf208e024dea808

                                                                                    SHA1

                                                                                    97f88b3f7369e2a6b4ebe984f2d5205bd42c8730

                                                                                    SHA256

                                                                                    f77b0622c90ed9b471255f247a329022811b39bfde2cfe8ed764faa169147aa6

                                                                                    SHA512

                                                                                    59238793842d50c4ee68cc8e8f85c82c871717d1c18bb924a932cb51ab9a786a3eeb4284b1b96da86196466c9446830687aef22b5d01db2ea706ee665d8ae8d3

                                                                                  • C:\Windows\Dllhost.exe

                                                                                    Filesize

                                                                                    43KB

                                                                                    MD5

                                                                                    a463c96ab06522c82bf208e024dea808

                                                                                    SHA1

                                                                                    97f88b3f7369e2a6b4ebe984f2d5205bd42c8730

                                                                                    SHA256

                                                                                    f77b0622c90ed9b471255f247a329022811b39bfde2cfe8ed764faa169147aa6

                                                                                    SHA512

                                                                                    59238793842d50c4ee68cc8e8f85c82c871717d1c18bb924a932cb51ab9a786a3eeb4284b1b96da86196466c9446830687aef22b5d01db2ea706ee665d8ae8d3

                                                                                  • \??\pipe\crashpad_3156_YELLJUSWXHYJBOSE

                                                                                    MD5

                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                    SHA1

                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                    SHA256

                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                    SHA512

                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                  • memory/332-28-0x00007FFDC26F0000-0x00007FFDC31B1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/332-46-0x00007FFDC26F0000-0x00007FFDC31B1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/332-34-0x00000202A8930000-0x00000202A8952000-memory.dmp

                                                                                    Filesize

                                                                                    136KB

                                                                                  • memory/332-40-0x00000202A8980000-0x00000202A8990000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/332-39-0x00000202A8980000-0x00000202A8990000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/332-41-0x00000202A8980000-0x00000202A8990000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/2000-47-0x0000000000980000-0x0000000000992000-memory.dmp

                                                                                    Filesize

                                                                                    72KB

                                                                                  • memory/2000-49-0x00000000051E0000-0x000000000527C000-memory.dmp

                                                                                    Filesize

                                                                                    624KB

                                                                                  • memory/2000-62-0x0000000074E10000-0x00000000755C0000-memory.dmp

                                                                                    Filesize

                                                                                    7.7MB

                                                                                  • memory/2000-48-0x0000000074E10000-0x00000000755C0000-memory.dmp

                                                                                    Filesize

                                                                                    7.7MB

                                                                                  • memory/2000-52-0x0000000005640000-0x00000000056D2000-memory.dmp

                                                                                    Filesize

                                                                                    584KB

                                                                                  • memory/2000-51-0x0000000005B50000-0x00000000060F4000-memory.dmp

                                                                                    Filesize

                                                                                    5.6MB

                                                                                  • memory/2000-50-0x0000000005390000-0x00000000053A0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/3540-68-0x0000000074E10000-0x00000000755C0000-memory.dmp

                                                                                    Filesize

                                                                                    7.7MB

                                                                                  • memory/3540-71-0x00000000063C0000-0x00000000063CA000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/3540-69-0x00000000062A0000-0x00000000062B8000-memory.dmp

                                                                                    Filesize

                                                                                    96KB

                                                                                  • memory/3540-569-0x00000000009D0000-0x0000000000A16000-memory.dmp

                                                                                    Filesize

                                                                                    280KB

                                                                                  • memory/3540-67-0x00000000053A0000-0x0000000005406000-memory.dmp

                                                                                    Filesize

                                                                                    408KB

                                                                                  • memory/3540-66-0x0000000005110000-0x000000000511A000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/3540-64-0x0000000000E40000-0x0000000000E50000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/3540-70-0x0000000000E40000-0x0000000000E50000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/3540-63-0x0000000074E10000-0x00000000755C0000-memory.dmp

                                                                                    Filesize

                                                                                    7.7MB

                                                                                  • memory/3540-561-0x0000000006510000-0x0000000006526000-memory.dmp

                                                                                    Filesize

                                                                                    88KB

                                                                                  • memory/3540-568-0x00000000067A0000-0x00000000067B2000-memory.dmp

                                                                                    Filesize

                                                                                    72KB

                                                                                  • memory/3596-708-0x000000001EEF0000-0x000000001F078000-memory.dmp

                                                                                    Filesize

                                                                                    1.5MB

                                                                                  • memory/3596-17-0x0000000001690000-0x00000000016A0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/3596-905-0x0000000001690000-0x00000000016A0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/3596-904-0x0000000001690000-0x00000000016A0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/3596-866-0x000000001C4C0000-0x000000001C53A000-memory.dmp

                                                                                    Filesize

                                                                                    488KB

                                                                                  • memory/3596-26-0x000000001C6E0000-0x000000001C712000-memory.dmp

                                                                                    Filesize

                                                                                    200KB

                                                                                  • memory/3596-585-0x000000001EDD0000-0x000000001EEF2000-memory.dmp

                                                                                    Filesize

                                                                                    1.1MB

                                                                                  • memory/3596-25-0x000000001C7C0000-0x000000001C7F2000-memory.dmp

                                                                                    Filesize

                                                                                    200KB

                                                                                  • memory/3596-24-0x000000001DB70000-0x000000001DB8A000-memory.dmp

                                                                                    Filesize

                                                                                    104KB

                                                                                  • memory/3596-23-0x000000001DE90000-0x000000001DEAC000-memory.dmp

                                                                                    Filesize

                                                                                    112KB

                                                                                  • memory/3596-22-0x000000001DD70000-0x000000001DD94000-memory.dmp

                                                                                    Filesize

                                                                                    144KB

                                                                                  • memory/3596-21-0x000000001E070000-0x000000001E08E000-memory.dmp

                                                                                    Filesize

                                                                                    120KB

                                                                                  • memory/3596-20-0x0000000002F40000-0x0000000002F74000-memory.dmp

                                                                                    Filesize

                                                                                    208KB

                                                                                  • memory/3596-19-0x000000001E0F0000-0x000000001E166000-memory.dmp

                                                                                    Filesize

                                                                                    472KB

                                                                                  • memory/3596-18-0x00007FFDE0D10000-0x00007FFDE0F05000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/3596-854-0x0000000001690000-0x00000000016A0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/3596-853-0x0000000001690000-0x00000000016A0000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/3596-713-0x00000000013D0000-0x00000000013DA000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/3596-16-0x00007FFDC26F0000-0x00007FFDC31B1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/3596-15-0x00007FFDE0D10000-0x00007FFDE0F05000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/3596-14-0x00007FFDC26F0000-0x00007FFDC31B1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/3920-570-0x0000000000400000-0x0000000000472000-memory.dmp

                                                                                    Filesize

                                                                                    456KB

                                                                                  • memory/3920-579-0x0000000000400000-0x0000000000472000-memory.dmp

                                                                                    Filesize

                                                                                    456KB

                                                                                  • memory/3920-574-0x0000000000400000-0x0000000000472000-memory.dmp

                                                                                    Filesize

                                                                                    456KB

                                                                                  • memory/3920-572-0x0000000000400000-0x0000000000472000-memory.dmp

                                                                                    Filesize

                                                                                    456KB

                                                                                  • memory/5028-9-0x00007FFDE0D10000-0x00007FFDE0F05000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/5028-8-0x00007FFDC26F0000-0x00007FFDC31B1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/5028-7-0x00007FFDE0D10000-0x00007FFDE0F05000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/5028-2-0x0000000002A00000-0x0000000002A10000-memory.dmp

                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/5028-1-0x00007FFDC26F0000-0x00007FFDC31B1000-memory.dmp

                                                                                    Filesize

                                                                                    10.8MB

                                                                                  • memory/5028-0-0x0000000000960000-0x0000000000976000-memory.dmp

                                                                                    Filesize

                                                                                    88KB