stealc | 59a1621e7c30d4bb04595fe4d94950023a5ff08204f7339b6513cbe04181f05a

Analysis

max time kernel
394s
max time network
434s
platform
windows10-2004_x64
resource
win10v2004-20240508-es
resource tags

arch:x64arch:x86image:win10v2004-20240508-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
30-06-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2277.rar
Size

15.4MB
MD5

bb2cc0c6a8f9412c01e128ab8f60417b
SHA1

0ec4fb899ea1a89ec652ea04c78b84a914be9dc2
SHA256

59a1621e7c30d4bb04595fe4d94950023a5ff08204f7339b6513cbe04181f05a
SHA512

7f089cd594ad86a2528e06bf1e29945440196041c58dbd0b1589d1575accca01806684d0d48dd735001a9fc9a92fd1f72425e00266aeed6a7a0614aea42e971c
SSDEEP

196608:iDYe69n1BrVXOtPR6y8quB/6W6oH6VzGuByRTvT7eQBZRmtOg0wcIDhxCZc5FbY:AYRPX4p6ZdxRDTyQB/ohxC25FbY

Score

10^/10

stealc vidar discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

vidar

https://t.me/g067n

https://steamcommunity.com/profiles/76561199707802586

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0

Signatures

Detect Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/5360-583-0x0000000000D10000-0x0000000000F59000-memory.dmp	family_vidar_v7
behavioral1/memory/6112-612-0x0000000000940000-0x0000000000B89000-memory.dmp	family_vidar_v7
behavioral1/memory/6112-614-0x0000000000940000-0x0000000000B89000-memory.dmp	family_vidar_v7
behavioral1/memory/5360-641-0x0000000000D10000-0x0000000000F59000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

VIDA.au3

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation VIDA.au3
Executes dropped EXE 13 IoCs

Processes:

Setup.exeJRWeb.exeJRWeb.exeSetup.exeJRWeb.exeJRWeb.exeSetup.exeJRWeb.exeSetup.exeJRWeb.exeSetup.exeJRWeb.exeJRWeb.exe

pid process

4080 Setup.exe
4112 JRWeb.exe
2372 JRWeb.exe
5660 Setup.exe
1664 JRWeb.exe
628 JRWeb.exe
6140 Setup.exe
1092 JRWeb.exe
416 Setup.exe
6072 JRWeb.exe
5272 Setup.exe
1820 JRWeb.exe
5384 JRWeb.exe
Loads dropped DLL 11 IoCs

Processes:

JRWeb.exeJRWeb.exeJRWeb.exeJRWeb.exeVIDA.au3JRWeb.exeVIDA.au3JRWeb.exeJRWeb.exeJRWeb.exeVIDA.au3

pid process

4112 JRWeb.exe
2372 JRWeb.exe
1664 JRWeb.exe
628 JRWeb.exe
5360 VIDA.au3
1092 JRWeb.exe
6112 VIDA.au3
6072 JRWeb.exe
1820 JRWeb.exe
5384 JRWeb.exe
548 VIDA.au3
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	VIDA.au3

pid	process
4080	Setup.exe
4112	JRWeb.exe
2372	JRWeb.exe
5660	Setup.exe
1664	JRWeb.exe
628	JRWeb.exe
6140	Setup.exe
1092	JRWeb.exe
416	Setup.exe
6072	JRWeb.exe
5272	Setup.exe
1820	JRWeb.exe
5384	JRWeb.exe

pid	process
4112	JRWeb.exe
2372	JRWeb.exe
1664	JRWeb.exe
628	JRWeb.exe
5360	VIDA.au3
1092	JRWeb.exe
6112	VIDA.au3
6072	JRWeb.exe
1820	JRWeb.exe
5384	JRWeb.exe
548	VIDA.au3

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Setup.exeSetup.exeSetup.exeSetup.exeSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

JRWeb.exeJRWeb.exeJRWeb.exe

description	pid	process	target process
PID 2372 set thread context of 5188	2372	JRWeb.exe	more.com
PID 628 set thread context of 5324	628	JRWeb.exe	more.com
PID 5384 set thread context of 2036	5384	JRWeb.exe	more.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exeVIDA.au3firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VIDA.au3
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VIDA.au3
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

1464 timeout.exe
5536 timeout.exe

pid	process
1464	timeout.exe
5536	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133642566035555043"	chrome.exe

Modifies registry class 3 IoCs

Processes:

cmd.exeOpenWith.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1856 NOTEPAD.EXE

pid	process
1856	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 51 IoCs

Processes:

chrome.exechrome.exeSetup.exeJRWeb.exeJRWeb.exemore.comSetup.exeJRWeb.exeJRWeb.exemore.comVIDA.au3Setup.exeJRWeb.exeSetup.exeJRWeb.exeSetup.exeJRWeb.exeJRWeb.exemore.commsedge.exeVIDA.au3

pid	process
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
4804	chrome.exe
4804	chrome.exe
4080	Setup.exe
4080	Setup.exe
4080	Setup.exe
4112	JRWeb.exe
2372	JRWeb.exe
2372	JRWeb.exe
2372	JRWeb.exe
5188	more.com
5188	more.com
5188	more.com
5188	more.com
5660	Setup.exe
5660	Setup.exe
5660	Setup.exe
1664	JRWeb.exe
628	JRWeb.exe
628	JRWeb.exe
628	JRWeb.exe
5324	more.com
5324	more.com
5324	more.com
5324	more.com
5360	VIDA.au3
5360	VIDA.au3
6140	Setup.exe
6140	Setup.exe
1092	JRWeb.exe
416	Setup.exe
416	Setup.exe
6072	JRWeb.exe
5360	VIDA.au3
5360	VIDA.au3
5360	VIDA.au3
5360	VIDA.au3
5272	Setup.exe
5272	Setup.exe
1820	JRWeb.exe
5384	JRWeb.exe
5384	JRWeb.exe
2036	more.com
2036	more.com
2604	msedge.exe
2604	msedge.exe
548	VIDA.au3
548	VIDA.au3

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exe7zFM.exe

pid process

4060 OpenWith.exe
5676 7zFM.exe
Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid

4
4
4
4
4
656
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

JRWeb.exeJRWeb.exemore.commore.comJRWeb.exemore.com

pid process

2372 JRWeb.exe
628 JRWeb.exe
5188 more.com
5324 more.com
5384 JRWeb.exe
2036 more.com
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

chrome.exe

pid process

2984 chrome.exe
2984 chrome.exe
2984 chrome.exe
2984 chrome.exe
2984 chrome.exe
2984 chrome.exe
2984 chrome.exe
2984 chrome.exe
2984 chrome.exe

pid
4
4
4
4
4
656

pid	process
2372	JRWeb.exe
628	JRWeb.exe
5188	more.com
5324	more.com
5384	JRWeb.exe
2036	more.com

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	1084	firefox.exe
Token: SeDebugPrivilege	1084	firefox.exe
Token: SeDebugPrivilege	1084	firefox.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe
Token: SeCreatePagefilePrivilege	2984	chrome.exe
Token: SeShutdownPrivilege	2984	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

firefox.exechrome.exe7zFM.exe7zG.exe

pid	process
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
5676	7zFM.exe
408	7zG.exe
2984	chrome.exe

Suspicious use of SendNotifyMessage 29 IoCs

Processes:

firefox.exechrome.exe

pid	process
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe
2984	chrome.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

OpenWith.exefirefox.exe

pid	process
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
4060	OpenWith.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe
1084	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

OpenWith.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4060 wrote to memory of 4956	4060	OpenWith.exe	firefox.exe
PID 4060 wrote to memory of 4956	4060	OpenWith.exe	firefox.exe
PID 4956 wrote to memory of 1084	4956	firefox.exe	firefox.exe
PID 4956 wrote to memory of 1084	4956	firefox.exe	firefox.exe
PID 4956 wrote to memory of 1084	4956	firefox.exe	firefox.exe
PID 4956 wrote to memory of 1084	4956	firefox.exe	firefox.exe
PID 4956 wrote to memory of 1084	4956	firefox.exe	firefox.exe
PID 4956 wrote to memory of 1084	4956	firefox.exe	firefox.exe
PID 4956 wrote to memory of 1084	4956	firefox.exe	firefox.exe
PID 4956 wrote to memory of 1084	4956	firefox.exe	firefox.exe
PID 4956 wrote to memory of 1084	4956	firefox.exe	firefox.exe
PID 4956 wrote to memory of 1084	4956	firefox.exe	firefox.exe
PID 4956 wrote to memory of 1084	4956	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 1952	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 4016	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 4016	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 4016	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 4016	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 4016	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 4016	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 4016	1084	firefox.exe	firefox.exe
PID 1084 wrote to memory of 4016	1084	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2277.rar
1⤵
- Modifies registry class
PID:3148

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\2277.rar"
2⤵
- Suspicious use of WriteProcessMemory
PID:4956

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\2277.rar
3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1084.0.1425143364\578869658" -parentBuildID 20230214051806 -prefsHandle 1788 -prefMapHandle 1780 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72ec91e6-e5db-4d53-b7c2-1271034b7f27} 1084 "\\.\pipe\gecko-crash-server-pipe.1084" 1880 1877572b458 gpu
4⤵
PID:1952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1084.1.484754547\10925643" -parentBuildID 20230214051806 -prefsHandle 2448 -prefMapHandle 2436 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c32ceed-bd57-4674-ab03-efc5613be28e} 1084 "\\.\pipe\gecko-crash-server-pipe.1084" 2476 18768989658 socket
4⤵
- Checks processor information in registry
PID:4016

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1084.2.173696766\611926344" -childID 1 -isForBrowser -prefsHandle 2844 -prefMapHandle 2752 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f0d56fe-4db6-4462-b45e-86229907659b} 1084 "\\.\pipe\gecko-crash-server-pipe.1084" 2744 1877863f858 tab
4⤵
PID:564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1084.3.274682144\614846639" -childID 2 -isForBrowser -prefsHandle 3624 -prefMapHandle 3724 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5baaa64f-2c86-444a-88d0-f1dd851dc01a} 1084 "\\.\pipe\gecko-crash-server-pipe.1084" 3964 1876897a558 tab
4⤵
PID:3660

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1084.4.1658563067\2091189525" -childID 3 -isForBrowser -prefsHandle 4968 -prefMapHandle 4964 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6d5d65f-d042-4b55-aa2a-e937419c45e1} 1084 "\\.\pipe\gecko-crash-server-pipe.1084" 4980 1877bd07b58 tab
4⤵
PID:5088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1084.5.1510814925\843820423" -childID 4 -isForBrowser -prefsHandle 5100 -prefMapHandle 5124 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02444e3e-bf88-4210-b4fd-cae09c241e61} 1084 "\\.\pipe\gecko-crash-server-pipe.1084" 5008 1877bd08458 tab
4⤵
PID:5112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1084.6.307108015\593086534" -childID 5 -isForBrowser -prefsHandle 5320 -prefMapHandle 5324 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31840353-3011-4740-b807-a4c90d64c692} 1084 "\\.\pipe\gecko-crash-server-pipe.1084" 5308 1877bd40e58 tab
4⤵
PID:4468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ffb611eab58,0x7ffb611eab68,0x7ffb611eab78
2⤵
PID:4052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:2
2⤵
PID:4224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:8
2⤵
PID:4532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2280 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:8
2⤵
PID:3460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:1
2⤵
PID:2148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:1
2⤵
PID:3872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4292 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:1
2⤵
PID:5240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:8
2⤵
PID:5404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:8
2⤵
PID:5464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:8
2⤵
PID:5744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:8
2⤵
PID:5752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:8
2⤵
PID:5856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3940 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:1
2⤵
PID:5936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4648 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:1
2⤵
PID:5964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3336 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:1
2⤵
PID:6120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1228 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:1
2⤵
PID:5348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2976 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:1
2⤵
PID:2900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3384 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:1
2⤵
PID:5752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:8
2⤵
PID:5148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 --field-trial-handle=1888,i,17127089463849930712,3092267300830438142,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4804

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5140

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6028

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\2277\" -spe -an -ai#7zMap867:70:7zEvent28149
1⤵
- Suspicious use of FindShellTrayWindow
PID:408

C:\Users\Admin\Downloads\2277\Setup.exe
"C:\Users\Admin\Downloads\2277\Setup.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4080

C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4112

C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2372

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5188

C:\Users\Admin\AppData\Local\Temp\VIDA.au3
C:\Users\Admin\AppData\Local\Temp\VIDA.au3
5⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5360

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\VIDA.au3" & rd /s /q "C:\ProgramData\AAFIIJDAAAAK" & exit
6⤵
PID:216

C:\Windows\SysWOW64\timeout.exe
timeout /t 10
7⤵
- Delays execution with timeout.exe
PID:5536

C:\Users\Admin\Downloads\2277\Setup.exe
"C:\Users\Admin\Downloads\2277\Setup.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:5660

C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1664

C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:628

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5324

C:\Users\Admin\AppData\Local\Temp\VIDA.au3
C:\Users\Admin\AppData\Local\Temp\VIDA.au3
5⤵
- Loads dropped DLL
PID:6112

C:\Users\Admin\Downloads\2277\Setup.exe
"C:\Users\Admin\Downloads\2277\Setup.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:6140

C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1092

C:\Users\Admin\Downloads\2277\Setup.exe
"C:\Users\Admin\Downloads\2277\Setup.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:416

C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:6072

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\2277\ṔḁṨṨCṏḌḙ__2277.css
1⤵
PID:5888

C:\Users\Admin\Downloads\2277\Setup.exe
"C:\Users\Admin\Downloads\2277\Setup.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:5272

C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1820

C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5384

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2036

C:\Users\Admin\AppData\Local\Temp\VIDA.au3
C:\Users\Admin\AppData\Local\Temp\VIDA.au3
5⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\VIDA.au3" & rd /s /q "C:\ProgramData\FIJECAEHJJJK" & exit
6⤵
PID:1736

C:\Windows\SysWOW64\timeout.exe
timeout /t 10
7⤵
- Delays execution with timeout.exe
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault27173277hc5e2h4caahbfa7h6f775221ce77
1⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb606346f8,0x7ffb60634708,0x7ffb60634718
2⤵
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16119179562780555611,10838868469865708439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
2⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16119179562780555611,10838868469865708439,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16119179562780555611,10838868469865708439,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
2⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:5516

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\2277\updater\manager\ks_tyres.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:1856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
811B

MD5
25b96a6a30f8792bf4141176b87e6411

SHA1
81b5e1038fbda2e074b79749898f81d8f3099e08

SHA256
acbb2e9bea6c78a3694988459bf14cb7c73d63d4f800d9fe88dfade2d694e70b

SHA512
bc685bb25d60a9d8d33f39c5d3687a2d518c9aceb0d6124387af71873252a8800b9ae9c553e77d4d4a5bdf75f3cd8495bc5351a7c146218250974d7c1cc714ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
e7e67d8d0ada64e5957372fa14c612c4

SHA1
495761c6d9f0c869be5a17bf4e7a5d805f2d05a5

SHA256
637ecbad809bea1025f06f67e48c6a2b9d20b28a76b3cc94efa03a8a5380bc7e

SHA512
d46f3dedc602eee14a8c60d9d06edcf999b1de77e7dd7e0ff7062d8480a62e56f501891a24d5ab34f5ed3bb8c4dac0cf52d6a4c2de558adde518d7ab5762c09b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
8134c786b0ce219e6542dfb99f89c12b

SHA1
845b9e4961faee04e98f245b8f78df8f09f55fcc

SHA256
7b5f41bb661c12c2e866fafe633a2b6cc00785f3c1370d8d298337b17cea3cbf

SHA512
cb888350e504810ca1625aa6f120f9d33a7a52c0af884c1ccfa579132ca4804f00e7e660c3918d795814569398bf484bc7217c9cbc9be3b87458b8b2236c1a43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
257KB

MD5
a819ff6b67aeff8a7fb3d978c9592545

SHA1
414d5678717522c2da1b387ce0f2779127604e81

SHA256
5b7e016b1a78e80b90a4b444c77feec9b74be186c4ac4969d66d91bd3a685a05

SHA512
73e90cbe17e4aec9305372a21b415cc2d4320425139c35dcbde6e09a0c7d067d702bfb0250200663037e0b4a6b468b5c97d0df4acb9292cd381cf29d69791ba7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
257KB

MD5
dd51047fbca96c1f9d9247992684e7d2

SHA1
08eabd04acdac08457785739297c2a20ef2b547c

SHA256
8035a190ed128da10c20855c7afd84a3cdaa3eed10a956c7fc0a4824cd067e89

SHA512
2ccb2b65b6cd7f7e12c0ec88ffff98964482a96e67dbd08465191605e6d24ed3b243e82ce8cc4fb92b825d0cb5ac7646120cfae703d7a5a66509cd6ce9af48c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
307KB

MD5
8bc3d1f04f15e85483e5110294528371

SHA1
082b0554fb0db71b272d32018d91a88b0a1ce30b

SHA256
abac9790ad2c5aa3700197ff3bea381ac5123703a4c455699837eadc0077c2c2

SHA512
d6c7339772f216a8092fccfa0377b8afd5086a008bf6a59f231bf04dffce85365a436f927634035e1180fdbe702616e3ba887756414ddc90ddca81c3ef6797c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
339KB

MD5
7229a2b311799ee6f93097b615b52751

SHA1
89d280273253fbb544d04298e58b1202eccffd54

SHA256
ce3df08f1056afcf400775125aa279b4e6404b6b86c9b52d7bd9c0daa922c360

SHA512
93123b6c85f903db9be18fcc198348c65b2fa8b2202bda46e95b925a7d582d07b3fb7fab734ec39f4ad7819b63633aea052ed37564ab605854804fa75bd711a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
96KB

MD5
1da96c2867e8ec32e6ff689aea319121

SHA1
5f14aeff435d08f9ef25da760a82242fdeaa2326

SHA256
54f0c1c1a2ff0e1d0000670717987c3f4baceff108470b48a646e3aadad14e2a

SHA512
9fcbff7b1119d790a99b33feb95a19974d2a7cfceef50893abfd5390e8e74882c9d75a707781cc34f9bd7b7553517e25807b66ee514a790e2ce955f0ce55f9ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
97KB

MD5
98c3b2a766202d651d77cb2f30185d06

SHA1
ac617b584b4de52054d7c4440eb0cca87a8641c3

SHA256
413e639656f10d069018ae21462d3eec2bf1fcd09cde5d1866acdc1e1b5f6b4a

SHA512
78e6cd6cf45acae6c87ceff6ec240f936fc745d552eefdd3d4a25cafea92f98e283c48ef0e2a3aea54621cc66ec548f7a095b45b3525951cd397b00271f19b9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58a6bb.TMP
Filesize
93KB

MD5
4a8793c687f6f13ed7061b3e0cf014e3

SHA1
2298a7349cecb75503075642a55a59b4447051ce

SHA256
8758c69053ec4854ca1d461ef54755895b49564bb11e8a146ff938dfc47aee40

SHA512
b9838bb6443aebee05b877707535a73a9a609627c4b5419a6d3295f5265009030d23651aaf10390ec369c388f9be9dab41ed5d53ef96eff27a5f1009bb27c75d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
059b64b8ccc95e8af8b255f3c20afafd

SHA1
a75433a3d563da3fa33f6f0639fe1c7a910a5084

SHA256
2698e6e77b514ba4442cff9892791e4a42f6dd834a270c6f64f41819c07bfce5

SHA512
3ba19fba1813216d1148ab68e0e703185e5d519a301b0a2f1425dcc18b564c3fe70fbf502f4861f0f1925fa54deead1deaf7ec7137b2825abdc8f86e7f6019ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26d7b282-302f-477e-a55f-253f198ad4ea.tmp
Filesize
5KB

MD5
a24544e5515d992b478e238f23cf35dc

SHA1
8d19f93895b183a62af6226ffd519f984fba79c7

SHA256
e82345cbc7b65eab2a8225882d200782d5222981f2accc1d4575ac99a71de07f

SHA512
6fc0c5916d4fcd96e565047ec38b1393abd030d5db5cd39b454914b4ac82b4af4fee378e74da962e9597595a65b7189d641eb22148a773a2b4d23ee2418e39ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
61B

MD5
4df4574bfbb7e0b0bc56c2c9b12b6c47

SHA1
81efcbd3e3da8221444a21f45305af6fa4b71907

SHA256
e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

SHA512
78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ca913634-023e-4576-9d35-7bc0f1dff456.tmp
Filesize
8KB

MD5
e6626127715712f15d9e1ccb7bf824b5

SHA1
16a06ef1d55e44744c4925554a4373cb438a053b

SHA256
bf5cd6d1a0e5229dbed90fd270d91481f79cd6fe8f190dcdecb37e5726df5717

SHA512
ead4cab55e01131be15c94da18322fd49bdae004fc2fb18ca404dd4d6556f7cf343ef390658a431a641802faa19542ff08580fea72b134d62b4846df9d9053b2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\activity-stream.discovery_stream.json.tmp
Filesize
23KB

MD5
ead454db2dcaa220934844c5b9e4b9ee

SHA1
299f4097191bd5752b59bffeac80a26c7ef26063

SHA256
4e70456f3ab416d8e9f6bdd02e972c0985805ec1800a39a1dcd86d2c5aa9e2e3

SHA512
1f1f13628230d4efa01157bb7c414eafc69c25c7f7ff773d999879f6f509cf9384565a2d1984e567f2235a3e4499bd22366984baba07578e351e0cc6a9be3911

Download Submit
C:\Users\Admin\AppData\Local\Temp\34ba0a5c
Filesize
1.7MB

MD5
0c72828ca4bc96b8c5346e1f4dc3d187

SHA1
8bf67bf3ff72fe7aacf9e85adb10a29c6db73b1f

SHA256
6674181279239bebd9c64214a3f4a514268aa9e1b4c2894442a2cef95a4ad598

SHA512
778abee765ed7b33e1e3ffa5b0c5a3777f2591f725983c64b4c2c94b5c58737e14d4e0c2f7965c93ca09c05bdf7d33318f938fe6df78edb3d92d9217d728480e

Download Submit
C:\Users\Admin\AppData\Local\Temp\VIDA.au3
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\e0b84016
Filesize
3.1MB

MD5
038f969cf28ab41dcd0f0e1b5a4cebd3

SHA1
eed533f861d87b723cf284b3b31048b9b637af6f

SHA256
c854dfad81bd531c249020281866d6a13c150834d39ea57d646747d2915feca8

SHA512
7e470585f49ef9ddc16ef7d66cc48bcee749a855ef7587f8bb4d5ea88684e9c7f46e39190b083c610bb1bf14ae864333bd0d36e7024087af98f7fab565055898

Download Submit
C:\Users\Admin\AppData\Local\Temp\e81bfe91
Filesize
1.7MB

MD5
f436cdd40a8ddf17f42b6c43f36f3e71

SHA1
91930116e866b050c4bad63b38320b1ddb9b9a60

SHA256
69ab53450956375fc3cf7970cedb31ada6c0688716ecb5b760b984324bce9f7d

SHA512
05fc77f3ab0b84594a607159decff6748db3b797f33eeb44136f00017aaee9595ab7fc22c20e7d7f7598bf996509d975263f8235b18d834e70b4ba6b90f050ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
Filesize
1.1MB

MD5
c047ae13fc1e25bc494b17ca10aa179e

SHA1
e293c7815c0eb8fbc44d60a3e9b27bd91b44b522

SHA256
6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf

SHA512
0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nodealt\WebView2Loader.dll
Filesize
157KB

MD5
4a99cb402c0d843b61a83015e0d3d731

SHA1
ac59e7722c85fef8050a715e6f4c3a3e5085d98e

SHA256
4ae3f7437a6991db64eac8e5d2fa02e9edce56ad98aaa273006963fed39548a8

SHA512
1eceb6ff5f53a98e61f21c90de9242e46c9607817eeb7ce77f500a5b225e123ac52b357c7729b334063cd8c8b37c2fbe38e76c1a5ee77244b176aa3e08d7eb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\nodealt\butadiene.wav
Filesize
1.2MB

MD5
581f817b235d1ecdadb890992d332a51

SHA1
a3795a50e05569325d59608390e1e6065811fa59

SHA256
1b6f3e200f7b8f0c4c296984fc33a56c318f4161559f90b812c608ff633a321f

SHA512
7f2e410663f8c5e9836d1054c96b203f68857a9e1f5356742bfa41989d6e503ead16ffd80ec60c2b833856f23a4a231bcaa707e0e0416ec7c2200f8b20a6cebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nodealt\perfidy.svg
Filesize
65KB

MD5
d7046da347cd1c24f9af82a326413734

SHA1
a8ecd6cd212e0b866ef9611bf07b6826262da0c4

SHA256
580209f46352f01b832c81a836e72d05819d33502f51bdda6212eefe0b7675d6

SHA512
cd0327dce2c68ee800e204972a88afc30b59e93847a4837fb72ddb2ee0de73e40b8e4450d7f800d50adf239ee0bdf6a1818e21c05677d1893906fc898f59c9de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
7KB

MD5
573c2d75eeed5d27ac80cf728c15c71b

SHA1
a0f84f08058f1a665474abae8b789d86ab6033c4

SHA256
4ffce44a75b33ad722a6d9504c5114c6113d3874aa861c7754ca861ba7845557

SHA512
4e04530a9e6375e42d79d589bfb4af942db5e2e54ada8f28c515edb9f1796bf1d4ebc56f1977a41d85884714e78111593773529de26304fe0e1664a66d801fc7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
7KB

MD5
03be9992cf9ab7cf25a629f4babf96c1

SHA1
77a8f93787185777be890e6d5ea95c6e7e2a21e2

SHA256
c9b7230d28ac77debaf074ef46d07f957976f4a355c7747e2e60ff00dc27c7bf

SHA512
d96480a5583a61705c4a979d6fb541c44c7dff3f5ae42e109adf35c6f10e23b2c4aed086f48ce71fbe8a100c46127af8cb9fe2acb798b4b17efbb6db8a98aa9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs-1.js
Filesize
7KB

MD5
4149f08bfa8ef7d7ca5d9e47daa3d001

SHA1
f2cfe764a86c7620ab557f6b7bf7baa31bf56508

SHA256
3ea1282686cd6a5e98d86f636e0639168439f922ecb991e6e404f287969b09b1

SHA512
262b1d0bf24c9c04eae149e83e454e073817e8c2d4ed39387892dc1e4704bdc35cf87c54b8d480c75a3ed1413df0c3e02fbdf04d471f3a0182325f1ccc9aa339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs-1.js
Filesize
7KB

MD5
8ae5f7bf6c49f444f71e2c35ad55182a

SHA1
31577c6d3fcdb056d6532ee5f2b880fa68e58f8c

SHA256
ade103508163797ddc5140f0610df1fcd2d1d5666dc424deac33ff2a7ca25848

SHA512
a6cf24b5244e3176ba6ff41983cee860afd7ca253d65c6432e25a726ef447b76c2684d656581c79e1708368860d62006827fb9825d91f6ce341d7186679db0a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs-1.js
Filesize
7KB

MD5
57524d28e19a5feb057b01027788e2ef

SHA1
d9ce1eb8926a7ef5674ef1f7d6f2ef8e915780a9

SHA256
a356a24c48b0bcee9338537145117a0056fcd36c62a302bdfcb4bfacdf65caf0

SHA512
9b6357e45a4e03c66b96f179212ef6f362c0f864eb5b0a0c1d6f20317cfc9328c4f3e2ef7be7a14b427741881daeceb581a7ac8d216d0f34f574eba19b16044c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\prefs.js
Filesize
6KB

MD5
0486519b09d5307f1552c343c7e1eb86

SHA1
be309333af91fca5d14c76aa31be32e1fbbccf96

SHA256
dfd015bcd1106e8cfb7e46fdc4231b4bc5626d7680bd2904086c33e3c0491f9a

SHA512
ff5c1737fab3ac4c0026702b7605eb6781b8f9f27454fc7549a5fe2e272861141d981482d220156a2315982bb925e3e47b2659a1e9107703d3da50ec48246753

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
eb02778d80d1044ffd2e6c26cca60816

SHA1
a59b4030a2ae5dd5b76dbbcfcc31878711c8e05c

SHA256
81b4437484c51dfa473858eb915b52b43ec2a3827cc285036a5e7778db190c05

SHA512
17bd784f25dfa2e3d036cc635a3e0f42e3c66c715cf18cd97de59f58966b089a6c5f0e98153c4b5050ac7ecdb0f7fbd6e5d6a3525b8b4caaad59b7fcbf278b3d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ue3bcu6m.default-release\sessionstore.jsonlz4
Filesize
643B

MD5
3dcb015a1b8212d971dfdccf10e2b4cf

SHA1
1c12d5571a775e90c94ae7885510ed60494e273a

SHA256
6724aa72c7bc81518809b2fb73229ce8c062ac0a8247334c5f9ccf928761db34

SHA512
946074a32b71cd892a433a388357d85df701729ed177cec54beb00e52112eddfafd49cffe2ba13a0fdd0dfded677c79d1af2845c48d2d29a95bb8c0ab727fbed

Download Submit
C:\Users\Admin\Downloads\HY2qeGXX.rar.part
Filesize
15.4MB

MD5
bb2cc0c6a8f9412c01e128ab8f60417b

SHA1
0ec4fb899ea1a89ec652ea04c78b84a914be9dc2

SHA256
59a1621e7c30d4bb04595fe4d94950023a5ff08204f7339b6513cbe04181f05a

SHA512
7f089cd594ad86a2528e06bf1e29945440196041c58dbd0b1589d1575accca01806684d0d48dd735001a9fc9a92fd1f72425e00266aeed6a7a0614aea42e971c

Download Submit
\??\pipe\crashpad_2984_KOLRHTZWHDSDTLKW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/416-617-0x00007FF770830000-0x00007FF7716FB000-memory.dmp

Filesize
14.8MB

Download
memory/416-626-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/416-642-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/416-623-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/548-728-0x00007FFB81070000-0x00007FFB81265000-memory.dmp

Filesize
2.0MB

Download
memory/628-420-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/628-418-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/1092-606-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/1664-406-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/1820-660-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/2036-723-0x0000000075500000-0x000000007567B000-memory.dmp

Filesize
1.5MB

Download
memory/2036-670-0x00007FFB81070000-0x00007FFB81265000-memory.dmp

Filesize
2.0MB

Download
memory/2372-370-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/2372-368-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/4080-339-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/4080-369-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/4080-341-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/4080-333-0x00007FF770830000-0x00007FF7716FB000-memory.dmp

Filesize
14.8MB

Download
memory/4112-355-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/5188-424-0x0000000075460000-0x00000000755DB000-memory.dmp

Filesize
1.5MB

Download
memory/5188-373-0x00007FFB81070000-0x00007FFB81265000-memory.dmp

Filesize
2.0MB

Download
memory/5272-650-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/5272-644-0x00007FF770830000-0x00007FF7716FB000-memory.dmp

Filesize
14.8MB

Download
memory/5272-652-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/5272-667-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/5324-426-0x00007FFB81070000-0x00007FFB81265000-memory.dmp

Filesize
2.0MB

Download
memory/5360-583-0x0000000000D10000-0x0000000000F59000-memory.dmp

Filesize
2.3MB

Download
memory/5360-641-0x0000000000D10000-0x0000000000F59000-memory.dmp

Filesize
2.3MB

Download
memory/5360-524-0x00007FFB81070000-0x00007FFB81265000-memory.dmp

Filesize
2.0MB

Download
memory/5384-666-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/5384-668-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/5660-385-0x00007FF770830000-0x00007FF7716FB000-memory.dmp

Filesize
14.8MB

Download
memory/5660-419-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/5660-393-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/5660-391-0x00007FFB61BC0000-0x00007FFB61D32000-memory.dmp

Filesize
1.4MB

Download
memory/6072-640-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/6112-612-0x0000000000940000-0x0000000000B89000-memory.dmp

Filesize
2.3MB

Download
memory/6112-613-0x00007FFB81070000-0x00007FFB81265000-memory.dmp

Filesize
2.0MB

Download
memory/6112-614-0x0000000000940000-0x0000000000B89000-memory.dmp

Filesize
2.3MB

Download
memory/6140-593-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/6140-591-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download
memory/6140-585-0x00007FF770830000-0x00007FF7716FB000-memory.dmp

Filesize
14.8MB

Download
memory/6140-615-0x00007FFB62CC0000-0x00007FFB62E32000-memory.dmp

Filesize
1.4MB

Download