Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 22:36
Static task
static1
Behavioral task
behavioral1
Sample
7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe
Resource
win10v20201028
General
-
Target
7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe
-
Size
18KB
-
MD5
d360e4b15da3d3b89640a3ba98464214
-
SHA1
67816c29b8f35cff28bb4f3f1428d001a8f1f280
-
SHA256
7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e
-
SHA512
d00295e6d7192c0a2dfa8ccbf18fb344852fae9de074fc843b6ef20967b003c7fcff2b6835fc3dd7bd69c0bfdf714c22f972a5e609f5859d051579c94967179a
Malware Config
Extracted
C:\Users\Admin\Desktop\READ_ME.hta
https://wikipedia.org/wiki/Bitcoinhttps://wikipedia.org/wiki/Encryption
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
0xy5pqal.exeTaskHostHelper.exepid process 3116 0xy5pqal.exe 3156 TaskHostHelper.exe -
Drops startup file 1 IoCs
Processes:
TaskHostHelper.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\READ_ME.hta TaskHostHelper.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
TaskHostHelper.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TaskHostHelper.exe" TaskHostHelper.exe -
Drops file in System32 directory 2 IoCs
Processes:
TaskHostHelper.exedescription ioc process File created C:\Windows\SysWOW64\@AudioToastIcon.png TaskHostHelper.exe File created C:\Windows\SysWOW64\RNSNKMA6.vbs TaskHostHelper.exe -
Drops file in Program Files directory 1673 IoCs
Processes:
TaskHostHelper.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png TaskHostHelper.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png TaskHostHelper.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png TaskHostHelper.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html TaskHostHelper.exe File opened for modification C:\Program Files\7-Zip\License.txt TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml TaskHostHelper.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png TaskHostHelper.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml TaskHostHelper.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-text.xml TaskHostHelper.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png TaskHostHelper.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons2x.png TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] TaskHostHelper.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt TaskHostHelper.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\main.css TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main-selector.css TaskHostHelper.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\platform.xml TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text.png TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\adobe_logo.png TaskHostHelper.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml TaskHostHelper.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\dblook.bat TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png TaskHostHelper.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\scan-2x.png TaskHostHelper.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] TaskHostHelper.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons.png TaskHostHelper.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html TaskHostHelper.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\vscroll-thumb.png TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons2x.png TaskHostHelper.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt TaskHostHelper.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\VisualElements\SmallLogoDev.png TaskHostHelper.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\inline-error-1x.png TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon.png TaskHostHelper.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File created C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] TaskHostHelper.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\file_icons.png TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css TaskHostHelper.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml TaskHostHelper.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME.txt TaskHostHelper.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] TaskHostHelper.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons_2x.png TaskHostHelper.exe -
Drops file in Windows directory 386 IoCs
Processes:
TaskHostHelper.exedescription ioc process File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppxBlockMap.xml TaskHostHelper.exe File created C:\Windows\InfusedApps\Applications\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File created C:\Windows\InfusedApps\Applications\Microsoft.XboxGameOverlay_1.15.2003.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\addUser.aspx TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml TaskHostHelper.exe File created C:\Windows\InfusedApps\Packages\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\error.aspx TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk TaskHostHelper.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\AppxBlockMap.xml TaskHostHelper.exe File created C:\Windows\InfusedApps\Frameworks\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\editUser.aspx TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk TaskHostHelper.exe File created C:\Windows\WinSxS\migration.xml TaskHostHelper.exe File created C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\UninstallSqlState.sql TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\en\Tracking_Logic.sql TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx TaskHostHelper.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AppxBlockMap.xml TaskHostHelper.exe File created C:\Windows\InfusedApps\Applications\Microsoft.XboxSpeechToTextOverlay_1.14.2002.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File created C:\Windows\InfusedApps\Frameworks\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File created C:\Windows\InfusedApps\Packages\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File created C:\Windows\InfusedApps\Packages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk TaskHostHelper.exe File opened for modification C:\Windows\Vss\Writers\System\0bada1de-01a9-4625-8278-69e735f39dd2.xml TaskHostHelper.exe File created C:\Windows\InfusedApps\Packages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\home2.aspx TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home1.aspx TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk TaskHostHelper.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk TaskHostHelper.exe File created C:\Windows\InfusedApps\Packages\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\256x256.png TaskHostHelper.exe File created C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallCommon.sql TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE (x86).lnk TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\security0.aspx TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg TaskHostHelper.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RedistList\FrameworkList.xml TaskHostHelper.exe File created C:\Windows\Performance\WinSAT\Clip_1080_5sec_10mbps_h264.mp4 TaskHostHelper.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\AppxBlockMap.xml TaskHostHelper.exe File created C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AppxBlockMap.xml TaskHostHelper.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\AppxBlockMap.xml TaskHostHelper.exe File created C:\Windows\InfusedApps\Packages\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxBlockMap.xml TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallPersonalization.sql TaskHostHelper.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\SubsetList\Client.xml TaskHostHelper.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk TaskHostHelper.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk TaskHostHelper.exe File created C:\Windows\diagnostics\index\AeroDiagnostic.xml TaskHostHelper.exe -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 412 vssadmin.exe 508 vssadmin.exe 2272 vssadmin.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3040 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
TaskHostHelper.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings TaskHostHelper.exe -
Suspicious behavior: EnumeratesProcesses 477 IoCs
Processes:
7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exepid process 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe -
Suspicious use of AdjustPrivilegeToken 141 IoCs
Processes:
7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exetaskkill.exe0xy5pqal.exeTaskHostHelper.exevssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe Token: SeDebugPrivilege 3040 taskkill.exe Token: SeDebugPrivilege 3116 0xy5pqal.exe Token: SeDebugPrivilege 3156 TaskHostHelper.exe Token: 33 3156 TaskHostHelper.exe Token: SeIncBasePriorityPrivilege 3156 TaskHostHelper.exe Token: SeBackupPrivilege 1040 vssvc.exe Token: SeRestorePrivilege 1040 vssvc.exe Token: SeAuditPrivilege 1040 vssvc.exe Token: SeIncreaseQuotaPrivilege 3896 WMIC.exe Token: SeSecurityPrivilege 3896 WMIC.exe Token: SeTakeOwnershipPrivilege 3896 WMIC.exe Token: SeLoadDriverPrivilege 3896 WMIC.exe Token: SeSystemProfilePrivilege 3896 WMIC.exe Token: SeSystemtimePrivilege 3896 WMIC.exe Token: SeProfSingleProcessPrivilege 3896 WMIC.exe Token: SeIncBasePriorityPrivilege 3896 WMIC.exe Token: SeCreatePagefilePrivilege 3896 WMIC.exe Token: SeBackupPrivilege 3896 WMIC.exe Token: SeRestorePrivilege 3896 WMIC.exe Token: SeShutdownPrivilege 3896 WMIC.exe Token: SeDebugPrivilege 3896 WMIC.exe Token: SeSystemEnvironmentPrivilege 3896 WMIC.exe Token: SeRemoteShutdownPrivilege 3896 WMIC.exe Token: SeUndockPrivilege 3896 WMIC.exe Token: SeManageVolumePrivilege 3896 WMIC.exe Token: 33 3896 WMIC.exe Token: 34 3896 WMIC.exe Token: 35 3896 WMIC.exe Token: 36 3896 WMIC.exe Token: SeIncreaseQuotaPrivilege 3896 WMIC.exe Token: SeSecurityPrivilege 3896 WMIC.exe Token: SeTakeOwnershipPrivilege 3896 WMIC.exe Token: SeLoadDriverPrivilege 3896 WMIC.exe Token: SeSystemProfilePrivilege 3896 WMIC.exe Token: SeSystemtimePrivilege 3896 WMIC.exe Token: SeProfSingleProcessPrivilege 3896 WMIC.exe Token: SeIncBasePriorityPrivilege 3896 WMIC.exe Token: SeCreatePagefilePrivilege 3896 WMIC.exe Token: SeBackupPrivilege 3896 WMIC.exe Token: SeRestorePrivilege 3896 WMIC.exe Token: SeShutdownPrivilege 3896 WMIC.exe Token: SeDebugPrivilege 3896 WMIC.exe Token: SeSystemEnvironmentPrivilege 3896 WMIC.exe Token: SeRemoteShutdownPrivilege 3896 WMIC.exe Token: SeUndockPrivilege 3896 WMIC.exe Token: SeManageVolumePrivilege 3896 WMIC.exe Token: 33 3896 WMIC.exe Token: 34 3896 WMIC.exe Token: 35 3896 WMIC.exe Token: 36 3896 WMIC.exe Token: SeIncreaseQuotaPrivilege 3972 WMIC.exe Token: SeSecurityPrivilege 3972 WMIC.exe Token: SeTakeOwnershipPrivilege 3972 WMIC.exe Token: SeLoadDriverPrivilege 3972 WMIC.exe Token: SeSystemProfilePrivilege 3972 WMIC.exe Token: SeSystemtimePrivilege 3972 WMIC.exe Token: SeProfSingleProcessPrivilege 3972 WMIC.exe Token: SeIncBasePriorityPrivilege 3972 WMIC.exe Token: SeCreatePagefilePrivilege 3972 WMIC.exe Token: SeBackupPrivilege 3972 WMIC.exe Token: SeRestorePrivilege 3972 WMIC.exe Token: SeShutdownPrivilege 3972 WMIC.exe Token: SeDebugPrivilege 3972 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exepid process 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.execmd.exe0xy5pqal.exeTaskHostHelper.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3940 wrote to memory of 1648 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe cmstp.exe PID 3940 wrote to memory of 1648 3940 7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe cmstp.exe PID 3968 wrote to memory of 3116 3968 cmd.exe 0xy5pqal.exe PID 3968 wrote to memory of 3116 3968 cmd.exe 0xy5pqal.exe PID 3968 wrote to memory of 3116 3968 cmd.exe 0xy5pqal.exe PID 3116 wrote to memory of 3156 3116 0xy5pqal.exe TaskHostHelper.exe PID 3116 wrote to memory of 3156 3116 0xy5pqal.exe TaskHostHelper.exe PID 3116 wrote to memory of 3156 3116 0xy5pqal.exe TaskHostHelper.exe PID 3156 wrote to memory of 4032 3156 TaskHostHelper.exe mshta.exe PID 3156 wrote to memory of 4032 3156 TaskHostHelper.exe mshta.exe PID 3156 wrote to memory of 4032 3156 TaskHostHelper.exe mshta.exe PID 3156 wrote to memory of 3912 3156 TaskHostHelper.exe WScript.exe PID 3156 wrote to memory of 3912 3156 TaskHostHelper.exe WScript.exe PID 3156 wrote to memory of 3912 3156 TaskHostHelper.exe WScript.exe PID 3156 wrote to memory of 2276 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2276 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2276 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2172 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2172 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2172 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2916 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2916 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2916 3156 TaskHostHelper.exe cmd.exe PID 2276 wrote to memory of 412 2276 cmd.exe vssadmin.exe PID 2276 wrote to memory of 412 2276 cmd.exe vssadmin.exe PID 2276 wrote to memory of 412 2276 cmd.exe vssadmin.exe PID 2172 wrote to memory of 3896 2172 cmd.exe WMIC.exe PID 2172 wrote to memory of 3896 2172 cmd.exe WMIC.exe PID 2172 wrote to memory of 3896 2172 cmd.exe WMIC.exe PID 3156 wrote to memory of 2068 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2068 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2068 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 1456 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 1456 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 1456 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 3432 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 3432 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 3432 3156 TaskHostHelper.exe cmd.exe PID 2068 wrote to memory of 508 2068 cmd.exe vssadmin.exe PID 2068 wrote to memory of 508 2068 cmd.exe vssadmin.exe PID 2068 wrote to memory of 508 2068 cmd.exe vssadmin.exe PID 1456 wrote to memory of 3972 1456 cmd.exe WMIC.exe PID 1456 wrote to memory of 3972 1456 cmd.exe WMIC.exe PID 1456 wrote to memory of 3972 1456 cmd.exe WMIC.exe PID 3156 wrote to memory of 2400 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2400 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2400 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2168 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2168 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 2168 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 3260 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 3260 3156 TaskHostHelper.exe cmd.exe PID 3156 wrote to memory of 3260 3156 TaskHostHelper.exe cmd.exe PID 2400 wrote to memory of 2272 2400 cmd.exe vssadmin.exe PID 2400 wrote to memory of 2272 2400 cmd.exe vssadmin.exe PID 2400 wrote to memory of 2272 2400 cmd.exe vssadmin.exe PID 2168 wrote to memory of 3572 2168 cmd.exe WMIC.exe PID 2168 wrote to memory of 3572 2168 cmd.exe WMIC.exe PID 2168 wrote to memory of 3572 2168 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe"C:\Users\Admin\AppData\Local\Temp\7d017b752826bf83685828bebc8a00b050490f46aaa8c21b0dd1020f0c9b563e.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\q3ppw5jw.inf2⤵
-
C:\Windows\system32\cmd.execmd /c start C:\Windows\temp\0xy5pqal.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\0xy5pqal.exeC:\Windows\temp\0xy5pqal.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TaskHostHelper.exe"C:\Users\Admin\AppData\Local\Temp\TaskHostHelper.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\READ_ME.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}4⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Windows\System32\RNSNKMA6.vbs"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3a41⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TaskHostHelper.exeMD5
c6ec91aaa2bba2deb31fb645a2f9b9e4
SHA1a921f8a827897250ebbc9847ea113f56dbb1c18d
SHA256b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0
SHA51213571cf45881b5d4ef0904f2aa0e091e9fe895bf038b71075f09a051318cf052e0737ad1fab5549e5143e866fda816ce282a2330dea128357e201948b8ce7019
-
C:\Users\Admin\AppData\Local\Temp\TaskHostHelper.exeMD5
c6ec91aaa2bba2deb31fb645a2f9b9e4
SHA1a921f8a827897250ebbc9847ea113f56dbb1c18d
SHA256b5e178f6b78d77fa92e271409eb3d0472c5608df13fbb7de1f8501f0ee87a8d0
SHA51213571cf45881b5d4ef0904f2aa0e091e9fe895bf038b71075f09a051318cf052e0737ad1fab5549e5143e866fda816ce282a2330dea128357e201948b8ce7019
-
C:\Users\Admin\Desktop\READ_ME.htaMD5
a076b2df780ea7d573ffd70ce0c603ea
SHA1226531b08d9cdccf6de988172ed1e144b1d0be57
SHA2566d5c611b01516055bbc4a56e992e7d90fcab562448d5b56a179d0f286c4b356a
SHA512aa610f6f9c1b7cefe0f4bffe6acaae668b33e19430e137523193a51f30dd89b096b9fd29f323e9c1f71da0e6d99b8d8cb2eb334275db5ac02375af447a0e7fdd
-
C:\Windows\SysWOW64\RNSNKMA6.vbsMD5
07641762ad9c0d4b5983babccecb071b
SHA184afb077fccaa75f82338c30c5d03f4b67e39c62
SHA256c65ff4443a32b8144455278a1fd98d442e1ad76f738a82668b2229acd7a2a117
SHA5124be951540e9ad6c0eba31a1c31899ee1b327b4f37410cfc1f8a2fa8b27d705a265053f4ace0e8997b2ba337d293adb8d122860a85b775c41dfea5e1f252977ff
-
C:\Windows\Temp\0xy5pqal.exeMD5
f3d78f15bf85aa14f71979585d310ae7
SHA11e73b89abd5e0e0e74291d5ebb4f10574a9ef2e2
SHA256bb1b5b72a867a401876a6ad6a9bcc1f4af9f4e4fdb568ef7ce2b812796b48c7a
SHA512ef251e35c6047df225d937b568ded6ad9ee8e72235fac6ce6c04e9287f01aad65c63ada7e65e304ac094029f0a768d2697c3960dde818f7cf0f73cd81283e087
-
C:\Windows\temp\0xy5pqal.exeMD5
f3d78f15bf85aa14f71979585d310ae7
SHA11e73b89abd5e0e0e74291d5ebb4f10574a9ef2e2
SHA256bb1b5b72a867a401876a6ad6a9bcc1f4af9f4e4fdb568ef7ce2b812796b48c7a
SHA512ef251e35c6047df225d937b568ded6ad9ee8e72235fac6ce6c04e9287f01aad65c63ada7e65e304ac094029f0a768d2697c3960dde818f7cf0f73cd81283e087
-
C:\Windows\temp\q3ppw5jw.infMD5
ad64686d8e7e318b7bf2597ca54ef669
SHA12da9ff5aefe90c319dea0e933bdf360976682c63
SHA25609ef9046fb40d5623b5f8b82aae4877b7327667b8fc61cd7a4bc6ea4fccab320
SHA51221b67e773578153b54d7058a08e7cb945c9d07f9bf42b4426d71dea31763625db18c5992c1b5e80e4f34935dd9f130e75442d890d254f08b2ad06786d6d281f5
-
memory/412-41-0x0000000000000000-mapping.dmp
-
memory/508-46-0x0000000000000000-mapping.dmp
-
memory/1456-44-0x0000000000000000-mapping.dmp
-
memory/1648-9-0x000001AC52A20000-0x000001AC52A21000-memory.dmpFilesize
4KB
-
memory/1648-15-0x000001AC52A20000-0x000001AC52B21000-memory.dmpFilesize
1.0MB
-
memory/1648-7-0x000001AC52A20000-0x000001AC52A21000-memory.dmpFilesize
4KB
-
memory/1648-5-0x0000000000000000-mapping.dmp
-
memory/2068-43-0x0000000000000000-mapping.dmp
-
memory/2168-49-0x0000000000000000-mapping.dmp
-
memory/2172-37-0x0000000000000000-mapping.dmp
-
memory/2272-51-0x0000000000000000-mapping.dmp
-
memory/2276-36-0x0000000000000000-mapping.dmp
-
memory/2400-48-0x0000000000000000-mapping.dmp
-
memory/2916-39-0x0000000000000000-mapping.dmp
-
memory/3116-16-0x0000000000000000-mapping.dmp
-
memory/3116-19-0x0000000073BA0000-0x000000007428E000-memory.dmpFilesize
6.9MB
-
memory/3116-22-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/3116-20-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/3156-23-0x0000000000000000-mapping.dmp
-
memory/3156-31-0x0000000005720000-0x0000000005721000-memory.dmpFilesize
4KB
-
memory/3156-32-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/3156-33-0x0000000005943000-0x0000000005945000-memory.dmpFilesize
8KB
-
memory/3156-29-0x0000000005BD0000-0x0000000005BD1000-memory.dmpFilesize
4KB
-
memory/3156-27-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB
-
memory/3156-26-0x0000000073BA0000-0x000000007428E000-memory.dmpFilesize
6.9MB
-
memory/3156-30-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/3260-50-0x0000000000000000-mapping.dmp
-
memory/3432-45-0x0000000000000000-mapping.dmp
-
memory/3572-52-0x0000000000000000-mapping.dmp
-
memory/3896-42-0x0000000000000000-mapping.dmp
-
memory/3912-35-0x0000000000000000-mapping.dmp
-
memory/3940-13-0x0000000002D82000-0x0000000002D84000-memory.dmpFilesize
8KB
-
memory/3940-2-0x00007FF8EA2B0000-0x00007FF8EAC9C000-memory.dmpFilesize
9.9MB
-
memory/3940-14-0x0000000002D84000-0x0000000002D86000-memory.dmpFilesize
8KB
-
memory/3940-3-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/3940-12-0x0000000002D80000-0x0000000002D82000-memory.dmpFilesize
8KB
-
memory/3972-47-0x0000000000000000-mapping.dmp
-
memory/4032-34-0x0000000000000000-mapping.dmp