Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 13:37
Static task
static1
Behavioral task
behavioral1
Sample
FACTURA08798696.vbe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
FACTURA08798696.vbe
Resource
win10v2004-20240508-en
General
-
Target
FACTURA08798696.vbe
-
Size
646KB
-
MD5
877d62bb0a3ca04372a89f1fd63aa517
-
SHA1
abb9619743f94df8ee35bcb29e08a33f49acc91a
-
SHA256
411d7a0d9d268daa710bbd8af48825e3227be7ed743c50c68afc05b71a940e83
-
SHA512
072e1b5ebf6aa76ee374d94b5d9f066c3f2c922808a646768234bf8cae9c62b55a82fa4e18ab860f7ffb5b31a625619991feaa3a82bc8fc7a3712b38cbbcf7ae
-
SSDEEP
12288:NuXAeUMRwhbVmNmN7wNL4NBN3rNrx9V0NnNcN/v3gRN6fyNMNIN3NLojSAfp+J1/:T4Rwhb79SyV7R1AIJTaud62Q
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/644-1378-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView behavioral2/memory/644-1374-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3060-1375-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/3060-1390-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4508-1372-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/3060-1375-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/644-1378-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/4508-1377-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/644-1374-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/3060-1390-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exex.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation x.exe -
Executes dropped EXE 5 IoCs
Processes:
x.exeQQ.exeQQ.exeQQ.exeQQ.exepid process 4736 x.exe 2452 QQ.exe 3060 QQ.exe 644 QQ.exe 4508 QQ.exe -
Loads dropped DLL 64 IoCs
Processes:
x.exepid process 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe 4736 x.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
QQ.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts QQ.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
QQ.exex.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\"" QQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\"" QQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\"" x.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-R6CJUW = "\"C:\\Users\\Admin\\AppData\\Roaming\\QQ\\QQ.exe\"" x.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs
Processes:
x.exeQQ.exepid process 4132 x.exe 4132 x.exe 1960 QQ.exe 1960 QQ.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
x.exex.exeQQ.exeQQ.exepid process 4736 x.exe 4132 x.exe 2452 QQ.exe 1960 QQ.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
x.exeQQ.exeQQ.exedescription pid process target process PID 4736 set thread context of 4132 4736 x.exe x.exe PID 2452 set thread context of 1960 2452 QQ.exe QQ.exe PID 1960 set thread context of 3060 1960 QQ.exe QQ.exe PID 1960 set thread context of 644 1960 QQ.exe QQ.exe PID 1960 set thread context of 4508 1960 QQ.exe QQ.exe -
Drops file in Windows directory 6 IoCs
Processes:
x.exeQQ.exedescription ioc process File opened for modification C:\Windows\resources\gokke\empacket.bru x.exe File opened for modification C:\Windows\resources\Informationssgningers.par x.exe File opened for modification C:\Windows\Fonts\sanitetstjenesten.par x.exe File opened for modification C:\Windows\resources\gokke\empacket.bru QQ.exe File opened for modification C:\Windows\resources\Informationssgningers.par QQ.exe File opened for modification C:\Windows\Fonts\sanitetstjenesten.par QQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
QQ.exeQQ.exepid process 4508 QQ.exe 4508 QQ.exe 3060 QQ.exe 3060 QQ.exe 3060 QQ.exe 3060 QQ.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
x.exeQQ.exeQQ.exepid process 4736 x.exe 2452 QQ.exe 1960 QQ.exe 1960 QQ.exe 1960 QQ.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
QQ.exedescription pid process Token: SeDebugPrivilege 4508 QQ.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
QQ.exepid process 1960 QQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
WScript.exex.exedescription pid process target process PID 3588 wrote to memory of 4736 3588 WScript.exe x.exe PID 3588 wrote to memory of 4736 3588 WScript.exe x.exe PID 3588 wrote to memory of 4736 3588 WScript.exe x.exe PID 4736 wrote to memory of 4916 4736 x.exe cmd.exe PID 4736 wrote to memory of 4916 4736 x.exe cmd.exe PID 4736 wrote to memory of 4916 4736 x.exe cmd.exe PID 4736 wrote to memory of 3520 4736 x.exe cmd.exe PID 4736 wrote to memory of 3520 4736 x.exe cmd.exe PID 4736 wrote to memory of 3520 4736 x.exe cmd.exe PID 4736 wrote to memory of 912 4736 x.exe cmd.exe PID 4736 wrote to memory of 912 4736 x.exe cmd.exe PID 4736 wrote to memory of 912 4736 x.exe cmd.exe PID 4736 wrote to memory of 1232 4736 x.exe cmd.exe PID 4736 wrote to memory of 1232 4736 x.exe cmd.exe PID 4736 wrote to memory of 1232 4736 x.exe cmd.exe PID 4736 wrote to memory of 4972 4736 x.exe cmd.exe PID 4736 wrote to memory of 4972 4736 x.exe cmd.exe PID 4736 wrote to memory of 4972 4736 x.exe cmd.exe PID 4736 wrote to memory of 1340 4736 x.exe cmd.exe PID 4736 wrote to memory of 1340 4736 x.exe cmd.exe PID 4736 wrote to memory of 1340 4736 x.exe cmd.exe PID 4736 wrote to memory of 968 4736 x.exe cmd.exe PID 4736 wrote to memory of 968 4736 x.exe cmd.exe PID 4736 wrote to memory of 968 4736 x.exe cmd.exe PID 4736 wrote to memory of 4612 4736 x.exe cmd.exe PID 4736 wrote to memory of 4612 4736 x.exe cmd.exe PID 4736 wrote to memory of 4612 4736 x.exe cmd.exe PID 4736 wrote to memory of 1392 4736 x.exe cmd.exe PID 4736 wrote to memory of 1392 4736 x.exe cmd.exe PID 4736 wrote to memory of 1392 4736 x.exe cmd.exe PID 4736 wrote to memory of 4920 4736 x.exe cmd.exe PID 4736 wrote to memory of 4920 4736 x.exe cmd.exe PID 4736 wrote to memory of 4920 4736 x.exe cmd.exe PID 4736 wrote to memory of 4928 4736 x.exe cmd.exe PID 4736 wrote to memory of 4928 4736 x.exe cmd.exe PID 4736 wrote to memory of 4928 4736 x.exe cmd.exe PID 4736 wrote to memory of 4868 4736 x.exe cmd.exe PID 4736 wrote to memory of 4868 4736 x.exe cmd.exe PID 4736 wrote to memory of 4868 4736 x.exe cmd.exe PID 4736 wrote to memory of 1904 4736 x.exe cmd.exe PID 4736 wrote to memory of 1904 4736 x.exe cmd.exe PID 4736 wrote to memory of 1904 4736 x.exe cmd.exe PID 4736 wrote to memory of 732 4736 x.exe cmd.exe PID 4736 wrote to memory of 732 4736 x.exe cmd.exe PID 4736 wrote to memory of 732 4736 x.exe cmd.exe PID 4736 wrote to memory of 2272 4736 x.exe cmd.exe PID 4736 wrote to memory of 2272 4736 x.exe cmd.exe PID 4736 wrote to memory of 2272 4736 x.exe cmd.exe PID 4736 wrote to memory of 2112 4736 x.exe cmd.exe PID 4736 wrote to memory of 2112 4736 x.exe cmd.exe PID 4736 wrote to memory of 2112 4736 x.exe cmd.exe PID 4736 wrote to memory of 4784 4736 x.exe cmd.exe PID 4736 wrote to memory of 4784 4736 x.exe cmd.exe PID 4736 wrote to memory of 4784 4736 x.exe cmd.exe PID 4736 wrote to memory of 4132 4736 x.exe cmd.exe PID 4736 wrote to memory of 4132 4736 x.exe cmd.exe PID 4736 wrote to memory of 4132 4736 x.exe cmd.exe PID 4736 wrote to memory of 1480 4736 x.exe cmd.exe PID 4736 wrote to memory of 1480 4736 x.exe cmd.exe PID 4736 wrote to memory of 1480 4736 x.exe cmd.exe PID 4736 wrote to memory of 4488 4736 x.exe cmd.exe PID 4736 wrote to memory of 4488 4736 x.exe cmd.exe PID 4736 wrote to memory of 4488 4736 x.exe cmd.exe PID 4736 wrote to memory of 3840 4736 x.exe cmd.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FACTURA08798696.vbe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x75^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6D^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x74^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x68^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x70^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0B^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4D^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x65^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x76^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"3⤵
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"3⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\QQ\QQ.exe"C:\Users\Admin\AppData\Roaming\QQ\QQ.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x75^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6D^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x74^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x68^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x6A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x70^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x63^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0B^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x10^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x56^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4D^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4B^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x50^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x52^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x08^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x79^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x11^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x13^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x17^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x53^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x55^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x43^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x15^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x14^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x1C^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x65^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x47^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x71^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x48^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x42^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x51^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x76^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x49^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x45^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x67^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0E^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x54^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x12^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0A^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x4F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x06^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x16^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x0F^38"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c set /a "0x5F^38"5⤵
-
C:\Users\Admin\AppData\Roaming\QQ\QQ.exe"C:\Users\Admin\AppData\Roaming\QQ\QQ.exe"5⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\QQ\QQ.exeC:\Users\Admin\AppData\Roaming\QQ\QQ.exe /stext "C:\Users\Admin\AppData\Local\Temp\trjpw"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\QQ\QQ.exeC:\Users\Admin\AppData\Roaming\QQ\QQ.exe /stext "C:\Users\Admin\AppData\Local\Temp\dloawhyo"6⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Roaming\QQ\QQ.exeC:\Users\Admin\AppData\Roaming\QQ\QQ.exe /stext "C:\Users\Admin\AppData\Local\Temp\gnusxajhzdb"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD5d511002e7cb48fac086cca5509a63a3c
SHA1024283cb1cc10805383cc66d6fd7114e893997ea
SHA2564ca0a5224b526a2452052ee0dff646c2238f4f360c860639ce25f4b0b725736f
SHA5124b004d81a889b7f819d8ab1e4793d3a0072faa831c18e8dd24b35620190bb29fc58dae38d6f3b9d1b5e574fd0ed7dba743a7b10d05b48112ebc42fbe31f4818a
-
C:\Users\Admin\AppData\Local\Temp\nsoF609.tmp\System.dllFilesize
12KB
MD56c38da8922cc37b4bbb77de4a63ad843
SHA14e0533fd11df8bddbd543ed58df7b6060d9f4631
SHA2561624d9ad8b2e2658af224691263f64388ba3a997efe80011889e3c35237ce4c1
SHA512ad0be3d7e57da9c304e9b9cac5341b6c76b157456ab44f5579d6c38c830a31c9c3e1e9a875b8f465243c607ea2ede6b0bb77237f17a70a4d4c78606e036c3430
-
C:\Users\Admin\AppData\Local\Temp\nsoF609.tmp\nsExec.dllFilesize
7KB
MD5052099395689171cf64bf4a868e6a9be
SHA19581e80b223226eee5f726f38b3e966fdc5bbfad
SHA25699fc8f647bfff3655dcd4ec577d79ec4102fb3a68b567282ba0b51e0b5262802
SHA512f45e38314e10129d3cceaefa918b25a432c67db8bf73f110a6957ca7f5cc96db749601fed550e0357bf67c84de2721d9692b8785c295fc7a1537b42c68b461a9
-
C:\Users\Admin\AppData\Local\Temp\x.exeFilesize
469KB
MD59698e5ebed702eb7a5045811c60a3bc9
SHA107f394eaa3d0cfdf0933093775062cce0792129b
SHA256ddaf4a30fd1d9a4c74f1ae8842a6b0bb2053d9cfdcbcf9b7ad8122561658518a
SHA512a7f4acc934de58d4f3e203ef764c834ca41afe741ae5f596ed337225886d14052488d8428e34f8a5e28343cc9cbf5114c44c9f089f9675ba8fbb48171cd52a5e
-
memory/644-1374-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/644-1363-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/644-1370-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/644-1378-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1960-1396-0x0000000034A60000-0x0000000034A79000-memory.dmpFilesize
100KB
-
memory/1960-1360-0x0000000001A70000-0x0000000003115000-memory.dmpFilesize
22.6MB
-
memory/1960-1395-0x0000000034A60000-0x0000000034A79000-memory.dmpFilesize
100KB
-
memory/1960-1392-0x0000000034A60000-0x0000000034A79000-memory.dmpFilesize
100KB
-
memory/3060-1375-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3060-1369-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3060-1390-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3060-1362-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4132-725-0x0000000001A70000-0x0000000003115000-memory.dmpFilesize
22.6MB
-
memory/4132-715-0x0000000001A70000-0x0000000003115000-memory.dmpFilesize
22.6MB
-
memory/4508-1377-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4508-1371-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4508-1364-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4508-1372-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB