Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    28-09-2021 05:56

General

  • Target

    info.txt.js

  • Size

    3KB

  • MD5

    a7d8a48297c4927fd6d9fa9bfd224871

  • SHA1

    07f40176246032463687f71e63bfbf42276f95b3

  • SHA256

    7f99624842278a1f965ff411dc0efe4c26b1bb2d22099ab7fc87f5d8508b0413

  • SHA512

    9971a6e9c33fbcc13f47b6025f876b7dded0406c389e5e014f210173c55ccd4f2eccab293c34527204d7572e04ed83afee406bfe8049cb89d1adc97145144a2d

Malware Config

Signatures

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

  • Taurus Stealer Payload 3 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Blocklisted process makes network request 11 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\info.txt.js
    1⤵
    • Deletes itself
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\rtbGdENb.jse"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Users\Admin\AppData\Local\Temp\Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1684
        • C:\Users\Admin\AppData\Local\Temp\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of WriteProcessMemory
          PID:620
          • C:\Users\Admin\AppData\Local\Temp\Clfbibif.exe
            "C:\Users\Admin\AppData\Local\Temp\Clfbibif.exe"
            5⤵
            • Executes dropped EXE
            • Checks BIOS information in registry
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of WriteProcessMemory
            PID:1572
            • C:\Windows\system32\cmd.exe
              "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2024
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1404
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1952
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:472
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:376
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\Clfbibif.exe"
              6⤵
              • Loads dropped DLL
              PID:1288
              • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
                C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\Clfbibif.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1732
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"' & exit
                  8⤵
                    PID:720
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"'
                      9⤵
                      • Creates scheduled task(s)
                      PID:1752
                  • C:\Users\Admin\AppData\Local\Temp\services32.exe
                    "C:\Users\Admin\AppData\Local\Temp\services32.exe"
                    8⤵
                    • Executes dropped EXE
                    • Checks BIOS information in registry
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:2016
                    • C:\Windows\system32\cmd.exe
                      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                      9⤵
                        PID:916
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                          10⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:852
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                          10⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:880
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                          10⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2024
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                          10⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1640
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\services32.exe"
                        9⤵
                        • Loads dropped DLL
                        PID:740
                        • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
                          C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\services32.exe"
                          10⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2028
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"' & exit
                            11⤵
                              PID:1180
                              • C:\Windows\system32\schtasks.exe
                                schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"'
                                12⤵
                                • Creates scheduled task(s)
                                PID:1556
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
                              "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
                              11⤵
                              • Executes dropped EXE
                              PID:1056
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
                              11⤵
                                PID:2044
                                • C:\Windows\system32\choice.exe
                                  choice /C Y /N /D Y /T 3
                                  12⤵
                                    PID:276
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
                            8⤵
                              PID:1972
                              • C:\Windows\system32\choice.exe
                                choice /C Y /N /D Y /T 3
                                9⤵
                                  PID:1704
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\Clfbibif.exe"
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1628
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\Clfbibif.exe"
                            6⤵
                            • Creates scheduled task(s)
                            PID:1940
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\ekfelBGb.exe"
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2004
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\ekfelBGb.exe"
                            6⤵
                            • Creates scheduled task(s)
                            PID:1616
                        • C:\Windows\SysWOW64\cmd.exe
                          /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\Setup.exe
                          5⤵
                            PID:1196
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout /t 3
                              6⤵
                              • Delays execution with timeout.exe
                              PID:1260
                  • C:\Windows\system32\taskeng.exe
                    taskeng.exe {FADEC855-AEF5-41DB-97F7-86119F6C9C66} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
                    1⤵
                      PID:1096

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\Clfbibif.exe

                      MD5

                      b4660eb00a0bda6878645d6a4d73f1b0

                      SHA1

                      7dde0bb3008f5f8f0a38ad891da8902e7b3713b2

                      SHA256

                      44d2f8c798594a326b6b66d3a0a611acb6b847ab3225579055bcc6605bff4b67

                      SHA512

                      a1de8d764aba5164ca7ae4b113f104953afe3a2b5eb07bc60b18d6eecc532ded29e65a21ab185c406a08c45a843a23441ee8fd0ba438dd01014cbed11b586dcc

                    • C:\Users\Admin\AppData\Local\Temp\Clfbibif.exe

                      MD5

                      b4660eb00a0bda6878645d6a4d73f1b0

                      SHA1

                      7dde0bb3008f5f8f0a38ad891da8902e7b3713b2

                      SHA256

                      44d2f8c798594a326b6b66d3a0a611acb6b847ab3225579055bcc6605bff4b67

                      SHA512

                      a1de8d764aba5164ca7ae4b113f104953afe3a2b5eb07bc60b18d6eecc532ded29e65a21ab185c406a08c45a843a23441ee8fd0ba438dd01014cbed11b586dcc

                    • C:\Users\Admin\AppData\Local\Temp\Setup.exe

                      MD5

                      68106119e2ebb4bf67817e6549871a74

                      SHA1

                      be2b0aa9150887fadd85a4c5795501e83a4e1ef4

                      SHA256

                      07f697a46c26e3b4149a0db587227d571f5ffae8e013276c5ca91618d5b8b0f4

                      SHA512

                      3b4ffac36c69e8bae20991d8fff7c2bc5734e944ea37d5212aedb1d319e430c373c310d0ee2460f02b08b56c915f1a507faae33f4e001e3a3bc5a48ee508dfa9

                    • C:\Users\Admin\AppData\Local\Temp\Setup.exe

                      MD5

                      68106119e2ebb4bf67817e6549871a74

                      SHA1

                      be2b0aa9150887fadd85a4c5795501e83a4e1ef4

                      SHA256

                      07f697a46c26e3b4149a0db587227d571f5ffae8e013276c5ca91618d5b8b0f4

                      SHA512

                      3b4ffac36c69e8bae20991d8fff7c2bc5734e944ea37d5212aedb1d319e430c373c310d0ee2460f02b08b56c915f1a507faae33f4e001e3a3bc5a48ee508dfa9

                    • C:\Users\Admin\AppData\Local\Temp\Setup.exe

                      MD5

                      68106119e2ebb4bf67817e6549871a74

                      SHA1

                      be2b0aa9150887fadd85a4c5795501e83a4e1ef4

                      SHA256

                      07f697a46c26e3b4149a0db587227d571f5ffae8e013276c5ca91618d5b8b0f4

                      SHA512

                      3b4ffac36c69e8bae20991d8fff7c2bc5734e944ea37d5212aedb1d319e430c373c310d0ee2460f02b08b56c915f1a507faae33f4e001e3a3bc5a48ee508dfa9

                    • C:\Users\Admin\AppData\Local\Temp\services32.exe

                      MD5

                      b4660eb00a0bda6878645d6a4d73f1b0

                      SHA1

                      7dde0bb3008f5f8f0a38ad891da8902e7b3713b2

                      SHA256

                      44d2f8c798594a326b6b66d3a0a611acb6b847ab3225579055bcc6605bff4b67

                      SHA512

                      a1de8d764aba5164ca7ae4b113f104953afe3a2b5eb07bc60b18d6eecc532ded29e65a21ab185c406a08c45a843a23441ee8fd0ba438dd01014cbed11b586dcc

                    • C:\Users\Admin\AppData\Local\Temp\services32.exe

                      MD5

                      b4660eb00a0bda6878645d6a4d73f1b0

                      SHA1

                      7dde0bb3008f5f8f0a38ad891da8902e7b3713b2

                      SHA256

                      44d2f8c798594a326b6b66d3a0a611acb6b847ab3225579055bcc6605bff4b67

                      SHA512

                      a1de8d764aba5164ca7ae4b113f104953afe3a2b5eb07bc60b18d6eecc532ded29e65a21ab185c406a08c45a843a23441ee8fd0ba438dd01014cbed11b586dcc

                    • C:\Users\Admin\AppData\Local\Temp\svchost32.exe

                      MD5

                      acc8d4e1ebe2a80fdddfccc9f1a023c1

                      SHA1

                      844b925ac0bf210a6b3cff6042f03fc37e958193

                      SHA256

                      051fd9088d21f0a61b2442f4a1d9835c98c6198d09aaa2671cacccd26ec2fafe

                      SHA512

                      c13f73565eed5850236ff3da9c333d7359a591c1569d8e70f1d6c3bfe38891cd5450ba24de5f6e92b1401c412d8f8219ef25b4956973e0f92b6bfe4575885070

                    • C:\Users\Admin\AppData\Local\Temp\svchost32.exe

                      MD5

                      acc8d4e1ebe2a80fdddfccc9f1a023c1

                      SHA1

                      844b925ac0bf210a6b3cff6042f03fc37e958193

                      SHA256

                      051fd9088d21f0a61b2442f4a1d9835c98c6198d09aaa2671cacccd26ec2fafe

                      SHA512

                      c13f73565eed5850236ff3da9c333d7359a591c1569d8e70f1d6c3bfe38891cd5450ba24de5f6e92b1401c412d8f8219ef25b4956973e0f92b6bfe4575885070

                    • C:\Users\Admin\AppData\Local\Temp\svchost32.exe

                      MD5

                      acc8d4e1ebe2a80fdddfccc9f1a023c1

                      SHA1

                      844b925ac0bf210a6b3cff6042f03fc37e958193

                      SHA256

                      051fd9088d21f0a61b2442f4a1d9835c98c6198d09aaa2671cacccd26ec2fafe

                      SHA512

                      c13f73565eed5850236ff3da9c333d7359a591c1569d8e70f1d6c3bfe38891cd5450ba24de5f6e92b1401c412d8f8219ef25b4956973e0f92b6bfe4575885070

                    • C:\Users\Admin\AppData\Local\Temp\svchost32.exe

                      MD5

                      acc8d4e1ebe2a80fdddfccc9f1a023c1

                      SHA1

                      844b925ac0bf210a6b3cff6042f03fc37e958193

                      SHA256

                      051fd9088d21f0a61b2442f4a1d9835c98c6198d09aaa2671cacccd26ec2fafe

                      SHA512

                      c13f73565eed5850236ff3da9c333d7359a591c1569d8e70f1d6c3bfe38891cd5450ba24de5f6e92b1401c412d8f8219ef25b4956973e0f92b6bfe4575885070

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe

                      MD5

                      812beec5864b07c7731ef249ea507f80

                      SHA1

                      b3e676a95d1fb0a37bc6cf68d265fb0978203cb7

                      SHA256

                      76431f8d6eb79586cf18b7fe473970f043ea4774c44abd8212dabfe2936df8e2

                      SHA512

                      87afd83e7ef4196ec0d950a3f7cc230670acfbc89b7b8b56052005c4150a628928f592d257e64601433b70708014d67d800d4e3e25c66616540063cd07e82cf2

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe

                      MD5

                      812beec5864b07c7731ef249ea507f80

                      SHA1

                      b3e676a95d1fb0a37bc6cf68d265fb0978203cb7

                      SHA256

                      76431f8d6eb79586cf18b7fe473970f043ea4774c44abd8212dabfe2936df8e2

                      SHA512

                      87afd83e7ef4196ec0d950a3f7cc230670acfbc89b7b8b56052005c4150a628928f592d257e64601433b70708014d67d800d4e3e25c66616540063cd07e82cf2

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                      MD5

                      a77a6f427f7f62529e868b7cf814ee98

                      SHA1

                      12e0df4a3799d2cdef29fddc254a871c04df008c

                      SHA256

                      1b57e439724c1fe1e3324c35ad380bfa88d342211dd2b2dfa48e3541349796a4

                      SHA512

                      c289160ddc477f951cf4e5fb2ccf39af77de6f5144f3e7cdd05d2d8cd14c8fb38a143134ed64c1887fc52bcc863f88fc838c19f8688546ace6d06a9bb0811445

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                      MD5

                      13af8161b935c620a73d36dd00327ce2

                      SHA1

                      fad232626b5f5ab88855b16427d8fb3efea9723b

                      SHA256

                      6852687d98931c0baac4f20ffaf670ac548e93066d844d7b22c91f220e94a43c

                      SHA512

                      8a443cc9957a585bedac7102c3d9f45ea59dd5208be27ee7451198027d5ce9ecb9215b87122db3c202b63543a49268d34f0eb98cc7869886feec9e4cc4d02a9a

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                      MD5

                      a77a6f427f7f62529e868b7cf814ee98

                      SHA1

                      12e0df4a3799d2cdef29fddc254a871c04df008c

                      SHA256

                      1b57e439724c1fe1e3324c35ad380bfa88d342211dd2b2dfa48e3541349796a4

                      SHA512

                      c289160ddc477f951cf4e5fb2ccf39af77de6f5144f3e7cdd05d2d8cd14c8fb38a143134ed64c1887fc52bcc863f88fc838c19f8688546ace6d06a9bb0811445

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                      MD5

                      13af8161b935c620a73d36dd00327ce2

                      SHA1

                      fad232626b5f5ab88855b16427d8fb3efea9723b

                      SHA256

                      6852687d98931c0baac4f20ffaf670ac548e93066d844d7b22c91f220e94a43c

                      SHA512

                      8a443cc9957a585bedac7102c3d9f45ea59dd5208be27ee7451198027d5ce9ecb9215b87122db3c202b63543a49268d34f0eb98cc7869886feec9e4cc4d02a9a

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                      MD5

                      a77a6f427f7f62529e868b7cf814ee98

                      SHA1

                      12e0df4a3799d2cdef29fddc254a871c04df008c

                      SHA256

                      1b57e439724c1fe1e3324c35ad380bfa88d342211dd2b2dfa48e3541349796a4

                      SHA512

                      c289160ddc477f951cf4e5fb2ccf39af77de6f5144f3e7cdd05d2d8cd14c8fb38a143134ed64c1887fc52bcc863f88fc838c19f8688546ace6d06a9bb0811445

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                      MD5

                      a77a6f427f7f62529e868b7cf814ee98

                      SHA1

                      12e0df4a3799d2cdef29fddc254a871c04df008c

                      SHA256

                      1b57e439724c1fe1e3324c35ad380bfa88d342211dd2b2dfa48e3541349796a4

                      SHA512

                      c289160ddc477f951cf4e5fb2ccf39af77de6f5144f3e7cdd05d2d8cd14c8fb38a143134ed64c1887fc52bcc863f88fc838c19f8688546ace6d06a9bb0811445

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                      MD5

                      13af8161b935c620a73d36dd00327ce2

                      SHA1

                      fad232626b5f5ab88855b16427d8fb3efea9723b

                      SHA256

                      6852687d98931c0baac4f20ffaf670ac548e93066d844d7b22c91f220e94a43c

                      SHA512

                      8a443cc9957a585bedac7102c3d9f45ea59dd5208be27ee7451198027d5ce9ecb9215b87122db3c202b63543a49268d34f0eb98cc7869886feec9e4cc4d02a9a

                    • C:\Users\Admin\AppData\Roaming\rtbGdENb.jse

                      MD5

                      0c16a5e293dcef0d5161f188ca8b1ed9

                      SHA1

                      c3ca13590f8c3964de3e639aa908ba9601fe2509

                      SHA256

                      3522c792d0b76231320540567d2fe4084a29060e14121635e68b90ee68c9a6d4

                      SHA512

                      4eed53d7d260497727c83b9876dad6ef0482474ac99291751357014006aaa581e1f91aa53a2fefb9bef8db5c364653375e42eacb554b698ff519b27aef1d84fb

                    • \??\PIPE\srvsvc

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \??\PIPE\srvsvc

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \??\PIPE\srvsvc

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \Users\Admin\AppData\Local\Temp\Clfbibif.exe

                      MD5

                      b4660eb00a0bda6878645d6a4d73f1b0

                      SHA1

                      7dde0bb3008f5f8f0a38ad891da8902e7b3713b2

                      SHA256

                      44d2f8c798594a326b6b66d3a0a611acb6b847ab3225579055bcc6605bff4b67

                      SHA512

                      a1de8d764aba5164ca7ae4b113f104953afe3a2b5eb07bc60b18d6eecc532ded29e65a21ab185c406a08c45a843a23441ee8fd0ba438dd01014cbed11b586dcc

                    • \Users\Admin\AppData\Local\Temp\Setup.exe

                      MD5

                      68106119e2ebb4bf67817e6549871a74

                      SHA1

                      be2b0aa9150887fadd85a4c5795501e83a4e1ef4

                      SHA256

                      07f697a46c26e3b4149a0db587227d571f5ffae8e013276c5ca91618d5b8b0f4

                      SHA512

                      3b4ffac36c69e8bae20991d8fff7c2bc5734e944ea37d5212aedb1d319e430c373c310d0ee2460f02b08b56c915f1a507faae33f4e001e3a3bc5a48ee508dfa9

                    • \Users\Admin\AppData\Local\Temp\services32.exe

                      MD5

                      b4660eb00a0bda6878645d6a4d73f1b0

                      SHA1

                      7dde0bb3008f5f8f0a38ad891da8902e7b3713b2

                      SHA256

                      44d2f8c798594a326b6b66d3a0a611acb6b847ab3225579055bcc6605bff4b67

                      SHA512

                      a1de8d764aba5164ca7ae4b113f104953afe3a2b5eb07bc60b18d6eecc532ded29e65a21ab185c406a08c45a843a23441ee8fd0ba438dd01014cbed11b586dcc

                    • \Users\Admin\AppData\Local\Temp\svchost32.exe

                      MD5

                      acc8d4e1ebe2a80fdddfccc9f1a023c1

                      SHA1

                      844b925ac0bf210a6b3cff6042f03fc37e958193

                      SHA256

                      051fd9088d21f0a61b2442f4a1d9835c98c6198d09aaa2671cacccd26ec2fafe

                      SHA512

                      c13f73565eed5850236ff3da9c333d7359a591c1569d8e70f1d6c3bfe38891cd5450ba24de5f6e92b1401c412d8f8219ef25b4956973e0f92b6bfe4575885070

                    • \Users\Admin\AppData\Local\Temp\svchost32.exe

                      MD5

                      acc8d4e1ebe2a80fdddfccc9f1a023c1

                      SHA1

                      844b925ac0bf210a6b3cff6042f03fc37e958193

                      SHA256

                      051fd9088d21f0a61b2442f4a1d9835c98c6198d09aaa2671cacccd26ec2fafe

                      SHA512

                      c13f73565eed5850236ff3da9c333d7359a591c1569d8e70f1d6c3bfe38891cd5450ba24de5f6e92b1401c412d8f8219ef25b4956973e0f92b6bfe4575885070

                    • \Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe

                      MD5

                      812beec5864b07c7731ef249ea507f80

                      SHA1

                      b3e676a95d1fb0a37bc6cf68d265fb0978203cb7

                      SHA256

                      76431f8d6eb79586cf18b7fe473970f043ea4774c44abd8212dabfe2936df8e2

                      SHA512

                      87afd83e7ef4196ec0d950a3f7cc230670acfbc89b7b8b56052005c4150a628928f592d257e64601433b70708014d67d800d4e3e25c66616540063cd07e82cf2

                    • memory/276-199-0x0000000000000000-mapping.dmp

                    • memory/376-119-0x0000000002752000-0x0000000002754000-memory.dmp

                      Filesize

                      8KB

                    • memory/376-113-0x0000000000000000-mapping.dmp

                    • memory/376-116-0x000007FEED7C0000-0x000007FEEE31D000-memory.dmp

                      Filesize

                      11.4MB

                    • memory/376-117-0x0000000002750000-0x0000000002752000-memory.dmp

                      Filesize

                      8KB

                    • memory/376-120-0x0000000002754000-0x0000000002757000-memory.dmp

                      Filesize

                      12KB

                    • memory/376-118-0x000000000275B000-0x000000000277A000-memory.dmp

                      Filesize

                      124KB

                    • memory/472-111-0x000000001B720000-0x000000001BA1F000-memory.dmp

                      Filesize

                      3.0MB

                    • memory/472-112-0x00000000028EB000-0x000000000290A000-memory.dmp

                      Filesize

                      124KB

                    • memory/472-109-0x00000000028E4000-0x00000000028E7000-memory.dmp

                      Filesize

                      12KB

                    • memory/472-108-0x00000000028E2000-0x00000000028E4000-memory.dmp

                      Filesize

                      8KB

                    • memory/472-106-0x000007FEED7C0000-0x000007FEEE31D000-memory.dmp

                      Filesize

                      11.4MB

                    • memory/472-99-0x0000000000000000-mapping.dmp

                    • memory/472-107-0x00000000028E0000-0x00000000028E2000-memory.dmp

                      Filesize

                      8KB

                    • memory/620-67-0x0000000000400000-0x000000000043A000-memory.dmp

                      Filesize

                      232KB

                    • memory/620-71-0x0000000000400000-0x000000000043A000-memory.dmp

                      Filesize

                      232KB

                    • memory/620-68-0x000000000041EB74-mapping.dmp

                    • memory/720-128-0x0000000000000000-mapping.dmp

                    • memory/740-180-0x0000000000000000-mapping.dmp

                    • memory/852-143-0x0000000000000000-mapping.dmp

                    • memory/852-146-0x000007FEED7C0000-0x000007FEEE31D000-memory.dmp

                      Filesize

                      11.4MB

                    • memory/852-148-0x0000000002320000-0x0000000002322000-memory.dmp

                      Filesize

                      8KB

                    • memory/852-149-0x0000000002322000-0x0000000002324000-memory.dmp

                      Filesize

                      8KB

                    • memory/852-150-0x0000000002324000-0x0000000002327000-memory.dmp

                      Filesize

                      12KB

                    • memory/852-156-0x000000000232B000-0x000000000234A000-memory.dmp

                      Filesize

                      124KB

                    • memory/880-164-0x000000000258B000-0x00000000025AA000-memory.dmp

                      Filesize

                      124KB

                    • memory/880-160-0x000000001B730000-0x000000001BA2F000-memory.dmp

                      Filesize

                      3.0MB

                    • memory/880-155-0x000007FEED7C0000-0x000007FEEE31D000-memory.dmp

                      Filesize

                      11.4MB

                    • memory/880-159-0x0000000002584000-0x0000000002587000-memory.dmp

                      Filesize

                      12KB

                    • memory/880-158-0x0000000002582000-0x0000000002584000-memory.dmp

                      Filesize

                      8KB

                    • memory/880-151-0x0000000000000000-mapping.dmp

                    • memory/880-157-0x0000000002580000-0x0000000002582000-memory.dmp

                      Filesize

                      8KB

                    • memory/916-142-0x0000000000000000-mapping.dmp

                    • memory/1056-190-0x0000000000000000-mapping.dmp

                    • memory/1056-193-0x000000013F410000-0x000000013F411000-memory.dmp

                      Filesize

                      4KB

                    • memory/1056-197-0x0000000002350000-0x0000000002352000-memory.dmp

                      Filesize

                      8KB

                    • memory/1180-187-0x0000000000000000-mapping.dmp

                    • memory/1196-81-0x0000000000000000-mapping.dmp

                    • memory/1288-121-0x0000000000000000-mapping.dmp

                    • memory/1404-96-0x000000000281B000-0x000000000283A000-memory.dmp

                      Filesize

                      124KB

                    • memory/1404-91-0x0000000002812000-0x0000000002814000-memory.dmp

                      Filesize

                      8KB

                    • memory/1404-86-0x0000000000000000-mapping.dmp

                    • memory/1404-90-0x0000000002810000-0x0000000002812000-memory.dmp

                      Filesize

                      8KB

                    • memory/1404-93-0x000000001B6F0000-0x000000001B9EF000-memory.dmp

                      Filesize

                      3.0MB

                    • memory/1404-88-0x000007FEED7C0000-0x000007FEEE31D000-memory.dmp

                      Filesize

                      11.4MB

                    • memory/1404-92-0x0000000002814000-0x0000000002817000-memory.dmp

                      Filesize

                      12KB

                    • memory/1556-188-0x0000000000000000-mapping.dmp

                    • memory/1572-80-0x000007FE80010000-0x000007FE80011000-memory.dmp

                      Filesize

                      4KB

                    • memory/1572-73-0x0000000000000000-mapping.dmp

                    • memory/1572-79-0x00000000004E0000-0x00000000004E1000-memory.dmp

                      Filesize

                      4KB

                    • memory/1572-89-0x000000001C590000-0x000000001C592000-memory.dmp

                      Filesize

                      8KB

                    • memory/1572-83-0x000000013FD90000-0x000000013FD91000-memory.dmp

                      Filesize

                      4KB

                    • memory/1616-82-0x0000000000000000-mapping.dmp

                    • memory/1628-75-0x0000000000000000-mapping.dmp

                    • memory/1640-178-0x0000000002964000-0x0000000002967000-memory.dmp

                      Filesize

                      12KB

                    • memory/1640-176-0x0000000002960000-0x0000000002962000-memory.dmp

                      Filesize

                      8KB

                    • memory/1640-174-0x000007FEED7C0000-0x000007FEEE31D000-memory.dmp

                      Filesize

                      11.4MB

                    • memory/1640-175-0x000000001B930000-0x000000001BC2F000-memory.dmp

                      Filesize

                      3.0MB

                    • memory/1640-169-0x0000000000000000-mapping.dmp

                    • memory/1640-179-0x000000000296B000-0x000000000298A000-memory.dmp

                      Filesize

                      124KB

                    • memory/1640-177-0x0000000002962000-0x0000000002964000-memory.dmp

                      Filesize

                      8KB

                    • memory/1684-60-0x0000000001290000-0x0000000001291000-memory.dmp

                      Filesize

                      4KB

                    • memory/1684-64-0x00000000055B0000-0x0000000005618000-memory.dmp

                      Filesize

                      416KB

                    • memory/1684-65-0x0000000000F50000-0x0000000000F91000-memory.dmp

                      Filesize

                      260KB

                    • memory/1684-63-0x0000000000620000-0x0000000000636000-memory.dmp

                      Filesize

                      88KB

                    • memory/1684-62-0x0000000005040000-0x0000000005041000-memory.dmp

                      Filesize

                      4KB

                    • memory/1684-59-0x0000000075821000-0x0000000075823000-memory.dmp

                      Filesize

                      8KB

                    • memory/1684-56-0x0000000000000000-mapping.dmp

                    • memory/1704-136-0x0000000000000000-mapping.dmp

                    • memory/1732-123-0x0000000000000000-mapping.dmp

                    • memory/1732-126-0x000000013FF50000-0x000000013FF51000-memory.dmp

                      Filesize

                      4KB

                    • memory/1732-131-0x000000001BCF0000-0x000000001BCF2000-memory.dmp

                      Filesize

                      8KB

                    • memory/1752-130-0x0000000000000000-mapping.dmp

                    • memory/1940-76-0x0000000000000000-mapping.dmp

                    • memory/1952-94-0x0000000000000000-mapping.dmp

                    • memory/1952-102-0x0000000001E02000-0x0000000001E04000-memory.dmp

                      Filesize

                      8KB

                    • memory/1952-98-0x000007FEED7C0000-0x000007FEEE31D000-memory.dmp

                      Filesize

                      11.4MB

                    • memory/1952-105-0x0000000001E04000-0x0000000001E07000-memory.dmp

                      Filesize

                      12KB

                    • memory/1952-101-0x0000000001E00000-0x0000000001E02000-memory.dmp

                      Filesize

                      8KB

                    • memory/1952-110-0x0000000001E0B000-0x0000000001E2A000-memory.dmp

                      Filesize

                      124KB

                    • memory/1972-135-0x0000000000000000-mapping.dmp

                    • memory/2004-77-0x0000000000000000-mapping.dmp

                    • memory/2012-54-0x0000000000000000-mapping.dmp

                    • memory/2016-138-0x00000000004E0000-0x00000000004E1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2016-147-0x00000000007B0000-0x00000000007B2000-memory.dmp

                      Filesize

                      8KB

                    • memory/2016-140-0x000000013F610000-0x000000013F611000-memory.dmp

                      Filesize

                      4KB

                    • memory/2016-133-0x0000000000000000-mapping.dmp

                    • memory/2016-139-0x000007FE80010000-0x000007FE80011000-memory.dmp

                      Filesize

                      4KB

                    • memory/2024-53-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

                      Filesize

                      8KB

                    • memory/2024-161-0x0000000000000000-mapping.dmp

                    • memory/2024-166-0x0000000002760000-0x0000000002762000-memory.dmp

                      Filesize

                      8KB

                    • memory/2024-167-0x0000000002762000-0x0000000002764000-memory.dmp

                      Filesize

                      8KB

                    • memory/2024-171-0x000000000276B000-0x000000000278A000-memory.dmp

                      Filesize

                      124KB

                    • memory/2024-85-0x0000000000000000-mapping.dmp

                    • memory/2024-165-0x000007FEED7C0000-0x000007FEEE31D000-memory.dmp

                      Filesize

                      11.4MB

                    • memory/2024-168-0x0000000002764000-0x0000000002767000-memory.dmp

                      Filesize

                      12KB

                    • memory/2028-185-0x000000013FC60000-0x000000013FC61000-memory.dmp

                      Filesize

                      4KB

                    • memory/2028-182-0x0000000000000000-mapping.dmp

                    • memory/2028-196-0x000000001BE10000-0x000000001BE12000-memory.dmp

                      Filesize

                      8KB

                    • memory/2044-198-0x0000000000000000-mapping.dmp