Malware Analysis Report

2024-10-23 20:10

Sample ID 210920-qbvklsghck
Target f6200b9b9789794de4a8d78f4ae96d22.exe
SHA256 85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a
Tags
xpertrat test evasion persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

85f0af15d708b6a2ea67a30f2a858efc9f32af678a5633289c297f588443cd7a

Threat Level: Known bad

The file f6200b9b9789794de4a8d78f4ae96d22.exe was found to be: Known bad.

Malicious Activity Summary

xpertrat test evasion persistence rat trojan upx

UAC bypass

XpertRAT Core Payload

XpertRAT

Windows security bypass

Nirsoft

NirSoft WebBrowserPassView

NirSoft MailPassView

UPX packed file

Adds policy Run key to start application

Windows security modification

Deletes itself

Adds Run key to start application

Checks whether UAC is enabled

Program crash

Suspicious use of SetThreadContext

Enumerates physical storage devices

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-09-20 13:05

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-09-20 13:05

Reported

2021-09-20 13:08

Platform

win7-en-20210916

Max time kernel

146s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe"

Signatures

UAC bypass

evasion trojan

Windows security bypass

evasion trojan

XpertRAT

rat xpertrat

XpertRAT Core Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2375386074-2889020035-839874990-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1244 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 1732 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1244 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1244 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1808 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1808 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1808 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1808 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1808 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1808 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1808 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1808 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1808 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1372 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 944 wrote to memory of 1372 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 944 wrote to memory of 1372 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 944 wrote to memory of 1372 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 944 wrote to memory of 1372 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 944 wrote to memory of 1072 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1072 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1072 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1072 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1072 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1072 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1072 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1072 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1072 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1120 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1120 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1120 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1120 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1120 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1120 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1120 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe

"C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.bing.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.facebook.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.twitter.com

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe

C:\Windows\SysWOW64\notepad.exe

notepad.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\devzyvbcn0.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\devzyvbcn1.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\devzyvbcn2.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\devzyvbcn3.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\devzyvbcn3.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\devzyvbcn3.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\devzyvbcn4.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.bing.com udp
US 8.8.8.8:53 www.twitter.com udp
US 8.8.8.8:53 kapasky-antivirus.firewall-gateway.net udp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp

Files

memory/1244-53-0x0000000000300000-0x0000000000301000-memory.dmp

memory/1244-55-0x0000000000700000-0x0000000000701000-memory.dmp

memory/1488-56-0x0000000000000000-mapping.dmp

memory/1484-57-0x0000000000000000-mapping.dmp

memory/1860-58-0x0000000000000000-mapping.dmp

memory/1488-59-0x0000000076921000-0x0000000076923000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 22fc90d8ac25dc49776d3c9f0e7a5547
SHA1 ae7015f1cc68004e83101d80d358e0ad25e926c6
SHA256 6defbb76c5baea614faf72db098e2f4adf77d0831d92f6b87b965a8c1e0e4413
SHA512 0535abbcf8b474f1526b3939f879be4945ccfddc2fd1612d6c116bf87f3d9fd82329efe77302667586aac24a9af9637f90da2c0320d01df270ed0388bae9aa66

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 22fc90d8ac25dc49776d3c9f0e7a5547
SHA1 ae7015f1cc68004e83101d80d358e0ad25e926c6
SHA256 6defbb76c5baea614faf72db098e2f4adf77d0831d92f6b87b965a8c1e0e4413
SHA512 0535abbcf8b474f1526b3939f879be4945ccfddc2fd1612d6c116bf87f3d9fd82329efe77302667586aac24a9af9637f90da2c0320d01df270ed0388bae9aa66

memory/1484-67-0x0000000002490000-0x00000000030DA000-memory.dmp

memory/1860-66-0x0000000002440000-0x000000000308A000-memory.dmp

memory/1484-64-0x0000000002490000-0x00000000030DA000-memory.dmp

memory/1488-68-0x00000000025C0000-0x000000000320A000-memory.dmp

memory/1488-65-0x00000000025C0000-0x000000000320A000-memory.dmp

memory/1732-69-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 22fc90d8ac25dc49776d3c9f0e7a5547
SHA1 ae7015f1cc68004e83101d80d358e0ad25e926c6
SHA256 6defbb76c5baea614faf72db098e2f4adf77d0831d92f6b87b965a8c1e0e4413
SHA512 0535abbcf8b474f1526b3939f879be4945ccfddc2fd1612d6c116bf87f3d9fd82329efe77302667586aac24a9af9637f90da2c0320d01df270ed0388bae9aa66

memory/1732-72-0x0000000002330000-0x0000000002F7A000-memory.dmp

memory/1244-73-0x0000000004EA0000-0x0000000004EE6000-memory.dmp

memory/1244-74-0x0000000002080000-0x00000000020B0000-memory.dmp

memory/1808-75-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1808-76-0x00000000004010B8-mapping.dmp

memory/944-79-0x0000000000400000-0x0000000000443000-memory.dmp

memory/944-80-0x0000000000401364-mapping.dmp

memory/944-81-0x00000000005D0000-0x0000000000723000-memory.dmp

memory/1372-84-0x0000000000000000-mapping.dmp

memory/1072-87-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1072-88-0x0000000000423BC0-mapping.dmp

memory/1120-90-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1120-91-0x0000000000411654-mapping.dmp

memory/1656-93-0x0000000000400000-0x0000000000459000-memory.dmp

memory/1656-94-0x0000000000442F04-mapping.dmp

C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\devzyvbcn2.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

memory/1720-98-0x0000000000413750-mapping.dmp

memory/1584-100-0x0000000000413750-mapping.dmp

memory/1480-101-0x0000000000400000-0x0000000000416000-memory.dmp

memory/1480-102-0x0000000000413750-mapping.dmp

memory/792-104-0x0000000000400000-0x0000000000415000-memory.dmp

memory/792-105-0x000000000040C2A8-mapping.dmp

C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\devzyvbcn4.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Analysis: behavioral2

Detonation Overview

Submitted

2021-09-20 13:05

Reported

2021-09-20 13:08

Platform

win10v20210408

Max time kernel

77s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe"

Signatures

UAC bypass

evasion trojan

Windows security bypass

evasion trojan

XpertRAT

rat xpertrat

XpertRAT Core Payload

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft MailPassView

Description Indicator Process Target
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A

Nirsoft

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 604 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 1388 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 604 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 604 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 604 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 604 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 604 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 604 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 604 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe
PID 1748 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 4072 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 1748 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 3980 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 3980 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 3980 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 3980 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\notepad.exe
PID 2912 wrote to memory of 1332 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1332 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1332 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1332 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1332 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1332 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1332 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1332 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1328 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1328 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1328 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1328 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1328 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1328 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1328 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 1328 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 2800 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 2800 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 2800 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 2800 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 2800 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 2800 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 2800 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 2800 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2912 wrote to memory of 2800 N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe

"C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.bing.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.facebook.com

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.twitter.com

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 92

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Admin\AppData\Local\Temp\f6200b9b9789794de4a8d78f4ae96d22.exe

C:\Windows\SysWOW64\notepad.exe

notepad.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka0.txt"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 92

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka0.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka1.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka2.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka3.txt"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka4.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.bing.com udp
US 8.8.8.8:53 www.twitter.com udp
US 8.8.8.8:53 kapasky-antivirus.firewall-gateway.net udp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp
FR 146.59.132.186:4000 kapasky-antivirus.firewall-gateway.net tcp

Files

memory/604-114-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

memory/604-116-0x0000000005D10000-0x0000000005D11000-memory.dmp

memory/604-117-0x00000000058B0000-0x00000000058B1000-memory.dmp

memory/604-118-0x0000000005810000-0x0000000005D0E000-memory.dmp

memory/604-119-0x0000000005950000-0x0000000005951000-memory.dmp

memory/1204-121-0x0000000000000000-mapping.dmp

memory/1216-120-0x0000000000000000-mapping.dmp

memory/1388-122-0x0000000000000000-mapping.dmp

memory/1204-129-0x00000000064E0000-0x00000000064E1000-memory.dmp

memory/1204-132-0x0000000006C80000-0x0000000006C81000-memory.dmp

memory/1216-136-0x00000000048C0000-0x00000000048C1000-memory.dmp

memory/1388-135-0x0000000006E00000-0x0000000006E01000-memory.dmp

memory/1204-137-0x0000000006640000-0x0000000006641000-memory.dmp

memory/1204-139-0x0000000006642000-0x0000000006643000-memory.dmp

memory/1216-138-0x00000000048C2000-0x00000000048C3000-memory.dmp

memory/1388-140-0x0000000006E02000-0x0000000006E03000-memory.dmp

memory/1204-141-0x0000000006AF0000-0x0000000006AF1000-memory.dmp

memory/1216-144-0x0000000007A00000-0x0000000007A01000-memory.dmp

memory/1216-147-0x0000000007C50000-0x0000000007C51000-memory.dmp

memory/1388-150-0x0000000007C50000-0x0000000007C51000-memory.dmp

memory/1216-153-0x0000000008090000-0x0000000008091000-memory.dmp

memory/1204-156-0x0000000007A30000-0x0000000007A31000-memory.dmp

memory/1388-159-0x00000000083D0000-0x00000000083D1000-memory.dmp

memory/1204-174-0x0000000008CF0000-0x0000000008CF1000-memory.dmp

memory/1388-177-0x0000000009070000-0x0000000009071000-memory.dmp

memory/1216-180-0x00000000090E0000-0x00000000090E1000-memory.dmp

memory/1388-204-0x000000000A420000-0x000000000A421000-memory.dmp

memory/1388-208-0x0000000006E03000-0x0000000006E04000-memory.dmp

memory/1216-207-0x00000000048C3000-0x00000000048C4000-memory.dmp

memory/1204-211-0x0000000006643000-0x0000000006644000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 e71a0a7e48b10bde0a9c54387762f33e
SHA1 fed75947f1163b00096e24a46e67d9c21e7eeebd
SHA256 83d7be67d0eb544d655cc8e8eb687c26f772d6a40ebf8394e5c12b248976a2de
SHA512 394c25daef6143de894505189b1edcdffb82fd6ab9de1c9e43865fb790803ff5c384debfe16236d4a9d95a78d3eea548d3cef332ed5a6881ac9c50d252c3c34a

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8660a4637b572e5e873ef1f732a82261
SHA1 296063f66b7c9147e4064edb938ee441284ac873
SHA256 90867b5af926f1ae0ed73fea9f4cf778f96af16fdcd8595f9fef456db0be074a
SHA512 b72cfdf0316db8beb6445c0710017222035c3ba7a7f47b8d72cdab9027c1e01524cc51930cf2cbfa2ce0912376ddf35f976095848e5ee3dc634e4a3421a4e3f6

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0c13f05a12dc83f890009cb5385ab227
SHA1 f1e7074e5cac5c93a0faa9abad3dbefdf4c5ed0e
SHA256 0af61ea8a157a08e01529c7f67a53921e3a7a27c842b01797d0db7eb5cb67c8d
SHA512 76022ac70111ab1c0329d6e791c31370bda7a4d38873b91c6e836001dc99e67a0d8d51bd6950f686d2401cbda518acf3ee035f512f8ca774fac2ef2717b39d00

memory/2276-408-0x0000000000000000-mapping.dmp

memory/2276-415-0x0000000004A30000-0x0000000004A31000-memory.dmp

memory/2276-416-0x0000000004A32000-0x0000000004A33000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2802260e694ebf1227e6e925af81980d
SHA1 8858ac84ed2b92df1298b129bd867ebe743a38b9
SHA256 cc0a6c1a887d205958ef32c526fa2ab6d42f8799ca8b95d5324473fefe65c833
SHA512 69c652e93c866c15b999ba641032be6a74f484441c6457df81d34fe13c2cb049a17144c19950dca1b5ec9e4099ff3829ea1285a71eb709095031bc15c9ea0773

memory/2276-440-0x0000000004A33000-0x0000000004A34000-memory.dmp

memory/604-504-0x0000000007CE0000-0x0000000007D26000-memory.dmp

memory/604-505-0x0000000005C30000-0x0000000005C60000-memory.dmp

memory/1748-506-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1748-507-0x00000000004010B8-mapping.dmp

memory/4072-511-0x0000000000401364-mapping.dmp

memory/1748-512-0x0000000000400000-0x000000000042C000-memory.dmp

memory/2912-514-0x0000000000401364-mapping.dmp

memory/3980-521-0x0000000000000000-mapping.dmp

memory/1332-523-0x0000000000423BC0-mapping.dmp

memory/1328-525-0x0000000000423BC0-mapping.dmp

memory/2800-529-0x0000000000411654-mapping.dmp

memory/1476-533-0x0000000000442F04-mapping.dmp

C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka2.txt

MD5 f94dc819ca773f1e3cb27abbc9e7fa27
SHA1 9a7700efadc5ea09ab288544ef1e3cd876255086
SHA256 a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA512 72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

memory/2728-538-0x0000000000413750-mapping.dmp

memory/2296-542-0x000000000040C2A8-mapping.dmp

C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\arzuswuka4.txt

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84