Analysis
-
max time kernel
82s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en -
submitted
20-09-2021 12:26
Static task
static1
Behavioral task
behavioral1
Sample
f6200b9b9789794de4a8d78f4ae96d22.exe
Resource
win7v20210408
General
-
Target
f6200b9b9789794de4a8d78f4ae96d22.exe
-
Size
292KB
-
MD5
f6200b9b9789794de4a8d78f4ae96d22
-
SHA1
1d18c71e7e4de5c6216653db5effba586345597c
-
SHA256
85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a
-
SHA512
5fd2e93293bf2ebe5b68e747dbed842c2f4fcd74dce883ffa7daa6daf647e41f4b1926fdf2f05048b3024609ef6805fb2a6b501c92335ab37098dfb6d4defa72
Malware Config
Extracted
xpertrat
3.0.10
Test
kapasky-antivirus.firewall-gateway.net:4000
L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0
Signatures
-
XpertRAT Core Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4764-513-0x0000000000401364-mapping.dmp xpertrat -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/4828-528-0x0000000000411654-mapping.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/1600-536-0x0000000000442F04-mapping.dmp WebBrowserPassView -
Nirsoft 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4828-528-0x0000000000411654-mapping.dmp Nirsoft behavioral2/memory/1600-536-0x0000000000442F04-mapping.dmp Nirsoft behavioral2/memory/1824-545-0x000000000040C2A8-mapping.dmp Nirsoft -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1016 notepad.exe -
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" f6200b9b9789794de4a8d78f4ae96d22.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe -
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f6200b9b9789794de4a8d78f4ae96d22.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1304 4796 WerFault.exe iexplore.exe 1436 4860 WerFault.exe iexplore.exe 4884 4876 WerFault.exe iexplore.exe -
Suspicious use of SetThreadContext 10 IoCs
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exef6200b9b9789794de4a8d78f4ae96d22.exeiexplore.exedescription pid process target process PID 3388 set thread context of 4720 3388 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 4720 set thread context of 4764 4720 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 4764 set thread context of 4784 4764 iexplore.exe iexplore.exe PID 4764 set thread context of 4796 4764 iexplore.exe iexplore.exe PID 4764 set thread context of 4828 4764 iexplore.exe iexplore.exe PID 4764 set thread context of 4860 4764 iexplore.exe iexplore.exe PID 4764 set thread context of 4876 4764 iexplore.exe iexplore.exe PID 4764 set thread context of 1600 4764 iexplore.exe iexplore.exe PID 4764 set thread context of 1672 4764 iexplore.exe iexplore.exe PID 4764 set thread context of 1824 4764 iexplore.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exef6200b9b9789794de4a8d78f4ae96d22.exef6200b9b9789794de4a8d78f4ae96d22.exeiexplore.exeiexplore.exepid process 3888 powershell.exe 3584 powershell.exe 3928 powershell.exe 3584 powershell.exe 3928 powershell.exe 3888 powershell.exe 3888 powershell.exe 3584 powershell.exe 3928 powershell.exe 3032 powershell.exe 3032 powershell.exe 3032 powershell.exe 3388 f6200b9b9789794de4a8d78f4ae96d22.exe 3388 f6200b9b9789794de4a8d78f4ae96d22.exe 3388 f6200b9b9789794de4a8d78f4ae96d22.exe 3388 f6200b9b9789794de4a8d78f4ae96d22.exe 3388 f6200b9b9789794de4a8d78f4ae96d22.exe 3388 f6200b9b9789794de4a8d78f4ae96d22.exe 4720 f6200b9b9789794de4a8d78f4ae96d22.exe 4720 f6200b9b9789794de4a8d78f4ae96d22.exe 4784 iexplore.exe 4784 iexplore.exe 4720 f6200b9b9789794de4a8d78f4ae96d22.exe 4720 f6200b9b9789794de4a8d78f4ae96d22.exe 1600 iexplore.exe 1600 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3584 powershell.exe Token: SeDebugPrivilege 3928 powershell.exe Token: SeDebugPrivilege 3888 powershell.exe Token: SeIncreaseQuotaPrivilege 3928 powershell.exe Token: SeSecurityPrivilege 3928 powershell.exe Token: SeTakeOwnershipPrivilege 3928 powershell.exe Token: SeLoadDriverPrivilege 3928 powershell.exe Token: SeSystemProfilePrivilege 3928 powershell.exe Token: SeSystemtimePrivilege 3928 powershell.exe Token: SeProfSingleProcessPrivilege 3928 powershell.exe Token: SeIncBasePriorityPrivilege 3928 powershell.exe Token: SeCreatePagefilePrivilege 3928 powershell.exe Token: SeBackupPrivilege 3928 powershell.exe Token: SeRestorePrivilege 3928 powershell.exe Token: SeShutdownPrivilege 3928 powershell.exe Token: SeDebugPrivilege 3928 powershell.exe Token: SeSystemEnvironmentPrivilege 3928 powershell.exe Token: SeRemoteShutdownPrivilege 3928 powershell.exe Token: SeUndockPrivilege 3928 powershell.exe Token: SeManageVolumePrivilege 3928 powershell.exe Token: 33 3928 powershell.exe Token: 34 3928 powershell.exe Token: 35 3928 powershell.exe Token: 36 3928 powershell.exe Token: SeIncreaseQuotaPrivilege 3584 powershell.exe Token: SeSecurityPrivilege 3584 powershell.exe Token: SeTakeOwnershipPrivilege 3584 powershell.exe Token: SeLoadDriverPrivilege 3584 powershell.exe Token: SeSystemProfilePrivilege 3584 powershell.exe Token: SeSystemtimePrivilege 3584 powershell.exe Token: SeProfSingleProcessPrivilege 3584 powershell.exe Token: SeIncBasePriorityPrivilege 3584 powershell.exe Token: SeCreatePagefilePrivilege 3584 powershell.exe Token: SeBackupPrivilege 3584 powershell.exe Token: SeRestorePrivilege 3584 powershell.exe Token: SeShutdownPrivilege 3584 powershell.exe Token: SeDebugPrivilege 3584 powershell.exe Token: SeSystemEnvironmentPrivilege 3584 powershell.exe Token: SeRemoteShutdownPrivilege 3584 powershell.exe Token: SeUndockPrivilege 3584 powershell.exe Token: SeManageVolumePrivilege 3584 powershell.exe Token: 33 3584 powershell.exe Token: 34 3584 powershell.exe Token: 35 3584 powershell.exe Token: 36 3584 powershell.exe Token: SeIncreaseQuotaPrivilege 3888 powershell.exe Token: SeSecurityPrivilege 3888 powershell.exe Token: SeTakeOwnershipPrivilege 3888 powershell.exe Token: SeLoadDriverPrivilege 3888 powershell.exe Token: SeSystemProfilePrivilege 3888 powershell.exe Token: SeSystemtimePrivilege 3888 powershell.exe Token: SeProfSingleProcessPrivilege 3888 powershell.exe Token: SeIncBasePriorityPrivilege 3888 powershell.exe Token: SeCreatePagefilePrivilege 3888 powershell.exe Token: SeBackupPrivilege 3888 powershell.exe Token: SeRestorePrivilege 3888 powershell.exe Token: SeShutdownPrivilege 3888 powershell.exe Token: SeDebugPrivilege 3888 powershell.exe Token: SeSystemEnvironmentPrivilege 3888 powershell.exe Token: SeRemoteShutdownPrivilege 3888 powershell.exe Token: SeUndockPrivilege 3888 powershell.exe Token: SeManageVolumePrivilege 3888 powershell.exe Token: 33 3888 powershell.exe Token: 34 3888 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exeiexplore.exepid process 4720 f6200b9b9789794de4a8d78f4ae96d22.exe 4764 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exef6200b9b9789794de4a8d78f4ae96d22.exeiexplore.exedescription pid process target process PID 3388 wrote to memory of 3928 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 3888 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 3928 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 3888 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 3928 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 3888 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 3584 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 3584 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 3584 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 3032 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 3032 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 3032 3388 f6200b9b9789794de4a8d78f4ae96d22.exe powershell.exe PID 3388 wrote to memory of 4716 3388 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 3388 wrote to memory of 4716 3388 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 3388 wrote to memory of 4716 3388 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 3388 wrote to memory of 4720 3388 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 3388 wrote to memory of 4720 3388 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 3388 wrote to memory of 4720 3388 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 3388 wrote to memory of 4720 3388 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 3388 wrote to memory of 4720 3388 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 3388 wrote to memory of 4720 3388 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 3388 wrote to memory of 4720 3388 f6200b9b9789794de4a8d78f4ae96d22.exe f6200b9b9789794de4a8d78f4ae96d22.exe PID 4720 wrote to memory of 4764 4720 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 4720 wrote to memory of 4764 4720 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 4720 wrote to memory of 4764 4720 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 4720 wrote to memory of 4764 4720 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 4720 wrote to memory of 4764 4720 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 4720 wrote to memory of 4764 4720 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 4720 wrote to memory of 4764 4720 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 4720 wrote to memory of 4764 4720 f6200b9b9789794de4a8d78f4ae96d22.exe iexplore.exe PID 4764 wrote to memory of 1016 4764 iexplore.exe notepad.exe PID 4764 wrote to memory of 1016 4764 iexplore.exe notepad.exe PID 4764 wrote to memory of 1016 4764 iexplore.exe notepad.exe PID 4764 wrote to memory of 1016 4764 iexplore.exe notepad.exe PID 4764 wrote to memory of 4784 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4784 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4784 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4784 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4784 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4784 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4784 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4784 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4796 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4796 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4796 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4796 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4796 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4796 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4796 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4796 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4796 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4828 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4828 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4828 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4828 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4828 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4828 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4828 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4828 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4828 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4860 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4860 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4860 4764 iexplore.exe iexplore.exe PID 4764 wrote to memory of 4860 4764 iexplore.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
f6200b9b9789794de4a8d78f4ae96d22.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f6200b9b9789794de4a8d78f4ae96d22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe"C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.bing.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.facebook.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.twitter.com2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exeC:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exeC:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
- Deletes itself
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck0.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck1.txt"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 925⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck1.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck2.txt"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 925⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck2.txt"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 925⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck2.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck3.txt"4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck4.txt"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
e71a0a7e48b10bde0a9c54387762f33e
SHA1fed75947f1163b00096e24a46e67d9c21e7eeebd
SHA25683d7be67d0eb544d655cc8e8eb687c26f772d6a40ebf8394e5c12b248976a2de
SHA512394c25daef6143de894505189b1edcdffb82fd6ab9de1c9e43865fb790803ff5c384debfe16236d4a9d95a78d3eea548d3cef332ed5a6881ac9c50d252c3c34a
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
e71a0a7e48b10bde0a9c54387762f33e
SHA1fed75947f1163b00096e24a46e67d9c21e7eeebd
SHA25683d7be67d0eb544d655cc8e8eb687c26f772d6a40ebf8394e5c12b248976a2de
SHA512394c25daef6143de894505189b1edcdffb82fd6ab9de1c9e43865fb790803ff5c384debfe16236d4a9d95a78d3eea548d3cef332ed5a6881ac9c50d252c3c34a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
3e77416d08e983c4998c643d5bcfac14
SHA1ffe76fe7b9acaf48ebb11799618b111c362d5ab3
SHA256fca58f3e1d9142142f68e503be69209cd16f7fa573b99a85f484898c68fac675
SHA512298e863d5cf308cd50ff1687fb076fe882ff72e5bc2f7b4775e5c88efad6ca15fbe252620228eee8e6e896460dca1a25bfb7402390d77438be5e7862ef24997d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
27e87e2444e75e1df647adc5c9a43364
SHA1b29220936e83725e2794e4523483214eea3cda35
SHA256c4175db27f7e960f30cbcad7541b3157b3a31ed521f79c66820febca3e4c18e8
SHA512f4dce6aeccda767db9e87ba00537ba46802da759cf0e2b2ae4b6ed515d3c7024277a4c92c95aac6905d9e2cbf7cec3ba0a02aaa8cbce1231262120e3ab8d8c75
-
C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck2.txtMD5
f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ykgleybck4.txtMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
memory/1016-520-0x0000000000000000-mapping.dmp
-
memory/1600-536-0x0000000000442F04-mapping.dmp
-
memory/1672-541-0x0000000000413750-mapping.dmp
-
memory/1824-545-0x000000000040C2A8-mapping.dmp
-
memory/3032-455-0x0000000001033000-0x0000000001034000-memory.dmpFilesize
4KB
-
memory/3032-409-0x0000000000000000-mapping.dmp
-
memory/3032-413-0x0000000001030000-0x0000000001031000-memory.dmpFilesize
4KB
-
memory/3032-415-0x0000000001032000-0x0000000001033000-memory.dmpFilesize
4KB
-
memory/3388-505-0x0000000006F10000-0x0000000006F56000-memory.dmpFilesize
280KB
-
memory/3388-119-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/3388-115-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/3388-506-0x0000000005010000-0x0000000005040000-memory.dmpFilesize
192KB
-
memory/3388-120-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/3388-118-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/3388-117-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/3584-139-0x0000000006B40000-0x0000000006B41000-memory.dmpFilesize
4KB
-
memory/3584-154-0x0000000007A10000-0x0000000007A11000-memory.dmpFilesize
4KB
-
memory/3584-151-0x0000000007580000-0x0000000007581000-memory.dmpFilesize
4KB
-
memory/3584-123-0x0000000000000000-mapping.dmp
-
memory/3584-144-0x0000000000E52000-0x0000000000E53000-memory.dmpFilesize
4KB
-
memory/3584-138-0x0000000000E50000-0x0000000000E51000-memory.dmpFilesize
4KB
-
memory/3584-209-0x0000000000E53000-0x0000000000E54000-memory.dmpFilesize
4KB
-
memory/3888-208-0x0000000006BA3000-0x0000000006BA4000-memory.dmpFilesize
4KB
-
memory/3888-142-0x0000000006BA2000-0x0000000006BA3000-memory.dmpFilesize
4KB
-
memory/3888-160-0x00000000082E0000-0x00000000082E1000-memory.dmpFilesize
4KB
-
memory/3888-136-0x0000000006BA0000-0x0000000006BA1000-memory.dmpFilesize
4KB
-
memory/3888-122-0x0000000000000000-mapping.dmp
-
memory/3888-148-0x0000000007A90000-0x0000000007A91000-memory.dmpFilesize
4KB
-
memory/3888-145-0x00000000079B0000-0x00000000079B1000-memory.dmpFilesize
4KB
-
memory/3928-157-0x00000000089F0000-0x00000000089F1000-memory.dmpFilesize
4KB
-
memory/3928-133-0x0000000007940000-0x0000000007941000-memory.dmpFilesize
4KB
-
memory/3928-210-0x0000000007303000-0x0000000007304000-memory.dmpFilesize
4KB
-
memory/3928-205-0x000000000A9D0000-0x000000000A9D1000-memory.dmpFilesize
4KB
-
memory/3928-137-0x0000000007300000-0x0000000007301000-memory.dmpFilesize
4KB
-
memory/3928-143-0x0000000007302000-0x0000000007303000-memory.dmpFilesize
4KB
-
memory/3928-121-0x0000000000000000-mapping.dmp
-
memory/3928-171-0x00000000098B0000-0x00000000098B1000-memory.dmpFilesize
4KB
-
memory/3928-176-0x00000000095A0000-0x00000000095A1000-memory.dmpFilesize
4KB
-
memory/3928-179-0x00000000095C0000-0x00000000095C1000-memory.dmpFilesize
4KB
-
memory/3928-130-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/4720-507-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4720-511-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4720-508-0x00000000004010B8-mapping.dmp
-
memory/4764-513-0x0000000000401364-mapping.dmp
-
memory/4784-522-0x0000000000423BC0-mapping.dmp
-
memory/4796-526-0x0000000000411654-mapping.dmp
-
memory/4828-528-0x0000000000411654-mapping.dmp
-
memory/4860-532-0x0000000000442F04-mapping.dmp
-
memory/4876-534-0x0000000000442F04-mapping.dmp