Malware Analysis Report

2024-10-23 20:10

Sample ID 210906-nzbfjaebem
Target EXCEL.exe
SHA256 862bf290697cfbd5cb41966b550e8b163aac94d6e07461c6e4353ea6fad62e83
Tags
xpertrat test evasion persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

862bf290697cfbd5cb41966b550e8b163aac94d6e07461c6e4353ea6fad62e83

Threat Level: Known bad

The file EXCEL.exe was found to be: Known bad.

Malicious Activity Summary

xpertrat test evasion persistence rat trojan upx

XpertRAT Core Payload

Windows security bypass

XpertRAT

UAC bypass

NirSoft WebBrowserPassView

Nirsoft

NirSoft MailPassView

Adds policy Run key to start application

UPX packed file

Deletes itself

Windows security modification

Adds Run key to start application

Checks whether UAC is enabled

Program crash

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

System policy modification

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-06 11:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-06 11:49

Reported

2021-09-06 11:52

Platform

win7-en

Max time kernel

140s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\EXCEL.exe"

Signatures

UAC bypass

evasion trojan

Windows security bypass

evasion trojan

XpertRAT

rat xpertrat

XpertRAT Core Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 736 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 1320 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 736 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 736 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 736 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 736 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 736 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 736 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 736 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 736 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 736 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 736 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 736 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 2008 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2008 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

"C:\Users\Admin\AppData\Local\Temp\EXCEL.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName youtube.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName facebook.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName outlook.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName bing.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Windows\SysWOW64\notepad.exe

notepad.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\oigetytud0.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\oigetytud1.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\oigetytud2.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\oigetytud3.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\oigetytud4.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 facebook.com udp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 bing.com udp
US 8.8.8.8:53 kapasky-antivirus.firewall-gateway.net udp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp

Files

memory/736-53-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

memory/736-55-0x0000000075E51000-0x0000000075E53000-memory.dmp

memory/736-56-0x0000000004890000-0x0000000004891000-memory.dmp

memory/1980-57-0x0000000000000000-mapping.dmp

memory/1980-59-0x0000000001E50000-0x0000000001E51000-memory.dmp

memory/1980-60-0x0000000001E51000-0x0000000001E52000-memory.dmp

memory/1980-61-0x0000000001E52000-0x0000000001E54000-memory.dmp

memory/1468-62-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 8ff59a39feae834f4574a358122a4a8b
SHA1 1d9b29d097fdcecf31b41f77ca9710cfb7322b8f
SHA256 d0efae4e1476e615da7d5947cb8f2def0d95705bee735d264cd099fefd5b23c1
SHA512 2cee2487fd686f8d6c4bdbd6c7895d83123ce98cec15ea7b8bbf7a3889150cbfdce76e243c73709a0ebf020a16e5eaef22c931e222e9c141f0f403cacfa5ee88

memory/1468-65-0x0000000002220000-0x0000000002E6A000-memory.dmp

memory/2024-66-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 8ff59a39feae834f4574a358122a4a8b
SHA1 1d9b29d097fdcecf31b41f77ca9710cfb7322b8f
SHA256 d0efae4e1476e615da7d5947cb8f2def0d95705bee735d264cd099fefd5b23c1
SHA512 2cee2487fd686f8d6c4bdbd6c7895d83123ce98cec15ea7b8bbf7a3889150cbfdce76e243c73709a0ebf020a16e5eaef22c931e222e9c141f0f403cacfa5ee88

memory/1624-69-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 8ff59a39feae834f4574a358122a4a8b
SHA1 1d9b29d097fdcecf31b41f77ca9710cfb7322b8f
SHA256 d0efae4e1476e615da7d5947cb8f2def0d95705bee735d264cd099fefd5b23c1
SHA512 2cee2487fd686f8d6c4bdbd6c7895d83123ce98cec15ea7b8bbf7a3889150cbfdce76e243c73709a0ebf020a16e5eaef22c931e222e9c141f0f403cacfa5ee88

memory/1320-72-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 8ff59a39feae834f4574a358122a4a8b
SHA1 1d9b29d097fdcecf31b41f77ca9710cfb7322b8f
SHA256 d0efae4e1476e615da7d5947cb8f2def0d95705bee735d264cd099fefd5b23c1
SHA512 2cee2487fd686f8d6c4bdbd6c7895d83123ce98cec15ea7b8bbf7a3889150cbfdce76e243c73709a0ebf020a16e5eaef22c931e222e9c141f0f403cacfa5ee88

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1320-76-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/1320-77-0x00000000020D1000-0x00000000020D2000-memory.dmp

memory/1320-78-0x00000000020D2000-0x00000000020D4000-memory.dmp

memory/324-79-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 8ff59a39feae834f4574a358122a4a8b
SHA1 1d9b29d097fdcecf31b41f77ca9710cfb7322b8f
SHA256 d0efae4e1476e615da7d5947cb8f2def0d95705bee735d264cd099fefd5b23c1
SHA512 2cee2487fd686f8d6c4bdbd6c7895d83123ce98cec15ea7b8bbf7a3889150cbfdce76e243c73709a0ebf020a16e5eaef22c931e222e9c141f0f403cacfa5ee88

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/736-83-0x0000000002150000-0x00000000021A5000-memory.dmp

memory/736-88-0x0000000004DD0000-0x0000000004DF8000-memory.dmp

memory/2008-90-0x00000000004010B8-mapping.dmp

memory/2008-89-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1252-94-0x0000000000401364-mapping.dmp

memory/1516-96-0x0000000000401364-mapping.dmp

memory/1560-98-0x0000000000401364-mapping.dmp

memory/1964-100-0x0000000000401364-mapping.dmp

memory/1964-99-0x0000000000400000-0x0000000000443000-memory.dmp

memory/1964-101-0x0000000000600000-0x0000000000753000-memory.dmp

memory/608-104-0x0000000000000000-mapping.dmp

memory/1396-107-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1396-108-0x0000000000423BC0-mapping.dmp

memory/1532-110-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1532-111-0x0000000000411654-mapping.dmp

memory/1692-113-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1692-114-0x0000000000442F04-mapping.dmp

C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\oigetytud2.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/564-117-0x0000000000400000-0x0000000000416000-memory.dmp

memory/564-118-0x0000000000413750-mapping.dmp

memory/532-120-0x0000000000400000-0x0000000000415000-memory.dmp

memory/532-121-0x000000000040C2A8-mapping.dmp

C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\oigetytud4.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-06 11:49

Reported

2021-09-06 11:52

Platform

win10v20210408

Max time kernel

38s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\EXCEL.exe"

Signatures

UAC bypass

evasion trojan

Windows security bypass

evasion trojan

XpertRAT

rat xpertrat

XpertRAT Core Payload

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1032 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1032 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1032 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1032 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1032 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1032 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1032 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1032 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1032 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1032 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 1032 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Users\Admin\AppData\Local\Temp\EXCEL.exe
PID 4700 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4700 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\EXCEL.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 5036 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 4956 wrote to memory of 5036 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 4956 wrote to memory of 5036 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 4956 wrote to memory of 5036 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 4956 wrote to memory of 2116 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 2116 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 2116 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 2116 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 2116 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 2116 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 2116 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 2116 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 1276 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 1276 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 1276 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 1276 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 1276 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 1276 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 1276 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 4956 wrote to memory of 1276 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\EXCEL.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

"C:\Users\Admin\AppData\Local\Temp\EXCEL.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName youtube.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName facebook.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName outlook.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName bing.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 92

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\EXCEL.exe

C:\Windows\SysWOW64\notepad.exe

notepad.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ljxvzuvwv0.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ljxvzuvwv1.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ljxvzuvwv2.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ljxvzuvwv3.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ljxvzuvwv4.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 facebook.com udp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 bing.com udp
US 8.8.8.8:53 kapasky-antivirus.firewall-gateway.net udp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp

Files

memory/1032-114-0x0000000000700000-0x0000000000701000-memory.dmp

memory/1032-116-0x00000000056D0000-0x00000000056D1000-memory.dmp

memory/1032-117-0x00000000051D0000-0x00000000051D1000-memory.dmp

memory/1032-118-0x00000000052C0000-0x00000000052C1000-memory.dmp

memory/1032-119-0x00000000051D0000-0x00000000056CE000-memory.dmp

memory/3548-120-0x0000000000000000-mapping.dmp

memory/3548-123-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

memory/3548-124-0x0000000006D10000-0x0000000006D11000-memory.dmp

memory/3548-125-0x0000000000E60000-0x0000000000E61000-memory.dmp

memory/3548-126-0x0000000000E62000-0x0000000000E63000-memory.dmp

memory/3548-127-0x0000000006B80000-0x0000000006B81000-memory.dmp

memory/3548-128-0x0000000007440000-0x0000000007441000-memory.dmp

memory/3548-129-0x0000000006C30000-0x0000000006C31000-memory.dmp

memory/3548-130-0x00000000074B0000-0x00000000074B1000-memory.dmp

memory/3548-131-0x0000000007820000-0x0000000007821000-memory.dmp

memory/3548-132-0x0000000007D80000-0x0000000007D81000-memory.dmp

memory/424-133-0x0000000000000000-mapping.dmp

memory/3548-138-0x0000000007C40000-0x0000000007C41000-memory.dmp

memory/424-145-0x0000000001110000-0x0000000001111000-memory.dmp

memory/424-146-0x0000000001112000-0x0000000001113000-memory.dmp

memory/2256-152-0x0000000000000000-mapping.dmp

memory/3548-161-0x0000000008C40000-0x0000000008C41000-memory.dmp

memory/424-163-0x00000000088A0000-0x00000000088A1000-memory.dmp

memory/424-166-0x0000000008910000-0x0000000008911000-memory.dmp

memory/2256-173-0x00000000073F0000-0x00000000073F1000-memory.dmp

memory/2256-174-0x00000000073F2000-0x00000000073F3000-memory.dmp

memory/3788-182-0x0000000000000000-mapping.dmp

memory/3548-196-0x0000000009D60000-0x0000000009D61000-memory.dmp

memory/424-199-0x0000000001113000-0x0000000001114000-memory.dmp

memory/3548-200-0x0000000000E63000-0x0000000000E64000-memory.dmp

memory/3788-201-0x00000000072B0000-0x00000000072B1000-memory.dmp

memory/3788-204-0x00000000072B2000-0x00000000072B3000-memory.dmp

memory/2256-254-0x00000000073F3000-0x00000000073F4000-memory.dmp

memory/4532-293-0x0000000000000000-mapping.dmp

memory/3788-309-0x00000000072B3000-0x00000000072B4000-memory.dmp

memory/4532-311-0x00000000011D0000-0x00000000011D1000-memory.dmp

memory/4532-313-0x00000000011D2000-0x00000000011D3000-memory.dmp

memory/4532-397-0x00000000011D3000-0x00000000011D4000-memory.dmp

memory/4392-475-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 c2d06c11dd1f1a8b1dedc1a311ca8cdc
SHA1 75c07243f9cb80a9c7aed2865f9c5192cc920e7e
SHA256 91ac15f1f176f74f02ce89ecdc443d8e33e0064c7bc69a87c7b2da145449d586
SHA512 db00860292c3e7430b1534f459c2f0f9778df3a94c51d622dcf1cde390a5539bdc6d60a0d41e6f1ed99a989f17ecb109abd4c17faac4cd398945536f1d0ebb4d

memory/4392-488-0x0000000006EA0000-0x0000000006EA1000-memory.dmp

memory/4392-489-0x0000000006EA2000-0x0000000006EA3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 c2d06c11dd1f1a8b1dedc1a311ca8cdc
SHA1 75c07243f9cb80a9c7aed2865f9c5192cc920e7e
SHA256 91ac15f1f176f74f02ce89ecdc443d8e33e0064c7bc69a87c7b2da145449d586
SHA512 db00860292c3e7430b1534f459c2f0f9778df3a94c51d622dcf1cde390a5539bdc6d60a0d41e6f1ed99a989f17ecb109abd4c17faac4cd398945536f1d0ebb4d

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0f130357f532401c1cd5e8d38cc9708f
SHA1 0b0ae24e88affedbd139d08a03a20d49801b50f6
SHA256 056c8df36d8abd06aa9c506e0e9329708e774132862a185f250acfb95a98fa69
SHA512 f6923dc793f1776738bc642b47cdb9b2998184b9f2e1ddeac6ee373b303848b157a0336d19aa12c86a7392612196b59a2725ff6574cbbc9714597b4e6857455a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0f130357f532401c1cd5e8d38cc9708f
SHA1 0b0ae24e88affedbd139d08a03a20d49801b50f6
SHA256 056c8df36d8abd06aa9c506e0e9329708e774132862a185f250acfb95a98fa69
SHA512 f6923dc793f1776738bc642b47cdb9b2998184b9f2e1ddeac6ee373b303848b157a0336d19aa12c86a7392612196b59a2725ff6574cbbc9714597b4e6857455a

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 e71a0a7e48b10bde0a9c54387762f33e
SHA1 fed75947f1163b00096e24a46e67d9c21e7eeebd
SHA256 83d7be67d0eb544d655cc8e8eb687c26f772d6a40ebf8394e5c12b248976a2de
SHA512 394c25daef6143de894505189b1edcdffb82fd6ab9de1c9e43865fb790803ff5c384debfe16236d4a9d95a78d3eea548d3cef332ed5a6881ac9c50d252c3c34a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 347ac96d0592d83d91877315bd0bd301
SHA1 6724aa09388f89a727ed7f7761a4fca0368ec679
SHA256 8a8f0a40fa6b3e5efacc9bc992baf570d4b27de323148487caa77fbc468cc15d
SHA512 ab3ff601c83fec79cf1a0f0a2b2a58b48a282bf5c1baa1adda6d0df1ceaf618dc1faaf1afe990c88aea43cb8b71fcbdb28a10fba38e9ac67adf09a0043278922

memory/4392-594-0x0000000006EA3000-0x0000000006EA4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 321848b0c119ff21e8c500732e9b3599
SHA1 8fcd2fbd0cbb7ea5ba2ed359e10f7027e999511b
SHA256 eb5cc7eeb3953ad2e6fb9853fad579b6573a1f5198a099be74bc31206ea639fa
SHA512 1d7e0952b5830287c5265a63f9b64c1e756b5379b32697cb13ca1aa593a2fd7bbb1a6c779a8e8e696013d63f093b4bb88f4a9f48211a178aacd21daf11891b4c

memory/4700-673-0x00000000004010B8-mapping.dmp

memory/4832-695-0x0000000000401364-mapping.dmp

memory/4700-696-0x0000000000400000-0x000000000042C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bb32447cae9c2c01ac3d10f608780106
SHA1 00d3624b8e0f6a7330215d8877a49c5b20283ae2
SHA256 36db91d7f4a871b659704f806ba1e54f1b055375cf7063d48133d0b232ef6271
SHA512 28eb69a00767f7757923788783416979d2ca0fcde9586f5d665015d9061d37ea54b8e9b22cfd917f52f037354a1b16214a0cfc9d9cbec14589080325adbda529

memory/4956-716-0x0000000000401364-mapping.dmp

memory/5036-724-0x0000000000000000-mapping.dmp

memory/2116-726-0x0000000000423BC0-mapping.dmp

memory/1276-730-0x0000000000411654-mapping.dmp

memory/720-734-0x0000000000442F04-mapping.dmp

C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ljxvzuvwv2.txt

MD5 f94dc819ca773f1e3cb27abbc9e7fa27
SHA1 9a7700efadc5ea09ab288544ef1e3cd876255086
SHA256 a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA512 72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

memory/3064-739-0x0000000000413750-mapping.dmp

memory/1108-743-0x000000000040C2A8-mapping.dmp

C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ljxvzuvwv4.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84