quasar | 8a31693ddf8924f144ba19a8802766188bd13f1ed7eea7c226eb0e01a9e47685

Analysis

max time kernel
514s
max time network
518s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
17-11-2024 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PORQUEPUTASYANOSIRVE.7z
Size

923KB
MD5

d757d40193d311216967491e36fc2ba4
SHA1

2dd90fa74c489da4f85bdf301053230b480a31fa
SHA256

8a31693ddf8924f144ba19a8802766188bd13f1ed7eea7c226eb0e01a9e47685
SHA512

9be26ab222457605eea0c42a4dbcfa80154cb384e6abf0db6a010fcca172a0eda8792b9e3fff9d67717f095f67448d9310c7e049f7fea8dd5907afe8bd462921
SSDEEP

24576:q9gl2kNvEE7GFdGqXsShFTAkBojKLUI56eGk:46vbIGqXscAkW+h1

Score

10^/10

quasar office04 discovery spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

azxq0ap.localto.net:3425

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes

encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\PORQUEPUTASYANOSIRVE.exe	family_quasar
behavioral1/memory/2216-5-0x0000000000A20000-0x0000000000D44000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Client.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation Client.exe
Executes dropped EXE 2 IoCs

Processes:

PORQUEPUTASYANOSIRVE.exeClient.exe

pid process

2216 PORQUEPUTASYANOSIRVE.exe
2588 Client.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Control Panel\International\Geo\Nation	Client.exe

pid	process
2216	PORQUEPUTASYANOSIRVE.exe
2588	Client.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wmplayer.exeunregmp2.exe

description	ioc	process
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c26243b7-d59f-4763-9d34-352d961e65d2.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241117222957.pma	setup.exe

Drops file in Windows directory 3 IoCs

Processes:

svchost.exemspaint.exemspaint.exe

description	ioc	process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3240 4676 WerFault.exe wmplayer.exe

pid	pid_target	process	target process
3240	4676	WerFault.exe	wmplayer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

wmplayer.exeunregmp2.exeIEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXEmsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e996d23f39db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802e92d23f39db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FD28E4BB-A532-11EF-913D-62680AF28EC1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007f6f31cd184e7a4e932a809586f2d01800000000020000000000106600000001000020000000d52a01ffbe40d112da2f3a5e39435f0e39f88e7f113d7f089362e62d4a52c8d6000000000e8000000002000020000000c41626585dec07565e15150ecd0fbb83129ed3b0e6fa3558ba133dcd1eb9d0b72000000055b61e9b1643c617c7cfd74995c93417560894ae1c3ee663392b437e4ac9123f40000000aee09a348b1b11ccd9c7b31955b755ca26e266b06eea6a79d59db4472c0290886e2d56464a4477fb5c6d271f587efd596b14a490ad31e8d06deeb4e1a7dd2506	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31144255"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3515927052"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007f6f31cd184e7a4e932a809586f2d018000000000200000000001066000000010000200000009a0eeb572d1850d57c596dd5b26d90b8d3fc88e3b07517481ab54e2ead56212c000000000e80000000020000200000009a5c11d4ab7ff3ec619e3cc75417700d4857c44c259740890d626adaf21e6986200000008790f209443fe44adb2baeba09108b23d280d7057e334e66aaa64f0daddfc6a54000000038e9ff2d4da74f587adcb4a97d9a5177ceb80725e729a589c95ecec87c54aae8b6795f968d67b65cd5acb680ce3328ed3a63912bf02bb0071604524531a963f1	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3515927052"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31144255"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.4355\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 4 IoCs

Processes:

Client.exeOpenWith.exeOpenWith.exe7zFM.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings	Client.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2288 NOTEPAD.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

1800 schtasks.exe
5040 schtasks.exe
Suspicious behavior: AddClipboardFormatListener 3 IoCs

Processes:

vlc.exeWINWORD.EXE

pid process

4764 vlc.exe
2468 WINWORD.EXE
2468 WINWORD.EXE

pid	process
2288	NOTEPAD.EXE

pid	process
1800	schtasks.exe
5040	schtasks.exe

pid	process
4764	vlc.exe
2468	WINWORD.EXE
2468	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

mspaint.exemspaint.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4760	mspaint.exe
4760	mspaint.exe
2836	mspaint.exe
2836	mspaint.exe
1916	msedge.exe
1916	msedge.exe
5104	msedge.exe
5104	msedge.exe
1608	identity_helper.exe
1608	identity_helper.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exevlc.exe

pid process

3712 7zFM.exe
4764 vlc.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

5104 msedge.exe
5104 msedge.exe
5104 msedge.exe
5104 msedge.exe
5104 msedge.exe
5104 msedge.exe
5104 msedge.exe
5104 msedge.exe

pid	process
3712	7zFM.exe
4764	vlc.exe

pid	process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

7zFM.exePORQUEPUTASYANOSIRVE.exeClient.exeunregmp2.exewmplayer.exewhoami.exeAUDIODG.EXE

description	pid	process
Token: SeRestorePrivilege	3712	7zFM.exe
Token: 35	3712	7zFM.exe
Token: SeSecurityPrivilege	3712	7zFM.exe
Token: SeDebugPrivilege	2216	PORQUEPUTASYANOSIRVE.exe
Token: SeDebugPrivilege	2588	Client.exe
Token: SeShutdownPrivilege	3796	unregmp2.exe
Token: SeCreatePagefilePrivilege	3796	unregmp2.exe
Token: SeShutdownPrivilege	4676	wmplayer.exe
Token: SeCreatePagefilePrivilege	4676	wmplayer.exe
Token: SeDebugPrivilege	5036	whoami.exe
Token: 33	3168	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3168	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

7zFM.exewmplayer.exeiexplore.exevlc.exemsedge.exe

pid process

3712 7zFM.exe
3712 7zFM.exe
3712 7zFM.exe
4676 wmplayer.exe
724 iexplore.exe
4764 vlc.exe
4764 vlc.exe
4764 vlc.exe
4764 vlc.exe
5104 msedge.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

vlc.exe

pid process

4764 vlc.exe
4764 vlc.exe
4764 vlc.exe

pid	process
3712	7zFM.exe
3712	7zFM.exe
3712	7zFM.exe
4676	wmplayer.exe
724	iexplore.exe
4764	vlc.exe
4764	vlc.exe
4764	vlc.exe
4764	vlc.exe
5104	msedge.exe

pid	process
4764	vlc.exe
4764	vlc.exe
4764	vlc.exe

Suspicious use of SetWindowsHookEx 29 IoCs

Processes:

Client.exeiexplore.exeOpenWith.exemspaint.exemspaint.exeIEXPLORE.EXEvlc.exeWINWORD.EXEOpenWith.exe

pid	process
2588	Client.exe
724	iexplore.exe
724	iexplore.exe
1096	OpenWith.exe
4760	mspaint.exe
2836	mspaint.exe
3500	IEXPLORE.EXE
3500	IEXPLORE.EXE
2836	mspaint.exe
2836	mspaint.exe
2836	mspaint.exe
4760	mspaint.exe
4760	mspaint.exe
4760	mspaint.exe
4764	vlc.exe
2468	WINWORD.EXE
2468	WINWORD.EXE
2468	WINWORD.EXE
2468	WINWORD.EXE
2468	WINWORD.EXE
2468	WINWORD.EXE
2468	WINWORD.EXE
2468	WINWORD.EXE
2468	WINWORD.EXE
2468	WINWORD.EXE
2468	WINWORD.EXE
2468	WINWORD.EXE
2468	WINWORD.EXE
1892	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

PORQUEPUTASYANOSIRVE.exeClient.exewmplayer.exeunregmp2.exeiexplore.execmd.exemsedge.exe

description	pid	process	target process
PID 2216 wrote to memory of 1800	2216	PORQUEPUTASYANOSIRVE.exe	schtasks.exe
PID 2216 wrote to memory of 1800	2216	PORQUEPUTASYANOSIRVE.exe	schtasks.exe
PID 2216 wrote to memory of 2588	2216	PORQUEPUTASYANOSIRVE.exe	Client.exe
PID 2216 wrote to memory of 2588	2216	PORQUEPUTASYANOSIRVE.exe	Client.exe
PID 2588 wrote to memory of 5040	2588	Client.exe	schtasks.exe
PID 2588 wrote to memory of 5040	2588	Client.exe	schtasks.exe
PID 4676 wrote to memory of 4636	4676	wmplayer.exe	unregmp2.exe
PID 4676 wrote to memory of 4636	4676	wmplayer.exe	unregmp2.exe
PID 4676 wrote to memory of 4636	4676	wmplayer.exe	unregmp2.exe
PID 4636 wrote to memory of 3796	4636	unregmp2.exe	unregmp2.exe
PID 4636 wrote to memory of 3796	4636	unregmp2.exe	unregmp2.exe
PID 2588 wrote to memory of 724	2588	Client.exe	iexplore.exe
PID 2588 wrote to memory of 724	2588	Client.exe	iexplore.exe
PID 724 wrote to memory of 3500	724	iexplore.exe	IEXPLORE.EXE
PID 724 wrote to memory of 3500	724	iexplore.exe	IEXPLORE.EXE
PID 724 wrote to memory of 3500	724	iexplore.exe	IEXPLORE.EXE
PID 2588 wrote to memory of 4760	2588	Client.exe	mspaint.exe
PID 2588 wrote to memory of 4760	2588	Client.exe	mspaint.exe
PID 2588 wrote to memory of 2836	2588	Client.exe	mspaint.exe
PID 2588 wrote to memory of 2836	2588	Client.exe	mspaint.exe
PID 2588 wrote to memory of 2288	2588	Client.exe	NOTEPAD.EXE
PID 2588 wrote to memory of 2288	2588	Client.exe	NOTEPAD.EXE
PID 2588 wrote to memory of 2468	2588	Client.exe	WINWORD.EXE
PID 2588 wrote to memory of 2468	2588	Client.exe	WINWORD.EXE
PID 2588 wrote to memory of 4764	2588	Client.exe	vlc.exe
PID 2588 wrote to memory of 4764	2588	Client.exe	vlc.exe
PID 2588 wrote to memory of 632	2588	Client.exe	cmd.exe
PID 2588 wrote to memory of 632	2588	Client.exe	cmd.exe
PID 632 wrote to memory of 2716	632	cmd.exe	chcp.com
PID 632 wrote to memory of 2716	632	cmd.exe	chcp.com
PID 632 wrote to memory of 5036	632	cmd.exe	whoami.exe
PID 632 wrote to memory of 5036	632	cmd.exe	whoami.exe
PID 2588 wrote to memory of 5104	2588	Client.exe	msedge.exe
PID 2588 wrote to memory of 5104	2588	Client.exe	msedge.exe
PID 5104 wrote to memory of 2100	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2100	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2472	5104	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\PORQUEPUTASYANOSIRVE.7z"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3712

C:\Users\Admin\Desktop\PORQUEPUTASYANOSIRVE.exe
"C:\Users\Admin\Desktop\PORQUEPUTASYANOSIRVE.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1800
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5040
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Roaming\InvokeDeny.xht
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:724 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3500
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Roaming\MoveDisable.dib"
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4760
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Roaming\OpenSync.wmf"
    3⤵
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2836
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\PublishNew.css
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2288
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\SelectResize.odt"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2468
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\UndoJoin.aiff"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4764
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /K CHCP 437
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Windows\system32\chcp.com
      CHCP 437
      4⤵
      PID:2716
  - - C:\Windows\system32\whoami.exe
      whoami
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ff9da2c46f8,0x7ff9da2c4708,0x7ff9da2c4718
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2368 /prefetch:1
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5792 /prefetch:8
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:1060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff7a5255460,0x7ff7a5255470,0x7ff7a5255480
        5⤵
        
        PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
      4⤵
      PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1092376696067836941,17272561754785656683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2840

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 2244
  2⤵
  - Program crash
  PID:3240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4932

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4676 -ip 4676
1⤵
PID:880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4120

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4 0x388
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2320

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fccab8a2a3330ebd702a08d6cc6c1aee

SHA1
2d0ea7fa697cb1723d240ebf3c0781ce56273cf7

SHA256
fa39b46c6f11977f5a2e6f4cd495db424063320fbac26a2eae7466e82ffeb712

SHA512
5339b52bad5dff926b66044067aa3e1a6147c389a27ebd89b0f16e1267621d7ce7af9810010bee81cba7b08c77a33ede8ef4675fe049b9fb2ed510fcaef93d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9d533e1f93a61b94eea29bf4313b0a8e

SHA1
96c1f0811d9e2fbf408e1b7186921b855fc891db

SHA256
ae95a7d192b6dfed1a8a5611850df994c63ba2038018901d59ef4dae64b74ed3

SHA512
b10de657d0cef4255e96daa1b6ad0c99c70b16c13b8e86790ea226e37e9ded1a8f8bed1e137f976d86ebc3ea9a4b5eb67ce2f5b0200025d35dc8e94c947ff3f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
0be93c207fce054be66b8341826c2fa9

SHA1
6b2492cd357ff542a32609c4308f56100248a406

SHA256
ddfdc41e17330d108abe77c72e16566fd92a54d662623f869ca02ebf00f2cdce

SHA512
431804ba3343076f859a8dd445baec7ab4c3420de0ae907b5a5bc65a514fa9319ce485e54a268f7677e02e12856b51aa3ad050a7eca8bb149cba5b1ad054c385

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
5abbb71b9dc5ec60f4fd30b5c6b1f5a4

SHA1
a73cc16940d4654e54a1b44fb517ff7d542bd701

SHA256
25093528ea99b784ef5d139acd7a6bb05f52852d37abaaa1f356a8eec95ae96f

SHA512
8e98ee51abbee2823199f1b8367b8e59a392ae822233b2a883478105f029345d124f83969055465422d0c5eb46e976c0d108f7ab5ef2da01607e0b348e20ab3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9f0c87a956548e263b6db4c532ed0215

SHA1
913f213b71889bba1e87d2214f73ee29d02eb220

SHA256
5805cbd9f6be2a9a3e6dd49d48ee881c9997eea94bf509a329ffaaa35821eb73

SHA512
9bf1bc272ae3ad46c9d74d3532bc1d732f654babdeba188cf65270732e72ec293e3d742f3710e46ef4dabe36e7edef96c1606a61b81facddae80a71cf251a292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
10eba2c77ed909bad7ada33cf563d8d0

SHA1
af3bc436051c7aeac1eb17230b416998d44b4a11

SHA256
ac18877f071caff015de61bf37cf00b902dffead7d4288e42ec194223e641431

SHA512
f4c1da0a63aa607249673ed1e241e32170a164a4ba53dfa6c048aadef82439b81e661493c8834cfcf5e35d949f65e9d8163e3a7d56c309b7011f8b66c8734bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ce216b0546c1c8dd5cf240d44e2b32b

SHA1
34a7f18627b645f8956d584e6f6c12bc86b87164

SHA256
3d75d44f815b010e935758e9f9b3d253d875fb935e2cb304dfeb76173cb56004

SHA512
8f2526406834f57eff74cdb03256617b117d839eb30d7c8f2ed3b199d72ac0a656363d337fa4297b50c6d20c6eabedf20c0a8f8143dd412f3f5b8b23b7ea31d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
ca96119e561b04ecc2658591323aa243

SHA1
1f11ddd4a36295f2c7829e8a4f229c5d18f97bc4

SHA256
327996d4246d8daa8cd8c14ea73eeb6316735909fe10ec66bbcb928b308d9a03

SHA512
3b2891706fcdcee7c41920e68c43a42c0876c72b73d917d84dc95a521757c4c8beb910803c23582501d4c386de6fcf082d0da1dd5844e1e402cb229f5dfab9fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d23b5386e8b15d248904519e2cb32f42

SHA1
cfda942630cf6d774acd6884b3eda48c7f864788

SHA256
1b8b59bbf97e3565ac6ab8995e94d43c74d05fc914035a9de1eda55f419b11c6

SHA512
2627dfb6777ce6f6cfea55b7fd597a344805155d50250ca3f0b70e8259bb38b9425656f101115cf9462fdd544f1422bfd6d045510f47d46b1757b6a0b89cc490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
944fb606b3059948794f370b09ceedbf

SHA1
64e33ac4ec1237b59a09c8084ab816f7c044941a

SHA256
bb6b698ecb42845148c30db99fa2f45b409c6c9336c3d0666b26d3b113b32ad4

SHA512
47bee2aa61aa004e16708e2741616c0c13d3a2974c6bdbad6b9f806afced62092042aad6989cf0a79f4e72193516f8bfcb8875b6d6dc7ae4dadbe06ac43e485e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ec09c7cbd7cb0b8a777b3a9e2a1892e

SHA1
3b07979e57b6c93be7d5a6cd8fa954dee91bd8dd

SHA256
a623633f34a241b0dbc9fd26f34446d716955f94e90b2ff9ac8b9df801bdae5e

SHA512
5fff0a38a3b6e4b29d402eef2650011e4d9df514e0624767c84ea31cb73cbba10c7e0b5711cb487976d637f0f60a85c431cf0db54b519411245684c116c07b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ed659b1d7a51e558246bd24f62fff931

SHA1
84685d6f04379c290e4261ff04e9e1879d54d42c

SHA256
23fafd9073812d5ff8b523b84bc981e4cb410bebbf3675db2b29cfac0dae9690

SHA512
1c3203328583241895db9fb165fcfd595f642e218ee3a453ab6873cbac10ddab693cd2f913bab15c8bb7b5a12c5768b3dfcb278aad754dec1fbffe66b81843cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\cb85247f-2edd-4513-b22c-f47682b07c4f\index-dir\the-real-index

Filesize
2KB

MD5
c097bc9ce0220b928e0beb344c31b81e

SHA1
12625c90434148c120fc80c1b78a395b421d8c0a

SHA256
fee88e13b60e566496c31bf701479afebcca2b0403f2f3694ed41593354f9b98

SHA512
42b0c16a1fff2d0ae2167e63b280340dd1b44cc992b53eaaf8a4959b2fcb1991b69ecf594d464fefd2bae83f10176d311c8039c338174fe372db11cea99e279e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\cb85247f-2edd-4513-b22c-f47682b07c4f\index-dir\the-real-index~RFe5d644a.TMP

Filesize
48B

MD5
bcb0235efbac18181999787f8188bcf8

SHA1
1322f78c92fa8294e63187f8c2daa35efb9f9d8d

SHA256
cc2d121cac7332aa3eb3a24ea46645ded6a3ef1615267243937430cc795ca87f

SHA512
5a6b2d8ace1da837e0c510fd6e160eb9098ee2c625a00cc0ec69b3ad6adbef2f66f4dc2465b4b626f697663255625625c12cf2f3efafc45d1cd038e1ff59454b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
a13b86a4d1bf19ae660ec2962269f78f

SHA1
879b35efa8857a74d00ed7c8f2e3ceee26a1af89

SHA256
628358ddb8afcc325360b87f2326865401642dcaceb7a82643fa64fc617b44a8

SHA512
039a8f3319f8221ba6ff6483f11913d7987289a4f04000ec6f6234dff96df893b2b581cae1398c8907aa0ffbb27701a20042c56ac9a7a8b6467c308c806810e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
f638827fed09415c1a61b87751cce433

SHA1
cc20bf11868f80e152e22d80c64c89ce4a623119

SHA256
fcd013b8ce3533bbf6b7bbb1cbe620dbec71a7f281c1098871ed2d93ad7cc488

SHA512
56bdcf0f765db81a2c33ea4d186b7df6259c9345ebc8b13d41c50b8ef531b4ea73234b887e5966189526b6e73fcb3eaca99d54a5400ce7d583e9e2753e9c5100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
e35bd7b4cf267e7dda3762e2e075b86b

SHA1
0be0bc1b068fec6e41fe0ed7f0b0b72448aab54e

SHA256
ea93172785282cde0f84396b5b63736de4d3c8220d6d41d0e067b6a0123a61d9

SHA512
3c48fba94d107112edb3bc1feaf0543d894e16e3a495f79c117ed1a85bcb49e29938408d865c69fb25dedd98d1cd4930c222bbd2d6e3bfc47bf96b97f1d5b1f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
3a91ce8a686d5fec8bc7919b89e13b88

SHA1
157d33a4840abdb77aac4af3ca60ad577d582a3b

SHA256
a2c895baa0e7d0317a8fb49ec6229851abb08028e40c7dad3d5c9dd6e9d20315

SHA512
6d2a18416aec0722474b7d54cff264a200e4462e6a3d771886455d7afbe2c92147941ef101658037e2e6b9dd25b642fd8cb48a51d438f88973c87ad75ff0efcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
39816410a79f8b26f8dc32cd6d7a80d3

SHA1
f327b8c4a2dd95496d9b376f5b1905222f37a0d9

SHA256
41f7bdf1a34240bc0335fa309f3ed3f24ce616ea856d3c8eea4b544a5e8b0912

SHA512
eef6cec2ef93bc7c0bccdd13502193e441db626629422997a037a8de9a50b868c2bc2866cdcf9295d8860db0656aa36d0c34495db5092df8e048ba0370075f3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d5cb9.TMP

Filesize
48B

MD5
68609e831d47f87795d7d9e3645765a1

SHA1
f1b928db0a396cb4b5ec0c05804e013829e94f04

SHA256
70262e2ec8bf1cf7a6c41b0f12fb66fd3bbf281a4106a270e95e4d5e226a8123

SHA512
7d37f642f6947e6178811f34271c86e5e675fb5a19523543898c859cae9f9ddeb49a720e7881a0bd09b2f2b10be6dfbe080d6b568d762a5c50b4949c716e1e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
57642bdb6089e403e89cc8f65f35e1eb

SHA1
7a7cf4dbe51c2b049915567c9097dc9c6b0901db

SHA256
7d5eccbc4230280d4d7b654056cdbc7ca9655de624f6e847252eb117d62e7f89

SHA512
96fd760683222755798b260f540f02237dc993de16861ef87ee3288293cddb4a139d01d75d37287d10ea934a74f94d1df4ae59ff117957f4becc9926fbf96f74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
563088ad0f20fabf9dd62c6ba8ae1636

SHA1
f9cd2fd153afa1a12ff990cf27c32b8c9c44e878

SHA256
eb897bf202d32f067728f1b666eb16e9926557efa8676b72db11411013030184

SHA512
8229dfb1d96b6a34b91b1e5c463833e7859331be880f585c48af1ba0ace0465ac755c7f22a9e6f30284266165f850e8f85af76157eea8136b2d6f79db02d3092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
950f7262895f6bafb1fb9f4ccba7cb14

SHA1
a467799b8822b604248b2c0e75fd3b143bce8076

SHA256
01c1f85acb987205899d755132196fb1f0613f0fc6f63047c4d9c91a79e690ab

SHA512
3418412f9c58564b8cfc66435c3268ba5ef48ed4127a131e307c757e10bfa06816b159829b2301c6e453a1018c6b691d5b04e59eac99a59af9ce0863704c2fbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
9ae8897c864f298689387ed98e040597

SHA1
ab0c175c630b2a94e22e5337c5f31807a363c11c

SHA256
b48a97389119f6ea340a7aeef9254ae49ff2e087feafb5c57d4572280e08044d

SHA512
77aeb158224d57b4d9ca09b565a8bad41090afdffc56086948aa496d0c0df73bda1fe429524bb121cbef0b33035c9d2dbee4be7957f5859277d496b9c02487fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
a3b50e3c622f91446c054f72087705fc

SHA1
8fb67ec1e015cc690fc3df06adebcb2fa12b11e9

SHA256
e0eb9018680cb63e17179f83049dc7aef399fe8c9c57c6dea203f5962d6d0900

SHA512
83d91f14440a6f08eb3b4eae945af37c5fb1ccb47bb3173dc6b2cc4ff08d2ee27f36e0510678610ab8ff11b33595f3e74005598c63f721d92ed6670cd57ac623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
120d4376b69d79a0c04f359df45ff405

SHA1
a19a6f3da195f72d4bbc2c3d090d81d2aea10a63

SHA256
f499e8935b08569c16d4f13c0f5ffe1d115e4eec8bf0a122e951dcf5051667a5

SHA512
e94d497dc2f3ea8b782f31c72500d1c3e47d2ea707532d203d786ba7e4fcc631f78af22d97d58d810605101581bff582df2aa9eaa1b3a775dafd45715950e415

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
3KB

MD5
e8ea4d32591b0602091a24cdbcba49bc

SHA1
5042ce24a3d12143f0c791269e43560ef4a4d43f

SHA256
369a258a9e137e76a6bf1c708b2daca288ca3e1990578f48b264deb0fa9631ce

SHA512
243fa1ea0aba8a877e6c08c5ada637c189907260dd423586d0de84d377f19cc69f6ef30925299fd0a0da1f587dd55bdb450e8856011fdfee9310832b24246700

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

Filesize
1KB

MD5
f8feac7458c4fcfe73591eb9d96df681

SHA1
95f0268b4e464114ef3022b9f14c4e8eca8e0d16

SHA256
6f218c3f739898fa18eee6ddd53bb9a91c35ff1abe0f0a30c3e3b0f728160019

SHA512
6f963e5b7a053df70c85665ea1f593457cf660a8152e3c3d5591e3a668d321d413c05783b14ab4227a588842d02d4366cc598a218a2c32f2170ee3142f0ad380

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
62b1bb522370e2a434244a22f12b1711

SHA1
3a92dfb17c159c6602a6590695bafba9817e3015

SHA256
0a2c5075551507a395311edd3b3870c739deb6a6ab5fb0752d6d156e67fa072f

SHA512
e455e6c89ad3f7e7fc53c5e9450ce92250569ab61fe1864816a02239092741d21b15d35fefea54c68f9c18214ace31881dbd7ef11b178d170a1b26b488c6946e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
4648a33a67a3bd02f2b0650174d717b0

SHA1
d55646e0eacc31f3435e2740a8fffaa1a28ba817

SHA256
c3836ebc9d6da4565cb32b3c8d750c3b003a08e85ae0c6a71a0cfa6e45012a96

SHA512
3f30ff8121c1283798f058a1c6e05f948a33036b7d0295764b409d8bb71de2d7310f1f4937004ea31295077afc1281d3086fd139db93cb029d2e7ec2c59063f0

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlcrc.4764

Filesize
94KB

MD5
7b37c4f352a44c8246bf685258f75045

SHA1
817dacb245334f10de0297e69c98b4c9470f083e

SHA256
ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e

SHA512
1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02

Download Submit
C:\Users\Admin\Desktop\PORQUEPUTASYANOSIRVE.exe

Filesize
3.1MB

MD5
73565f33ed4d8741291cbb30409f1727

SHA1
4d3a54b28f3ea80f884a25905e27165bdc353109

SHA256
aafe953e627f9e733e101d7211f0c9594dbdf82ec4019b2c9aa361cbc478f0de

SHA512
d897b098ddcdc94ac9177bc9a90b700c8b9a7cfafa74f729beebf74a094f76a7bd69e764711bdfedcdd231465daef16e937676e391ca2c010df03fecc863b583

Download Submit
\??\pipe\LOCAL\crashpad_5104_BRLGLBTEYTYCKUVI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2216-5-0x0000000000A20000-0x0000000000D44000-memory.dmp

Filesize
3.1MB

Download
memory/2216-4-0x00007FF9C1903000-0x00007FF9C1905000-memory.dmp

Filesize
8KB

Download
memory/2216-6-0x00007FF9C1900000-0x00007FF9C23C2000-memory.dmp

Filesize
10.8MB

Download
memory/2216-9-0x00007FF9C1900000-0x00007FF9C23C2000-memory.dmp

Filesize
10.8MB

Download
memory/2468-152-0x00007FF9A1490000-0x00007FF9A14A0000-memory.dmp

Filesize
64KB

Download
memory/2468-153-0x00007FF9A1490000-0x00007FF9A14A0000-memory.dmp

Filesize
64KB

Download
memory/2468-155-0x00007FF9A1490000-0x00007FF9A14A0000-memory.dmp

Filesize
64KB

Download
memory/2468-154-0x00007FF9A1490000-0x00007FF9A14A0000-memory.dmp

Filesize
64KB

Download
memory/2468-94-0x00007FF9A1490000-0x00007FF9A14A0000-memory.dmp

Filesize
64KB

Download
memory/2468-100-0x00007FF99F070000-0x00007FF99F080000-memory.dmp

Filesize
64KB

Download
memory/2468-99-0x00007FF99F070000-0x00007FF99F080000-memory.dmp

Filesize
64KB

Download
memory/2468-95-0x00007FF9A1490000-0x00007FF9A14A0000-memory.dmp

Filesize
64KB

Download
memory/2468-98-0x00007FF9A1490000-0x00007FF9A14A0000-memory.dmp

Filesize
64KB

Download
memory/2468-97-0x00007FF9A1490000-0x00007FF9A14A0000-memory.dmp

Filesize
64KB

Download
memory/2468-96-0x00007FF9A1490000-0x00007FF9A14A0000-memory.dmp

Filesize
64KB

Download
memory/2588-67-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-70-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-93-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-92-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-90-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-85-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-86-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-87-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-10-0x000000001C370000-0x000000001C3C0000-memory.dmp

Filesize
320KB

Download
memory/2588-11-0x000000001C480000-0x000000001C532000-memory.dmp

Filesize
712KB

Download
memory/2588-14-0x000000001C3E0000-0x000000001C3F2000-memory.dmp

Filesize
72KB

Download
memory/2588-15-0x000000001C440000-0x000000001C47C000-memory.dmp

Filesize
240KB

Download
memory/2588-88-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-89-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-84-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-81-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-82-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-83-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-80-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-79-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-78-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-74-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-77-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-76-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-75-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-91-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-71-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-69-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-72-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-73-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-68-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-65-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-66-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-64-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-63-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/2588-62-0x000000001D110000-0x000000001D120000-memory.dmp

Filesize
64KB

Download
memory/4676-61-0x000000000A4E0000-0x000000000A4F0000-memory.dmp

Filesize
64KB

Download
memory/4676-60-0x000000000A4E0000-0x000000000A4F0000-memory.dmp

Filesize
64KB

Download
memory/4676-55-0x000000000A4E0000-0x000000000A4F0000-memory.dmp

Filesize
64KB

Download
memory/4676-56-0x000000000A4E0000-0x000000000A4F0000-memory.dmp

Filesize
64KB

Download
memory/4676-57-0x000000000A4E0000-0x000000000A4F0000-memory.dmp

Filesize
64KB

Download
memory/4676-58-0x000000000A4E0000-0x000000000A4F0000-memory.dmp

Filesize
64KB

Download
memory/4676-59-0x000000000A4E0000-0x000000000A4F0000-memory.dmp

Filesize
64KB

Download
memory/4676-54-0x000000000A4E0000-0x000000000A4F0000-memory.dmp

Filesize
64KB

Download
memory/4676-52-0x0000000005870000-0x0000000005880000-memory.dmp

Filesize
64KB

Download
memory/4764-133-0x00007FF9A8870000-0x00007FF9A9920000-memory.dmp

Filesize
16.7MB

Download
memory/4764-132-0x00007FF9B9840000-0x00007FF9B9AF6000-memory.dmp

Filesize
2.7MB

Download
memory/4764-130-0x00007FF734020000-0x00007FF734118000-memory.dmp

Filesize
992KB

Download
memory/4764-131-0x00007FF9CC290000-0x00007FF9CC2C4000-memory.dmp

Filesize
208KB

Download