Analysis

  • max time kernel
    156s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    11-03-2022 00:23

General

  • Target

    3d76585487bec639bb39a96139986f50b2e5af83263fec6b754ccc1cf400d787.exe

  • Size

    7.8MB

  • MD5

    c1cf691b09e84a5975b59ceebe4fcd8f

  • SHA1

    f990a2d00840c8d334f48948c34854a26fa700d2

  • SHA256

    3d76585487bec639bb39a96139986f50b2e5af83263fec6b754ccc1cf400d787

  • SHA512

    276cf73fe577bf3060589ba38cea2cc3ee445bd4c44366972e1e87f652b410e7886ad745107141a024ac549aad06f3a9a59cbe0fe478b11119185135fa5fa4c9

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.fcektsy.top/

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 4 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

    suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • Modifies Windows Firewall 1 TTPs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d76585487bec639bb39a96139986f50b2e5af83263fec6b754ccc1cf400d787.exe
    "C:\Users\Admin\AppData\Local\Temp\3d76585487bec639bb39a96139986f50b2e5af83263fec6b754ccc1cf400d787.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4172
    • C:\Users\Admin\AppData\Local\Temp\Updbdate.exe
      "C:\Users\Admin\AppData\Local\Temp\Updbdate.exe"
      2⤵
      • Executes dropped EXE
      PID:1188
    • C:\Users\Admin\AppData\Local\Temp\Info.exe
      "C:\Users\Admin\AppData\Local\Temp\Info.exe"
      2⤵
      • Executes dropped EXE
      PID:964
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 272
        3⤵
        • Program crash
        PID:4928
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 372
        3⤵
        • Program crash
        PID:4616
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 372
        3⤵
        • Program crash
        PID:1504
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 664
        3⤵
        • Program crash
        PID:1544
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 664
        3⤵
        • Program crash
        PID:1740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 664
        3⤵
        • Program crash
        PID:4988
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 664
        3⤵
        • Program crash
        PID:4380
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 728
        3⤵
        • Program crash
        PID:4496
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 752
        3⤵
        • Program crash
        PID:3056
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 812
        3⤵
        • Program crash
        PID:2280
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 676
        3⤵
        • Program crash
        PID:3092
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 776
        3⤵
        • Program crash
        PID:4512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 876
        3⤵
        • Program crash
        PID:528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 856
        3⤵
        • Program crash
        PID:1276
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 696
        3⤵
        • Program crash
        PID:2012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 888
        3⤵
        • Program crash
        PID:3708
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 768
        3⤵
        • Program crash
        PID:3432
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 872
        3⤵
        • Program crash
        PID:3816
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 836
        3⤵
        • Program crash
        PID:3968
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 724
        3⤵
        • Program crash
        PID:1788
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 920
        3⤵
        • Program crash
        PID:4080
      • C:\Users\Admin\AppData\Local\Temp\Info.exe
        "C:\Users\Admin\AppData\Local\Temp\Info.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:1488
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 332
          4⤵
          • Program crash
          PID:3516
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 336
          4⤵
          • Program crash
          PID:4736
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 360
          4⤵
          • Program crash
          PID:3200
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 636
          4⤵
          • Program crash
          PID:4000
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 636
          4⤵
          • Program crash
          PID:944
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 636
          4⤵
          • Program crash
          PID:3732
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 636
          4⤵
          • Program crash
          PID:1552
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 708
          4⤵
          • Program crash
          PID:3428
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 724
          4⤵
          • Program crash
          PID:4424
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 668
          4⤵
          • Program crash
          PID:1180
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 576
          4⤵
          • Program crash
          PID:3356
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 824
          4⤵
          • Program crash
          PID:4688
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 736
          4⤵
          • Program crash
          PID:4480
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 576
          4⤵
          • Program crash
          PID:4804
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 716
          4⤵
          • Program crash
          PID:2300
        • C:\Windows\system32\cmd.exe
          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
            5⤵
              PID:4540
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 660
            4⤵
            • Program crash
            PID:2268
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 908
            4⤵
            • Program crash
            PID:2932
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe /94-94
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1768
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 360
              5⤵
              • Program crash
              PID:5072
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 368
              5⤵
              • Program crash
              PID:1280
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 368
              5⤵
              • Program crash
              PID:1216
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 664
              5⤵
              • Program crash
              PID:4000
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 724
              5⤵
              • Program crash
              PID:944
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 724
              5⤵
              • Program crash
              PID:3732
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 704
              5⤵
              • Program crash
              PID:2644
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 756
              5⤵
              • Program crash
              PID:4744
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 776
              5⤵
              • Program crash
              PID:1096
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 816
              5⤵
              • Program crash
              PID:2244
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 824
              5⤵
              • Program crash
              PID:3356
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 644
              5⤵
              • Program crash
              PID:5052
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 904
              5⤵
              • Program crash
              PID:5036
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 904
              5⤵
              • Program crash
              PID:4804
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 924
              5⤵
              • Program crash
              PID:1796
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              5⤵
              • Creates scheduled task(s)
              PID:1916
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 976
              5⤵
              • Program crash
              PID:704
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 992
              5⤵
              • Program crash
              PID:3484
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 904
              5⤵
              • Program crash
              PID:392
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 964
              5⤵
              • Program crash
              PID:4272
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 936
              5⤵
              • Program crash
              PID:1736
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 1116
              5⤵
              • Program crash
              PID:2504
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 1020
              5⤵
              • Program crash
              PID:2784
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 1108
              5⤵
              • Program crash
              PID:1460
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 956
              5⤵
              • Program crash
              PID:4640
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 1132
              5⤵
                PID:5048
              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                5⤵
                • Executes dropped EXE
                PID:528
        • C:\Users\Admin\AppData\Local\Temp\Folder.exe
          "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:1128
          • C:\Users\Admin\AppData\Local\Temp\Folder.exe
            "C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a
            3⤵
            • Executes dropped EXE
            PID:1952
        • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
          "C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"
          2⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of AdjustPrivilegeToken
          PID:2008
        • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
          "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3432
        • C:\Users\Admin\AppData\Local\Temp\Install.exe
          "C:\Users\Admin\AppData\Local\Temp\Install.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3940
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c taskkill /f /im chrome.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4576
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im chrome.exe
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3960
        • C:\Users\Admin\AppData\Local\Temp\File.exe
          "C:\Users\Admin\AppData\Local\Temp\File.exe"
          2⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4048
          • C:\Users\Admin\Pictures\Adobe Films\Q4k9jICxp6ihXOsNAf61CQuS.exe
            "C:\Users\Admin\Pictures\Adobe Films\Q4k9jICxp6ihXOsNAf61CQuS.exe"
            3⤵
            • Executes dropped EXE
            PID:3076
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 1900
            3⤵
            • Program crash
            PID:4004
        • C:\Users\Admin\AppData\Local\Temp\pub2.exe
          "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
          2⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:3968
        • C:\Users\Admin\AppData\Local\Temp\Files.exe
          "C:\Users\Admin\AppData\Local\Temp\Files.exe"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4120
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            PID:1360
          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4440
      • C:\Windows\system32\rUNdlL32.eXe
        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
        1⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Windows\SysWOW64\rundll32.exe
          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
          2⤵
          • Loads dropped DLL
          PID:4016
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 604
            3⤵
            • Program crash
            PID:4848
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4016 -ip 4016
        1⤵
          PID:4224
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 964 -ip 964
          1⤵
            PID:4700
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 964 -ip 964
            1⤵
              PID:1896
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 964 -ip 964
              1⤵
                PID:4984
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 964 -ip 964
                1⤵
                  PID:804
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 964 -ip 964
                  1⤵
                    PID:2260
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 964 -ip 964
                    1⤵
                      PID:560
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 964 -ip 964
                      1⤵
                        PID:4028
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 964 -ip 964
                        1⤵
                          PID:3624
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 964 -ip 964
                          1⤵
                            PID:2432
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 964 -ip 964
                            1⤵
                              PID:432
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 964 -ip 964
                              1⤵
                                PID:1460
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 964 -ip 964
                                1⤵
                                  PID:1084
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 964 -ip 964
                                  1⤵
                                    PID:204
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 964 -ip 964
                                    1⤵
                                      PID:4012
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 964 -ip 964
                                      1⤵
                                        PID:4212
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 964 -ip 964
                                        1⤵
                                          PID:3660
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 964 -ip 964
                                          1⤵
                                            PID:4676
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 964 -ip 964
                                            1⤵
                                              PID:4456
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 964 -ip 964
                                              1⤵
                                                PID:4952
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 964 -ip 964
                                                1⤵
                                                  PID:4348
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 964 -ip 964
                                                  1⤵
                                                    PID:4396
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
                                                    1⤵
                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2448
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1488 -ip 1488
                                                    1⤵
                                                      PID:4924
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1488 -ip 1488
                                                      1⤵
                                                        PID:1280
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1488 -ip 1488
                                                        1⤵
                                                          PID:3404
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1488 -ip 1488
                                                          1⤵
                                                            PID:3544
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1488 -ip 1488
                                                            1⤵
                                                              PID:3444
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1488 -ip 1488
                                                              1⤵
                                                                PID:4208
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1488 -ip 1488
                                                                1⤵
                                                                  PID:3364
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1488 -ip 1488
                                                                  1⤵
                                                                    PID:2636
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1488 -ip 1488
                                                                    1⤵
                                                                      PID:4764
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1488 -ip 1488
                                                                      1⤵
                                                                        PID:4268
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1488 -ip 1488
                                                                        1⤵
                                                                          PID:3868
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1488 -ip 1488
                                                                          1⤵
                                                                            PID:2264
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1488 -ip 1488
                                                                            1⤵
                                                                              PID:5100
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1488 -ip 1488
                                                                              1⤵
                                                                                PID:1332
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1488 -ip 1488
                                                                                1⤵
                                                                                  PID:4752
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1488 -ip 1488
                                                                                  1⤵
                                                                                    PID:4472
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1488 -ip 1488
                                                                                    1⤵
                                                                                      PID:5076
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4048 -ip 4048
                                                                                      1⤵
                                                                                        PID:3908
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1768 -ip 1768
                                                                                        1⤵
                                                                                          PID:3132
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1768 -ip 1768
                                                                                          1⤵
                                                                                            PID:3516
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1768 -ip 1768
                                                                                            1⤵
                                                                                              PID:4992
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1768 -ip 1768
                                                                                              1⤵
                                                                                                PID:3992
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1768 -ip 1768
                                                                                                1⤵
                                                                                                  PID:3444
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1768 -ip 1768
                                                                                                  1⤵
                                                                                                    PID:4208
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1768 -ip 1768
                                                                                                    1⤵
                                                                                                      PID:1856
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1768 -ip 1768
                                                                                                      1⤵
                                                                                                        PID:4896
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1768 -ip 1768
                                                                                                        1⤵
                                                                                                          PID:3464
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1768 -ip 1768
                                                                                                          1⤵
                                                                                                            PID:4536
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1768 -ip 1768
                                                                                                            1⤵
                                                                                                              PID:1688
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1768 -ip 1768
                                                                                                              1⤵
                                                                                                                PID:2264
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1768 -ip 1768
                                                                                                                1⤵
                                                                                                                  PID:4612
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1768 -ip 1768
                                                                                                                  1⤵
                                                                                                                    PID:1332
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1768 -ip 1768
                                                                                                                    1⤵
                                                                                                                      PID:4752
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1768 -ip 1768
                                                                                                                      1⤵
                                                                                                                        PID:380
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1768 -ip 1768
                                                                                                                        1⤵
                                                                                                                          PID:2400
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1768 -ip 1768
                                                                                                                          1⤵
                                                                                                                            PID:2472
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1768 -ip 1768
                                                                                                                            1⤵
                                                                                                                              PID:4196
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1768 -ip 1768
                                                                                                                              1⤵
                                                                                                                                PID:4372
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1768 -ip 1768
                                                                                                                                1⤵
                                                                                                                                  PID:1908
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1768 -ip 1768
                                                                                                                                  1⤵
                                                                                                                                    PID:1944
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1768 -ip 1768
                                                                                                                                    1⤵
                                                                                                                                      PID:772
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1768 -ip 1768
                                                                                                                                      1⤵
                                                                                                                                        PID:856
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1768 -ip 1768
                                                                                                                                        1⤵
                                                                                                                                          PID:4576

                                                                                                                                        Network

                                                                                                                                        MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                        Execution

                                                                                                                                        Scheduled Task

                                                                                                                                        1
                                                                                                                                        T1053

                                                                                                                                        Persistence

                                                                                                                                        Modify Existing Service

                                                                                                                                        2
                                                                                                                                        T1031

                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                        1
                                                                                                                                        T1060

                                                                                                                                        Scheduled Task

                                                                                                                                        1
                                                                                                                                        T1053

                                                                                                                                        Privilege Escalation

                                                                                                                                        Scheduled Task

                                                                                                                                        1
                                                                                                                                        T1053

                                                                                                                                        Defense Evasion

                                                                                                                                        Modify Registry

                                                                                                                                        2
                                                                                                                                        T1112

                                                                                                                                        Disabling Security Tools

                                                                                                                                        1
                                                                                                                                        T1089

                                                                                                                                        Credential Access

                                                                                                                                        Credentials in Files

                                                                                                                                        1
                                                                                                                                        T1081

                                                                                                                                        Discovery

                                                                                                                                        Query Registry

                                                                                                                                        3
                                                                                                                                        T1012

                                                                                                                                        System Information Discovery

                                                                                                                                        4
                                                                                                                                        T1082

                                                                                                                                        Peripheral Device Discovery

                                                                                                                                        1
                                                                                                                                        T1120

                                                                                                                                        Collection

                                                                                                                                        Data from Local System

                                                                                                                                        1
                                                                                                                                        T1005

                                                                                                                                        Command and Control

                                                                                                                                        Web Service

                                                                                                                                        1
                                                                                                                                        T1102

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\File.exe
                                                                                                                                          MD5

                                                                                                                                          cbafd60beffb18c666ff85f1517a76f9

                                                                                                                                          SHA1

                                                                                                                                          9e015cba7168b610969bfc299a4ffe4763f4fd5f

                                                                                                                                          SHA256

                                                                                                                                          d31f2d2d991acee74d9be732c8180f37cea12aceaba324804fbcf2d0d2891a3d

                                                                                                                                          SHA512

                                                                                                                                          ba61ac5f49827b0fba2c72f4b19540b91f8bceb8b441a713b7de00317059955ad592c88af8f9c94093077503ab3b4c4c522b0e577599ca5020ad1b0f254066ce

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\File.exe
                                                                                                                                          MD5

                                                                                                                                          cbafd60beffb18c666ff85f1517a76f9

                                                                                                                                          SHA1

                                                                                                                                          9e015cba7168b610969bfc299a4ffe4763f4fd5f

                                                                                                                                          SHA256

                                                                                                                                          d31f2d2d991acee74d9be732c8180f37cea12aceaba324804fbcf2d0d2891a3d

                                                                                                                                          SHA512

                                                                                                                                          ba61ac5f49827b0fba2c72f4b19540b91f8bceb8b441a713b7de00317059955ad592c88af8f9c94093077503ab3b4c4c522b0e577599ca5020ad1b0f254066ce

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                                                                                                                          MD5

                                                                                                                                          2d0217e0c70440d8c82883eadea517b9

                                                                                                                                          SHA1

                                                                                                                                          f3b7dd6dbb43b895ba26f67370af99952b7d83cb

                                                                                                                                          SHA256

                                                                                                                                          d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01

                                                                                                                                          SHA512

                                                                                                                                          6d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Files.exe
                                                                                                                                          MD5

                                                                                                                                          2d0217e0c70440d8c82883eadea517b9

                                                                                                                                          SHA1

                                                                                                                                          f3b7dd6dbb43b895ba26f67370af99952b7d83cb

                                                                                                                                          SHA256

                                                                                                                                          d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01

                                                                                                                                          SHA512

                                                                                                                                          6d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                                                                                                                          MD5

                                                                                                                                          b89068659ca07ab9b39f1c580a6f9d39

                                                                                                                                          SHA1

                                                                                                                                          7e3e246fcf920d1ada06900889d099784fe06aa5

                                                                                                                                          SHA256

                                                                                                                                          9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

                                                                                                                                          SHA512

                                                                                                                                          940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                                                                                                                          MD5

                                                                                                                                          b89068659ca07ab9b39f1c580a6f9d39

                                                                                                                                          SHA1

                                                                                                                                          7e3e246fcf920d1ada06900889d099784fe06aa5

                                                                                                                                          SHA256

                                                                                                                                          9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

                                                                                                                                          SHA512

                                                                                                                                          940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                                                                                                                                          MD5

                                                                                                                                          b89068659ca07ab9b39f1c580a6f9d39

                                                                                                                                          SHA1

                                                                                                                                          7e3e246fcf920d1ada06900889d099784fe06aa5

                                                                                                                                          SHA256

                                                                                                                                          9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

                                                                                                                                          SHA512

                                                                                                                                          940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Info.exe
                                                                                                                                          MD5

                                                                                                                                          f01d6fa9b172453c4538847d8fba92fd

                                                                                                                                          SHA1

                                                                                                                                          5c8bce1505107101bf28151fc073c71fca6ca7ba

                                                                                                                                          SHA256

                                                                                                                                          7ce5bfd458b3a8064b078a41fa9ecdd777f8be28d04e1fc1a0fe508a77e43660

                                                                                                                                          SHA512

                                                                                                                                          7127a48dffa23c79a07137fd8030510769b3a27db7555cea5b562945b62588243862b8c06bafeaeeed2237dcb0d56dbcfc2cf1b8e3108fd64a47b5e13a980324

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Info.exe
                                                                                                                                          MD5

                                                                                                                                          f01d6fa9b172453c4538847d8fba92fd

                                                                                                                                          SHA1

                                                                                                                                          5c8bce1505107101bf28151fc073c71fca6ca7ba

                                                                                                                                          SHA256

                                                                                                                                          7ce5bfd458b3a8064b078a41fa9ecdd777f8be28d04e1fc1a0fe508a77e43660

                                                                                                                                          SHA512

                                                                                                                                          7127a48dffa23c79a07137fd8030510769b3a27db7555cea5b562945b62588243862b8c06bafeaeeed2237dcb0d56dbcfc2cf1b8e3108fd64a47b5e13a980324

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Info.exe
                                                                                                                                          MD5

                                                                                                                                          f01d6fa9b172453c4538847d8fba92fd

                                                                                                                                          SHA1

                                                                                                                                          5c8bce1505107101bf28151fc073c71fca6ca7ba

                                                                                                                                          SHA256

                                                                                                                                          7ce5bfd458b3a8064b078a41fa9ecdd777f8be28d04e1fc1a0fe508a77e43660

                                                                                                                                          SHA512

                                                                                                                                          7127a48dffa23c79a07137fd8030510769b3a27db7555cea5b562945b62588243862b8c06bafeaeeed2237dcb0d56dbcfc2cf1b8e3108fd64a47b5e13a980324

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                                                          MD5

                                                                                                                                          992a30dec0b76e19f0644cab152e0888

                                                                                                                                          SHA1

                                                                                                                                          38b13055600cbd801666377630cdc196d806ece8

                                                                                                                                          SHA256

                                                                                                                                          a63201ba5d88041eb789ddba10d28b79afa40325350f2833c67e655e5964d1c6

                                                                                                                                          SHA512

                                                                                                                                          84f75a40d426e93a0f337cbe216abc333c5da9556bb283a7a4aed7d2b4a27176ce439668069c71c69d0ace86a94f72512dc0eb2f56dd9a8930f004dd960133cb

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                                                                                          MD5

                                                                                                                                          992a30dec0b76e19f0644cab152e0888

                                                                                                                                          SHA1

                                                                                                                                          38b13055600cbd801666377630cdc196d806ece8

                                                                                                                                          SHA256

                                                                                                                                          a63201ba5d88041eb789ddba10d28b79afa40325350f2833c67e655e5964d1c6

                                                                                                                                          SHA512

                                                                                                                                          84f75a40d426e93a0f337cbe216abc333c5da9556bb283a7a4aed7d2b4a27176ce439668069c71c69d0ace86a94f72512dc0eb2f56dd9a8930f004dd960133cb

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                                                                                          MD5

                                                                                                                                          fb87a8d964a90ae94c0be5de3d25bb01

                                                                                                                                          SHA1

                                                                                                                                          8ddada78923059a0373598495fe4efbb125e795c

                                                                                                                                          SHA256

                                                                                                                                          49b033d90c561256dbe38618a71c2b61d3872c0e0029ab30fc3f5a509105770f

                                                                                                                                          SHA512

                                                                                                                                          5488ccf896547a434902637f132e2a0b1522d3250497cb2b65208a6baf14aa2a5ac6e6ef27d25aa95405bf6c96aedb636d9376eb6e98cc6f88734ecc23342c37

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                                                                                          MD5

                                                                                                                                          fb87a8d964a90ae94c0be5de3d25bb01

                                                                                                                                          SHA1

                                                                                                                                          8ddada78923059a0373598495fe4efbb125e795c

                                                                                                                                          SHA256

                                                                                                                                          49b033d90c561256dbe38618a71c2b61d3872c0e0029ab30fc3f5a509105770f

                                                                                                                                          SHA512

                                                                                                                                          5488ccf896547a434902637f132e2a0b1522d3250497cb2b65208a6baf14aa2a5ac6e6ef27d25aa95405bf6c96aedb636d9376eb6e98cc6f88734ecc23342c37

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Updbdate.exe
                                                                                                                                          MD5

                                                                                                                                          e0d7a00d5d1d17d549330622d5efbc57

                                                                                                                                          SHA1

                                                                                                                                          e3abe1626a305c75b223bc17a9de9245290c1571

                                                                                                                                          SHA256

                                                                                                                                          aae3cdeedc940844c30f81a0df1c1da150fc890c604fc81f0f81da729831e51f

                                                                                                                                          SHA512

                                                                                                                                          8931fd7e2b00fe4fc3386eaaf8bfd0d30005e5fda3795d105a866505c83e3c5aca59725a5d8dd6369cc43a426920f6eab1f9fc62e40755ea7c905ec9d27464da

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Updbdate.exe
                                                                                                                                          MD5

                                                                                                                                          e0d7a00d5d1d17d549330622d5efbc57

                                                                                                                                          SHA1

                                                                                                                                          e3abe1626a305c75b223bc17a9de9245290c1571

                                                                                                                                          SHA256

                                                                                                                                          aae3cdeedc940844c30f81a0df1c1da150fc890c604fc81f0f81da729831e51f

                                                                                                                                          SHA512

                                                                                                                                          8931fd7e2b00fe4fc3386eaaf8bfd0d30005e5fda3795d105a866505c83e3c5aca59725a5d8dd6369cc43a426920f6eab1f9fc62e40755ea7c905ec9d27464da

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\axhub.dat
                                                                                                                                          MD5

                                                                                                                                          5fd2eba6df44d23c9e662763009d7f84

                                                                                                                                          SHA1

                                                                                                                                          43530574f8ac455ae263c70cc99550bc60bfa4f1

                                                                                                                                          SHA256

                                                                                                                                          2991e2231855661e94ef80a4202487a9d7dc7bebccab9a0b2a786cf0783a051f

                                                                                                                                          SHA512

                                                                                                                                          321a86725e533dedb5b74e17218e6e53a49fa6ffc87d7f7da0f0b8441a081fe785f7846a76f67ef03ec3abddacbe8906b20a2f3ce8178896ec57090ef7ab0eb7

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                                          MD5

                                                                                                                                          1c7be730bdc4833afb7117d48c3fd513

                                                                                                                                          SHA1

                                                                                                                                          dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                                                                                          SHA256

                                                                                                                                          8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                                                                                          SHA512

                                                                                                                                          7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                                          MD5

                                                                                                                                          1c7be730bdc4833afb7117d48c3fd513

                                                                                                                                          SHA1

                                                                                                                                          dc7e38cfe2ae4a117922306aead5a7544af646b8

                                                                                                                                          SHA256

                                                                                                                                          8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

                                                                                                                                          SHA512

                                                                                                                                          7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                                                                          MD5

                                                                                                                                          d98e33b66343e7c96158444127a117f6

                                                                                                                                          SHA1

                                                                                                                                          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                                                                          SHA256

                                                                                                                                          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                                                                          SHA512

                                                                                                                                          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                                                                                                          MD5

                                                                                                                                          d98e33b66343e7c96158444127a117f6

                                                                                                                                          SHA1

                                                                                                                                          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                                                                          SHA256

                                                                                                                                          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                                                                          SHA512

                                                                                                                                          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                          MD5

                                                                                                                                          b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                                          SHA1

                                                                                                                                          d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                                          SHA256

                                                                                                                                          fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                                          SHA512

                                                                                                                                          98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                          MD5

                                                                                                                                          c47c42b0ee7caf1cc6b7e6ab8939bf69

                                                                                                                                          SHA1

                                                                                                                                          824945fcdbcc11ca51568808f83d42bb6103fd08

                                                                                                                                          SHA256

                                                                                                                                          7f379ea8fee1c2fe3f11d48d8508a52558de98ba6a2cbc9bf231301e658a827b

                                                                                                                                          SHA512

                                                                                                                                          8aa4dd0d6c785201b094006b3112ef872fdf4fd961b3f71f8b8e608c9f57d22b7b6dc6fcf6519d3e04048fe1f185a8cbedaece7e8a3da3246dbb5f90cf193255

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                          MD5

                                                                                                                                          7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                          SHA1

                                                                                                                                          1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                          SHA256

                                                                                                                                          a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                          SHA512

                                                                                                                                          3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                          MD5

                                                                                                                                          7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                          SHA1

                                                                                                                                          1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                          SHA256

                                                                                                                                          a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                          SHA512

                                                                                                                                          3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                          MD5

                                                                                                                                          a6279ec92ff948760ce53bba817d6a77

                                                                                                                                          SHA1

                                                                                                                                          5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                                                                                                          SHA256

                                                                                                                                          8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                                                                                                          SHA512

                                                                                                                                          213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                          MD5

                                                                                                                                          a6279ec92ff948760ce53bba817d6a77

                                                                                                                                          SHA1

                                                                                                                                          5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                                                                                                          SHA256

                                                                                                                                          8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                                                                                                          SHA512

                                                                                                                                          213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
                                                                                                                                          MD5

                                                                                                                                          ecd7365422db60cf4f55f3c6f4ed49bf

                                                                                                                                          SHA1

                                                                                                                                          e4b914e366e854fc076b0faa955d4f52ae6f840d

                                                                                                                                          SHA256

                                                                                                                                          77041a33e4f52b86a78b12d80a21e48ba25e4d4c430090f33ba69a08f12a83a7

                                                                                                                                          SHA512

                                                                                                                                          a6a3b539765c31957564ee166dd8f2539ff4cfb73e76eda3cae1120f15abea410cc735bd8b0e759d69971ed788e58191b8d1c6f18081236aa7a431c8f88b0a24

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
                                                                                                                                          MD5

                                                                                                                                          ecd7365422db60cf4f55f3c6f4ed49bf

                                                                                                                                          SHA1

                                                                                                                                          e4b914e366e854fc076b0faa955d4f52ae6f840d

                                                                                                                                          SHA256

                                                                                                                                          77041a33e4f52b86a78b12d80a21e48ba25e4d4c430090f33ba69a08f12a83a7

                                                                                                                                          SHA512

                                                                                                                                          a6a3b539765c31957564ee166dd8f2539ff4cfb73e76eda3cae1120f15abea410cc735bd8b0e759d69971ed788e58191b8d1c6f18081236aa7a431c8f88b0a24

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                                                                                          MD5

                                                                                                                                          8097f49e3facdb9c8b0c99cd99f3066e

                                                                                                                                          SHA1

                                                                                                                                          077ffc21b8e60ebfc8c8df770db25e39a84e466a

                                                                                                                                          SHA256

                                                                                                                                          435dc414c613b77700a07c401e0c63acac66b31ea37c6fea63e37178c02b74a5

                                                                                                                                          SHA512

                                                                                                                                          91853360fc25ed589e8cba0ae22c3e01947ac0065d1474fb7a840b56f4ebe9923490ffb197714ce9f378f902cb5a6f9a201494f71344f8808dee1308e5a8a088

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                                                                                          MD5

                                                                                                                                          8097f49e3facdb9c8b0c99cd99f3066e

                                                                                                                                          SHA1

                                                                                                                                          077ffc21b8e60ebfc8c8df770db25e39a84e466a

                                                                                                                                          SHA256

                                                                                                                                          435dc414c613b77700a07c401e0c63acac66b31ea37c6fea63e37178c02b74a5

                                                                                                                                          SHA512

                                                                                                                                          91853360fc25ed589e8cba0ae22c3e01947ac0065d1474fb7a840b56f4ebe9923490ffb197714ce9f378f902cb5a6f9a201494f71344f8808dee1308e5a8a088

                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\Q4k9jICxp6ihXOsNAf61CQuS.exe
                                                                                                                                          MD5

                                                                                                                                          3f22bd82ee1b38f439e6354c60126d6d

                                                                                                                                          SHA1

                                                                                                                                          63b57d818f86ea64ebc8566faeb0c977839defde

                                                                                                                                          SHA256

                                                                                                                                          265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                                                                                                                                          SHA512

                                                                                                                                          b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\Q4k9jICxp6ihXOsNAf61CQuS.exe
                                                                                                                                          MD5

                                                                                                                                          3f22bd82ee1b38f439e6354c60126d6d

                                                                                                                                          SHA1

                                                                                                                                          63b57d818f86ea64ebc8566faeb0c977839defde

                                                                                                                                          SHA256

                                                                                                                                          265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                                                                                                                                          SHA512

                                                                                                                                          b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                                                                                                                                        • C:\Windows\rss\csrss.exe
                                                                                                                                          MD5

                                                                                                                                          f01d6fa9b172453c4538847d8fba92fd

                                                                                                                                          SHA1

                                                                                                                                          5c8bce1505107101bf28151fc073c71fca6ca7ba

                                                                                                                                          SHA256

                                                                                                                                          7ce5bfd458b3a8064b078a41fa9ecdd777f8be28d04e1fc1a0fe508a77e43660

                                                                                                                                          SHA512

                                                                                                                                          7127a48dffa23c79a07137fd8030510769b3a27db7555cea5b562945b62588243862b8c06bafeaeeed2237dcb0d56dbcfc2cf1b8e3108fd64a47b5e13a980324

                                                                                                                                        • C:\Windows\rss\csrss.exe
                                                                                                                                          MD5

                                                                                                                                          f01d6fa9b172453c4538847d8fba92fd

                                                                                                                                          SHA1

                                                                                                                                          5c8bce1505107101bf28151fc073c71fca6ca7ba

                                                                                                                                          SHA256

                                                                                                                                          7ce5bfd458b3a8064b078a41fa9ecdd777f8be28d04e1fc1a0fe508a77e43660

                                                                                                                                          SHA512

                                                                                                                                          7127a48dffa23c79a07137fd8030510769b3a27db7555cea5b562945b62588243862b8c06bafeaeeed2237dcb0d56dbcfc2cf1b8e3108fd64a47b5e13a980324

                                                                                                                                        • memory/964-173-0x0000000000400000-0x00000000030E8000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          44.9MB

                                                                                                                                        • memory/964-170-0x0000000004E57000-0x0000000005293000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4.2MB

                                                                                                                                        • memory/964-172-0x00000000052A0000-0x0000000005BC6000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          9.1MB

                                                                                                                                        • memory/1188-193-0x0000000006B03000-0x0000000006B04000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1188-171-0x0000000006B10000-0x00000000070B4000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          5.6MB

                                                                                                                                        • memory/1188-174-0x00000000076E0000-0x0000000007CF8000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          6.1MB

                                                                                                                                        • memory/1188-175-0x0000000007350000-0x0000000007362000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          72KB

                                                                                                                                        • memory/1188-176-0x0000000007370000-0x00000000073AC000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          240KB

                                                                                                                                        • memory/1188-198-0x0000000007420000-0x000000000752A000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          1.0MB

                                                                                                                                        • memory/1188-191-0x0000000006B00000-0x0000000006B01000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1188-186-0x00000000001C0000-0x00000000001EF000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          188KB

                                                                                                                                        • memory/1188-192-0x0000000006B02000-0x0000000006B03000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1188-189-0x0000000006B04000-0x0000000006B06000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                        • memory/1188-146-0x0000000002413000-0x0000000002435000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          136KB

                                                                                                                                        • memory/1188-188-0x0000000000400000-0x00000000023BE000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          31.7MB

                                                                                                                                        • memory/1188-184-0x0000000071950000-0x0000000072100000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          7.7MB

                                                                                                                                        • memory/1188-185-0x0000000002413000-0x0000000002435000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          136KB

                                                                                                                                        • memory/1488-178-0x0000000004CFD000-0x0000000005139000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4.2MB

                                                                                                                                        • memory/1488-180-0x0000000000400000-0x00000000030E8000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          44.9MB

                                                                                                                                        • memory/1768-190-0x0000000005200000-0x000000000563C000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          4.2MB

                                                                                                                                        • memory/1768-195-0x0000000000400000-0x00000000030E8000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          44.9MB

                                                                                                                                        • memory/2008-183-0x0000000000400000-0x0000000000661000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          2.4MB

                                                                                                                                        • memory/2772-187-0x0000000002A60000-0x0000000002A76000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          88KB

                                                                                                                                        • memory/3432-162-0x00007FFFED500000-0x00007FFFEDFC1000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/3432-147-0x0000000000580000-0x00000000005A4000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          144KB

                                                                                                                                        • memory/3968-166-0x0000000000030000-0x0000000000039000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          36KB

                                                                                                                                        • memory/3968-167-0x0000000000400000-0x00000000023AF000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          31.7MB

                                                                                                                                        • memory/3968-155-0x0000000002483000-0x0000000002493000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/3968-165-0x0000000002483000-0x0000000002493000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          64KB

                                                                                                                                        • memory/4048-194-0x00000000038E0000-0x0000000003A9E000-memory.dmp
                                                                                                                                          Filesize

                                                                                                                                          1.7MB