Analysis

  • max time kernel
    95s
  • max time network
    289s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-09-2024 00:02

General

  • Target

    1725148829.119856_File.exe

  • Size

    7.5MB

  • MD5

    1facb48e71b030612dd4dd23040c699e

  • SHA1

    ac87f80408d31879417259c3ab9dde2c32f175f0

  • SHA256

    2c074fffbd47b3ed8129a7e9a4e350e7b9f6ce923f75b0166a8cb3e425e39e95

  • SHA512

    fc3b5601889bd6e5252c3cc2e1ccbfd47ecdbd401beda2687f557a87423157b5bea9df2a777ac77d29d0428bb26fe060889bf304d9c0062e41d8818db1e9d6e0

  • SSDEEP

    98304:8OWyk7cxZ0xjWoIOF/Oz+U8xJIhskAtpUacuxgGV2Tbs+unJsu5FFBN4W3:l7k7KawOJe+VDiiUajxgCusfnTFBN1

Malware Config

Extracted

Family

vidar

Version

10.8

Botnet

1f3c236c672ff2ffe017b396f834c66e

C2

http://147.45.68.138:80

https://steamcommunity.com/profiles/76561199761128941

https://t.me/iyigunl

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Extracted

Family

stealc

Botnet

default

C2

http://46.8.231.109

Attributes
  • url_path

    /c4754d4f680ead72.php

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

147.45.47.36:30035

Extracted

Family

stealc

Botnet

leva

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

lumma

C2

https://locatedblsoqp.shop/api

https://traineiwnqo.shop/api

https://condedqpwqm.shop/api

Signatures

  • Detect Vidar Stealer 5 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

    Run Powershell and hide display window.

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 19 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 12 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1725148829.119856_File.exe
    "C:\Users\Admin\AppData\Local\Temp\1725148829.119856_File.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3500
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:752
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:1984
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3560
          • C:\Users\Admin\Documents\iofolko5\bTk6z17ukjRsYPjToqllP1Iz.exe
            C:\Users\Admin\Documents\iofolko5\bTk6z17ukjRsYPjToqllP1Iz.exe
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4756
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              4⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:1128
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
              4⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:3668
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              4⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:4100
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
              4⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:404
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe delete "VIFLJRPW"
              4⤵
              • Launches sc.exe
              PID:2184
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe create "VIFLJRPW" binpath= "C:\ProgramData\xprfjygruytr\etzpikspwykg.exe" start= "auto"
              4⤵
              • Launches sc.exe
              PID:4716
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop eventlog
              4⤵
              • Launches sc.exe
              PID:2044
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe start "VIFLJRPW"
              4⤵
              • Launches sc.exe
              PID:2744
          • C:\Users\Admin\Documents\iofolko5\1uGU_PaYOd93mwdvO0pRZJq6.exe
            C:\Users\Admin\Documents\iofolko5\1uGU_PaYOd93mwdvO0pRZJq6.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1128
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
                PID:3136
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                • Checks computer location settings
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:1984
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminAKFHCAKJDB.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4944
                  • C:\Users\AdminAKFHCAKJDB.exe
                    "C:\Users\AdminAKFHCAKJDB.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:4192
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      7⤵
                      • System Location Discovery: System Language Discovery
                      • Checks processor information in registry
                      PID:4804
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminECBGHCGCBK.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2764
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    6⤵
                      PID:4888
                    • C:\Users\AdminECBGHCGCBK.exe
                      "C:\Users\AdminECBGHCGCBK.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:4876
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:4660
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 1364
                          8⤵
                          • Program crash
                          PID:3484
              • C:\Users\Admin\Documents\iofolko5\CH6wiprYnjjiLcQcurMqpLJ8.exe
                C:\Users\Admin\Documents\iofolko5\CH6wiprYnjjiLcQcurMqpLJ8.exe
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2344
                • C:\Users\Admin\Documents\iofolko5\CH6wiprYnjjiLcQcurMqpLJ8.exe
                  "C:\Users\Admin\Documents\iofolko5\CH6wiprYnjjiLcQcurMqpLJ8.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2392
              • C:\Users\Admin\Documents\iofolko5\tBmzHMAfN793ylri5IeghaV3.exe
                C:\Users\Admin\Documents\iofolko5\tBmzHMAfN793ylri5IeghaV3.exe
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5116
              • C:\Users\Admin\Documents\iofolko5\py_q9F9XhXBwexdoquFQoW9L.exe
                C:\Users\Admin\Documents\iofolko5\py_q9F9XhXBwexdoquFQoW9L.exe
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2484
                • C:\Users\Admin\AppData\Local\Temp\is-8V7HB.tmp\py_q9F9XhXBwexdoquFQoW9L.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-8V7HB.tmp\py_q9F9XhXBwexdoquFQoW9L.tmp" /SL5="$C01D8,3429829,54272,C:\Users\Admin\Documents\iofolko5\py_q9F9XhXBwexdoquFQoW9L.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:3556
                  • C:\Users\Admin\AppData\Local\Free Video Converter Max\videoconvertermax32_64.exe
                    "C:\Users\Admin\AppData\Local\Free Video Converter Max\videoconvertermax32_64.exe" -i
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4600
              • C:\Users\Admin\Documents\iofolko5\AY3U4Euxcxv9ydttoPDJ4yyd.exe
                C:\Users\Admin\Documents\iofolko5\AY3U4Euxcxv9ydttoPDJ4yyd.exe
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4192
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  4⤵
                    PID:4996
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:412
                    • C:\ProgramData\EGIIJDHCGC.exe
                      "C:\ProgramData\EGIIJDHCGC.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:1936
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:3136
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 1332
                          7⤵
                          • Program crash
                          PID:5000
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 1372
                          7⤵
                          • Program crash
                          PID:1444
                    • C:\ProgramData\DBKKFCBAKK.exe
                      "C:\ProgramData\DBKKFCBAKK.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:4636
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                          PID:828
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:2612
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AAKKFHCFIECA" & exit
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:4416
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /t 10
                          6⤵
                          • System Location Discovery: System Language Discovery
                          • Delays execution with timeout.exe
                          PID:432
                  • C:\Users\Admin\Documents\iofolko5\Jn6gHmXmfs6tHAhtqBqrADGy.exe
                    C:\Users\Admin\Documents\iofolko5\Jn6gHmXmfs6tHAhtqBqrADGy.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:4028
                    • C:\Users\Admin\Documents\iofolko5\Jn6gHmXmfs6tHAhtqBqrADGy.exe
                      "C:\Users\Admin\Documents\iofolko5\Jn6gHmXmfs6tHAhtqBqrADGy.exe"
                      4⤵
                      • Drops startup file
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:4424
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
                        5⤵
                        • System Location Discovery: System Language Discovery
                        • Scheduled Task/Job: Scheduled Task
                        PID:3840
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf LG" /sc ONLOGON /rl HIGHEST
                        5⤵
                        • System Location Discovery: System Language Discovery
                        • Scheduled Task/Job: Scheduled Task
                        PID:3736
                  • C:\Users\Admin\Documents\iofolko5\OXjlPcHMWw9IOxuKS5jSh7o5.exe
                    C:\Users\Admin\Documents\iofolko5\OXjlPcHMWw9IOxuKS5jSh7o5.exe
                    3⤵
                    • Executes dropped EXE
                    • Modifies system certificate store
                    PID:3668
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1848
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:436
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4944
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:60
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3224
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Liliafer'"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4836
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1948
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
                      4⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4896
                    • C:\Liliafer\msptjhkfda.exe
                      C:\Liliafer\msptjhkfda.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4888
                  • C:\Users\Admin\Documents\iofolko5\HR8iA61XqPfBph12_UX1aPyX.exe
                    C:\Users\Admin\Documents\iofolko5\HR8iA61XqPfBph12_UX1aPyX.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3656
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies system certificate store
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1288
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3136 -ip 3136
                1⤵
                  PID:1008
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3136 -ip 3136
                  1⤵
                    PID:3892
                  • C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
                    C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5016
                    • C:\Windows\system32\powercfg.exe
                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                      2⤵
                      • Power Settings
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4068
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        3⤵
                          PID:828
                      • C:\Windows\system32\powercfg.exe
                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                        2⤵
                        • Power Settings
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4236
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          3⤵
                            PID:4636
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                          2⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:708
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                          2⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4080
                        • C:\Windows\system32\conhost.exe
                          C:\Windows\system32\conhost.exe
                          2⤵
                            PID:736
                          • C:\Windows\system32\svchost.exe
                            svchost.exe
                            2⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4736
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4660 -ip 4660
                          1⤵
                            PID:1808

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Liliafer\msptjhkfda.exe

                            Filesize

                            1.2MB

                            MD5

                            35b8c1c64fe230be546ef57fc2402c09

                            SHA1

                            06a4298da56d14b37f051171463603cc43727f3a

                            SHA256

                            f5a0022c0b4669fa4a8f89fe75b0f230afc6e4d3c31bded8d6d4328fbb76d5bf

                            SHA512

                            18ce36ae35ec32963ddb92c9dc63a200e952d9b0e21e2dcca9878324c67294997fc394479d74af4b293cefc7a3ce993695bf8bcbfcf5088553c797b66e11b44b

                          • C:\ProgramData\AAKKFHCFIECA\FBFIJJ

                            Filesize

                            116KB

                            MD5

                            f70aa3fa04f0536280f872ad17973c3d

                            SHA1

                            50a7b889329a92de1b272d0ecf5fce87395d3123

                            SHA256

                            8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                            SHA512

                            30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                          • C:\ProgramData\AAKKFHCFIECA\KFCBAE

                            Filesize

                            114KB

                            MD5

                            3cfabadfcb05a77b204fe1a6b09a5c90

                            SHA1

                            f106b5ed22265e64bc61dc5cf1e2d33ed12ec18d

                            SHA256

                            693617c470d7472e751d872341061cfb663f22ee95bdb42f9db01f02cb90df9c

                            SHA512

                            d5502023a17213919e2e991f5ba2d0d2c08223fd489d876a47a37239b637d03ace9cb9b92deb71460ae4030194ca49ce9e9752e0bf2ccbcd297dc5afe62a4e7b

                          • C:\ProgramData\ECGDHDHJEBGHJKFIECBG

                            Filesize

                            11KB

                            MD5

                            1c2c324da992245af106bf761a855edf

                            SHA1

                            37e5796ed02a41a9815ea17bee2e9585d8e6546c

                            SHA256

                            d055e09d3e677766d727ac057991ecd25b7eeb417b418b3945ec32fd7bf883f3

                            SHA512

                            870e468a7ce5fef23df4a4434afd0e3ef84ba6fcc100922c96b6bb38399fce48c54f493d8188ec3f4de30acdfcbc9a1675ac5852aa1f58c1141015a3a2e37863

                          • C:\ProgramData\EGIIJDHCGC.exe

                            Filesize

                            383KB

                            MD5

                            463fa073a06a2d19d0a8395d94d12fb4

                            SHA1

                            257b18e3d4c1004afafce8c2ff7c604a459abef9

                            SHA256

                            48c76c428ef4e3e11a2ab4e3e0689465415d0c491179709c70f89067e096cd8f

                            SHA512

                            ccac763a4c8744fd6493822d3399fbf8066d5f0465004d20be92dde7ca6b47932b1d6988dde536e9a3d9ae58856ef1f9406909bca6215fe45f02294cc0121f63

                          • C:\ProgramData\GIJDGCAEBFII\BFBFBF

                            Filesize

                            40KB

                            MD5

                            a182561a527f929489bf4b8f74f65cd7

                            SHA1

                            8cd6866594759711ea1836e86a5b7ca64ee8911f

                            SHA256

                            42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

                            SHA512

                            9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

                          • C:\ProgramData\GIJDGCAEBFII\BFBFBF

                            Filesize

                            160KB

                            MD5

                            f310cf1ff562ae14449e0167a3e1fe46

                            SHA1

                            85c58afa9049467031c6c2b17f5c12ca73bb2788

                            SHA256

                            e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                            SHA512

                            1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                          • C:\ProgramData\GIJDGCAEBFII\FHCBGD

                            Filesize

                            20KB

                            MD5

                            a603e09d617fea7517059b4924b1df93

                            SHA1

                            31d66e1496e0229c6a312f8be05da3f813b3fa9e

                            SHA256

                            ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

                            SHA512

                            eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

                          • C:\ProgramData\freebl3.dll

                            Filesize

                            669KB

                            MD5

                            550686c0ee48c386dfcb40199bd076ac

                            SHA1

                            ee5134da4d3efcb466081fb6197be5e12a5b22ab

                            SHA256

                            edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

                            SHA512

                            0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

                          • C:\ProgramData\mozglue.dll

                            Filesize

                            593KB

                            MD5

                            c8fd9be83bc728cc04beffafc2907fe9

                            SHA1

                            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                            SHA256

                            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                            SHA512

                            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                          • C:\ProgramData\msvcp140.dll

                            Filesize

                            439KB

                            MD5

                            5ff1fca37c466d6723ec67be93b51442

                            SHA1

                            34cc4e158092083b13d67d6d2bc9e57b798a303b

                            SHA256

                            5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

                            SHA512

                            4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

                          • C:\ProgramData\nss3.dll

                            Filesize

                            2.0MB

                            MD5

                            1cc453cdf74f31e4d913ff9c10acdde2

                            SHA1

                            6e85eae544d6e965f15fa5c39700fa7202f3aafe

                            SHA256

                            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                            SHA512

                            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                          • C:\ProgramData\softokn3.dll

                            Filesize

                            34KB

                            MD5

                            0d30b26812fb8c2034fdc0745ea88f45

                            SHA1

                            9d343115c9dda2ba65586e050039c9c76bd661a2

                            SHA256

                            8b803d7d3573c69906b3b727b5371ac4b96716ec7da19f665e35d726b459b9eb

                            SHA512

                            766d22004a4875331941a16def585e394299bb55c09b10311b873a088fde727f2779948791947e6c2fa78efee21487f5ded52acae6ea05bceeaae546b2b81aea

                          • C:\ProgramData\vcruntime140.dll

                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                          • C:\Users\Admin\AppData\Local\Free Video Converter Max\videoconvertermax32_64.exe

                            Filesize

                            3.5MB

                            MD5

                            0451ab717fb9d85d548df23d0f3d0596

                            SHA1

                            4704da48917a13b6acfcc7ad18727b16bdef3274

                            SHA256

                            a6c3d2b564125c7fc51643e9f778e2404da45c2790a0d7f5d9f3bf8bb5acc35d

                            SHA512

                            8dd396656a8e7b09f81066f0c88ff3449c7ba02d34149f97f7021288366988478853266e62bbb93155e1ee660f939229f876eb6ff156aa78f13e80f6f60421b3

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                            Filesize

                            2KB

                            MD5

                            d85ba6ff808d9e5444a4b369f5bc2730

                            SHA1

                            31aa9d96590fff6981b315e0b391b575e4c0804a

                            SHA256

                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                            SHA512

                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AdminAKFHCAKJDB.exe.log

                            Filesize

                            425B

                            MD5

                            4eaca4566b22b01cd3bc115b9b0b2196

                            SHA1

                            e743e0792c19f71740416e7b3c061d9f1336bf94

                            SHA256

                            34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

                            SHA512

                            bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CH6wiprYnjjiLcQcurMqpLJ8.exe.log

                            Filesize

                            617B

                            MD5

                            99e770c0d4043aa84ef3d3cbc7723c25

                            SHA1

                            19829c5c413fccba750a3357f938dfa94486acad

                            SHA256

                            33c7dd4c852dae6462c701337f8e0a8647602847ccaee656fa6f1149cccfb5d5

                            SHA512

                            ba521e2f57d7e1db19445201948caa7af6d953e1c1340228934888f8ec05b8984ad492122d0bf0550b5e679614d8a713ecf68f91916ffa6e5d8f75bf003aae39

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8M42AOWL\sql[1].dll

                            Filesize

                            2.3MB

                            MD5

                            90e744829865d57082a7f452edc90de5

                            SHA1

                            833b178775f39675fa4e55eab1032353514e1052

                            SHA256

                            036a57102385d7f0d7b2deacf932c1c372ae30d924365b7a88f8a26657dd7550

                            SHA512

                            0a2d112ff7cb806a74f5ec17fe097d28107bb497d6ed5ad28ea47e6795434ba903cdb49aaf97a9a99c08cd0411f1969cad93031246dc107c26606a898e570323

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            Filesize

                            944B

                            MD5

                            77d622bb1a5b250869a3238b9bc1402b

                            SHA1

                            d47f4003c2554b9dfc4c16f22460b331886b191b

                            SHA256

                            f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                            SHA512

                            d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            Filesize

                            944B

                            MD5

                            34f595487e6bfd1d11c7de88ee50356a

                            SHA1

                            4caad088c15766cc0fa1f42009260e9a02f953bb

                            SHA256

                            0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

                            SHA512

                            10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            Filesize

                            944B

                            MD5

                            a2c8179aaa149c0b9791b73ce44c04d1

                            SHA1

                            703361b0d43ec7f669304e7c0ffbbfdeb1e484ff

                            SHA256

                            c1d30342a40a2b6e7553da30ceb85754d33820f6fbb3bbbed1ceb30d6390de4a

                            SHA512

                            2e201dd457d055baad86f68c15bcc7beb48d6dc2ffc10db7f304eb93f697e7b45991cbde857d25da2c9c60c23f3e13df8b5ed5809c1753737a23096e296cc9e3

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            Filesize

                            944B

                            MD5

                            d79d1bd60b7247fd284d8602d6e69c14

                            SHA1

                            597f223c49c70fe13d0b4e5440dd3b9a998c89e0

                            SHA256

                            45903c738ea99da02de9bc04177db4e702574ff7b8b448016f107b769079e553

                            SHA512

                            a3f38b9ac86f8c7a93129502bc4f08aee02eaee70f41fb602c34a1c76562b5cca314c15727e01a73643cf17f5337a7b8f98da379860d139aabbd68e485251b09

                          • C:\Users\Admin\AppData\Local\Temp\TmpA7A5.tmp

                            Filesize

                            2KB

                            MD5

                            1420d30f964eac2c85b2ccfe968eebce

                            SHA1

                            bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                            SHA256

                            f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                            SHA512

                            6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0dzynmyb.hzg.ps1

                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          • C:\Users\Admin\AppData\Local\Temp\is-3RR06.tmp\_isetup\_iscrypt.dll

                            Filesize

                            2KB

                            MD5

                            a69559718ab506675e907fe49deb71e9

                            SHA1

                            bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                            SHA256

                            2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                            SHA512

                            e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                          • C:\Users\Admin\AppData\Local\Temp\is-8V7HB.tmp\py_q9F9XhXBwexdoquFQoW9L.tmp

                            Filesize

                            680KB

                            MD5

                            38deb275b04a61c5837ef9597e066fcd

                            SHA1

                            c389def26f07be7c4f44e1d3b686ed52de401753

                            SHA256

                            346d652d50dd304ef8eafa8ffcc3b959363d006bb97a96caba169cde8c3cbc8e

                            SHA512

                            385a604f61e8a2c4dd1610a34361b1248491639961f891db509e45890457ff647c6305390ebfbde5a26ce29c748a87f422840d2935be2988d5aeb9bbfd95cb62

                          • C:\Users\Admin\Documents\iofolko5\1uGU_PaYOd93mwdvO0pRZJq6.exe

                            Filesize

                            269KB

                            MD5

                            68da26c2c1d0d040a86cc3910a40d287

                            SHA1

                            b374f418f3d086868f661ae2108a71e8eb70dcfa

                            SHA256

                            0904ef6ec1a22ab31adf07bb35bb0667603c574032da3e6004fb1592cea15b06

                            SHA512

                            09b0647bf8e9d01bb36cf90cc82ecd33d545586ffa7ef14bf903f796739bc1c3c0986aa0f71851407434fc215214acb082fd6e95a24ca027a1d51982a1841b08

                          • C:\Users\Admin\Documents\iofolko5\AY3U4Euxcxv9ydttoPDJ4yyd.exe

                            Filesize

                            252KB

                            MD5

                            19206462deb8093a24b063f75c0f88a0

                            SHA1

                            294b76a6e7dceadde162e682c69115151edd8d73

                            SHA256

                            a672db5e7e34e662bbf17075a2076dc0b3479f75a49982c77e575077813ace94

                            SHA512

                            426db34d5128e3071f766bf937b04959b90016448311789b97fb8b39d214f4129818e2b24e4c068eb3d1d1ef45be82bd16139f2db0eecb7c6d7b2c57001f06e8

                          • C:\Users\Admin\Documents\iofolko5\CH6wiprYnjjiLcQcurMqpLJ8.exe

                            Filesize

                            6.3MB

                            MD5

                            bd2891236510c953d469e346d092f0c7

                            SHA1

                            6409a3259b18ecf91d2ff6a43ff319c2f8158be2

                            SHA256

                            1cf403233a05fd6140f33df350f8edccf51eea02746c6ba4ab3e31b32b8bab44

                            SHA512

                            409abb8ce3382297bb669e7b7edfa44b0c2166831a6212223237245cba0595cf35592ec9755c839a69372bd0a4e96c74b98e7bca375a82b3e0707658d4b5802d

                          • C:\Users\Admin\Documents\iofolko5\HR8iA61XqPfBph12_UX1aPyX.exe

                            Filesize

                            375KB

                            MD5

                            1b4e6b62027f8ee24d3401c9ec96f672

                            SHA1

                            6bb4152446cd1ed5752f81f7ba4053b8e12d0852

                            SHA256

                            d30d079e3e347e11a8d8ebd5ec025367968147b52d47d15c61a7bc48e0fbeee2

                            SHA512

                            bf8a779100c87206018926bc077ffd23bdce02fe5f47518e528e747b0ed83f60972d98abdf618ac514f8ac87250488fe0cab7756bc11ba18686e0d45c1c0dffc

                          • C:\Users\Admin\Documents\iofolko5\Jn6gHmXmfs6tHAhtqBqrADGy.exe

                            Filesize

                            2.9MB

                            MD5

                            d4ac1a0d0504ab9a127defa511df833e

                            SHA1

                            9254864b6917eba6d4d4616ac2564f192626668b

                            SHA256

                            a29c9ebecbe58f11b98fa8f685619e46bbe0a73ca7f770a71a14051aa0bd9848

                            SHA512

                            59b707d1c4f3c66337ec2f913de4b3506786a31108fc621bdbe7201490e91b0f7b70505763f71d53eee0eaacf477dc6ef9cd50769881654daf1b678eaaf994c5

                          • C:\Users\Admin\Documents\iofolko5\OXjlPcHMWw9IOxuKS5jSh7o5.exe

                            Filesize

                            7.8MB

                            MD5

                            01a3155b62c88c17d864f9fd78745902

                            SHA1

                            ad629d70451330123fcd8c98e6a05406c4aea050

                            SHA256

                            82475d4397b6d833a0b170945b7fb607eb82e3609dc35dc51f04884be3a91155

                            SHA512

                            e61debb7a875414fa8af8baa28847fd852c719da94107e98a5209b96cd09dab99f3d291ddd7692b1074bf95a8d8e624423264d0ac524e9ff7a2e174acddc0a42

                          • C:\Users\Admin\Documents\iofolko5\bTk6z17ukjRsYPjToqllP1Iz.exe

                            Filesize

                            10.4MB

                            MD5

                            025ebe0a476fe1a27749e6da0eea724f

                            SHA1

                            fe844380280463b927b9368f9eace55eb97baab7

                            SHA256

                            2a51d50f42494c6ab6027dbd35f8861bdd6fe1551f5fb30bf10138619f4bc4b2

                            SHA512

                            5f2b40713cc4c54098da46f390bbeb0ac2fc0c0872c7fbdfdca26ab087c81ff0144b89347040cc93e35b5e5dd5dc102db28737baea616183bef4caecebfb9799

                          • C:\Users\Admin\Documents\iofolko5\py_q9F9XhXBwexdoquFQoW9L.exe

                            Filesize

                            3.5MB

                            MD5

                            fdcc68a75a0e43485921c995d7b30aa5

                            SHA1

                            904c066f7a5aa391a105de475fe0621ea9434a67

                            SHA256

                            350cdb47086ec6370f72779d1851953c3d12a91f0e6b59571be703a4538bbc48

                            SHA512

                            11df46188805f1b943c4e4885eabcd66aa146c222f6863e1110a964d7d313587dd7ad3558380152ddf62980160b4580c2ec9f497ab41b7ed48a5d46de0b8fdbd

                          • C:\Users\Admin\Documents\iofolko5\tBmzHMAfN793ylri5IeghaV3.exe

                            Filesize

                            1.7MB

                            MD5

                            4847d6885adc7ea78fdf9918c384cecb

                            SHA1

                            9eb0ce983f5a81300f18331b4899e03692fea6ef

                            SHA256

                            2954dec8276af3d7c60154c2afb2ae360d696c6a90eb779fd9e380848c6fd8cc

                            SHA512

                            e9b4d83425344b7137477105ee474c114f098d6c6e41d7bdfb47fb5902e32ba5c91ae9b9a3629dbad0ce4151bbf9d880c80dbfd5002d77da9ad88e8aa67f41fe

                          • memory/412-189-0x0000000000400000-0x0000000000641000-memory.dmp

                            Filesize

                            2.3MB

                          • memory/412-391-0x000000001FA60000-0x000000001FCBF000-memory.dmp

                            Filesize

                            2.4MB

                          • memory/412-362-0x0000000000400000-0x0000000000641000-memory.dmp

                            Filesize

                            2.3MB

                          • memory/412-191-0x0000000000400000-0x0000000000641000-memory.dmp

                            Filesize

                            2.3MB

                          • memory/412-187-0x0000000000400000-0x0000000000641000-memory.dmp

                            Filesize

                            2.3MB

                          • memory/412-361-0x0000000000400000-0x0000000000641000-memory.dmp

                            Filesize

                            2.3MB

                          • memory/1128-154-0x0000000000740000-0x0000000000788000-memory.dmp

                            Filesize

                            288KB

                          • memory/1288-258-0x0000000006930000-0x0000000006F48000-memory.dmp

                            Filesize

                            6.1MB

                          • memory/1288-433-0x0000000007830000-0x0000000007880000-memory.dmp

                            Filesize

                            320KB

                          • memory/1288-260-0x00000000063C0000-0x00000000063D2000-memory.dmp

                            Filesize

                            72KB

                          • memory/1288-249-0x0000000005C20000-0x0000000005C96000-memory.dmp

                            Filesize

                            472KB

                          • memory/1288-264-0x0000000006590000-0x00000000065DC000-memory.dmp

                            Filesize

                            304KB

                          • memory/1288-259-0x0000000006480000-0x000000000658A000-memory.dmp

                            Filesize

                            1.0MB

                          • memory/1288-219-0x00000000050B0000-0x00000000050BA000-memory.dmp

                            Filesize

                            40KB

                          • memory/1288-250-0x00000000062F0000-0x000000000630E000-memory.dmp

                            Filesize

                            120KB

                          • memory/1288-166-0x0000000000400000-0x0000000000452000-memory.dmp

                            Filesize

                            328KB

                          • memory/1288-261-0x0000000006420000-0x000000000645C000-memory.dmp

                            Filesize

                            240KB

                          • memory/1288-208-0x0000000004EE0000-0x0000000004F72000-memory.dmp

                            Filesize

                            584KB

                          • memory/1848-272-0x000001AE73310000-0x000001AE73332000-memory.dmp

                            Filesize

                            136KB

                          • memory/1936-515-0x00000000007C0000-0x0000000000824000-memory.dmp

                            Filesize

                            400KB

                          • memory/1984-217-0x0000000000400000-0x0000000000643000-memory.dmp

                            Filesize

                            2.3MB

                          • memory/1984-363-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                            Filesize

                            972KB

                          • memory/1984-220-0x0000000000400000-0x0000000000643000-memory.dmp

                            Filesize

                            2.3MB

                          • memory/2344-152-0x00000000053C0000-0x00000000055B2000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/2344-162-0x0000000005B60000-0x0000000006104000-memory.dmp

                            Filesize

                            5.6MB

                          • memory/2344-163-0x00000000050E0000-0x0000000005102000-memory.dmp

                            Filesize

                            136KB

                          • memory/2344-141-0x0000000000280000-0x00000000008CC000-memory.dmp

                            Filesize

                            6.3MB

                          • memory/2392-266-0x0000000009900000-0x0000000009966000-memory.dmp

                            Filesize

                            408KB

                          • memory/2392-170-0x0000000000400000-0x0000000000486000-memory.dmp

                            Filesize

                            536KB

                          • memory/2392-279-0x000000000A4C0000-0x000000000A682000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/2392-280-0x000000000ABC0000-0x000000000B0EC000-memory.dmp

                            Filesize

                            5.2MB

                          • memory/2484-127-0x0000000000400000-0x0000000000414000-memory.dmp

                            Filesize

                            80KB

                          • memory/2484-358-0x0000000000400000-0x0000000000414000-memory.dmp

                            Filesize

                            80KB

                          • memory/3500-1-0x00000000004F0000-0x0000000000C6A000-memory.dmp

                            Filesize

                            7.5MB

                          • memory/3500-2-0x0000000005640000-0x00000000056DC000-memory.dmp

                            Filesize

                            624KB

                          • memory/3500-3-0x000000007507E000-0x000000007507F000-memory.dmp

                            Filesize

                            4KB

                          • memory/3500-4-0x0000000075070000-0x0000000075820000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/3500-5-0x0000000005920000-0x0000000005D06000-memory.dmp

                            Filesize

                            3.9MB

                          • memory/3500-0-0x000000007507E000-0x000000007507F000-memory.dmp

                            Filesize

                            4KB

                          • memory/3500-6-0x0000000006F40000-0x00000000071F4000-memory.dmp

                            Filesize

                            2.7MB

                          • memory/3500-7-0x00000000050A0000-0x00000000050C2000-memory.dmp

                            Filesize

                            136KB

                          • memory/3500-14-0x0000000075070000-0x0000000075820000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/3556-359-0x0000000000400000-0x00000000004BA000-memory.dmp

                            Filesize

                            744KB

                          • memory/3560-108-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-110-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-125-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-102-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-8-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-28-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-15-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-13-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-11-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-17-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-18-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-19-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-24-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-20-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-112-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-119-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-121-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-10-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-16-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-106-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-21-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-104-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-22-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3560-23-0x0000000000400000-0x00000000005DF000-memory.dmp

                            Filesize

                            1.9MB

                          • memory/3656-157-0x00000000008D0000-0x0000000000934000-memory.dmp

                            Filesize

                            400KB

                          • memory/4028-168-0x0000000005800000-0x000000000599E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4028-142-0x0000000000840000-0x0000000000B32000-memory.dmp

                            Filesize

                            2.9MB

                          • memory/4028-161-0x0000000005600000-0x00000000057A0000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4192-164-0x0000000000C70000-0x0000000000CB4000-memory.dmp

                            Filesize

                            272KB

                          • memory/4424-209-0x0000000000400000-0x0000000000490000-memory.dmp

                            Filesize

                            576KB

                          • memory/4424-205-0x0000000000400000-0x0000000000490000-memory.dmp

                            Filesize

                            576KB

                          • memory/4424-207-0x0000000000400000-0x0000000000490000-memory.dmp

                            Filesize

                            576KB

                          • memory/4600-226-0x0000000000400000-0x0000000000786000-memory.dmp

                            Filesize

                            3.5MB

                          • memory/4600-441-0x0000000000400000-0x0000000000786000-memory.dmp

                            Filesize

                            3.5MB

                          • memory/4600-228-0x0000000000400000-0x0000000000786000-memory.dmp

                            Filesize

                            3.5MB

                          • memory/4756-257-0x00007FFDFDD90000-0x00007FFDFDD92000-memory.dmp

                            Filesize

                            8KB

                          • memory/4756-263-0x0000000140000000-0x0000000141999000-memory.dmp

                            Filesize

                            25.6MB

                          • memory/4888-483-0x00000000007D0000-0x0000000000B8B000-memory.dmp

                            Filesize

                            3.7MB

                          • memory/4888-472-0x00000000007D0000-0x0000000000B8B000-memory.dmp

                            Filesize

                            3.7MB

                          • memory/5116-256-0x0000000000C30000-0x00000000012B5000-memory.dmp

                            Filesize

                            6.5MB

                          • memory/5116-132-0x0000000000C30000-0x00000000012B5000-memory.dmp

                            Filesize

                            6.5MB