umbral | hxxps://www[.]youtube[.]com/redirect?event=comments&redir_token=QUFFLUhqbGhTdHNhbVFfaWpWbG9jcWhzRVZTLU12MWM0QXxBQ3Jtc0tteFo2ekR5NFpwcVNlSzR6djR2dG9neGJubkdtU1lRZzRpajZ0eDBfREF1Ymt0MmFsd1JwcUM2TlhWUlc5UndLZ2pabTVHa2tCRzRTeHpjQzVGQkViYVdTMjQ2Nkk3Q0d3SFRTLVAwaDFVcGRicWlBYw&q=https%3A%2F%2Fdrive[.]google[.]com%2Ffile%2Fd%2F1ejmrB0CjyRUyAo46MJfZzz2ibuuOqlRA%2Fview%3Fusp%3Dsharing

Analysis

max time kernel
58s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbGhTdHNhbVFfaWpWbG9jcWhzRVZTLU12MWM0QXxBQ3Jtc0tteFo2ekR5NFpwcVNlSzR6djR2dG9neGJubkdtU1lRZzRpajZ0eDBfREF1Ymt0MmFsd1JwcUM2TlhWUlc5UndLZ2pabTVHa2tCRzRTeHpjQzVGQkViYVdTMjQ2Nkk3Q0d3SFRTLVAwaDFVcGRicWlBYw&q=https%3A%2F%2Fdrive.google.com%2Ffile%2Fd%2F1ejmrB0CjyRUyAo46MJfZzz2ibuuOqlRA%2Fview%3Fusp%3Dsharing

Score

10^/10

umbral execution persistence spyware stealer

Malware Config

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023510-596.dat	family_umbral
behavioral1/memory/5052-615-0x00000184C0660000-0x00000184C06A0000-memory.dmp	family_umbral

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\StartMenuExperienceHost.exe\", \"C:\\Windows\\ShellComponents\\dllhost.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\StartMenuExperienceHost.exe\", \"C:\\Windows\\ShellComponents\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\firefox.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\StartMenuExperienceHost.exe\", \"C:\\Windows\\ShellComponents\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\firefox.exe\", \"C:\\Windows\\de-DE\\Idle.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\StartMenuExperienceHost.exe\", \"C:\\Windows\\ShellComponents\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\firefox.exe\", \"C:\\Windows\\de-DE\\Idle.exe\", \"C:\\Program Files (x86)\\Google\\explorer.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\StartMenuExperienceHost.exe\", \"C:\\Windows\\ShellComponents\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\firefox.exe\", \"C:\\Windows\\de-DE\\Idle.exe\", \"C:\\Program Files (x86)\\Google\\explorer.exe\", \"C:\\PortFontnetCommon\\ComBroker.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\StartMenuExperienceHost.exe\""	ComBroker.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5124	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5148	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5172	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5196	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5220	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5244	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5268	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5292	5076	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5316	5076	schtasks.exe	101

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1904	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	ComBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	FATALITY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	FATALITY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 5 IoCs

pid	Process
3676	FATALITY.exe
2248	FATALITY.exe
5052	Umbral.exe
1352	Windows Defender.exe
2620	ComBroker.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox = "\"C:\\Users\\Public\\Pictures\\firefox.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\de-DE\\Idle.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Google\\explorer.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ComBroker = "\"C:\\PortFontnetCommon\\ComBroker.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\All Users\\StartMenuExperienceHost.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\ShellComponents\\dllhost.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\firefox = "\"C:\\Users\\Public\\Pictures\\firefox.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Google\\explorer.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ComBroker = "\"C:\\PortFontnetCommon\\ComBroker.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\All Users\\StartMenuExperienceHost.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\ShellComponents\\dllhost.exe\""	ComBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\de-DE\\Idle.exe\""	ComBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
69	drive.google.com
70	drive.google.com
71	drive.google.com
66	drive.google.com
68	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
211	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCFC9276F57544A69D8AF931C227A695.TMP	csc.exe
File created	\??\c:\Windows\System32\u9kzos.exe	csc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\explorer.exe	ComBroker.exe
File opened for modification	C:\Program Files (x86)\Google\explorer.exe	ComBroker.exe
File created	C:\Program Files (x86)\Google\7a0fd90576e088	ComBroker.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\de-DE\6ccacd8608530f	ComBroker.exe
File created	C:\Windows\ShellComponents\dllhost.exe	ComBroker.exe
File created	C:\Windows\ShellComponents\5940a34987c991	ComBroker.exe
File created	C:\Windows\de-DE\Idle.exe	ComBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	FATALITY.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	ComBroker.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\FATALITY crack.rar:Zone.Identifier	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5316	schtasks.exe
5124	schtasks.exe
3660	schtasks.exe
4876	schtasks.exe
2988	schtasks.exe
5220	schtasks.exe
5244	schtasks.exe
1680	schtasks.exe
4496	schtasks.exe
5172	schtasks.exe
5196	schtasks.exe
5268	schtasks.exe
552	schtasks.exe
1732	schtasks.exe
3452	schtasks.exe
5148	schtasks.exe
5292	schtasks.exe
4496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5052	Umbral.exe
5052	Umbral.exe
1904	powershell.exe
1904	powershell.exe
1904	powershell.exe
2800	powershell.exe
2800	powershell.exe
2800	powershell.exe
3016	powershell.exe
3016	powershell.exe
3016	powershell.exe
220	powershell.exe
220	powershell.exe
220	powershell.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe
2620	ComBroker.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	firefox.exe
Token: SeDebugPrivilege	1492	firefox.exe
Token: SeDebugPrivilege	1492	firefox.exe
Token: SeRestorePrivilege	1872	7zG.exe
Token: 35	1872	7zG.exe
Token: SeSecurityPrivilege	1872	7zG.exe
Token: SeSecurityPrivilege	1872	7zG.exe
Token: SeDebugPrivilege	5052	Umbral.exe
Token: SeIncreaseQuotaPrivilege	3676	wmic.exe
Token: SeSecurityPrivilege	3676	wmic.exe
Token: SeTakeOwnershipPrivilege	3676	wmic.exe
Token: SeLoadDriverPrivilege	3676	wmic.exe
Token: SeSystemProfilePrivilege	3676	wmic.exe
Token: SeSystemtimePrivilege	3676	wmic.exe
Token: SeProfSingleProcessPrivilege	3676	wmic.exe
Token: SeIncBasePriorityPrivilege	3676	wmic.exe
Token: SeCreatePagefilePrivilege	3676	wmic.exe
Token: SeBackupPrivilege	3676	wmic.exe
Token: SeRestorePrivilege	3676	wmic.exe
Token: SeShutdownPrivilege	3676	wmic.exe
Token: SeDebugPrivilege	3676	wmic.exe
Token: SeSystemEnvironmentPrivilege	3676	wmic.exe
Token: SeRemoteShutdownPrivilege	3676	wmic.exe
Token: SeUndockPrivilege	3676	wmic.exe
Token: SeManageVolumePrivilege	3676	wmic.exe
Token: 33	3676	wmic.exe
Token: 34	3676	wmic.exe
Token: 35	3676	wmic.exe
Token: 36	3676	wmic.exe
Token: SeIncreaseQuotaPrivilege	3676	wmic.exe
Token: SeSecurityPrivilege	3676	wmic.exe
Token: SeTakeOwnershipPrivilege	3676	wmic.exe
Token: SeLoadDriverPrivilege	3676	wmic.exe
Token: SeSystemProfilePrivilege	3676	wmic.exe
Token: SeSystemtimePrivilege	3676	wmic.exe
Token: SeProfSingleProcessPrivilege	3676	wmic.exe
Token: SeIncBasePriorityPrivilege	3676	wmic.exe
Token: SeCreatePagefilePrivilege	3676	wmic.exe
Token: SeBackupPrivilege	3676	wmic.exe
Token: SeRestorePrivilege	3676	wmic.exe
Token: SeShutdownPrivilege	3676	wmic.exe
Token: SeDebugPrivilege	3676	wmic.exe
Token: SeSystemEnvironmentPrivilege	3676	wmic.exe
Token: SeRemoteShutdownPrivilege	3676	wmic.exe
Token: SeUndockPrivilege	3676	wmic.exe
Token: SeManageVolumePrivilege	3676	wmic.exe
Token: 33	3676	wmic.exe
Token: 34	3676	wmic.exe
Token: 35	3676	wmic.exe
Token: 36	3676	wmic.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	2800	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	220	powershell.exe
Token: SeDebugPrivilege	2620	ComBroker.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1872	7zG.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
224	OpenWith.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe
1492	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 1492	688	firefox.exe	83
PID 688 wrote to memory of 1492	688	firefox.exe	83
PID 688 wrote to memory of 1492	688	firefox.exe	83
PID 688 wrote to memory of 1492	688	firefox.exe	83
PID 688 wrote to memory of 1492	688	firefox.exe	83
PID 688 wrote to memory of 1492	688	firefox.exe	83
PID 688 wrote to memory of 1492	688	firefox.exe	83
PID 688 wrote to memory of 1492	688	firefox.exe	83
PID 688 wrote to memory of 1492	688	firefox.exe	83
PID 688 wrote to memory of 1492	688	firefox.exe	83
PID 688 wrote to memory of 1492	688	firefox.exe	83
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 2884	1492	firefox.exe	84
PID 1492 wrote to memory of 3112	1492	firefox.exe	85
PID 1492 wrote to memory of 3112	1492	firefox.exe	85
PID 1492 wrote to memory of 3112	1492	firefox.exe	85
PID 1492 wrote to memory of 3112	1492	firefox.exe	85
PID 1492 wrote to memory of 3112	1492	firefox.exe	85
PID 1492 wrote to memory of 3112	1492	firefox.exe	85
PID 1492 wrote to memory of 3112	1492	firefox.exe	85
PID 1492 wrote to memory of 3112	1492	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1156	attrib.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbGhTdHNhbVFfaWpWbG9jcWhzRVZTLU12MWM0QXxBQ3Jtc0tteFo2ekR5NFpwcVNlSzR6djR2dG9neGJubkdtU1lRZzRpajZ0eDBfREF1Ymt0MmFsd1JwcUM2TlhWUlc5UndLZ2pabTVHa2tCRzRTeHpjQzVGQkViYVdTMjQ2Nkk3Q0d3SFRTLVAwaDFVcGRicWlBYw&q=https%3A%2F%2Fdrive.google.com%2Ffile%2Fd%2F1ejmrB0CjyRUyAo46MJfZzz2ibuuOqlRA%2Fview%3Fusp%3Dsharing"
1⤵
- Suspicious use of WriteProcessMemory
PID:688
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbGhTdHNhbVFfaWpWbG9jcWhzRVZTLU12MWM0QXxBQ3Jtc0tteFo2ekR5NFpwcVNlSzR6djR2dG9neGJubkdtU1lRZzRpajZ0eDBfREF1Ymt0MmFsd1JwcUM2TlhWUlc5UndLZ2pabTVHa2tCRzRTeHpjQzVGQkViYVdTMjQ2Nkk3Q0d3SFRTLVAwaDFVcGRicWlBYw&q=https%3A%2F%2Fdrive.google.com%2Ffile%2Fd%2F1ejmrB0CjyRUyAo46MJfZzz2ibuuOqlRA%2Fview%3Fusp%3Dsharing
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 25753 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f05f68b4-a0a9-4f3b-9da9-ffd474686098} 1492 "\\.\pipe\gecko-crash-server-pipe.1492" gpu
    3⤵
    PID:2884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2416 -prefsLen 26673 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b5a3913-da91-4a26-813e-08cbd9b0ecc1} 1492 "\\.\pipe\gecko-crash-server-pipe.1492" socket
    3⤵
    PID:3112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3092 -childID 1 -isForBrowser -prefsHandle 3264 -prefMapHandle 3280 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bde21ea3-0489-4a4e-aea7-8173ab9b0119} 1492 "\\.\pipe\gecko-crash-server-pipe.1492" tab
    3⤵
    PID:2484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3712 -childID 2 -isForBrowser -prefsHandle 3624 -prefMapHandle 3356 -prefsLen 31163 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ebfaca0-e4fa-4f5a-ab56-52841003d11d} 1492 "\\.\pipe\gecko-crash-server-pipe.1492" tab
    3⤵
    PID:4796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4664 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4632 -prefMapHandle 4680 -prefsLen 31163 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef21711a-8148-4be0-bf98-cce925cc0769} 1492 "\\.\pipe\gecko-crash-server-pipe.1492" utility
    3⤵
    - Checks processor information in registry
    PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 3 -isForBrowser -prefsHandle 5616 -prefMapHandle 5612 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26e98b47-31a1-4308-b71c-6dcb4cce5db9} 1492 "\\.\pipe\gecko-crash-server-pipe.1492" tab
    3⤵
    PID:1668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 4 -isForBrowser -prefsHandle 5628 -prefMapHandle 5624 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {516154b0-1044-4867-8541-c8a8e4b618aa} 1492 "\\.\pipe\gecko-crash-server-pipe.1492" tab
    3⤵
    PID:4936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6004 -childID 5 -isForBrowser -prefsHandle 5724 -prefMapHandle 5932 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afbdd942-fa6e-4cd0-b6eb-3ef05a758ef0} 1492 "\\.\pipe\gecko-crash-server-pipe.1492" tab
    3⤵
    PID:4940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2976 -childID 6 -isForBrowser -prefsHandle 3612 -prefMapHandle 3168 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3c16644-e5a7-4e5f-a80c-fc78a8e08a5f} 1492 "\\.\pipe\gecko-crash-server-pipe.1492" tab
    3⤵
    PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3468 -childID 7 -isForBrowser -prefsHandle 3200 -prefMapHandle 5968 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38f293dc-7b79-4a4f-a09a-e7f03150c6b6} 1492 "\\.\pipe\gecko-crash-server-pipe.1492" tab
    3⤵
    PID:4104

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4016

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\FATALITY crack\" -spe -an -ai#7zMap16634:90:7zEvent3415
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1872

C:\Users\Admin\Downloads\FATALITY crack\FATALITY.exe
"C:\Users\Admin\Downloads\FATALITY crack\FATALITY.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3676
- C:\Users\Admin\AppData\Local\Temp\FATALITY.exe
  "C:\Users\Admin\AppData\Local\Temp\FATALITY.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  PID:2248
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\PortFontnetCommon\jnh1y.vbe"
    3⤵
    - Checks computer location settings
    PID:1648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\PortFontnetCommon\IOEmPpqly1DOIlscl2iPO8G0g.bat" "
      4⤵
      PID:4396
    - - C:\PortFontnetCommon\ComBroker.exe
        
        "C:\PortFontnetCommon/ComBroker.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\myn4jasq\myn4jasq.cmdline"
        6⤵
        Drops file in System32 directory
        
        PID:3064
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A49.tmp" "c:\Windows\System32\CSCFC9276F57544A69D8AF931C227A695.TMP"
        7⤵
        
        PID:984
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HteyCODaO8.bat"
        6⤵
        
        PID:5360
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:5420
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:5436
- C:\Users\Admin\AppData\Local\Temp\Umbral.exe
  "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3676
- - C:\Windows\SYSTEM32\attrib.exe
    "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Views/modifies file attributes
    PID:1156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:220
- C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe"
  2⤵
  - Executes dropped EXE
  PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\All Users\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\ShellComponents\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\ShellComponents\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\ShellComponents\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\firefox.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Users\Public\Pictures\firefox.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\firefox.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\de-DE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\de-DE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComBrokerC" /sc MINUTE /mo 9 /tr "'C:\PortFontnetCommon\ComBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComBroker" /sc ONLOGON /tr "'C:\PortFontnetCommon\ComBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComBrokerC" /sc MINUTE /mo 10 /tr "'C:\PortFontnetCommon\ComBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PortFontnetCommon\ComBroker.exe

Filesize
2.0MB

MD5
2af56288ae70824c48341954c6817df4

SHA1
36a4df878adc348e12ab01d8cee1b730f234158f

SHA256
08cd9bdbfd747ca0b60186b1c6d8a27c892cb6e3ee1e7e857302b881e8a6d125

SHA512
9469cec69704dccad5c6648af3722c98b2aa3e63ff549b4dd821470c6624e6aee1ddecfc4f4e0feb5f967c8110439b347717f98fc09f8664cef4e4f179199dcb

Download Submit
C:\PortFontnetCommon\IOEmPpqly1DOIlscl2iPO8G0g.bat

Filesize
77B

MD5
8a8897cb275aec7987c9fea337dbb5d7

SHA1
cacad156f59892d6070327926560ab0a5fc737da

SHA256
41ec477f48bcce425a660de22536aa3b0fde43560f13158e91d00732185d46a6

SHA512
0c2e8d66062b525a766545f82cf96808b40b307c2b8e478afd2fc1bb5ea8535a83b0b00bafb10af467bd937513d8713e6672b21955551beb33e62d45984092cc

Download Submit
C:\PortFontnetCommon\jnh1y.vbe

Filesize
220B

MD5
8bd8bfc27a2ccc45fc9bb7c3908de480

SHA1
40190bcef75e208709fabdac52efdfea410a6fa9

SHA256
0b6cb03c8b7f3adc721771d9b0f2453f7c983851d3621a6a620b8dbd76f9ba43

SHA512
2ce7ce7525bde10656c8539d1fb1fcbe3d8db693e05efaf6d24017766d623abd2414e7469df9b2d43aef3e4f24584628b7f0060efa51bbb42b0e9e270e76449a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
b0dc7c3718882fe730dbbc1b681bfc49

SHA1
03a9c793855b3fc4a82d48a70841ab547cfb9943

SHA256
05b199d4f0d7025646593db4f3d2a22a44e4e64438668d34ec6a3a31afe249bb

SHA512
c927720f5387ba226136b57bce9fb7f37917478d42a466aa9b175561bb5aae6837f82b3b45a3b285460cecffd40742302ce607c58dea83b8a8704eef783c9601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
276798eeb29a49dc6e199768bc9c2e71

SHA1
5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

SHA256
cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

SHA512
0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\activity-stream.discovery_stream.json.tmp

Filesize
21KB

MD5
92913e8733ecf4d372d3094c9a14e586

SHA1
4eeebc6ca04786c8baebe10f6ef4bbd9bf514c15

SHA256
385aed8bf857c6352570bb53d7e960547cf96ac6958ca2fe4ae4cce404b96d9f

SHA512
819ec723119bb14f3414824287a550587bae872d89e4bc472c3bd4523cf87a9a4ee93dc590f17330ea554021adafa4681e157c019d3ba86bfc293e32e41958bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\FATALITY.exe

Filesize
2.5MB

MD5
835f86f98a133e8bebd227594e9aff76

SHA1
3ebb6890c3f47ab0c906d958895a0d7db2de13d3

SHA256
73354fe6381e7678e3ee478c2c1e8bb21917c8de19e7218e5c4d241345831b29

SHA512
89f5a6a28794b4e414a9f95c44cdaf8e1b3998f668214de30716abd75dc32e526fe001aa5294bae5a44ae5e6274493191f3c2da8ba92fac1ab9f421cedecccc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\HteyCODaO8.bat

Filesize
222B

MD5
7337b5d1fb12c24729cffd49e98e1e17

SHA1
84c8407268a1a14381b35133daa798f23e8a0cff

SHA256
41b2aef8b98c9c2720d75e9355b22c5fc3484db4625e384a81f624bb97d1b235

SHA512
3022dcccb40801854f80621155ba67123f95b3358bd94b6d8466974be5c7f9c41298625a878059aaed3bbc9354bd28434bdf09db0d10bf4f4591eed7b01eb229

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8A49.tmp

Filesize
1KB

MD5
90e826320a9b0f62860406e986e982cc

SHA1
4acdeb76e2198a034b25662062f68ba850e70505

SHA256
2a345c004f5f4e7698c4ea36055de535f57e9aa1e7e50ed8f3ea609a1ad9cc19

SHA512
533b21e99dbff98808d0777d4b8c31d4a48b7a0321ee16ab91cbea5c28c95cd5d6efd9c87f4ad88cfcc3cd8d68b19645a03a82444b8294565c3dd0d6dea54a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
227KB

MD5
e7452f59f2853220a6db8b98e26a81d1

SHA1
730e6e1f5a6ee671b4be097843b08c242ef4e8fb

SHA256
a9f45987c45143e6c198ebb530c0df131cf1ce8d6b40f07128d22ed30a698f21

SHA512
22ac9f0951e0a7f32012b20335b464eb0b41609f5fbf8bc7ecacfbc3dcad73bfdaeac5695632b9f8005edd2066b2b79a01a743ce04f5847c76e4faff7b1291b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe

Filesize
490KB

MD5
fa3f84d3150dab7b7d8e35efbb8d02db

SHA1
5b690c0be18426633a1954844f49cee2b1e09cb7

SHA256
a42d5a457ee0d90dee5cb5ba969687a83ba5626abf040a2f3ed496f83456c162

SHA512
a4dd554461e167c6a272f8ca90bcde729c319a115419b2a8874af34241116afadf9e6a4dec7db5e145f7e5a1d98827f0a50861c862abb89de81c3f4703247f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0usfcdz3.ihv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\AlternateServices.bin

Filesize
8KB

MD5
bf862b87e20dfa7c62c8fc0514ab5a03

SHA1
823b7b55fad306432365132e56abe7ede35de7f6

SHA256
bd47b8fb8890033011a39b3543118e0c745dd8178673ef5c8e7c750d8d5b2f74

SHA512
0da060267f37bdcc3f39be9fd5bf9d882aafb5b8bf6adccfa41b92d53e2c490531734a7e17ef615e75e0b0470dff867910047064c3d0ac5f6b0d71a46a43079e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\AlternateServices.bin

Filesize
11KB

MD5
c07cca2017c5b0b882b9cbb56f328a64

SHA1
b3749a709bf3cf8fa83ce4df7d71644b823a9992

SHA256
68420c2e080b34e2079ef8c093bd5b163ae99395a17f30287a4d963470b99df0

SHA512
1a5cee437c302f0f45d2ebc470e2e957966594ec44ae99aa3f57512b87f924cf4d1b869ad15d95f2d8d6b6d4d77c04eea87458098579d5fa74d5ad9115dca6f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\AlternateServices.bin

Filesize
28KB

MD5
58abdc0429f3940e29835254b5072b72

SHA1
22c769effa10fe9f862e4293121f6e08632f406c

SHA256
1ae418e6569ec2d8d6cea1f43e79af6992b85768276f8acc45afe7aaefaaa7ae

SHA512
41ec733ee29f5dd5b90eb3a706e27b0c5830ac822ada05ed3a10196f1a3be1336ca20b59baf2cc568bfc5d931a1c0bac9558561ba64fab1cd7c994fdb0fbfc89

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
7da31ea4a14bad7e0b2a6d712ca31a66

SHA1
5b53be204ede511cad43d1bc6b8416269989a9dd

SHA256
0c8955a44de0c57e6c4e92fefc187381403132fd6a981f16a8cec2106581edb8

SHA512
4b81d50722f64317bc5df13b65e59abdc032dcb42617a162fd2da9df62d738ca402369a6ece8f234875c1fac2e63026d78240b9836786d9e05db241ca984c5d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
28082bf50f6c4e4866961c7918d34565

SHA1
6016cb263b5e31fe4fe2478b5ed9549e20494bec

SHA256
ad6871fc9d00f94bd2f793ce9caa57e618a5de2a49180b903f2b5be43392d2d4

SHA512
14438747b37b9d78016ed6956055c4d008495e94c0f814ea59153bc21abecbf7dce4a08b83296a70354224c50fb92d8b2e73a0ef00da72219b04147caa794379

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
194593f214ac77e05264b7c5453a897a

SHA1
d3c4a9c575bde2f1df68cb2f157daa5c9e7c8d8e

SHA256
3c3b0cef309fd205aab13cdf869337b4be63ad8132aad451c45b2c9a4957740d

SHA512
b9a7bf40f69a3bdec3d7153e9822fa971238e93e6691b354129905b4d3845bdcf02f9ca52fb60c2a6d08a2c4247263c344620bcbd20101d8c1f0c655a5fd778b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\a40a6c41-4fb2-4c37-8fe1-a4c6532728ae

Filesize
982B

MD5
911fab0778fa9bea4340ee76c76774d3

SHA1
da6042be30d4b6e326519bd4c8ab7998fe116e94

SHA256
bdb11cb8f901c265ec14601ba0c5a052bdd2bfad139ff890c29704d9b1cd3963

SHA512
492dcbd5a8f6f5a5d0eea052fc4e95beeee055ebed62b5792e8a4b4776a3107b687eb6df041dd34e1d217c57e9cc173b7cdad107f96d18b8f476aad382163fb6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\b970921c-b51c-40c2-ad4e-fdc2418fc2d6

Filesize
671B

MD5
851b15b358e9ac515023b42b7d3900ff

SHA1
13e02bcd042d375e62d144ed5361d86a1e9fea0d

SHA256
f5660e1200c40f75bba11d129d37d50cceeb6b48aac7b1af556cf560ceadae70

SHA512
859a1a40cddebae4ae71afdce752e803029c5cd23531a060cbe39345167f993a46d783137c8400fcf76e16b964d2084ead54ddb9259e6811525e2be61bc82d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\datareporting\glean\pending_pings\f08372c3-3a4c-4f5b-b430-ae05e9841868

Filesize
25KB

MD5
9c99a4a4c1af8ead4dc7a272bc9c8ff2

SHA1
3aac6430b6940992312d69c9abc82b9482b75a49

SHA256
70e874065b21b565080623166560e66d6335ffd3b163c730e830bf06b864e937

SHA512
9368ef7aad55452b22b62d281347f572a32450ae82746fefb9bf6bd5767e0dde5e3c18bba7c2a52d59e7c2d608fa9e9cff7ee0ba1f9c30011ab6c692d431a70f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs-1.js

Filesize
11KB

MD5
4f3c584ac9600bc7ab2fb1f12e92fe7f

SHA1
8a680cea00873225f371e55318f614898788b22d

SHA256
defe2f5506e68718f011d813acc2bc4cbe8ecd55baab33a627c7488fc8c712b7

SHA512
4256d51e12829e177331cb933f8638dd73f0cd83283715f441605030cedadf930facb6754423891db7216dfaa61db57d4525abae5e2798a2ea04692614a070b0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\prefs.js

Filesize
8KB

MD5
b41ad46f1f7f0568b7666bc2674e0fec

SHA1
acf21a772b72c222992817ef93e7814fc16d0389

SHA256
8a3ee5185f8a315f556c7d4d525e2fba51aa8b8371c78e928e1004812ce7585d

SHA512
3ce0c44318ff48d6b16061daf48f849ebc90159c2800a7d77290cc94e92df1b6766fb3dce1db45c04d89c87f904251e827f2967459a3e1601cb7e64771a08251

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vcc2x7ul.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
04e24fccf121c23fac1e73354e56fbd2

SHA1
38b23068dbed3cfe349f7c87932ed01ffc56a611

SHA256
d508dbf6e9ac1ccb01b1b766cffcf3c06a85beb2bd0eab9b54f5f76f6407b6a0

SHA512
77a4ffa270da0d4e3e60a3e0089c0c80939d78931d8ce9488b55743316500e994ae85e5feeda313836caacccf28859836404861fb7eec87b4f55ae9125870235

Download Submit
C:\Users\Admin\Downloads\FATALITY crack.QaUdU5He.rar.part

Filesize
2.3MB

MD5
2d9edb8b836a7d1d711d7e63b6896be8

SHA1
54a29663eb88d245bda7d9fbe71d6c3bd86e4e59

SHA256
48fa7c81eedbd5766d91bf8794b21a925e31a5d153a23acdec9138cf4781a540

SHA512
9beb4d1dc5e63a5e88072bd5829dca8eb4f6871622c0c0ded513028e3e3c52f048fae9128de316c1cb0f386cbd2f3e03640e2132955f033afb33faffeb779af2

Download Submit
C:\Users\Admin\Downloads\FATALITY crack\FATALITY.exe

Filesize
2.5MB

MD5
4320dae0d20c88ceb6f28b623a916dd2

SHA1
c1218c51804a602115462ea8259578fdbb280468

SHA256
441d4439cd72a239077d97895571804711356f1e1ded396c229635adf3c80ea4

SHA512
ee32e90d021835d608d43d3ee6d2d107fcfb15fa174c179ed4ae7dd47ec0dd45baadd1c73158c73d5e4fd7b89f5925ae505a6df66bb81e9d5693216316622fcf

Download Submit
C:\Users\Admin\Downloads\FATALITY crack\crack.pdb

Filesize
175KB

MD5
bba057869db12538db08489b52e24f8e

SHA1
1f97afcdb8e6efdde576f8341b9db6e928c901e8

SHA256
3f2ffba4d665d930671518bdf7ccd59e1d63c7c0ae568e98d7e379fc40c952d1

SHA512
b4d793425ded065683ae9910545b00dea7b581bdebee6d543ceebb78e2d121e4447daa33a70f2e1066b676bffb04f9fa13fac7afdf5c2b23b05d33b4bb9a6469

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\myn4jasq\myn4jasq.0.cs

Filesize
378B

MD5
01bee8af6f9744043ad1e374eb6bde04

SHA1
130ccd9cfaf393299596d86e1eeb6578dc7cf6e9

SHA256
684b0612ce560255e631dab53a570d7923e3630b9b1a9e3ad86aeefe23f3c20e

SHA512
8aabac497d9b756bbce9c19906726bb9fcaabacaf4bce5ef0c12e323168122274a10ef9fbe414e1aa2870bf9fe08df8e2e4e766f0af91ee4cfa37cd90e1c6ac7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\myn4jasq\myn4jasq.cmdline

Filesize
235B

MD5
ca5c801669007bc65a6c5294b9a97557

SHA1
cf251893c821725423e768399fd1fd4df5cd6d6c

SHA256
cdf593e20801a4aae1db288c95749d9abe88181522b6c1c4ad512cced4cf54d1

SHA512
e0d1046cb6a8d7976bee692ed7d77fe5a172ee7e0807f336644097f4d3f07c67ca6251fa334d4700eb0aefd63d31b5deb5a21bd160e6b5c3907bcb07b4cbe8b0

Download Submit
\??\c:\Windows\System32\CSCFC9276F57544A69D8AF931C227A695.TMP

Filesize
1KB

MD5
8dd28efa24161c95f66186f87013c172

SHA1
d39e29dec785bb67109ce4a6acaaac1613b96298

SHA256
8c39b597991e208b03dc19495c65b9a795ac982ac0aea89984cecab1cff0992c

SHA512
4b6f33df64e0fc0eb4a4cbe9f7d3ddaf826ab614c753c2edaa26d7037d0ff394b4adeb1f2437017ef1fc100415d8e42f5cd2167ceffc4626c7c4f6cecef696c4

Download Submit
memory/1352-618-0x0000000005030000-0x00000000050C2000-memory.dmp

Filesize
584KB

Download
memory/1352-617-0x0000000000730000-0x00000000007B0000-memory.dmp

Filesize
512KB

Download
memory/1352-619-0x0000000004F90000-0x0000000004FF6000-memory.dmp

Filesize
408KB

Download
memory/1904-637-0x0000022D6C070000-0x0000022D6C092000-memory.dmp

Filesize
136KB

Download
memory/2620-718-0x000000001B600000-0x000000001B60E000-memory.dmp

Filesize
56KB

Download
memory/2620-716-0x000000001B5B0000-0x000000001B5BE000-memory.dmp

Filesize
56KB

Download
memory/2620-706-0x0000000001260000-0x000000000126E000-memory.dmp

Filesize
56KB

Download
memory/2620-708-0x000000001B5C0000-0x000000001B5DC000-memory.dmp

Filesize
112KB

Download
memory/2620-710-0x000000001B5E0000-0x000000001B5F8000-memory.dmp

Filesize
96KB

Download
memory/2620-712-0x0000000002BA0000-0x0000000002BAE000-memory.dmp

Filesize
56KB

Download
memory/2620-714-0x000000001B5A0000-0x000000001B5AC000-memory.dmp

Filesize
48KB

Download
memory/2620-704-0x0000000000780000-0x0000000000980000-memory.dmp

Filesize
2.0MB

Download
memory/2620-749-0x000000001B7A0000-0x000000001B86D000-memory.dmp

Filesize
820KB

Download
memory/2620-720-0x000000001B610000-0x000000001B61C000-memory.dmp

Filesize
48KB

Download
memory/5052-696-0x00000184DAAF0000-0x00000184DAAFA000-memory.dmp

Filesize
40KB

Download
memory/5052-660-0x00000184DAB20000-0x00000184DAB3E000-memory.dmp

Filesize
120KB

Download
memory/5052-659-0x00000184DAEA0000-0x00000184DAEF0000-memory.dmp

Filesize
320KB

Download
memory/5052-658-0x00000184DADD0000-0x00000184DAE46000-memory.dmp

Filesize
472KB

Download
memory/5052-697-0x00000184DAB40000-0x00000184DAB52000-memory.dmp

Filesize
72KB

Download
memory/5052-615-0x00000184C0660000-0x00000184C06A0000-memory.dmp

Filesize
256KB

Download