Analysis
-
max time kernel
147s -
max time network
166s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
23-10-2021 06:32
Static task
static1
Behavioral task
behavioral1
Sample
SKM20212210RFQ00100490100.exe
Resource
win7-en-20210920
General
-
Target
SKM20212210RFQ00100490100.exe
-
Size
714KB
-
MD5
937c3eeb4afc46f15972f8631f098fec
-
SHA1
b4f162eaca7ea8cca9f0e637ea81a4eb349fef1e
-
SHA256
b1b14fd02510b79ea7f4a9a767d3738fc9761ce0b5d8b0ca969912d7942e8a94
-
SHA512
07c0802c6a6e96b3a001ef5144f80260c1d17e8197fca77baadb52c1f3ec62e88d95ab72ba15a2edc70482c0df5c7f8985130ba64c3d98ec778f475da7bf3f63
Malware Config
Extracted
asyncrat
0.5.7B
Default
cigdem5.duckdns.org:6606
cigdem5.duckdns.org:7707
cigdem5.duckdns.org:8808
AsyncMutex_6SI8OkPnk
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1864-62-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1864-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1864-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1864-65-0x000000000040C73E-mapping.dmp asyncrat behavioral1/memory/1864-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1864-120-0x0000000000540000-0x000000000055B000-memory.dmp asyncrat -
Nirsoft 14 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exe Nirsoft -
Executes dropped EXE 6 IoCs
Processes:
uxmwgx.exeAdvancedRun.exeAdvancedRun.exeયੱੳછੲં੫દ੮ય੪ઞડ.exeAdvancedRun.exeAdvancedRun.exepid process 684 uxmwgx.exe 1908 AdvancedRun.exe 1700 AdvancedRun.exe 2028 યੱੳછੲં੫દ੮ય੪ઞડ.exe 2352 AdvancedRun.exe 2416 AdvancedRun.exe -
Drops startup file 2 IoCs
Processes:
uxmwgx.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe uxmwgx.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe uxmwgx.exe -
Loads dropped DLL 10 IoCs
Processes:
powershell.exeuxmwgx.exeAdvancedRun.exeયੱੳછੲં੫દ੮ય੪ઞડ.exeAdvancedRun.exepid process 1276 powershell.exe 684 uxmwgx.exe 684 uxmwgx.exe 1908 AdvancedRun.exe 1908 AdvancedRun.exe 684 uxmwgx.exe 2028 યੱੳછੲં੫દ੮ય੪ઞડ.exe 2028 યੱੳછੲં੫દ੮ય੪ઞડ.exe 2352 AdvancedRun.exe 2352 AdvancedRun.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
uxmwgx.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" uxmwgx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" uxmwgx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe = "0" uxmwgx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths uxmwgx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions uxmwgx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\uxmwgx.exe = "0" uxmwgx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe = "0" uxmwgx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection uxmwgx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features uxmwgx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" uxmwgx.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
uxmwgx.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 uxmwgx.exe Key opened \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 uxmwgx.exe Key opened \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 uxmwgx.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
uxmwgx.exeયੱੳછੲં੫દ੮ય੪ઞડ.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\યੱੳછੲં੫દ੮ય੪ઞડ = "C:\\Windows\\Cursors\\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\\svchost.exe" uxmwgx.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\યੱੳછੲં੫દ੮ય੪ઞડ = "C:\\Windows\\Cursors\\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\\svchost.exe" યੱੳછੲં੫દ੮ય੪ઞડ.exe -
Processes:
uxmwgx.exeયੱੳછੲં੫દ੮ય੪ઞડ.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uxmwgx.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA યੱੳછੲં੫દ੮ય੪ઞડ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" યੱੳછੲં੫દ੮ય੪ઞડ.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uxmwgx.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
Processes:
SKM20212210RFQ00100490100.exepid process 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SKM20212210RFQ00100490100.exedescription pid process target process PID 1420 set thread context of 1864 1420 SKM20212210RFQ00100490100.exe SKM20212210RFQ00100490100.exe -
Drops file in Windows directory 1 IoCs
Processes:
uxmwgx.exedescription ioc process File created C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe uxmwgx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
SKM20212210RFQ00100490100.exeSKM20212210RFQ00100490100.exeAdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeuxmwgx.exeAdvancedRun.exeAdvancedRun.exeયੱੳછੲં੫દ੮ય੪ઞડ.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1420 SKM20212210RFQ00100490100.exe 1864 SKM20212210RFQ00100490100.exe 1908 AdvancedRun.exe 1908 AdvancedRun.exe 1700 AdvancedRun.exe 1700 AdvancedRun.exe 796 powershell.exe 1560 powershell.exe 1620 powershell.exe 1028 powershell.exe 572 powershell.exe 1272 powershell.exe 1004 powershell.exe 940 powershell.exe 684 uxmwgx.exe 684 uxmwgx.exe 2352 AdvancedRun.exe 2352 AdvancedRun.exe 2416 AdvancedRun.exe 2416 AdvancedRun.exe 2028 યੱੳછੲં੫દ੮ય੪ઞડ.exe 2028 યੱੳછੲં੫દ੮ય੪ઞડ.exe 2504 powershell.exe 2476 powershell.exe 2528 powershell.exe 2592 powershell.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
SKM20212210RFQ00100490100.exeSKM20212210RFQ00100490100.exeuxmwgx.exeAdvancedRun.exeAdvancedRun.exeયੱੳછੲં੫દ੮ય੪ઞડ.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeAdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1420 SKM20212210RFQ00100490100.exe Token: SeDebugPrivilege 1864 SKM20212210RFQ00100490100.exe Token: SeDebugPrivilege 684 uxmwgx.exe Token: SeDebugPrivilege 1908 AdvancedRun.exe Token: SeImpersonatePrivilege 1908 AdvancedRun.exe Token: SeDebugPrivilege 1700 AdvancedRun.exe Token: SeImpersonatePrivilege 1700 AdvancedRun.exe Token: SeDebugPrivilege 2028 યੱੳછੲં੫દ੮ય੪ઞડ.exe Token: SeDebugPrivilege 796 powershell.exe Token: SeDebugPrivilege 1560 powershell.exe Token: SeDebugPrivilege 1620 powershell.exe Token: SeDebugPrivilege 1028 powershell.exe Token: SeDebugPrivilege 572 powershell.exe Token: SeDebugPrivilege 1272 powershell.exe Token: SeDebugPrivilege 1004 powershell.exe Token: SeDebugPrivilege 940 powershell.exe Token: SeDebugPrivilege 2352 AdvancedRun.exe Token: SeImpersonatePrivilege 2352 AdvancedRun.exe Token: SeDebugPrivilege 2416 AdvancedRun.exe Token: SeImpersonatePrivilege 2416 AdvancedRun.exe Token: SeDebugPrivilege 2504 powershell.exe Token: SeDebugPrivilege 2476 powershell.exe Token: SeDebugPrivilege 2528 powershell.exe Token: SeDebugPrivilege 2592 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SKM20212210RFQ00100490100.exeSKM20212210RFQ00100490100.execmd.exeuxmwgx.exeAdvancedRun.exeયੱੳછੲં੫દ੮ય੪ઞડ.exedescription pid process target process PID 1420 wrote to memory of 1864 1420 SKM20212210RFQ00100490100.exe SKM20212210RFQ00100490100.exe PID 1420 wrote to memory of 1864 1420 SKM20212210RFQ00100490100.exe SKM20212210RFQ00100490100.exe PID 1420 wrote to memory of 1864 1420 SKM20212210RFQ00100490100.exe SKM20212210RFQ00100490100.exe PID 1420 wrote to memory of 1864 1420 SKM20212210RFQ00100490100.exe SKM20212210RFQ00100490100.exe PID 1420 wrote to memory of 1864 1420 SKM20212210RFQ00100490100.exe SKM20212210RFQ00100490100.exe PID 1420 wrote to memory of 1864 1420 SKM20212210RFQ00100490100.exe SKM20212210RFQ00100490100.exe PID 1420 wrote to memory of 1864 1420 SKM20212210RFQ00100490100.exe SKM20212210RFQ00100490100.exe PID 1420 wrote to memory of 1864 1420 SKM20212210RFQ00100490100.exe SKM20212210RFQ00100490100.exe PID 1420 wrote to memory of 1864 1420 SKM20212210RFQ00100490100.exe SKM20212210RFQ00100490100.exe PID 1864 wrote to memory of 1372 1864 SKM20212210RFQ00100490100.exe cmd.exe PID 1864 wrote to memory of 1372 1864 SKM20212210RFQ00100490100.exe cmd.exe PID 1864 wrote to memory of 1372 1864 SKM20212210RFQ00100490100.exe cmd.exe PID 1864 wrote to memory of 1372 1864 SKM20212210RFQ00100490100.exe cmd.exe PID 1372 wrote to memory of 1276 1372 cmd.exe powershell.exe PID 1372 wrote to memory of 1276 1372 cmd.exe powershell.exe PID 1372 wrote to memory of 1276 1372 cmd.exe powershell.exe PID 1372 wrote to memory of 1276 1372 cmd.exe powershell.exe PID 684 wrote to memory of 1908 684 uxmwgx.exe AdvancedRun.exe PID 684 wrote to memory of 1908 684 uxmwgx.exe AdvancedRun.exe PID 684 wrote to memory of 1908 684 uxmwgx.exe AdvancedRun.exe PID 684 wrote to memory of 1908 684 uxmwgx.exe AdvancedRun.exe PID 1908 wrote to memory of 1700 1908 AdvancedRun.exe AdvancedRun.exe PID 1908 wrote to memory of 1700 1908 AdvancedRun.exe AdvancedRun.exe PID 1908 wrote to memory of 1700 1908 AdvancedRun.exe AdvancedRun.exe PID 1908 wrote to memory of 1700 1908 AdvancedRun.exe AdvancedRun.exe PID 684 wrote to memory of 1272 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1272 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1272 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1272 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 572 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 572 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 572 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 572 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1004 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1004 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1004 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1004 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 796 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 796 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 796 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 796 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 940 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 940 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 940 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 940 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 2028 684 uxmwgx.exe યੱੳછੲં੫દ੮ય੪ઞડ.exe PID 684 wrote to memory of 2028 684 uxmwgx.exe યੱੳછੲં੫દ੮ય੪ઞડ.exe PID 684 wrote to memory of 2028 684 uxmwgx.exe યੱੳછੲં੫દ੮ય੪ઞડ.exe PID 684 wrote to memory of 2028 684 uxmwgx.exe યੱੳછੲં੫દ੮ય੪ઞડ.exe PID 684 wrote to memory of 1028 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1028 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1028 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1028 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1620 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1620 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1620 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1620 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1560 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1560 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1560 684 uxmwgx.exe powershell.exe PID 684 wrote to memory of 1560 684 uxmwgx.exe powershell.exe PID 2028 wrote to memory of 2352 2028 યੱੳછੲં੫દ੮ય੪ઞડ.exe AdvancedRun.exe PID 2028 wrote to memory of 2352 2028 યੱੳછੲં੫દ੮ય੪ઞડ.exe AdvancedRun.exe PID 2028 wrote to memory of 2352 2028 યੱੳછੲં੫દ੮ય੪ઞડ.exe AdvancedRun.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
uxmwgx.exeયੱੳછੲં੫દ੮ય੪ઞડ.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uxmwgx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" યੱੳછੲં੫દ੮ય੪ઞડ.exe -
outlook_office_path 1 IoCs
Processes:
uxmwgx.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 uxmwgx.exe -
outlook_win_path 1 IoCs
Processes:
uxmwgx.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 uxmwgx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKM20212210RFQ00100490100.exe"C:\Users\Admin\AppData\Local\Temp\SKM20212210RFQ00100490100.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKM20212210RFQ00100490100.exe"C:\Users\Admin\AppData\Local\Temp\SKM20212210RFQ00100490100.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\uxmwgx.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\uxmwgx.exe"'4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\uxmwgx.exe"C:\Users\Admin\AppData\Local\Temp\uxmwgx.exe"5⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exe" /SpecialRun 4101d8 19087⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\uxmwgx.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\uxmwgx.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\uxmwgx.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exe" /SpecialRun 4101d8 23528⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe" -Force7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe" -Force7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe" -Force7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe" -Force7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe" -Force7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\uxmwgx.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\uxmwgx.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
C:\Users\Admin\AppData\Local\Temp\uxmwgx.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0238d91b6d303a9a28f9f5778a5861c2
SHA1c9a944374dac808d6f296343c120c17a1ea954b0
SHA256a35e126187ee31e0b600c34b315fc62fb4d569fbbf9fe0389dcf65a147b884ed
SHA512b70db24e6933596b88f76e78b73f3b80983a040e942d8543ad4785d37ca16607a12658263f7f1aefdec4e2d19acf4836f1a7aeaf2b3dd30d80e994d8a3c4b834
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0238d91b6d303a9a28f9f5778a5861c2
SHA1c9a944374dac808d6f296343c120c17a1ea954b0
SHA256a35e126187ee31e0b600c34b315fc62fb4d569fbbf9fe0389dcf65a147b884ed
SHA512b70db24e6933596b88f76e78b73f3b80983a040e942d8543ad4785d37ca16607a12658263f7f1aefdec4e2d19acf4836f1a7aeaf2b3dd30d80e994d8a3c4b834
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0238d91b6d303a9a28f9f5778a5861c2
SHA1c9a944374dac808d6f296343c120c17a1ea954b0
SHA256a35e126187ee31e0b600c34b315fc62fb4d569fbbf9fe0389dcf65a147b884ed
SHA512b70db24e6933596b88f76e78b73f3b80983a040e942d8543ad4785d37ca16607a12658263f7f1aefdec4e2d19acf4836f1a7aeaf2b3dd30d80e994d8a3c4b834
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0238d91b6d303a9a28f9f5778a5861c2
SHA1c9a944374dac808d6f296343c120c17a1ea954b0
SHA256a35e126187ee31e0b600c34b315fc62fb4d569fbbf9fe0389dcf65a147b884ed
SHA512b70db24e6933596b88f76e78b73f3b80983a040e942d8543ad4785d37ca16607a12658263f7f1aefdec4e2d19acf4836f1a7aeaf2b3dd30d80e994d8a3c4b834
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0238d91b6d303a9a28f9f5778a5861c2
SHA1c9a944374dac808d6f296343c120c17a1ea954b0
SHA256a35e126187ee31e0b600c34b315fc62fb4d569fbbf9fe0389dcf65a147b884ed
SHA512b70db24e6933596b88f76e78b73f3b80983a040e942d8543ad4785d37ca16607a12658263f7f1aefdec4e2d19acf4836f1a7aeaf2b3dd30d80e994d8a3c4b834
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0238d91b6d303a9a28f9f5778a5861c2
SHA1c9a944374dac808d6f296343c120c17a1ea954b0
SHA256a35e126187ee31e0b600c34b315fc62fb4d569fbbf9fe0389dcf65a147b884ed
SHA512b70db24e6933596b88f76e78b73f3b80983a040e942d8543ad4785d37ca16607a12658263f7f1aefdec4e2d19acf4836f1a7aeaf2b3dd30d80e994d8a3c4b834
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0238d91b6d303a9a28f9f5778a5861c2
SHA1c9a944374dac808d6f296343c120c17a1ea954b0
SHA256a35e126187ee31e0b600c34b315fc62fb4d569fbbf9fe0389dcf65a147b884ed
SHA512b70db24e6933596b88f76e78b73f3b80983a040e942d8543ad4785d37ca16607a12658263f7f1aefdec4e2d19acf4836f1a7aeaf2b3dd30d80e994d8a3c4b834
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\3d8e0c50-2335-477a-b29a-29bd67068cf5\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\e9174ce8-1afa-41c7-9570-16871c9a63de\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\uxmwgx.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
memory/572-144-0x0000000000000000-mapping.dmp
-
memory/572-191-0x0000000002440000-0x000000000308A000-memory.dmpFilesize
12.3MB
-
memory/572-190-0x0000000002440000-0x000000000308A000-memory.dmpFilesize
12.3MB
-
memory/684-130-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/796-177-0x0000000002082000-0x0000000002084000-memory.dmpFilesize
8KB
-
memory/796-176-0x0000000002081000-0x0000000002082000-memory.dmpFilesize
4KB
-
memory/796-147-0x0000000000000000-mapping.dmp
-
memory/796-175-0x0000000002080000-0x0000000002081000-memory.dmpFilesize
4KB
-
memory/940-178-0x0000000002460000-0x00000000030AA000-memory.dmpFilesize
12.3MB
-
memory/940-174-0x0000000002460000-0x00000000030AA000-memory.dmpFilesize
12.3MB
-
memory/940-148-0x0000000000000000-mapping.dmp
-
memory/940-171-0x0000000002460000-0x00000000030AA000-memory.dmpFilesize
12.3MB
-
memory/1004-172-0x00000000024A0000-0x00000000030EA000-memory.dmpFilesize
12.3MB
-
memory/1004-187-0x00000000024A0000-0x00000000030EA000-memory.dmpFilesize
12.3MB
-
memory/1004-173-0x00000000024A0000-0x00000000030EA000-memory.dmpFilesize
12.3MB
-
memory/1004-145-0x0000000000000000-mapping.dmp
-
memory/1028-189-0x0000000002260000-0x0000000002EAA000-memory.dmpFilesize
12.3MB
-
memory/1028-186-0x0000000002260000-0x0000000002EAA000-memory.dmpFilesize
12.3MB
-
memory/1028-157-0x0000000000000000-mapping.dmp
-
memory/1028-184-0x0000000002260000-0x0000000002EAA000-memory.dmpFilesize
12.3MB
-
memory/1272-185-0x0000000002490000-0x00000000030DA000-memory.dmpFilesize
12.3MB
-
memory/1272-192-0x0000000002490000-0x00000000030DA000-memory.dmpFilesize
12.3MB
-
memory/1272-143-0x0000000000000000-mapping.dmp
-
memory/1276-122-0x0000000000000000-mapping.dmp
-
memory/1372-121-0x0000000000000000-mapping.dmp
-
memory/1420-68-0x0000000000400000-0x0000000000402000-memory.dmpFilesize
8KB
-
memory/1420-54-0x00000000010A0000-0x00000000010A1000-memory.dmpFilesize
4KB
-
memory/1420-56-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB
-
memory/1420-57-0x0000000000200000-0x0000000000203000-memory.dmpFilesize
12KB
-
memory/1420-58-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/1420-59-0x00000000004C0000-0x00000000004E2000-memory.dmpFilesize
136KB
-
memory/1560-182-0x0000000001D61000-0x0000000001D62000-memory.dmpFilesize
4KB
-
memory/1560-183-0x0000000001D62000-0x0000000001D64000-memory.dmpFilesize
8KB
-
memory/1560-181-0x0000000001D60000-0x0000000001D61000-memory.dmpFilesize
4KB
-
memory/1560-163-0x0000000000000000-mapping.dmp
-
memory/1620-188-0x00000000024A0000-0x00000000030EA000-memory.dmpFilesize
12.3MB
-
memory/1620-179-0x00000000024A0000-0x00000000030EA000-memory.dmpFilesize
12.3MB
-
memory/1620-161-0x0000000000000000-mapping.dmp
-
memory/1700-140-0x0000000000000000-mapping.dmp
-
memory/1864-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1864-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1864-120-0x0000000000540000-0x000000000055B000-memory.dmpFilesize
108KB
-
memory/1864-65-0x000000000040C73E-mapping.dmp
-
memory/1864-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1864-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1864-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1864-119-0x0000000001040000-0x0000000001041000-memory.dmpFilesize
4KB
-
memory/1864-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1908-134-0x0000000000000000-mapping.dmp
-
memory/2028-170-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/2028-154-0x0000000000000000-mapping.dmp
-
memory/2352-196-0x0000000000000000-mapping.dmp
-
memory/2416-202-0x0000000000000000-mapping.dmp
-
memory/2476-205-0x0000000000000000-mapping.dmp
-
memory/2504-220-0x0000000001CA0000-0x0000000001CA1000-memory.dmpFilesize
4KB
-
memory/2504-206-0x0000000000000000-mapping.dmp
-
memory/2504-222-0x0000000001CA1000-0x0000000001CA2000-memory.dmpFilesize
4KB
-
memory/2504-223-0x0000000001CA2000-0x0000000001CA4000-memory.dmpFilesize
8KB
-
memory/2528-207-0x0000000000000000-mapping.dmp
-
memory/2528-221-0x00000000024B0000-0x00000000030FA000-memory.dmpFilesize
12.3MB
-
memory/2528-225-0x00000000024B0000-0x00000000030FA000-memory.dmpFilesize
12.3MB
-
memory/2528-224-0x00000000024B0000-0x00000000030FA000-memory.dmpFilesize
12.3MB
-
memory/2560-208-0x0000000000000000-mapping.dmp
-
memory/2592-209-0x0000000000000000-mapping.dmp
-
memory/2592-226-0x0000000002680000-0x00000000032CA000-memory.dmpFilesize
12.3MB