Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    25-02-2024 22:45

General

  • Target

    0b31dc8d9eeaa4a6803873a6c1380c72.exe

  • Size

    211KB

  • MD5

    0b31dc8d9eeaa4a6803873a6c1380c72

  • SHA1

    89a3961bb7b5e29ce53cfc9bb64daa216259a85e

  • SHA256

    7c94ffaf6d76f18ce6bfc6039f9252a4b71d79e483d822aeab0de9b3189b6d0e

  • SHA512

    7c00f36554dfb6b611227255da75b92bb2200ceadcf92f71fd280cad4c55ee64ed588338b4ed73b110cbf054ea4774c71abc2a66220a65549e04b642404fd26d

  • SSDEEP

    3072:gyJtJkIZYF/TgVdkyrp90TvT5A70CutWTFlEz/BVwNMtyMz7:gyDahrgVdjrpc5EJkQMz

Malware Config

Extracted

Family

smokeloader

Botnet

tfd5

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .lkhy

  • offline_id

    OxV6DGl22io8sqMOW1zCCOlzPiv4f1Vqzw7Y8zt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-uNdL2KHHdy Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0851ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.9

Botnet

7f6c51bbce50f99b5a632c204a5ec558

C2

https://t.me/hypergog

https://steamcommunity.com/profiles/76561199642171824

Attributes
  • profile_id_v2

    7f6c51bbce50f99b5a632c204a5ec558

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36

Signatures

  • DcRat 6 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Detect Vidar Stealer 5 IoCs
  • Detect ZGRat V1 9 IoCs
  • Detected Djvu ransomware 14 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs 7 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Modifies boot configuration data using bcdedit 14 IoCs
  • Disables Task Manager via registry modification
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 41 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Suspicious use of SetThreadContext 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b31dc8d9eeaa4a6803873a6c1380c72.exe
    "C:\Users\Admin\AppData\Local\Temp\0b31dc8d9eeaa4a6803873a6c1380c72.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2932
  • C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\6E2E.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
      2⤵
        PID:2552
    • C:\Users\Admin\AppData\Local\Temp\84BB.exe
      C:\Users\Admin\AppData\Local\Temp\84BB.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Users\Admin\AppData\Local\Temp\84BB.exe
        C:\Users\Admin\AppData\Local\Temp\84BB.exe
        2⤵
        • DcRat
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\1cf4e57f-32c3-4019-88f0-dbc6891395db" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          3⤵
          • Modifies file permissions
          PID:2844
        • C:\Users\Admin\AppData\Local\Temp\84BB.exe
          "C:\Users\Admin\AppData\Local\Temp\84BB.exe" --Admin IsNotAutoStart IsNotTask
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2972
          • C:\Users\Admin\AppData\Local\Temp\84BB.exe
            "C:\Users\Admin\AppData\Local\Temp\84BB.exe" --Admin IsNotAutoStart IsNotTask
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1952
            • C:\Users\Admin\AppData\Local\786baa0e-1ea1-4bad-9bae-da8e1c27e104\build2.exe
              "C:\Users\Admin\AppData\Local\786baa0e-1ea1-4bad-9bae-da8e1c27e104\build2.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2244
              • C:\Users\Admin\AppData\Local\786baa0e-1ea1-4bad-9bae-da8e1c27e104\build2.exe
                "C:\Users\Admin\AppData\Local\786baa0e-1ea1-4bad-9bae-da8e1c27e104\build2.exe"
                6⤵
                • Executes dropped EXE
                • Modifies system certificate store
                PID:2284
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 1456
                  7⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:2628
            • C:\Users\Admin\AppData\Local\786baa0e-1ea1-4bad-9bae-da8e1c27e104\build3.exe
              "C:\Users\Admin\AppData\Local\786baa0e-1ea1-4bad-9bae-da8e1c27e104\build3.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:788
              • C:\Users\Admin\AppData\Local\786baa0e-1ea1-4bad-9bae-da8e1c27e104\build3.exe
                "C:\Users\Admin\AppData\Local\786baa0e-1ea1-4bad-9bae-da8e1c27e104\build3.exe"
                6⤵
                • Executes dropped EXE
                PID:1508
                • C:\Windows\SysWOW64\schtasks.exe
                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                  7⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:2260
    • C:\Users\Admin\AppData\Local\Temp\B8D6.exe
      C:\Users\Admin\AppData\Local\Temp\B8D6.exe
      1⤵
      • Executes dropped EXE
      PID:2544
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 124
        2⤵
        • Loads dropped DLL
        • Program crash
        PID:2592
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\BD88.bat" "
      1⤵
        PID:848
        • C:\Windows\system32\reg.exe
          reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
          2⤵
            PID:2768
        • C:\Users\Admin\AppData\Local\Temp\C851.exe
          C:\Users\Admin\AppData\Local\Temp\C851.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2812
          • C:\Users\Admin\AppData\Local\Temp\C851.exe
            "C:\Users\Admin\AppData\Local\Temp\C851.exe"
            2⤵
            • Windows security bypass
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            PID:1088
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              3⤵
                PID:628
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  4⤵
                  • Modifies Windows Firewall
                  • Modifies data under HKEY_USERS
                  PID:1392
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe
                3⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Manipulates WinMon driver.
                • Manipulates WinMonFS driver.
                • Drops file in Windows directory
                • Modifies system certificate store
                • Suspicious use of AdjustPrivilegeToken
                PID:1624
                • C:\Windows\system32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  4⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:2344
                • C:\Windows\system32\schtasks.exe
                  schtasks /delete /tn ScheduledUpdate /f
                  4⤵
                    PID:608
                  • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                    "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Modifies system certificate store
                    PID:2068
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2992
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -timeout 0
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2952
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1036
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2780
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2988
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2964
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2796
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2824
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2372
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1592
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2380
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2476
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1780
                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                    4⤵
                    • Executes dropped EXE
                    PID:1424
                  • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                    4⤵
                    • Executes dropped EXE
                    PID:2704
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\Sysnative\bcdedit.exe /v
                    4⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1224
                  • C:\Windows\system32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    4⤵
                    • DcRat
                    • Creates scheduled task(s)
                    PID:2084
                  • C:\Windows\windefender.exe
                    "C:\Windows\windefender.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:1268
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      5⤵
                        PID:1096
                        • C:\Windows\SysWOW64\sc.exe
                          sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          6⤵
                          • Launches sc.exe
                          • Suspicious use of AdjustPrivilegeToken
                          PID:636
              • C:\Windows\system32\makecab.exe
                "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240225224649.log C:\Windows\Logs\CBS\CbsPersist_20240225224649.cab
                1⤵
                • Drops file in Windows directory
                PID:1476
              • C:\Users\Admin\AppData\Local\Temp\DE51.exe
                C:\Users\Admin\AppData\Local\Temp\DE51.exe
                1⤵
                • Executes dropped EXE
                PID:1568
              • C:\Users\Admin\AppData\Local\Temp\EDE2.exe
                C:\Users\Admin\AppData\Local\Temp\EDE2.exe
                1⤵
                • Executes dropped EXE
                PID:2684
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 564
                  2⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:2120
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {7FE3199C-699E-4998-9CDF-A768539BA244} S-1-5-21-2248906074-2862704502-246302768-1000:GHPZRGFC\Admin:Interactive:[1]
                1⤵
                  PID:2108
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:2760
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      3⤵
                      • Executes dropped EXE
                      PID:2000
                      • C:\Windows\SysWOW64\schtasks.exe
                        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                        4⤵
                        • DcRat
                        • Creates scheduled task(s)
                        PID:2252
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1248
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      3⤵
                      • Executes dropped EXE
                      PID:2008
                • C:\Users\Admin\AppData\Local\Temp\2F75.exe
                  C:\Users\Admin\AppData\Local\Temp\2F75.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1560
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 564
                    2⤵
                    • Loads dropped DLL
                    • Program crash
                    PID:1196
                • C:\Users\Admin\AppData\Local\Temp\34C3.exe
                  C:\Users\Admin\AppData\Local\Temp\34C3.exe
                  1⤵
                  • Executes dropped EXE
                  PID:984
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\containerProviderhost\lSHV2TIIXWH4jLBRX.vbe"
                    2⤵
                      PID:1600
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ""C:\containerProviderhost\SSJnjC24t.bat" "
                        3⤵
                        • Loads dropped DLL
                        PID:1312
                        • C:\containerProviderhost\runtimenetSvc.exe
                          "C:\containerProviderhost/runtimenetSvc.exe"
                          4⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2300
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CCTxfaFxh3.bat"
                            5⤵
                              PID:2064
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                6⤵
                                  PID:2872
                                • C:\Windows\system32\PING.EXE
                                  ping -n 10 localhost
                                  6⤵
                                  • Runs ping.exe
                                  PID:1780
                                • C:\containerProviderhost\services.exe
                                  "C:\containerProviderhost\services.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1740
                            • C:\Windows\SysWOW64\reg.exe
                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                              4⤵
                              • Modifies registry key
                              PID:3048
                      • C:\Windows\windefender.exe
                        C:\Windows\windefender.exe
                        1⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        PID:308

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                        Filesize

                        1KB

                        MD5

                        610f387cecd6b98e4abcb72626ee7d13

                        SHA1

                        791f01f69d1e025c15660cc87c6a2d332c16d1c7

                        SHA256

                        dd9c87c9d210b8dcb6f9d2b897c11b0a480b955a0aeaf4bb9b661f1bdc0604d1

                        SHA512

                        97d58a6504e70c4ceb4f255c6327d076b8ffc017945a9a8474f1ece483a5326d572ef13d6e4e5ba6bc2dba4b9575f99085ca2af2dbabc375f6bf0e8bef554858

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                        Filesize

                        724B

                        MD5

                        8202a1cd02e7d69597995cabbe881a12

                        SHA1

                        8858d9d934b7aa9330ee73de6c476acf19929ff6

                        SHA256

                        58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                        SHA512

                        97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                        Filesize

                        410B

                        MD5

                        03fa66209b4cb101cc0ca864da3d5487

                        SHA1

                        9b794bb5ad8c9b3110e47a8523fe9fe852de97a2

                        SHA256

                        bc77e3b84899b3f13f5fc75cc7f619a907504455937106d7e824920d6b0108d9

                        SHA512

                        1449a85046331be1ae0d416d3cb519f9ae69d3c050b22b1174664ccfb4c7e8cab2bfb7b0352099bc3de10abfd9f5f5b84f947dedaa86dd79a7e81674092469c2

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                        Filesize

                        344B

                        MD5

                        ad6566517eb3e9171d634756fbf3b078

                        SHA1

                        78705160e78e929c0e09232faa819175a1063c87

                        SHA256

                        a99f05d8aca8b5c545166628141a585021bc5275d4686eb2ac03a7445df5edb4

                        SHA512

                        3d42510ccc7a3b144da47849943f4a89f02ad28da6e733ecce52893dfe973329097ccc618b681c7c6e059b0a4bc4db0032d282e4e181f18b659f68c5b17c23c0

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                        Filesize

                        344B

                        MD5

                        b2435d7a3ab468fc33970264424b92ab

                        SHA1

                        cd48c08aa31ae033e1ed796770296caa664f29c1

                        SHA256

                        d390ce7bfe6923bb7a45110c217ddffd4b8bd09606e72a1d6ed672d95c0cfa20

                        SHA512

                        5d90246fe4ca8d1fccd072a6a35e7dec288e9a8e71adac9e6f25f38aa360041fe0237e1572a82d0c6fd6924aeb38d5e88d372faf41f0d0b3420653792a0b973b

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                        Filesize

                        344B

                        MD5

                        ce8858719d79eed3452092ee81b11f57

                        SHA1

                        b39a7a679383ddfd742df2be9aaa8f266b996e89

                        SHA256

                        2cdacbb582edb4e554d8a087946a7899b9b6d894249dee8cb93090a1637f5c20

                        SHA512

                        ceb3100ccdd39e90ac90c9d316b90a37ff10551f18ad67f3e311c820272c496cf371c1c2e760d7ece3c6ba28abbf9929a733dfba87de6c9918cc0db8d48db26e

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                        Filesize

                        344B

                        MD5

                        b11d6fd7ea686d12419300f2087b125e

                        SHA1

                        d51f803ad9e34ddc59250ee1a383547207454c15

                        SHA256

                        352b00f64ca7be1f4ae360b0e4555456c56c4bedea7c3f06f8a7435887dd4c7a

                        SHA512

                        528ce67df59c97c799a707e1e133d7ddee13ecb88424127b37f35e06bde6c1ed543776f4439860d2233107ac84b24705997fbe0c3916fc2871bbcf400fc010d7

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                        Filesize

                        344B

                        MD5

                        9ebb75a2ee551a4cd3b5b7b39c3a8314

                        SHA1

                        9396c3710604e25efec53cdb48e4bebdc2ddbe62

                        SHA256

                        360d2ca65d4ff9c142c2bc0d1f7814c9847405f150a8e5cb8a2814bb6fac732c

                        SHA512

                        59854413e16a2480828c6fab0012652eb177d66d29a93fab1df8496d455686cb52ee3e6f0c759e151417b656d9466623b5382d2a81e269475d437032d7b7dd1f

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

                        Filesize

                        392B

                        MD5

                        ee838a25e9da12e2a5819cc7e940d21e

                        SHA1

                        2f6c9e7c286639e8a02f5c77089da35d03d2bc39

                        SHA256

                        1b3833124a22415acee38345934fe8c65f17ec48b4d254388b11d30915823555

                        SHA512

                        f8f4e6705c009a7e3940e6e91b16726c649d67fcf7a45e0d1b02d8263ca52a1b21ed11f646dc7d23a87a7a3791688817914e86e1a44745bf16ced580e11b2d16

                      • C:\Users\Admin\AppData\Local\786baa0e-1ea1-4bad-9bae-da8e1c27e104\build2.exe

                        Filesize

                        334KB

                        MD5

                        c6d3d647baad8a5b93b81d2487f4f072

                        SHA1

                        e9c1105dc41f85d4f7e94d4e004f8427787c8802

                        SHA256

                        7754125653413cfca3bde887fb2a22f0cd5144ec447bb274c69b005861b70a0a

                        SHA512

                        55425dc95161e627e19e17f1bb910f958dade0c2b12da5eaad31159f0e2dc5217ff293c52f39d860d399807d5b4a814f1bb24376c58b40cc171d298282052049

                      • C:\Users\Admin\AppData\Local\Temp\2F75.exe

                        Filesize

                        779KB

                        MD5

                        1ac1efba731f3020e96754f2472ec55c

                        SHA1

                        43dc7ed8b3f4521b118f3deae27a249ce2fe582e

                        SHA256

                        2040989b03a916d23217ede49ec52652294eef5000140e4f9819ba164af6de8f

                        SHA512

                        3e9ebcf535bf9eaf92ce03605269e90a8c2a9c00b80c65681f7f5ab25d0abfac7deedd12043f2ab93bd289dc8244463997f7670ed2be69028d24287cd0e2abeb

                      • C:\Users\Admin\AppData\Local\Temp\2F75.exe

                        Filesize

                        1.1MB

                        MD5

                        f9f0fd78f541e1427a1c531becb20aff

                        SHA1

                        5c881f95a2902af550ef160a0a1d8f52ca51f802

                        SHA256

                        d94196430230b97ab47ec68df839598c21a9996fe45580a95712be8d561ccaf2

                        SHA512

                        6d39115a303fc9c69a2ba18d69438f346e7c4e546a43c41f7c3910f4e7ef13ee4f898826ed250aec77af2b70dc5a10eb81494efdcf33009c23e2829f05e30318

                      • C:\Users\Admin\AppData\Local\Temp\34C3.exe

                        Filesize

                        1.7MB

                        MD5

                        f987e9af00984e438d535ffbcee2c6ed

                        SHA1

                        c11fed0146bb3927544fa4616caa2aaf38273253

                        SHA256

                        336f07ff04674d30e651ea22fa3de86f0ca7f9588ffb73d2f7623f6016efd5db

                        SHA512

                        d5f42a51caff69825485cee2c23fb09a456afadc505aeea8bdbef1186243f085dc3583792ed5995520b8d0710aaf417e58f7e20278266c138de2e4c849686b1d

                      • C:\Users\Admin\AppData\Local\Temp\6E2E.bat

                        Filesize

                        77B

                        MD5

                        55cc761bf3429324e5a0095cab002113

                        SHA1

                        2cc1ef4542a4e92d4158ab3978425d517fafd16d

                        SHA256

                        d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                        SHA512

                        33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                      • C:\Users\Admin\AppData\Local\Temp\84BB.exe

                        Filesize

                        742KB

                        MD5

                        3d196de47911047d26c003e31a878038

                        SHA1

                        c368e8a2dacb6c322064f7f2aeb0b3cbcb274cd9

                        SHA256

                        19b9c4e7ba38960b14cf6557c7b6b7989009f0a7e368f1936050d1606c4cfc4a

                        SHA512

                        30871d6b7a9d94a602f21a6f5325f017c735db491351b64d9044b497c0f2d1cd8f0988857a358f29e077047ab5800a6384a2aa2ab17a539c2092d8828e87581b

                      • C:\Users\Admin\AppData\Local\Temp\B8D6.exe

                        Filesize

                        5.0MB

                        MD5

                        0904e849f8483792ef67991619ece915

                        SHA1

                        58d04535efa58effb3c5ed53a2462aa96d676b79

                        SHA256

                        fca631b3198194fcc0c619b5690dbde2e9f38afb1b978bab8ea3f92b572ce1ef

                        SHA512

                        258fc59050aa455ad56167dd1bbe5e098eefc0f3e950c90d89bac2aa74abb5cfa1710d866c0e28e58dcb2f914736470a4dd9838dd6412b633aee87d71b867cf5

                      • C:\Users\Admin\AppData\Local\Temp\C851.exe

                        Filesize

                        3.8MB

                        MD5

                        ae508ddc1d7aa4458eee2e5d0589d309

                        SHA1

                        40d76a78c2233779b2ae684c3d514ad01a3f6243

                        SHA256

                        5bd900c94124ecfacb040aa8a991715591808e22e71ff15b11935b02db6e4b9d

                        SHA512

                        36510d03a35975e612944c859fda03a4f10d6dd1292d654dacb7a0d3e1ad5e86407e9339aea03d855c666d21a0f67035323ecdda6aeaffce5d7d81c52fee1d56

                      • C:\Users\Admin\AppData\Local\Temp\C851.exe

                        Filesize

                        4.1MB

                        MD5

                        c4cd2dabf6fe55752749ff664f9f9820

                        SHA1

                        b999a991aa6013a1cfe8d0bf5ee3e7ccd79012c9

                        SHA256

                        ecf58130e5f5905c6ab24345d42aa8ebf185bc45452fe9c93941d774d1d56c2e

                        SHA512

                        a2b64bbf37b291dbe3937100d228851024b44a953e91de6fedf1636dcaba7b4c02bcbd33fa21f0ce9fbdfde75a14893501ba583b0ddca0dce6968e67af5b6936

                      • C:\Users\Admin\AppData\Local\Temp\C851.exe

                        Filesize

                        1.8MB

                        MD5

                        e2809f14a2f6abe51e7c3a9358b45320

                        SHA1

                        6c5e3bd8c078a1dc6cc36e8357ecd61ecb1ed879

                        SHA256

                        2496048773f210ec237d6559b673c29375537de6b1c7afc04157f4521b9945ae

                        SHA512

                        f5fbefba490e94d8bf3276a6fa964fd368a30c43fa9751c39d4ed14caa74eed17181c90f841442e3ec9800a36a80475557276cf20ae34a1b9f5e0d9e5614d9a9

                      • C:\Users\Admin\AppData\Local\Temp\C851.exe

                        Filesize

                        1.9MB

                        MD5

                        3ab209ecb992b40aed1e8302dccc40e3

                        SHA1

                        68fe47da7d354cda05d4c013211a85a585501e11

                        SHA256

                        dccd5f02946183688b6e2158588eb3854b56cc5b60fc03af8eadb66e005d36b9

                        SHA512

                        1bee2fbd894ce760cd86a9c27c1ff035c84e9196ca417521b902688b86ae1b796738a0184183ab7b9f7f74189ca380f19965d1b9fa6fd153f4a6c19d1f5d230c

                      • C:\Users\Admin\AppData\Local\Temp\Cab8C0A.tmp

                        Filesize

                        65KB

                        MD5

                        ac05d27423a85adc1622c714f2cb6184

                        SHA1

                        b0fe2b1abddb97837ea0195be70ab2ff14d43198

                        SHA256

                        c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                        SHA512

                        6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                      • C:\Users\Admin\AppData\Local\Temp\DE51.exe

                        Filesize

                        1.5MB

                        MD5

                        41078ddcc4883c53b851fb092bcb79e1

                        SHA1

                        6370138391cc217a6b735ca2c1025d0382841a8e

                        SHA256

                        3d43f5bf00ff3e51dc4ccbc86bf0536859ea6db02b08097d6fe243405cb8d87a

                        SHA512

                        a5e9c66a734896ff3a08b2b791fe4463dff945a244a486fb0db67f899f283bde0fc5682dc324b0065e7679781bf7c09b45f9cac332d5b5356c2834535f84dce3

                      • C:\Users\Admin\AppData\Local\Temp\EDE2.exe

                        Filesize

                        409KB

                        MD5

                        00e3f4882f137105fd422a68c1abedd2

                        SHA1

                        e95713020236e6dc1efedea5deff6680190572b5

                        SHA256

                        f54394470bb9a9688de3aacd78430ad27e63803d1968d0c6e65fb0a6ebe94620

                        SHA512

                        d37b053a536fbbe581611e71b9c2a2f6a345fd8ca308a360d4573f4a9d1500b614a02923cd3d1194305b430f790c4e644b16f2d415192b58ccd48fbaa0b7207f

                      • C:\Users\Admin\AppData\Local\Temp\EDE2.exe

                        Filesize

                        761KB

                        MD5

                        36903ff1f3ff595fa0f07a184f2b5c62

                        SHA1

                        231f4500ee88f271024365da8d6f2e01f179968f

                        SHA256

                        9a5f9fa96d69e821725c4696328b745791448c4c81e69a93ff5085ab174a29d1

                        SHA512

                        1607eecbaf48c0a5bb6c13210ca757857664f98dc18f8e78d66d49390ccaf86af9c31d6159d2bb8dfcce50f36b234c70f3accbf77682206c23e2bde1a71f0458

                      • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error

                        Filesize

                        521KB

                        MD5

                        e7db04d67a840dc680bcd3cb6f71ce1a

                        SHA1

                        bb2c457d1b56eeedd242346baf85487b21f76ebc

                        SHA256

                        3c506e4cd2fb70ab2501011287489a936a950d89f6cefb9845f6310bcbde05b6

                        SHA512

                        a89e3afe09e27b124693e8c24cca1d6e13c664981a1ac0c5194a770d8480373db7d99f3a4514d1805a30a281559a017051de05e691784903df287242eca24c2f

                      • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

                        Filesize

                        492KB

                        MD5

                        fafbf2197151d5ce947872a4b0bcbe16

                        SHA1

                        a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                        SHA256

                        feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                        SHA512

                        acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                      • C:\Users\Admin\AppData\Local\Temp\TarA67D.tmp

                        Filesize

                        171KB

                        MD5

                        9c0c641c06238516f27941aa1166d427

                        SHA1

                        64cd549fb8cf014fcd9312aa7a5b023847b6c977

                        SHA256

                        4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                        SHA512

                        936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                        Filesize

                        281KB

                        MD5

                        d98e33b66343e7c96158444127a117f6

                        SHA1

                        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                        SHA256

                        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                        SHA512

                        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                      • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

                        Filesize

                        967KB

                        MD5

                        75cf9f6562ff34c3f0d52def91ea9749

                        SHA1

                        b07a693940408a71d9c958abe95b7146885788d7

                        SHA256

                        25c73a2f36e8c76791011ad0793d78b55abe7c4559139c5d05185ff864bcc89b

                        SHA512

                        b6848bc9263515b56e9c614fec192c22c13ab4dd92ca10c7de0bf41fd712c4068b19cda514bf27448c0ad3a24912d4ee74584a041c3a017fce1f4dcbfb9a8fc1

                      • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                        Filesize

                        908KB

                        MD5

                        0a6178814666c904769cb0f68e458af3

                        SHA1

                        e5382d19a1d27d64368cbf2225c8acf665cc7dd5

                        SHA256

                        49e6370aa9cbf74ced549635578146197d2ac789094cc4d8eeb75c8ad027e850

                        SHA512

                        ca382921c45af4624adbc3f0e738899118e924afb4451a925aa17eaa5c6d374eae28ae9a72fadd39f1593cc39422885f855b3f04bdbbb5a4f9f9571ca72f83c0

                      • C:\Users\Admin\AppData\Local\Temp\osloader.exe

                        Filesize

                        82KB

                        MD5

                        b9f99ea071fccbb26ff2c02a6d20dd4a

                        SHA1

                        73468c2f9c19c09bcbedf7ae97e7665c623428e3

                        SHA256

                        c6aea7891b35e84fbaaf0c023da4c69fc5d37890a3333bff07992fffc38416d4

                        SHA512

                        d9a31c672e510f2367d0e8d8892de504cf18879f58effd2176876e5e9f953158cb8ee149865d50bf4d5df9e11b10069bf0787bc76b23dcd544625e83e34430fe

                      • C:\Windows\rss\csrss.exe

                        Filesize

                        640KB

                        MD5

                        0bccade864c0d26ce69bb20b4078cc7e

                        SHA1

                        07100885604cfae2503a7bbf45d1c1b9cefdc793

                        SHA256

                        c33f6fada92bd7d7987696dfbe0967a2d6d290bbb8ea39eea385f3b8b93dd0eb

                        SHA512

                        4802d4cdf9f7bb2c77b1ff87e393886583b45b96c5783faa438a7fbd599df5076101c992c81823cfdd678458714a62daaa5df7a3b0d4d11235d85f2fdc13c7ea

                      • C:\Windows\rss\csrss.exe

                        Filesize

                        21KB

                        MD5

                        b6189d36e70cbe35c31ed3868422625e

                        SHA1

                        6e3df2a994e44b3ab10f7a100d087a386517775e

                        SHA256

                        21e27a779afc78bf8dfa75b34a112b062bd522e29eba8ce5c3e43648c0ead0d8

                        SHA512

                        ce1e5d1a5909425695bedbe9597246782f469ec69d9b07c4a8459668e2471060f1859ebe1e8e86faef497e53325c4017188b963cfb35336c1dc908bebd096e7a

                      • C:\containerProviderhost\sppsvc.exe

                        Filesize

                        3.4MB

                        MD5

                        92bf2463d72a410bf291db2bbb0176f5

                        SHA1

                        bcc41c9861ce8ad99e2d951c49c50429b4dc8d7f

                        SHA256

                        92883022e82b89d32c6936ad8f94a35ac1eb0c2313656029977aec1b4973b808

                        SHA512

                        c803d47482aec6ac9c74ee20b401f03f3f2d4a1cc80770e1cf70319cbb7da715ee204cb15e585dbd6d9df0d9fb81254fdb6f6dae5d2147cbbbd85c3cf5b8d300

                      • \Users\Admin\AppData\Local\786baa0e-1ea1-4bad-9bae-da8e1c27e104\build3.exe

                        Filesize

                        299KB

                        MD5

                        41b883a061c95e9b9cb17d4ca50de770

                        SHA1

                        1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

                        SHA256

                        fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

                        SHA512

                        cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

                      • \Users\Admin\AppData\Local\Temp\B8D6.exe

                        Filesize

                        3.3MB

                        MD5

                        91044e59972a50c139e40982ecd634a4

                        SHA1

                        36670182a5166f591780b98bedbef83bcac94950

                        SHA256

                        7285d2b17ba50b7cce109b7699f0cdcdd6adc900db2bc2279e751beb06bbb2b7

                        SHA512

                        93bc7fbf61afc7c42c1df62d59ed56e73eee4e06d518575633633211ede84be4f29afe240e417a2ca67a3fa5a26214d403d42257f1e612e24d40bea0803cfabc

                      • \Users\Admin\AppData\Local\Temp\B8D6.exe

                        Filesize

                        3.8MB

                        MD5

                        16d54f0d49c41790e1d265bc7452791a

                        SHA1

                        4f970896c8be729497106eac5c163321f1ba03f5

                        SHA256

                        20554829d97eb199a690636c1646ef1cbbc6ca93b078f5eae8a1c284b98d6a40

                        SHA512

                        ca121507f2833d31405201ef320fc5aa969d02e17fd754c7b6b088be102dcf38141e39a7f5f9ada76b6a9cc015cd6126145b9cdf7c6380d065e84a72085f32e9

                      • \Users\Admin\AppData\Local\Temp\B8D6.exe

                        Filesize

                        3.4MB

                        MD5

                        452d723c71b94983947183117a818966

                        SHA1

                        4b2fc7a2d747355eabb97da3988e7daccf942933

                        SHA256

                        b26f5d92a5a9761ca3f6935b55716e97ac3d59c31672b94660e52f74b2a043f6

                        SHA512

                        8c5f575e163eba6caecd6dc4062eca95756b46be6949910666ab0875f2f8fe4a4b8bf3d46213633d12bc8b44bac7a38598a5abd68c049dda713165bb46659558

                      • \Users\Admin\AppData\Local\Temp\DE51.exe

                        Filesize

                        1.5MB

                        MD5

                        c617562971e5552332875f43dae92533

                        SHA1

                        92d2950d251b21da4b5a857b16f062f77179d296

                        SHA256

                        132f86e54a7ed28ca3d12789924a03770382eabc5f2ddbf8a72349b4b7e2453f

                        SHA512

                        0325463290224213cce0fd1b8488df105b3846a0ca177e9a3a809c9c2d10f200ecee93e1c2662cf532388f705808ea93ed76df98a82cbb31936801b5654b6208

                      • \Users\Admin\AppData\Local\Temp\csrss\patch.exe

                        Filesize

                        1.1MB

                        MD5

                        be81c865af1555afb8eebadc41ddd23d

                        SHA1

                        1b7c70c5993c853abd63ef0979c43d29e5af85b4

                        SHA256

                        57a3a50b9879911442aa8288969013c4c4e58819ed6755144a3d184c3a0e5326

                        SHA512

                        f535655ad385bd8510a74ccffefde9686c1c3e62f5b09c6a6f1ff31fa62efd2bc01f7e05b440f4cf3ce9a67ef1cb1d9c0bf7f37cc9636dc0bd5720462e149b02

                      • \Users\Admin\AppData\Local\Temp\dbghelp.dll

                        Filesize

                        871KB

                        MD5

                        da4d522afbbd4bfd319233177d1d29a5

                        SHA1

                        0763dafe8fc71605e47b2362d0ae9894c52918d0

                        SHA256

                        50d491bb9335a9aca1ecff83423dd210555e63972e373dd7e55d372aaa20fcd1

                        SHA512

                        3bdc8435f2f72c77000dce9fa753faad8f32fe2549c2b678b8d4b6126a6c7cc8a39161f987cfad83fd75b4a7d8b586382839b7021d3041e0743cedbd2da087ce

                      • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                        Filesize

                        1.0MB

                        MD5

                        fa5fe67bbf51720a1810a8c78ba98767

                        SHA1

                        8caee866641a5f1f44e488929f3baa14baaf0816

                        SHA256

                        515d636ba9a21819b512ca3ed1767fda2334b5cd7c854cc1a55f712104d32113

                        SHA512

                        72880a5da5c838b0e26242dd8d12ea4dde40e551982223e598d655210f277996668f8e8259c9f18ea304007a0545ed2764582dc7c999e6fb1868fc56c0605f36

                      • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                        Filesize

                        643KB

                        MD5

                        e421a139e44cfa762f19f169856dce92

                        SHA1

                        a4c28ed01efd28b55d5ae4df38b9ee372c58a4d9

                        SHA256

                        eb9366f7df2c1b52e18bc26c62b858ce23f72fe6a1eb16e81bc7a950d0ca9d59

                        SHA512

                        c89746ab379e39d55b81cf6bb40be24198f55831549e4920fd965a5be1bc576c5a45feb6204226295dd31158997b6bc1e460fa1fb53ee8bbca26808164261518

                      • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                        Filesize

                        910KB

                        MD5

                        c11e6f45c4ace36caad7e0fc37c29adc

                        SHA1

                        54f7e63f9f431653169c8737877a49dc3525802e

                        SHA256

                        037ba343cc3876e31e33834401d28c10f3ab0ef11d6157e0d965bca8f0b237fd

                        SHA512

                        33d71133bb7414f163cef6314d34f96735bb8ce41a31af98dc6eafbe398020fa669a82cda8a507c88505a8eddc6bbba2886940edaf67ca4d03fb5a5c2b70fe7a

                      • \Users\Admin\AppData\Local\Temp\symsrv.dll

                        Filesize

                        163KB

                        MD5

                        5c399d34d8dc01741269ff1f1aca7554

                        SHA1

                        e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

                        SHA256

                        e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

                        SHA512

                        8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

                      • \Windows\rss\csrss.exe

                        Filesize

                        914KB

                        MD5

                        e06990f0d06b7d15911516f269e3a6ba

                        SHA1

                        ad6a54f561cf5bd104102d633563099583b85955

                        SHA256

                        8064f14de52225193e4beeb67bba22f365326f8e75c821418652f03c9485036a

                        SHA512

                        43b2cb09e0760dd3012738828607ca0a817cb3b5f88be68ed57d8e4c58cbfd15a393cc6686297591efc8305b6e480360017dfc2b540db81c0f3328900cdd1b58

                      • \Windows\rss\csrss.exe

                        Filesize

                        1.2MB

                        MD5

                        9f34c2e370064241cedad4c516d45abb

                        SHA1

                        e46153375c4f9d022835808bc22a9830d3c49a40

                        SHA256

                        5c6e0a903792ccd74f468357295e4ba7e523c1ff4b4ea425b84681cc725ad805

                        SHA512

                        23cee66a628ee3ea2262aaae1f9486d002e04ccdc21311fd5543441a0ee62c9a5bf2a67a6e45434509b2c29ce902a88b2805297a15a3a9af16aee69cfec288cf

                      • memory/788-227-0x0000000000C50000-0x0000000000D50000-memory.dmp

                        Filesize

                        1024KB

                      • memory/788-228-0x0000000000220000-0x0000000000224000-memory.dmp

                        Filesize

                        16KB

                      • memory/1088-375-0x0000000000400000-0x0000000001E0D000-memory.dmp

                        Filesize

                        26.1MB

                      • memory/1088-372-0x0000000003870000-0x0000000003C68000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/1088-374-0x0000000003870000-0x0000000003C68000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/1088-391-0x0000000000400000-0x0000000001E0D000-memory.dmp

                        Filesize

                        26.1MB

                      • memory/1256-4-0x0000000002510000-0x0000000002526000-memory.dmp

                        Filesize

                        88KB

                      • memory/1268-593-0x0000000000400000-0x00000000008DF000-memory.dmp

                        Filesize

                        4.9MB

                      • memory/1508-242-0x0000000000400000-0x0000000000406000-memory.dmp

                        Filesize

                        24KB

                      • memory/1508-245-0x0000000000410000-0x0000000000477000-memory.dmp

                        Filesize

                        412KB

                      • memory/1508-244-0x0000000000400000-0x0000000000406000-memory.dmp

                        Filesize

                        24KB

                      • memory/1508-239-0x0000000000400000-0x0000000000406000-memory.dmp

                        Filesize

                        24KB

                      • memory/1560-548-0x0000000072B30000-0x000000007321E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/1560-549-0x0000000005050000-0x0000000005090000-memory.dmp

                        Filesize

                        256KB

                      • memory/1560-547-0x0000000001280000-0x00000000018D2000-memory.dmp

                        Filesize

                        6.3MB

                      • memory/1568-381-0x000000013FDD0000-0x0000000140A32000-memory.dmp

                        Filesize

                        12.4MB

                      • memory/1624-390-0x0000000003880000-0x0000000003C78000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/1624-393-0x0000000003C80000-0x000000000456B000-memory.dmp

                        Filesize

                        8.9MB

                      • memory/1624-395-0x0000000000400000-0x0000000001E0D000-memory.dmp

                        Filesize

                        26.1MB

                      • memory/1624-392-0x0000000003880000-0x0000000003C78000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/1624-532-0x0000000000400000-0x0000000001E0D000-memory.dmp

                        Filesize

                        26.1MB

                      • memory/1624-531-0x0000000003880000-0x0000000003C78000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/1952-96-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1952-71-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1952-72-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1952-87-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1952-88-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1952-92-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1952-94-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1952-95-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/1952-177-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2068-537-0x00000000005D0000-0x0000000000BB8000-memory.dmp

                        Filesize

                        5.9MB

                      • memory/2068-410-0x00000000005D0000-0x0000000000BB8000-memory.dmp

                        Filesize

                        5.9MB

                      • memory/2068-442-0x00000000007A0000-0x0000000000D88000-memory.dmp

                        Filesize

                        5.9MB

                      • memory/2244-112-0x0000000000470000-0x00000000004A6000-memory.dmp

                        Filesize

                        216KB

                      • memory/2244-111-0x0000000000280000-0x0000000000380000-memory.dmp

                        Filesize

                        1024KB

                      • memory/2284-110-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                      • memory/2284-366-0x0000000000400000-0x0000000000649000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/2284-114-0x0000000000400000-0x0000000000649000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/2284-117-0x0000000000400000-0x0000000000649000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/2284-118-0x0000000000400000-0x0000000000649000-memory.dmp

                        Filesize

                        2.3MB

                      • memory/2300-608-0x0000000002340000-0x000000000234E000-memory.dmp

                        Filesize

                        56KB

                      • memory/2300-610-0x00000000023F0000-0x0000000002402000-memory.dmp

                        Filesize

                        72KB

                      • memory/2300-596-0x0000000000AB0000-0x0000000000AD6000-memory.dmp

                        Filesize

                        152KB

                      • memory/2300-598-0x0000000000A80000-0x0000000000A8E000-memory.dmp

                        Filesize

                        56KB

                      • memory/2300-600-0x0000000000A90000-0x0000000000AA0000-memory.dmp

                        Filesize

                        64KB

                      • memory/2300-602-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

                        Filesize

                        64KB

                      • memory/2300-604-0x0000000000AE0000-0x0000000000AF0000-memory.dmp

                        Filesize

                        64KB

                      • memory/2300-650-0x000000001B426000-0x000000001B48D000-memory.dmp

                        Filesize

                        412KB

                      • memory/2300-606-0x0000000000AF0000-0x0000000000AFE000-memory.dmp

                        Filesize

                        56KB

                      • memory/2300-649-0x000007FEF4A90000-0x000007FEF547C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/2300-634-0x000000001B300000-0x000000001B34E000-memory.dmp

                        Filesize

                        312KB

                      • memory/2300-632-0x000000001AA40000-0x000000001AA58000-memory.dmp

                        Filesize

                        96KB

                      • memory/2300-630-0x000000001AA10000-0x000000001AA1E000-memory.dmp

                        Filesize

                        56KB

                      • memory/2300-628-0x000000001AA00000-0x000000001AA10000-memory.dmp

                        Filesize

                        64KB

                      • memory/2300-626-0x0000000002570000-0x000000000257E000-memory.dmp

                        Filesize

                        56KB

                      • memory/2300-624-0x000000001AE30000-0x000000001AE8A000-memory.dmp

                        Filesize

                        360KB

                      • memory/2300-622-0x0000000002420000-0x0000000002430000-memory.dmp

                        Filesize

                        64KB

                      • memory/2300-620-0x0000000002410000-0x0000000002420000-memory.dmp

                        Filesize

                        64KB

                      • memory/2300-618-0x00000000023E0000-0x00000000023EE000-memory.dmp

                        Filesize

                        56KB

                      • memory/2300-616-0x0000000002550000-0x0000000002562000-memory.dmp

                        Filesize

                        72KB

                      • memory/2300-614-0x0000000002430000-0x0000000002446000-memory.dmp

                        Filesize

                        88KB

                      • memory/2300-612-0x00000000023D0000-0x00000000023E0000-memory.dmp

                        Filesize

                        64KB

                      • memory/2300-594-0x00000000002E0000-0x0000000000642000-memory.dmp

                        Filesize

                        3.4MB

                      • memory/2544-394-0x0000000000ED0000-0x000000000177F000-memory.dmp

                        Filesize

                        8.7MB

                      • memory/2544-284-0x0000000000190000-0x0000000000191000-memory.dmp

                        Filesize

                        4KB

                      • memory/2544-283-0x0000000077260000-0x0000000077261000-memory.dmp

                        Filesize

                        4KB

                      • memory/2544-275-0x0000000000080000-0x0000000000081000-memory.dmp

                        Filesize

                        4KB

                      • memory/2544-277-0x0000000000ED0000-0x000000000177F000-memory.dmp

                        Filesize

                        8.7MB

                      • memory/2544-278-0x0000000000080000-0x0000000000081000-memory.dmp

                        Filesize

                        4KB

                      • memory/2544-280-0x0000000000080000-0x0000000000081000-memory.dmp

                        Filesize

                        4KB

                      • memory/2648-27-0x0000000000330000-0x00000000003C1000-memory.dmp

                        Filesize

                        580KB

                      • memory/2648-30-0x00000000034E0000-0x00000000035FB000-memory.dmp

                        Filesize

                        1.1MB

                      • memory/2648-36-0x0000000000330000-0x00000000003C1000-memory.dmp

                        Filesize

                        580KB

                      • memory/2648-26-0x0000000000330000-0x00000000003C1000-memory.dmp

                        Filesize

                        580KB

                      • memory/2684-506-0x0000000000F80000-0x000000000152A000-memory.dmp

                        Filesize

                        5.7MB

                      • memory/2684-540-0x0000000072B30000-0x000000007321E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2684-507-0x0000000072B30000-0x000000007321E000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2684-550-0x0000000005000000-0x0000000005040000-memory.dmp

                        Filesize

                        256KB

                      • memory/2684-508-0x0000000005000000-0x0000000005040000-memory.dmp

                        Filesize

                        256KB

                      • memory/2760-528-0x0000000000890000-0x0000000000990000-memory.dmp

                        Filesize

                        1024KB

                      • memory/2812-373-0x0000000000400000-0x0000000001E0D000-memory.dmp

                        Filesize

                        26.1MB

                      • memory/2812-367-0x0000000003700000-0x0000000003AF8000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/2812-368-0x0000000003B00000-0x00000000043EB000-memory.dmp

                        Filesize

                        8.9MB

                      • memory/2812-369-0x0000000000400000-0x0000000001E0D000-memory.dmp

                        Filesize

                        26.1MB

                      • memory/2812-365-0x0000000003700000-0x0000000003AF8000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/2932-5-0x0000000000400000-0x0000000002BE0000-memory.dmp

                        Filesize

                        39.9MB

                      • memory/2932-3-0x0000000000400000-0x0000000002BE0000-memory.dmp

                        Filesize

                        39.9MB

                      • memory/2932-1-0x0000000000230000-0x0000000000330000-memory.dmp

                        Filesize

                        1024KB

                      • memory/2932-2-0x00000000003B0000-0x00000000003BB000-memory.dmp

                        Filesize

                        44KB

                      • memory/2940-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                      • memory/2940-38-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2940-33-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2940-61-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2940-37-0x0000000000400000-0x0000000000537000-memory.dmp

                        Filesize

                        1.2MB

                      • memory/2972-63-0x0000000001B20000-0x0000000001BB1000-memory.dmp

                        Filesize

                        580KB

                      • memory/2972-64-0x0000000001B20000-0x0000000001BB1000-memory.dmp

                        Filesize

                        580KB