umbral | c6392bea9c75d83d876ff39febeae79cac1750a23e307accc274f1d92419f655

Analysis

max time kernel
145s
max time network
266s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11111.txt
Size

39B
MD5

d9c00e0b63309eef99355c943f7d58f3
SHA1

fe5f685b95ea6190dd1b3e109f53ed844f79d7e1
SHA256

c6392bea9c75d83d876ff39febeae79cac1750a23e307accc274f1d92419f655
SHA512

ea79835f0cada5043491d986cd2146e7c0890476b9c683d26e0a628887383b63aee4374bf8eb8fa4727fe377a0bf666bd7767a270cef966ec5b52f63c42616a2

Score

10^/10

umbral xworm discovery execution persistence rat stealer trojan

Malware Config

Extracted

Family

xworm

connection-arizona.gl.at.ply.gg:65211

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Extracted

Family

umbral

https://discord.com/api/webhooks/1249007779272982548/JNrfEnOEk9T5Uy5CL9Eht-UTb749aNfK8MBYreIOGClZHBASVuqcHQsf1pCugOHPrnQu

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000019c85-325.dat	family_umbral
behavioral1/memory/1764-327-0x0000000001280000-0x00000000012C0000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000196d2-259.dat	family_xworm
behavioral1/memory/2692-261-0x00000000009B0000-0x00000000009E0000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2748	powershell.exe
2292	powershell.exe
2624	powershell.exe
2244	powershell.exe
872	powershell.exe
308	powershell.exe
3028	powershell.exe
1352	powershell.exe

Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 5 IoCs

pid	Process
2072	RTC_launcher.exe
2240	RTC-launcher.exe
1216	svchost.sfx.exe
2316	RTC_Launcher.exe
2692	svchost.exe

Loads dropped DLL 5 IoCs

pid	Process
1912	chrome.exe
448	chrome.exe
2028	chrome.exe
2072	RTC_launcher.exe
2240	RTC-launcher.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
42	discord.com
43	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1736	cmd.exe
2608	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1588	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1080	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2608	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1472	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1912	chrome.exe
1912	chrome.exe
308	powershell.exe
3028	powershell.exe
1352	powershell.exe
2244	powershell.exe
2692	svchost.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1200	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeDebugPrivilege	2692	svchost.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeDebugPrivilege	2316	RTC_Launcher.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeDebugPrivilege	308	powershell.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2692	svchost.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeDebugPrivilege	1200	taskmgr.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe
Token: SeShutdownPrivilege	1912	chrome.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1912	chrome.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe
1200	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2692	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 660	1912	chrome.exe	31
PID 1912 wrote to memory of 660	1912	chrome.exe	31
PID 1912 wrote to memory of 660	1912	chrome.exe	31
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2656	1912	chrome.exe	33
PID 1912 wrote to memory of 2704	1912	chrome.exe	34
PID 1912 wrote to memory of 2704	1912	chrome.exe	34
PID 1912 wrote to memory of 2704	1912	chrome.exe	34
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35
PID 1912 wrote to memory of 280	1912	chrome.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2952	attrib.exe

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\11111.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7d99758,0x7fef7d99768,0x7fef7d99778
  2⤵
  PID:660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1100 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:2
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:8
  2⤵
  PID:280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2240 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2248 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3220 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:2
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1304 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3464 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2776 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3836 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3788 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:8
  2⤵
  PID:308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4028 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:8
  2⤵
  - Loads dropped DLL
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2472 --field-trial-handle=1372,i,11455687357779369133,5677000901753052643,131072 /prefetch:8
  2⤵
  - Loads dropped DLL
  PID:2028
- C:\Users\Admin\Downloads\RTC_launcher.exe
  "C:\Users\Admin\Downloads\RTC_launcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2072
- - C:\Users\Admin\AppData\Roaming\RTC-launcher.exe
    "C:\Users\Admin\AppData\Roaming\RTC-launcher.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2240
  - - C:\Users\Admin\AppData\Roaming\svchost.sfx.exe
      "C:\Users\Admin\AppData\Roaming\svchost.sfx.exe"
      4⤵
      Executes dropped EXE
      PID:1216
    - - C:\Users\Admin\AppData\Roaming\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2692
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:308
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\pwvylr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pwvylr.exe"
        6⤵
        
        PID:1764
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        7⤵
        
        PID:1040
        
        C:\Windows\system32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\pwvylr.exe"
        7⤵
        Views/modifies file attributes
        
        PID:2952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\pwvylr.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        7⤵
        
        PID:756
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        7⤵
        
        PID:2388
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        7⤵
        
        PID:2268
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        7⤵
        
        PID:1400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2624
        
        C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:1588
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\pwvylr.exe" && pause
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1736
        
        C:\Windows\system32\PING.EXE
        
        ping localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2608
  - - C:\Users\Admin\AppData\Roaming\RTC_Launcher.exe
      "C:\Users\Admin\AppData\Roaming\RTC_Launcher.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2316

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2044

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1200

C:\Windows\system32\taskeng.exe
taskeng.exe {C3C56B96-6A4B-4977-9196-C9646395447A} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]
1⤵
PID:1704
- C:\Users\Admin\AppData\Roaming\svchost.exe
  C:\Users\Admin\AppData\Roaming\svchost.exe
  2⤵
  PID:1216

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000007.log

Filesize
4KB

MD5
16d083d8c348ffe5b0b2ce13c48e5bbc

SHA1
55813e09d2487239aa27052e923e62068001b752

SHA256
4db544ac4f1e46c10c71fb20c549e851ff991c95a58dc2acfe63d51df3410936

SHA512
8548179183cd75982e0e9642bb869563a6bea3ab52e4dbdcd3c28ad75db4d31067117779eb459eba704de2f931ea804a4b5038393d08457a88a1c871bc509e36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
9125188f88f2183c534572d394a1eb55

SHA1
8b7ff4f782407bb234812cfddc92725cd768c7be

SHA256
40870aa22c61cd3b081d3e48203934ad483defc028644583facc29b6949bf643

SHA512
d4c432bf7cc6c4990f8c74efd740f194c1b92b8a0e3ad7e0f395b62c25047fde0d5aea8b046bd49c0af6b35eb934d5bf760b0e49673913936db63f635ca14579

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
987B

MD5
a9aa4736ac8d522c47a8b4ed6bafc731

SHA1
c6d9eba912e48743707b77bcab8a753cfe095f26

SHA256
b9c5d26db34f3373dfe2a377716ccfe836d0da3a770b2f83c73d8badf93c141e

SHA512
c6119de4aa913027ba281e9c55731e0fa59e8117e4f71638a4ab766dba0e84bc085c43f0ad0ed0b8e8b5db615f5bcf7aba11cbe6b7e2cd869ba491753ed78a42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
e01672dca1182300c14c814b65b2e15a

SHA1
9d5cef1557c030cf84482fe88d6c33fef73dd2ff

SHA256
81ed3030e4769813ac647be76047c42dbe3d3b937137298dfd60a0a3f5193bfe

SHA512
7ee1f3e8e67ba04ac5f9ce8393b2ef5b3de015a57808efe9c91094230a3a3884b3d3dfacd7aea1c6389539f10a3797bb5eaa9eb3219c14c55c2db9be8673dede

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
4f61cb55c30a49f1064047729da9888e

SHA1
e34bc3ada56d71a2b60f05d6c4f4bc3e640bdfab

SHA256
d20c6ecd8cac678ccb0bf09dc6e5d9bf76190f0fdc619ab006aa0e269fac1451

SHA512
a449197beb35173b88651d63e96e412ebf197c303e9d64a88e01dc3bd00684818554b65891fd6614c8b04d912ea8368501eab67ad618b9f5826ad89b35f7cb94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
d3e34e9e1a4b427fe926c8221832231f

SHA1
d495e68a353ded98d62b85fb4bf3110993b930a3

SHA256
79466a8effd09dcf9ef9087578d81cc6e5620c20e040fbcfcd92b2a71b0eea80

SHA512
ff81540102ccbbcc25eadeba224550d7fb99388983a1bb678c861b6ff85c5775a76d68e5be65aab841fcea9a4f2ef0013859232585a12ff9021e8fbf2211e57d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000008.ldb

Filesize
1KB

MD5
692863620c1d22a00ab5c7bf7d068885

SHA1
c6ca3d53acff2b0b7cf59c560029f6219991415e

SHA256
60e65d2fe95ae442ecf1880c5d4d763221f93cf38d7e515183bb0926218b0eaf

SHA512
95ad027926a679d4ffde5715aff9e20da58fbd50fc83f64d9e9a545b62cf668dec4e6ef9362e7883e654d6033a076ca6d098a6063b872e5fb24d0eae082b71c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000009.log

Filesize
2KB

MD5
67494599343a36e4f5c2775d7a0d2886

SHA1
e55326c0f0897737b46098f561c77510ee45cd49

SHA256
4da04bed9f6416857259ba411ed861d836c20b1b0cddab6a8a7d86042920d8f8

SHA512
dd4cfe2077980b39d0af6d63ccda2106731332ce1060d13fd09d7de492c6c012bfa18e4e33033ef9774978d9a8ce0ae9d2da51ee6a7aa365d60667347c6848ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
310KB

MD5
ac7cd21889e67358b78ac2cec3ed5d6a

SHA1
ff4a6e5b6adadbe7b6c5842779f3942594ee2e2c

SHA256
30b25c2fd10e63be95ed0889b38ee6b75216e00da6c439a3011150110fe70001

SHA512
065e6156e18dd223ef731410fea157a98a80a7a12297de39fba4eb606a54f4e07f4748f3039d76f1a8803b8c237217dc917b6e60c30c2b76e783a9927037d797

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B86.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B99.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwvylr.exe

Filesize
229KB

MD5
4bc09295bb5cf98d5e3df87fc1a2ed72

SHA1
c59cbee06c84683e59788df06c97f642ac1a402b

SHA256
9a7ba8617514eec0bc69b27fe7f105b8c5be4de6ae8e92be724c6d27b3f857ea

SHA512
a2643afeeb9e5e65ebe9a9e342b4a0d8def545ed2cb1d2e6ed76a3d6d87ed6b4858b316df1e31d70225c2a03557e14e1badb3cc74942f9f27f15285f19c77c63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XDL249F4RDWQ6JVSM7B8.temp

Filesize
7KB

MD5
d4668dace13f3552dc04e3e373ab8c18

SHA1
9a198174285b6e1b4ffd1f697cfeef8d7adc2bf2

SHA256
503972ef9ddc7d78ca3f6dfe7c79fc8c69d3b60b0e6fd6a8d09e7caf2c92922d

SHA512
fab08c766be5146e9834b7e0113c1cb0b132baf3f6142c6577ac86f11c4e4828daf15a21c85b4134ad74655ae377b146a833d9990d1e063a87ffd10e798d6cae

Download Submit
C:\Users\Admin\AppData\Roaming\RTC-launcher.exe

Filesize
1.2MB

MD5
bfe20aac9317925bcd8621db0946384c

SHA1
c739dfce077121bf2f7614210173966b9731cabd

SHA256
2d6d57ffff1c26183290ee15d1663283b98fba8c8981b00409bca5ccce49ee54

SHA512
3e82fe9df6e037911b6d73bbc38241fd25f96fa1047eafefa543a72e9ea7fa35e232a0e165c39ac5cc4fa864b439743d755545964347b6f9b3b39003dd1d4cb4

Download Submit
C:\Users\Admin\AppData\Roaming\RTC_Launcher.exe

Filesize
758KB

MD5
cb1929328dea316fcb34f3486697d16e

SHA1
8c2db8d4b4644cb356a9283b2fa7bb6a988a5d7b

SHA256
7a3deffc327b1e49cbc95dc4c41f1f4c0fd55825cc7c18fd06b96a900e0bf5f9

SHA512
90ef1cc19c01c1c0b2b4b802e88d622ff07ffc91273350200cd0589e6acabb63634af2883f6cae554dacab0f401b4294d13291707507c6fa035c282214fc6a28

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
170KB

MD5
b4a592662f351fa139e2b2dbaacb6536

SHA1
effc55d139ca4b4fdd4bccce9c754661b626e624

SHA256
fae2b33e66e3f661f9ec876e263014cb89e97a66fff8eab2d311fc3ca8b1ec4c

SHA512
b31091654adc567b2fddf6e5a1e8f4f2f902d7a9471462070e0b6f5dea65a7bbc1424ddd7e1b618122bcb3310cb6b9e75a09b35e31f6fa50b4d6c563d7952c38

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
577f27e6d74bd8c5b7b0371f2b1e991c

SHA1
b334ccfe13792f82b698960cceaee2e690b85528

SHA256
0ade9ef91b5283eceb17614dd47eb450a5a2a371c410232552ad80af4fbfd5f9

SHA512
944b09b6b9d7c760b0c5add40efd9a25197c22e302c3c7e6d3f4837825ae9ee73e8438fc2c93e268da791f32deb70874799b8398ebae962a9fc51c980c7a5f5c

Download Submit
\Users\Admin\AppData\Roaming\svchost.sfx.exe

Filesize
505KB

MD5
0326c9fc30cea37fc3f9dfdc9c017260

SHA1
ef2548189632d87afef60c6c5c322daf95a6fe6a

SHA256
d88cd37c5dee7ef1a3bd7836150cfb63bee3ba792a71c08685fda46f31f1b9d5

SHA512
e7d256931d32502691c8ef9e54ac448b1b38d9574ae78dfcca6764fd3a653b175e01143cfb46f70af662bd8ee1c7521942a4d9dcfd8285e225bf732c4fc8ef7a

Download Submit
\Users\Admin\Downloads\RTC_launcher.exe

Filesize
1.5MB

MD5
e0e2f56b736c375d82c1668267f3fed4

SHA1
dd92ef585431f4d4295f05f04a044f84ab799b87

SHA256
2eef3ef0c91c8783544a4ea58131804dce6024fe5569ebdd1a497e0750693d54

SHA512
96ae6a0c5aa214bedc191c8eeb47c7bd17538387456d8af86680aaadf93cb3d2eb07c1714b3a597109789424584b52146ada4b67f9c04aec067c854caec30b68

Download Submit
memory/308-271-0x0000000002A70000-0x0000000002A78000-memory.dmp

Filesize
32KB

Download
memory/308-270-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/1200-303-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1200-317-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1200-316-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1200-315-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1200-302-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1764-327-0x0000000001280000-0x00000000012C0000-memory.dmp

Filesize
256KB

Download
memory/2044-386-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2044-368-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2044-385-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2044-395-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2044-396-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2044-397-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2316-252-0x0000000000C90000-0x0000000000D54000-memory.dmp

Filesize
784KB

Download
memory/2692-261-0x00000000009B0000-0x00000000009E0000-memory.dmp

Filesize
192KB

Download
memory/3028-277-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/3028-278-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download