Analysis
-
max time kernel
300s -
max time network
291s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
23-10-2021 08:42
Static task
static1
Behavioral task
behavioral1
Sample
SKM__20212210RFQ00100490100.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
SKM__20212210RFQ00100490100.exe
Resource
win10-en-20210920
General
-
Target
SKM__20212210RFQ00100490100.exe
-
Size
714KB
-
MD5
937c3eeb4afc46f15972f8631f098fec
-
SHA1
b4f162eaca7ea8cca9f0e637ea81a4eb349fef1e
-
SHA256
b1b14fd02510b79ea7f4a9a767d3738fc9761ce0b5d8b0ca969912d7942e8a94
-
SHA512
07c0802c6a6e96b3a001ef5144f80260c1d17e8197fca77baadb52c1f3ec62e88d95ab72ba15a2edc70482c0df5c7f8985130ba64c3d98ec778f475da7bf3f63
Malware Config
Extracted
asyncrat
0.5.7B
Default
cigdem5.duckdns.org:6606
cigdem5.duckdns.org:7707
cigdem5.duckdns.org:8808
AsyncMutex_6SI8OkPnk
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Extracted
agenttesla
Protocol: smtp- Host:
smtp.vivaldi.net - Port:
587 - Username:
instigator@vivaldi.net - Password:
Davidchukwuka2016
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/296-150-0x0000000004480000-0x00000000044B6000-memory.dmp family_agenttesla behavioral1/memory/2704-182-0x00000000023F0000-0x000000000303A000-memory.dmp family_agenttesla -
Async RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1924-64-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1924-65-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1924-66-0x000000000040C73E-mapping.dmp asyncrat behavioral1/memory/1924-67-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1924-73-0x0000000000590000-0x00000000005AB000-memory.dmp asyncrat -
Nirsoft 14 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exe Nirsoft -
Executes dropped EXE 6 IoCs
Processes:
dicgue.exeAdvancedRun.exeAdvancedRun.exeયੱੳછੲં੫દ੮ય੪ઞડ.exeAdvancedRun.exeAdvancedRun.exepid process 296 dicgue.exe 1612 AdvancedRun.exe 736 AdvancedRun.exe 1604 યੱੳછੲં੫દ੮ય੪ઞડ.exe 2588 AdvancedRun.exe 2644 AdvancedRun.exe -
Drops startup file 2 IoCs
Processes:
dicgue.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe dicgue.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe dicgue.exe -
Loads dropped DLL 10 IoCs
Processes:
powershell.exedicgue.exeAdvancedRun.exeયੱੳછੲં੫દ੮ય੪ઞડ.exeAdvancedRun.exepid process 1660 powershell.exe 296 dicgue.exe 296 dicgue.exe 1612 AdvancedRun.exe 1612 AdvancedRun.exe 296 dicgue.exe 1604 યੱੳછੲં੫દ੮ય੪ઞડ.exe 1604 યੱੳછੲં੫દ੮ય੪ઞડ.exe 2588 AdvancedRun.exe 2588 AdvancedRun.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
dicgue.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" dicgue.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features dicgue.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" dicgue.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths dicgue.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions dicgue.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection dicgue.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe = "0" dicgue.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\dicgue.exe = "0" dicgue.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" dicgue.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe = "0" dicgue.exe -
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
dicgue.exeયੱੳછੲં੫દ੮ય੪ઞડ.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dicgue.exe Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dicgue.exe Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dicgue.exe Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 યੱੳછੲં੫દ੮ય੪ઞડ.exe Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 યੱੳછੲં੫દ੮ય੪ઞડ.exe Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 યੱੳછੲં੫દ੮ય੪ઞડ.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
dicgue.exeયੱੳછੲં੫દ੮ય੪ઞડ.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\યੱੳછੲં੫દ੮ય੪ઞડ = "C:\\Windows\\Cursors\\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\\svchost.exe" dicgue.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\યੱੳછੲં੫દ੮ય੪ઞડ = "C:\\Windows\\Cursors\\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\\svchost.exe" યੱੳછੲં੫દ੮ય੪ઞડ.exe -
Processes:
dicgue.exeયੱੳછੲં੫દ੮ય੪ઞડ.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dicgue.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA યੱੳછੲં੫દ੮ય੪ઞડ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" યੱੳછੲં੫દ੮ય੪ઞડ.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dicgue.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
Processes:
SKM__20212210RFQ00100490100.exepid process 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SKM__20212210RFQ00100490100.exedescription pid process target process PID 1524 set thread context of 1924 1524 SKM__20212210RFQ00100490100.exe SKM__20212210RFQ00100490100.exe -
Drops file in Windows directory 1 IoCs
Processes:
dicgue.exedescription ioc process File created C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe dicgue.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1664 1524 WerFault.exe SKM__20212210RFQ00100490100.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
SKM__20212210RFQ00100490100.exeWerFault.exeSKM__20212210RFQ00100490100.exepowershell.exeAdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedicgue.exeAdvancedRun.exeAdvancedRun.exeયੱੳછੲં੫દ੮ય੪ઞડ.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1524 SKM__20212210RFQ00100490100.exe 1664 WerFault.exe 1664 WerFault.exe 1664 WerFault.exe 1664 WerFault.exe 1664 WerFault.exe 1924 SKM__20212210RFQ00100490100.exe 1660 powershell.exe 1660 powershell.exe 1660 powershell.exe 1612 AdvancedRun.exe 1612 AdvancedRun.exe 736 AdvancedRun.exe 736 AdvancedRun.exe 860 powershell.exe 564 powershell.exe 1080 powershell.exe 1352 powershell.exe 1640 powershell.exe 1832 powershell.exe 1580 powershell.exe 412 powershell.exe 296 dicgue.exe 296 dicgue.exe 2588 AdvancedRun.exe 2588 AdvancedRun.exe 2644 AdvancedRun.exe 2644 AdvancedRun.exe 1604 યੱੳછੲં੫દ੮ય੪ઞડ.exe 1604 યੱੳછੲં੫દ੮ય੪ઞડ.exe 2680 powershell.exe 2704 powershell.exe 2796 powershell.exe 2768 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1664 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
SKM__20212210RFQ00100490100.exeWerFault.exeSKM__20212210RFQ00100490100.exepowershell.exedicgue.exeAdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeયੱੳછੲં੫દ੮ય੪ઞડ.exeAdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1524 SKM__20212210RFQ00100490100.exe Token: SeDebugPrivilege 1664 WerFault.exe Token: SeDebugPrivilege 1924 SKM__20212210RFQ00100490100.exe Token: SeDebugPrivilege 1660 powershell.exe Token: SeDebugPrivilege 296 dicgue.exe Token: SeDebugPrivilege 1612 AdvancedRun.exe Token: SeImpersonatePrivilege 1612 AdvancedRun.exe Token: SeDebugPrivilege 736 AdvancedRun.exe Token: SeImpersonatePrivilege 736 AdvancedRun.exe Token: SeDebugPrivilege 860 powershell.exe Token: SeDebugPrivilege 564 powershell.exe Token: SeDebugPrivilege 1080 powershell.exe Token: SeDebugPrivilege 1352 powershell.exe Token: SeDebugPrivilege 1640 powershell.exe Token: SeDebugPrivilege 1832 powershell.exe Token: SeDebugPrivilege 1580 powershell.exe Token: SeDebugPrivilege 412 powershell.exe Token: SeDebugPrivilege 1604 યੱੳછੲં੫દ੮ય੪ઞડ.exe Token: SeDebugPrivilege 2588 AdvancedRun.exe Token: SeImpersonatePrivilege 2588 AdvancedRun.exe Token: SeDebugPrivilege 2644 AdvancedRun.exe Token: SeImpersonatePrivilege 2644 AdvancedRun.exe Token: SeDebugPrivilege 2680 powershell.exe Token: SeDebugPrivilege 2704 powershell.exe Token: SeDebugPrivilege 2796 powershell.exe Token: SeDebugPrivilege 2768 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SKM__20212210RFQ00100490100.exeSKM__20212210RFQ00100490100.execmd.exepowershell.exedicgue.exeAdvancedRun.exedescription pid process target process PID 1524 wrote to memory of 1924 1524 SKM__20212210RFQ00100490100.exe SKM__20212210RFQ00100490100.exe PID 1524 wrote to memory of 1924 1524 SKM__20212210RFQ00100490100.exe SKM__20212210RFQ00100490100.exe PID 1524 wrote to memory of 1924 1524 SKM__20212210RFQ00100490100.exe SKM__20212210RFQ00100490100.exe PID 1524 wrote to memory of 1924 1524 SKM__20212210RFQ00100490100.exe SKM__20212210RFQ00100490100.exe PID 1524 wrote to memory of 1924 1524 SKM__20212210RFQ00100490100.exe SKM__20212210RFQ00100490100.exe PID 1524 wrote to memory of 1924 1524 SKM__20212210RFQ00100490100.exe SKM__20212210RFQ00100490100.exe PID 1524 wrote to memory of 1924 1524 SKM__20212210RFQ00100490100.exe SKM__20212210RFQ00100490100.exe PID 1524 wrote to memory of 1924 1524 SKM__20212210RFQ00100490100.exe SKM__20212210RFQ00100490100.exe PID 1524 wrote to memory of 1924 1524 SKM__20212210RFQ00100490100.exe SKM__20212210RFQ00100490100.exe PID 1524 wrote to memory of 1664 1524 SKM__20212210RFQ00100490100.exe WerFault.exe PID 1524 wrote to memory of 1664 1524 SKM__20212210RFQ00100490100.exe WerFault.exe PID 1524 wrote to memory of 1664 1524 SKM__20212210RFQ00100490100.exe WerFault.exe PID 1524 wrote to memory of 1664 1524 SKM__20212210RFQ00100490100.exe WerFault.exe PID 1924 wrote to memory of 1720 1924 SKM__20212210RFQ00100490100.exe cmd.exe PID 1924 wrote to memory of 1720 1924 SKM__20212210RFQ00100490100.exe cmd.exe PID 1924 wrote to memory of 1720 1924 SKM__20212210RFQ00100490100.exe cmd.exe PID 1924 wrote to memory of 1720 1924 SKM__20212210RFQ00100490100.exe cmd.exe PID 1720 wrote to memory of 1660 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 1660 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 1660 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 1660 1720 cmd.exe powershell.exe PID 1660 wrote to memory of 296 1660 powershell.exe dicgue.exe PID 1660 wrote to memory of 296 1660 powershell.exe dicgue.exe PID 1660 wrote to memory of 296 1660 powershell.exe dicgue.exe PID 1660 wrote to memory of 296 1660 powershell.exe dicgue.exe PID 296 wrote to memory of 1612 296 dicgue.exe AdvancedRun.exe PID 296 wrote to memory of 1612 296 dicgue.exe AdvancedRun.exe PID 296 wrote to memory of 1612 296 dicgue.exe AdvancedRun.exe PID 296 wrote to memory of 1612 296 dicgue.exe AdvancedRun.exe PID 1612 wrote to memory of 736 1612 AdvancedRun.exe AdvancedRun.exe PID 1612 wrote to memory of 736 1612 AdvancedRun.exe AdvancedRun.exe PID 1612 wrote to memory of 736 1612 AdvancedRun.exe AdvancedRun.exe PID 1612 wrote to memory of 736 1612 AdvancedRun.exe AdvancedRun.exe PID 296 wrote to memory of 564 296 dicgue.exe powershell.exe PID 296 wrote to memory of 564 296 dicgue.exe powershell.exe PID 296 wrote to memory of 564 296 dicgue.exe powershell.exe PID 296 wrote to memory of 564 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1352 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1352 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1352 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1352 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1080 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1080 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1080 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1080 296 dicgue.exe powershell.exe PID 296 wrote to memory of 860 296 dicgue.exe powershell.exe PID 296 wrote to memory of 860 296 dicgue.exe powershell.exe PID 296 wrote to memory of 860 296 dicgue.exe powershell.exe PID 296 wrote to memory of 860 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1832 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1832 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1832 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1832 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1604 296 dicgue.exe યੱੳછੲં੫દ੮ય੪ઞડ.exe PID 296 wrote to memory of 1604 296 dicgue.exe યੱੳછੲં੫દ੮ય੪ઞડ.exe PID 296 wrote to memory of 1604 296 dicgue.exe યੱੳછੲં੫દ੮ય੪ઞડ.exe PID 296 wrote to memory of 1604 296 dicgue.exe યੱੳછੲં੫દ੮ય੪ઞડ.exe PID 296 wrote to memory of 1640 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1640 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1640 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1640 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1580 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1580 296 dicgue.exe powershell.exe PID 296 wrote to memory of 1580 296 dicgue.exe powershell.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
dicgue.exeયੱੳછੲં੫દ੮ય੪ઞડ.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dicgue.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" યੱੳછੲં੫દ੮ય੪ઞડ.exe -
outlook_office_path 1 IoCs
Processes:
યੱੳછੲં੫દ੮ય੪ઞડ.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 યੱੳછੲં੫દ੮ય੪ઞડ.exe -
outlook_win_path 1 IoCs
Processes:
યੱੳછੲં੫દ੮ય੪ઞડ.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 યੱੳછੲં੫દ੮ય੪ઞડ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKM__20212210RFQ00100490100.exe"C:\Users\Admin\AppData\Local\Temp\SKM__20212210RFQ00100490100.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKM__20212210RFQ00100490100.exe"C:\Users\Admin\AppData\Local\Temp\SKM__20212210RFQ00100490100.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\dicgue.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\dicgue.exe"'4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dicgue.exe"C:\Users\Admin\AppData\Local\Temp\dicgue.exe"5⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exe" /SpecialRun 4101d8 16127⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\dicgue.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\dicgue.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\dicgue.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exe" /SpecialRun 4101d8 25888⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe" -Force7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe" -Force7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe" -Force7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exe" -Force7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe" -Force7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\dicgue.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\醦醥酴醥酴醙酳酵醕酵酵醣醗醦酰\svchost.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 15722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\dicgue.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
C:\Users\Admin\AppData\Local\Temp\dicgue.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
d77b56f5a08e08fdc8f4f148a8bafb7b
SHA11dbd2e8a6a735290db7a950fa31b959b395fbc70
SHA2562ee2599302b6f591b1d2c17e8de495d8e087b70bea55a3b3cfe14771829fdf21
SHA512a6bd3d2ca59334ae13fd9c3e630b32df234862b988cf157e53c8472de59966c990f9dd31e9f0687256d4e4f2fcc531153859bbfea5c5431a00380cd1aa868d5d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
d77b56f5a08e08fdc8f4f148a8bafb7b
SHA11dbd2e8a6a735290db7a950fa31b959b395fbc70
SHA2562ee2599302b6f591b1d2c17e8de495d8e087b70bea55a3b3cfe14771829fdf21
SHA512a6bd3d2ca59334ae13fd9c3e630b32df234862b988cf157e53c8472de59966c990f9dd31e9f0687256d4e4f2fcc531153859bbfea5c5431a00380cd1aa868d5d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
d77b56f5a08e08fdc8f4f148a8bafb7b
SHA11dbd2e8a6a735290db7a950fa31b959b395fbc70
SHA2562ee2599302b6f591b1d2c17e8de495d8e087b70bea55a3b3cfe14771829fdf21
SHA512a6bd3d2ca59334ae13fd9c3e630b32df234862b988cf157e53c8472de59966c990f9dd31e9f0687256d4e4f2fcc531153859bbfea5c5431a00380cd1aa868d5d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
d77b56f5a08e08fdc8f4f148a8bafb7b
SHA11dbd2e8a6a735290db7a950fa31b959b395fbc70
SHA2562ee2599302b6f591b1d2c17e8de495d8e087b70bea55a3b3cfe14771829fdf21
SHA512a6bd3d2ca59334ae13fd9c3e630b32df234862b988cf157e53c8472de59966c990f9dd31e9f0687256d4e4f2fcc531153859bbfea5c5431a00380cd1aa868d5d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0c4f573154d363402d1cadef1b7a84dc
SHA143e5661db281db2c3a72f647e9400c19488235e5
SHA256b4846756e7b9319111d35729c084ed87f6a17b61feb281f75076b208376694bb
SHA51273fae41ec40462fee5d319d0f1fc947a3e24fb4cc47ff71bb7d9af2492ee134b83fdcff15b0f2ba0ff181523fd81bee2d67df35b373bc1f3143683dc9540edb3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
d77b56f5a08e08fdc8f4f148a8bafb7b
SHA11dbd2e8a6a735290db7a950fa31b959b395fbc70
SHA2562ee2599302b6f591b1d2c17e8de495d8e087b70bea55a3b3cfe14771829fdf21
SHA512a6bd3d2ca59334ae13fd9c3e630b32df234862b988cf157e53c8472de59966c990f9dd31e9f0687256d4e4f2fcc531153859bbfea5c5431a00380cd1aa868d5d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
d77b56f5a08e08fdc8f4f148a8bafb7b
SHA11dbd2e8a6a735290db7a950fa31b959b395fbc70
SHA2562ee2599302b6f591b1d2c17e8de495d8e087b70bea55a3b3cfe14771829fdf21
SHA512a6bd3d2ca59334ae13fd9c3e630b32df234862b988cf157e53c8472de59966c990f9dd31e9f0687256d4e4f2fcc531153859bbfea5c5431a00380cd1aa868d5d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
d77b56f5a08e08fdc8f4f148a8bafb7b
SHA11dbd2e8a6a735290db7a950fa31b959b395fbc70
SHA2562ee2599302b6f591b1d2c17e8de495d8e087b70bea55a3b3cfe14771829fdf21
SHA512a6bd3d2ca59334ae13fd9c3e630b32df234862b988cf157e53c8472de59966c990f9dd31e9f0687256d4e4f2fcc531153859bbfea5c5431a00380cd1aa868d5d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
d77b56f5a08e08fdc8f4f148a8bafb7b
SHA11dbd2e8a6a735290db7a950fa31b959b395fbc70
SHA2562ee2599302b6f591b1d2c17e8de495d8e087b70bea55a3b3cfe14771829fdf21
SHA512a6bd3d2ca59334ae13fd9c3e630b32df234862b988cf157e53c8472de59966c990f9dd31e9f0687256d4e4f2fcc531153859bbfea5c5431a00380cd1aa868d5d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0c4f573154d363402d1cadef1b7a84dc
SHA143e5661db281db2c3a72f647e9400c19488235e5
SHA256b4846756e7b9319111d35729c084ed87f6a17b61feb281f75076b208376694bb
SHA51273fae41ec40462fee5d319d0f1fc947a3e24fb4cc47ff71bb7d9af2492ee134b83fdcff15b0f2ba0ff181523fd81bee2d67df35b373bc1f3143683dc9540edb3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0c4f573154d363402d1cadef1b7a84dc
SHA143e5661db281db2c3a72f647e9400c19488235e5
SHA256b4846756e7b9319111d35729c084ed87f6a17b61feb281f75076b208376694bb
SHA51273fae41ec40462fee5d319d0f1fc947a3e24fb4cc47ff71bb7d9af2492ee134b83fdcff15b0f2ba0ff181523fd81bee2d67df35b373bc1f3143683dc9540edb3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\7adc8641-33e6-4b50-861d-e2e0d7b518df\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\d365f01f-baa8-4311-86ba-7048370d934b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\dicgue.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\યੱੳછੲં੫દ੮ય੪ઞડ.exeMD5
57432370e3702a5ac4e5f90e53d39a17
SHA18a08462077f4e660088d80e9507765f019ddfd35
SHA25669499fa919b422fc0e85862ae7695c6e98d06f27e8f7d851957f7f62af96375b
SHA512dfb7d75e87b009f50823e9063a4a87ef1bc325dc3032731658563df9208251cbbca28d0b406c2de31a19ca14268c5af4644f0c4e203185edfbfc56ac62d055d6
-
memory/296-150-0x0000000004480000-0x00000000044B6000-memory.dmpFilesize
216KB
-
memory/296-82-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/296-86-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/296-80-0x0000000000000000-mapping.dmp
-
memory/296-87-0x0000000000330000-0x00000000003B2000-memory.dmpFilesize
520KB
-
memory/412-142-0x00000000023F0000-0x000000000303A000-memory.dmpFilesize
12.3MB
-
memory/412-120-0x0000000000000000-mapping.dmp
-
memory/412-139-0x00000000023F0000-0x000000000303A000-memory.dmpFilesize
12.3MB
-
memory/412-137-0x00000000023F0000-0x000000000303A000-memory.dmpFilesize
12.3MB
-
memory/564-124-0x0000000002400000-0x000000000304A000-memory.dmpFilesize
12.3MB
-
memory/564-135-0x0000000002400000-0x000000000304A000-memory.dmpFilesize
12.3MB
-
memory/564-99-0x0000000000000000-mapping.dmp
-
memory/564-147-0x0000000002400000-0x000000000304A000-memory.dmpFilesize
12.3MB
-
memory/736-96-0x0000000000000000-mapping.dmp
-
memory/860-102-0x0000000000000000-mapping.dmp
-
memory/860-144-0x00000000023E2000-0x00000000023E4000-memory.dmpFilesize
8KB
-
memory/860-140-0x00000000023E0000-0x00000000023E1000-memory.dmpFilesize
4KB
-
memory/860-141-0x00000000023E1000-0x00000000023E2000-memory.dmpFilesize
4KB
-
memory/1080-145-0x00000000024D0000-0x000000000311A000-memory.dmpFilesize
12.3MB
-
memory/1080-127-0x00000000024D0000-0x000000000311A000-memory.dmpFilesize
12.3MB
-
memory/1080-101-0x0000000000000000-mapping.dmp
-
memory/1352-146-0x0000000002320000-0x0000000002F6A000-memory.dmpFilesize
12.3MB
-
memory/1352-133-0x0000000002320000-0x0000000002F6A000-memory.dmpFilesize
12.3MB
-
memory/1352-100-0x0000000000000000-mapping.dmp
-
memory/1352-138-0x0000000002320000-0x0000000002F6A000-memory.dmpFilesize
12.3MB
-
memory/1524-59-0x0000000000410000-0x0000000000413000-memory.dmpFilesize
12KB
-
memory/1524-60-0x00000000004C0000-0x00000000004E2000-memory.dmpFilesize
136KB
-
memory/1524-58-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/1524-57-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB
-
memory/1524-55-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/1580-118-0x0000000000000000-mapping.dmp
-
memory/1580-134-0x0000000002340000-0x0000000002F8A000-memory.dmpFilesize
12.3MB
-
memory/1580-136-0x0000000002340000-0x0000000002F8A000-memory.dmpFilesize
12.3MB
-
memory/1604-114-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/1604-152-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/1604-108-0x0000000000000000-mapping.dmp
-
memory/1612-90-0x0000000000000000-mapping.dmp
-
memory/1640-116-0x0000000000000000-mapping.dmp
-
memory/1640-131-0x0000000002430000-0x000000000307A000-memory.dmpFilesize
12.3MB
-
memory/1640-128-0x0000000002430000-0x000000000307A000-memory.dmpFilesize
12.3MB
-
memory/1640-149-0x0000000002430000-0x000000000307A000-memory.dmpFilesize
12.3MB
-
memory/1660-77-0x00000000024D0000-0x000000000311A000-memory.dmpFilesize
12.3MB
-
memory/1660-75-0x0000000000000000-mapping.dmp
-
memory/1664-69-0x0000000000000000-mapping.dmp
-
memory/1664-70-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1720-74-0x0000000000000000-mapping.dmp
-
memory/1832-104-0x0000000000000000-mapping.dmp
-
memory/1832-148-0x00000000023A0000-0x0000000002FEA000-memory.dmpFilesize
12.3MB
-
memory/1832-143-0x00000000023A0000-0x0000000002FEA000-memory.dmpFilesize
12.3MB
-
memory/1924-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1924-61-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1924-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1924-73-0x0000000000590000-0x00000000005AB000-memory.dmpFilesize
108KB
-
memory/1924-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1924-72-0x0000000004790000-0x0000000004791000-memory.dmpFilesize
4KB
-
memory/1924-66-0x000000000040C73E-mapping.dmp
-
memory/1924-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1924-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2588-156-0x0000000000000000-mapping.dmp
-
memory/2644-162-0x0000000000000000-mapping.dmp
-
memory/2680-165-0x0000000000000000-mapping.dmp
-
memory/2680-181-0x0000000002430000-0x000000000307A000-memory.dmpFilesize
12.3MB
-
memory/2704-166-0x0000000000000000-mapping.dmp
-
memory/2704-182-0x00000000023F0000-0x000000000303A000-memory.dmpFilesize
12.3MB
-
memory/2704-185-0x00000000023F0000-0x000000000303A000-memory.dmpFilesize
12.3MB
-
memory/2732-167-0x0000000000000000-mapping.dmp
-
memory/2768-168-0x0000000000000000-mapping.dmp
-
memory/2768-183-0x0000000002450000-0x000000000309A000-memory.dmpFilesize
12.3MB
-
memory/2768-186-0x0000000002450000-0x000000000309A000-memory.dmpFilesize
12.3MB
-
memory/2768-188-0x0000000002450000-0x000000000309A000-memory.dmpFilesize
12.3MB
-
memory/2796-169-0x0000000000000000-mapping.dmp
-
memory/2796-184-0x0000000002540000-0x000000000318A000-memory.dmpFilesize
12.3MB
-
memory/2796-187-0x0000000002540000-0x000000000318A000-memory.dmpFilesize
12.3MB