Analysis
-
max time kernel
1617s -
max time network
1622s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 04:32
Static task
static1
Behavioral task
behavioral1
Sample
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe
Resource
win10v2004-20220414-en
General
-
Target
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe
-
Size
336KB
-
MD5
76e0568cd550d31fe8f8974b69918a72
-
SHA1
1b9dc5b41bddce2db51c9951ebc9efc211178358
-
SHA256
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288
-
SHA512
26d13b91bbb14e537a9f216973b21e28facdce6fb03184fa4a6c2343acc86eecab820513772d1e31c0bb8de79b3744edd67cd8919d5947f1f4ee8463cc157ce8
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Modifies system executable filetype association 2 TTPs 13 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 13 IoCs
Processes:
xk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEpid process 1960 xk.exe 1752 IExplorer.exe 1696 WINLOGON.EXE 956 CSRSS.EXE 908 SERVICES.EXE 1288 LSASS.EXE 1632 xk.exe 276 IExplorer.exe 1204 WINLOGON.EXE 1836 CSRSS.EXE 876 SERVICES.EXE 1084 LSASS.EXE 1036 SMSS.EXE -
Processes:
resource yara_rule C:\Windows\xk.exe upx behavioral1/memory/1960-61-0x0000000000400000-0x0000000000430000-memory.dmp upx \Windows\SysWOW64\IExplorer.exe upx \Windows\SysWOW64\IExplorer.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/1752-68-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral1/memory/1696-78-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral1/memory/956-82-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral1/memory/908-90-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral1/memory/1288-96-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Windows\xk.exe upx \Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/1632-107-0x0000000000400000-0x0000000000430000-memory.dmp upx \Windows\SysWOW64\IExplorer.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/1932-101-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/276-112-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral1/memory/1204-121-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx behavioral1/memory/1836-126-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral1/memory/876-133-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral1/memory/1084-140-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx behavioral1/memory/1036-146-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/1932-154-0x0000000000400000-0x0000000000430000-memory.dmp upx -
Loads dropped DLL 22 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exepid process 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process File opened for modification C:\desktop.ini 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\desktop.ini 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process File opened (read-only) \??\F: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\G: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\J: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\E: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\K: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\M: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\Q: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\S: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\U: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\W: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\B: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\H: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\L: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\O: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\P: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\T: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\V: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\Y: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\Z: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\I: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\N: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\R: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\X: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Drops file in System32 directory 20 IoCs
Processes:
OUTLOOK.EXE99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process File created C:\Windows\system32\perfh011.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI OUTLOOK.EXE File created C:\Windows\system32\perfh00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfc010.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\Mig2.scr 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\Windows\system32\perfh007.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00A.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\shell.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\Windows\SysWOW64\Mig2.scr 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\Windows\system32\perfc00C.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\shell.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\Windows\SysWOW64\PerfStringBackup.TMP OUTLOOK.EXE File created C:\Windows\system32\perfh009.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfh010.dat OUTLOOK.EXE File created C:\Windows\system32\perfc011.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\IExplorer.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\Windows\system32\perfc007.dat OUTLOOK.EXE File created C:\Windows\system32\perfc009.dat OUTLOOK.EXE -
Drops file in Windows directory 5 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exeOUTLOOK.EXEdescription ioc process File created C:\Windows\xk.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File opened for modification C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File created C:\Windows\inf\Outlook\0009\outlperf.ini OUTLOOK.EXE File opened for modification C:\Windows\xk.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 4 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\ 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Processes:
OUTLOOK.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel OUTLOOK.EXE -
Modifies registry class 64 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DE-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063037-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E6-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303B-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063101-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300E-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063059-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063036-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672ED-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D6-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006305C-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063044-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304C-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B2-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063096-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063038-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D87E7E17-6897-11CE-A6C0-00AA00608FAA} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067366-0000-0000-C000-000000000046}\ = "OlkControl" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C7-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D7-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309E-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A2-0000-0000-C000-000000000046}\ = "_BusinessCardView" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CD-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CF-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A5-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063025-0000-0000-C000-000000000046}\ = "_NoteItem" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063036-0000-0000-C000-000000000046}\ = "_TaskRequestItem" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\ = "_Application" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A8-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063044-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A1-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067367-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304C-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304D-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F0-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E4-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063045-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C8-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300B-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063026-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063040-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E0-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F2-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FE-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DE-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CA-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300A-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300D-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EF-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F0-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C5-0000-0000-C000-000000000046}\ = "_Account" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D6-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309A-0000-0000-C000-000000000046}\ = "_OrderFields" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50BB9B50-811D-11CE-B565-00AA00608FAA} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063024-0000-0000-C000-000000000046}\ = "_PostItem" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063038-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B0-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309E-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063039-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EE-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063045-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303C-0000-0000-C000-000000000046}\ = "Attachments" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303D-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D8-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
OUTLOOK.EXEpid process 804 OUTLOOK.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exepid process 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OUTLOOK.EXEpid process 804 OUTLOOK.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
OUTLOOK.EXEpid process 804 OUTLOOK.EXE 804 OUTLOOK.EXE 804 OUTLOOK.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
OUTLOOK.EXEpid process 804 OUTLOOK.EXE 804 OUTLOOK.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exexk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEOUTLOOK.EXEpid process 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1960 xk.exe 1752 IExplorer.exe 1696 WINLOGON.EXE 956 CSRSS.EXE 908 SERVICES.EXE 1288 LSASS.EXE 1632 xk.exe 276 IExplorer.exe 1204 WINLOGON.EXE 1836 CSRSS.EXE 876 SERVICES.EXE 1084 LSASS.EXE 1036 SMSS.EXE 804 OUTLOOK.EXE -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription pid process target process PID 1932 wrote to memory of 1960 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 1932 wrote to memory of 1960 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 1932 wrote to memory of 1960 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 1932 wrote to memory of 1960 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 1932 wrote to memory of 1752 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 1932 wrote to memory of 1752 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 1932 wrote to memory of 1752 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 1932 wrote to memory of 1752 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 1932 wrote to memory of 1696 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 1932 wrote to memory of 1696 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 1932 wrote to memory of 1696 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 1932 wrote to memory of 1696 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 1932 wrote to memory of 956 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 1932 wrote to memory of 956 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 1932 wrote to memory of 956 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 1932 wrote to memory of 956 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 1932 wrote to memory of 908 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 1932 wrote to memory of 908 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 1932 wrote to memory of 908 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 1932 wrote to memory of 908 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 1932 wrote to memory of 1288 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 1932 wrote to memory of 1288 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 1932 wrote to memory of 1288 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 1932 wrote to memory of 1288 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 1932 wrote to memory of 1632 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 1932 wrote to memory of 1632 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 1932 wrote to memory of 1632 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 1932 wrote to memory of 1632 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 1932 wrote to memory of 276 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 1932 wrote to memory of 276 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 1932 wrote to memory of 276 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 1932 wrote to memory of 276 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 1932 wrote to memory of 1204 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 1932 wrote to memory of 1204 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 1932 wrote to memory of 1204 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 1932 wrote to memory of 1204 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 1932 wrote to memory of 1836 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 1932 wrote to memory of 1836 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 1932 wrote to memory of 1836 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 1932 wrote to memory of 1836 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 1932 wrote to memory of 876 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 1932 wrote to memory of 876 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 1932 wrote to memory of 876 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 1932 wrote to memory of 876 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 1932 wrote to memory of 1084 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 1932 wrote to memory of 1084 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 1932 wrote to memory of 1084 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 1932 wrote to memory of 1084 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 1932 wrote to memory of 1036 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SMSS.EXE PID 1932 wrote to memory of 1036 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SMSS.EXE PID 1932 wrote to memory of 1036 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SMSS.EXE PID 1932 wrote to memory of 1036 1932 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SMSS.EXE -
System policy modification 1 TTPs 4 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
outlook_win_path 1 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe"C:\Users\Admin\AppData\Local\Temp\99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe"1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding1⤵
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD50f37babf85089d63bcf455f25ff872ad
SHA12d2c75966adbac3ad4413939ca4b415c91280a66
SHA256c8f417475d484df8ec035626863881ca29fbad6f49cc7fb5c48f9484ada03eb3
SHA512f37a78c61c4fd1e346661d33740012d0b47f58f8bc6207458c5b7929843a9f6ca36887c2cc96e472e0138d76e89913b1857ca9d364b596284ff6ae2074b44bc9
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD59c57aef4cfd241445c633478386b1ecb
SHA1ab1ced1ff570df6dba8f47e985774385dd08d155
SHA256fa4279b7820367867bef94f25e718f5129aaa532082eb5b2dc02f4771f563c3b
SHA5124672796cc6fff3c002bfdcb30cb7c868e0431ce4f0fff659cf7e432969d9a3a7558e27b3e1d011238dcb960ff21cb227a5dcb58894e85412e1f547ff08d7980d
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD524003408e11b1db4183b79c98969563f
SHA16730b0101bbeae9369e6e61332fd188f3787dca9
SHA256931e43e9b2102cff8e7d118ada074679a7fb8d1f425acad5261f684e6aa1b8b2
SHA51287cba587ae049a8c57118ff201def26ce5415f074285877e4a61e079673ca649fa259c1057055f168bb8dc7719f2e4ce2c4c54645150b92e71036486d325b595
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD524003408e11b1db4183b79c98969563f
SHA16730b0101bbeae9369e6e61332fd188f3787dca9
SHA256931e43e9b2102cff8e7d118ada074679a7fb8d1f425acad5261f684e6aa1b8b2
SHA51287cba587ae049a8c57118ff201def26ce5415f074285877e4a61e079673ca649fa259c1057055f168bb8dc7719f2e4ce2c4c54645150b92e71036486d325b595
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD56d139f0d8aa386e2bc5f07855a37afab
SHA11aed5ffcf7bfc975ec7d977bb495813d900644b3
SHA25696c17f124eb45247af95f0b9ad8d94f6e8b6ba4e14bc9c29b3ca581fab775dd9
SHA512ecab2595708431c3ab52cce0e7f5cbf21892899cdb43ec99fc3dac0bcd0862fe1fe90c2eb9169224c24693e534ad8bce99b7bc495b1dfa1824f60300a33ac791
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD568d29ac7515bbc703dd7d71ecf0bc568
SHA16b3dbf9673da65b70028eedf3efdc3538e5fc08d
SHA256cb0f0b8e4bde997c6ba958062b1584688e8a1d30757139e790a37fa343b86df6
SHA512e86ae53d35360a177eec5b02edb08f07e8e0a39e23c7f9ec42a53583c391cb14bbfa8df97536986b630de068d0390f5c1dbf873d2250424edc74d71be655e689
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
336KB
MD57bb70408e9548eecce7804442de5f8b9
SHA1bac9fa2313713851580df6918427e589cfcf6442
SHA2561927e004c07e764742f70ef7634f68e0d0ebfc91a18f696777ac491aefaef16b
SHA51288668ff2b73bced9acf1e94b3dc7fd33d96ef4a911833cce3e3923824e961e8c1c37687fb2229e5a0c713d7ae42468fa13d36db9e75561e3c73b1251c4f53740
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD58e5a3f156f6fcf61947b75347cb60abd
SHA12127039cc6530ea02b032b78ea3aed713e3384d4
SHA25614a571814d28d560a653ce11f06ca460150589ba8a52a20834eeac2a899ff957
SHA5126602538650f10833b078402dd4d074b6954be026441f604c2a46198553cc766f1f7df1c9fb835615bf6fd27ecf372c7284e970560ca7151255eaf09d0ad476fa
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD5681f9090aee3fb1087f9a59bf1975409
SHA160112cb5ba5613c0be402819cf1a1fb24bf327b5
SHA2561687d12fe642c697cb8bea42c2318c8e934ae001f0969c40a483ace8a1f3bf4d
SHA512062cd276ecd36b043b6114cc72e965ec1b5f59f906f342986ab89d30a253f79d83982b1fafc77c36369897c30adb83769dc6d71c10c9abbdb2f1d1f8442c57db
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD53d9ac3c0bcd3e9c2ec297ff3e4d18bf4
SHA1220fa31cc5e0e86b41fd57c7159b4a1f0409f04b
SHA2562398814c5a180d980129677c318caab2027eb7babcbfcf6adf04bf0e0d783c62
SHA512dad874cd6ab5c1e7bda39d2d06266536bf92fa4c3794a6286dd85d39021b279dba70da6c8c016c7df33b69eef37752f96078d244800d5f0c39cc5ae994d75fb8
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD545c3bc896c56cb76d6764371cdea3009
SHA1382c1fe42cd16df99e837f971ce5c2d0f02d8935
SHA256ef77a89eab19fd078c2ed29c029481072ef19486228d268d084b4e9f51657a1f
SHA512f09d1c13736b34f4a6a18171ad951a712bfaf9c49e874aa2acca062fb0cc581edaa19a4933d28ab654fd2d2f9de0fdc7609942e2b4414bce211c0032f8b0af15
-
C:\Windows\xk.exeFilesize
336KB
MD558c2573ccb6e74a05f1f6659724ddb07
SHA18d5564162ee93186c309474c4e7ed4514308d3c1
SHA2562bcb5a3d300de8440096eb40a290b6116850d46743592274930a7278b5cfded5
SHA5122bc4e2d1ec636456311e83fe3b2479f68277bc593b1eeff2187a90b00558f5779c147c7ec14ff70a5f449e763b983e7813c6c988b03fa2b152440513fecea63e
-
C:\Windows\xk.exeFilesize
336KB
MD5acd92ca36b82bf23eb89a69e75cc560b
SHA12d90b0c3447f38cd0e63cbeabe6879be810d8be9
SHA256256901b269596966911c9f8ab5b0c0fd2a8c18e139fe7ff0b805a92c9fb97878
SHA512834dddd045c75f257b11646b69d243a136f9c80dbdb3706b61e0b4e52aecbd59862e0906e44cc7b548cad32970f7fd7723ecfe7cd704565d414d47d594a1dc96
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD50f37babf85089d63bcf455f25ff872ad
SHA12d2c75966adbac3ad4413939ca4b415c91280a66
SHA256c8f417475d484df8ec035626863881ca29fbad6f49cc7fb5c48f9484ada03eb3
SHA512f37a78c61c4fd1e346661d33740012d0b47f58f8bc6207458c5b7929843a9f6ca36887c2cc96e472e0138d76e89913b1857ca9d364b596284ff6ae2074b44bc9
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD50f37babf85089d63bcf455f25ff872ad
SHA12d2c75966adbac3ad4413939ca4b415c91280a66
SHA256c8f417475d484df8ec035626863881ca29fbad6f49cc7fb5c48f9484ada03eb3
SHA512f37a78c61c4fd1e346661d33740012d0b47f58f8bc6207458c5b7929843a9f6ca36887c2cc96e472e0138d76e89913b1857ca9d364b596284ff6ae2074b44bc9
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD59c57aef4cfd241445c633478386b1ecb
SHA1ab1ced1ff570df6dba8f47e985774385dd08d155
SHA256fa4279b7820367867bef94f25e718f5129aaa532082eb5b2dc02f4771f563c3b
SHA5124672796cc6fff3c002bfdcb30cb7c868e0431ce4f0fff659cf7e432969d9a3a7558e27b3e1d011238dcb960ff21cb227a5dcb58894e85412e1f547ff08d7980d
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD59c57aef4cfd241445c633478386b1ecb
SHA1ab1ced1ff570df6dba8f47e985774385dd08d155
SHA256fa4279b7820367867bef94f25e718f5129aaa532082eb5b2dc02f4771f563c3b
SHA5124672796cc6fff3c002bfdcb30cb7c868e0431ce4f0fff659cf7e432969d9a3a7558e27b3e1d011238dcb960ff21cb227a5dcb58894e85412e1f547ff08d7980d
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD524003408e11b1db4183b79c98969563f
SHA16730b0101bbeae9369e6e61332fd188f3787dca9
SHA256931e43e9b2102cff8e7d118ada074679a7fb8d1f425acad5261f684e6aa1b8b2
SHA51287cba587ae049a8c57118ff201def26ce5415f074285877e4a61e079673ca649fa259c1057055f168bb8dc7719f2e4ce2c4c54645150b92e71036486d325b595
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD524003408e11b1db4183b79c98969563f
SHA16730b0101bbeae9369e6e61332fd188f3787dca9
SHA256931e43e9b2102cff8e7d118ada074679a7fb8d1f425acad5261f684e6aa1b8b2
SHA51287cba587ae049a8c57118ff201def26ce5415f074285877e4a61e079673ca649fa259c1057055f168bb8dc7719f2e4ce2c4c54645150b92e71036486d325b595
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD524003408e11b1db4183b79c98969563f
SHA16730b0101bbeae9369e6e61332fd188f3787dca9
SHA256931e43e9b2102cff8e7d118ada074679a7fb8d1f425acad5261f684e6aa1b8b2
SHA51287cba587ae049a8c57118ff201def26ce5415f074285877e4a61e079673ca649fa259c1057055f168bb8dc7719f2e4ce2c4c54645150b92e71036486d325b595
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD524003408e11b1db4183b79c98969563f
SHA16730b0101bbeae9369e6e61332fd188f3787dca9
SHA256931e43e9b2102cff8e7d118ada074679a7fb8d1f425acad5261f684e6aa1b8b2
SHA51287cba587ae049a8c57118ff201def26ce5415f074285877e4a61e079673ca649fa259c1057055f168bb8dc7719f2e4ce2c4c54645150b92e71036486d325b595
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD56d139f0d8aa386e2bc5f07855a37afab
SHA11aed5ffcf7bfc975ec7d977bb495813d900644b3
SHA25696c17f124eb45247af95f0b9ad8d94f6e8b6ba4e14bc9c29b3ca581fab775dd9
SHA512ecab2595708431c3ab52cce0e7f5cbf21892899cdb43ec99fc3dac0bcd0862fe1fe90c2eb9169224c24693e534ad8bce99b7bc495b1dfa1824f60300a33ac791
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD56d139f0d8aa386e2bc5f07855a37afab
SHA11aed5ffcf7bfc975ec7d977bb495813d900644b3
SHA25696c17f124eb45247af95f0b9ad8d94f6e8b6ba4e14bc9c29b3ca581fab775dd9
SHA512ecab2595708431c3ab52cce0e7f5cbf21892899cdb43ec99fc3dac0bcd0862fe1fe90c2eb9169224c24693e534ad8bce99b7bc495b1dfa1824f60300a33ac791
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD568d29ac7515bbc703dd7d71ecf0bc568
SHA16b3dbf9673da65b70028eedf3efdc3538e5fc08d
SHA256cb0f0b8e4bde997c6ba958062b1584688e8a1d30757139e790a37fa343b86df6
SHA512e86ae53d35360a177eec5b02edb08f07e8e0a39e23c7f9ec42a53583c391cb14bbfa8df97536986b630de068d0390f5c1dbf873d2250424edc74d71be655e689
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD568d29ac7515bbc703dd7d71ecf0bc568
SHA16b3dbf9673da65b70028eedf3efdc3538e5fc08d
SHA256cb0f0b8e4bde997c6ba958062b1584688e8a1d30757139e790a37fa343b86df6
SHA512e86ae53d35360a177eec5b02edb08f07e8e0a39e23c7f9ec42a53583c391cb14bbfa8df97536986b630de068d0390f5c1dbf873d2250424edc74d71be655e689
-
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
336KB
MD57bb70408e9548eecce7804442de5f8b9
SHA1bac9fa2313713851580df6918427e589cfcf6442
SHA2561927e004c07e764742f70ef7634f68e0d0ebfc91a18f696777ac491aefaef16b
SHA51288668ff2b73bced9acf1e94b3dc7fd33d96ef4a911833cce3e3923824e961e8c1c37687fb2229e5a0c713d7ae42468fa13d36db9e75561e3c73b1251c4f53740
-
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
336KB
MD57bb70408e9548eecce7804442de5f8b9
SHA1bac9fa2313713851580df6918427e589cfcf6442
SHA2561927e004c07e764742f70ef7634f68e0d0ebfc91a18f696777ac491aefaef16b
SHA51288668ff2b73bced9acf1e94b3dc7fd33d96ef4a911833cce3e3923824e961e8c1c37687fb2229e5a0c713d7ae42468fa13d36db9e75561e3c73b1251c4f53740
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD58e5a3f156f6fcf61947b75347cb60abd
SHA12127039cc6530ea02b032b78ea3aed713e3384d4
SHA25614a571814d28d560a653ce11f06ca460150589ba8a52a20834eeac2a899ff957
SHA5126602538650f10833b078402dd4d074b6954be026441f604c2a46198553cc766f1f7df1c9fb835615bf6fd27ecf372c7284e970560ca7151255eaf09d0ad476fa
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD58e5a3f156f6fcf61947b75347cb60abd
SHA12127039cc6530ea02b032b78ea3aed713e3384d4
SHA25614a571814d28d560a653ce11f06ca460150589ba8a52a20834eeac2a899ff957
SHA5126602538650f10833b078402dd4d074b6954be026441f604c2a46198553cc766f1f7df1c9fb835615bf6fd27ecf372c7284e970560ca7151255eaf09d0ad476fa
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD5681f9090aee3fb1087f9a59bf1975409
SHA160112cb5ba5613c0be402819cf1a1fb24bf327b5
SHA2561687d12fe642c697cb8bea42c2318c8e934ae001f0969c40a483ace8a1f3bf4d
SHA512062cd276ecd36b043b6114cc72e965ec1b5f59f906f342986ab89d30a253f79d83982b1fafc77c36369897c30adb83769dc6d71c10c9abbdb2f1d1f8442c57db
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD5681f9090aee3fb1087f9a59bf1975409
SHA160112cb5ba5613c0be402819cf1a1fb24bf327b5
SHA2561687d12fe642c697cb8bea42c2318c8e934ae001f0969c40a483ace8a1f3bf4d
SHA512062cd276ecd36b043b6114cc72e965ec1b5f59f906f342986ab89d30a253f79d83982b1fafc77c36369897c30adb83769dc6d71c10c9abbdb2f1d1f8442c57db
-
\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD53d9ac3c0bcd3e9c2ec297ff3e4d18bf4
SHA1220fa31cc5e0e86b41fd57c7159b4a1f0409f04b
SHA2562398814c5a180d980129677c318caab2027eb7babcbfcf6adf04bf0e0d783c62
SHA512dad874cd6ab5c1e7bda39d2d06266536bf92fa4c3794a6286dd85d39021b279dba70da6c8c016c7df33b69eef37752f96078d244800d5f0c39cc5ae994d75fb8
-
\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD53d9ac3c0bcd3e9c2ec297ff3e4d18bf4
SHA1220fa31cc5e0e86b41fd57c7159b4a1f0409f04b
SHA2562398814c5a180d980129677c318caab2027eb7babcbfcf6adf04bf0e0d783c62
SHA512dad874cd6ab5c1e7bda39d2d06266536bf92fa4c3794a6286dd85d39021b279dba70da6c8c016c7df33b69eef37752f96078d244800d5f0c39cc5ae994d75fb8
-
\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD545c3bc896c56cb76d6764371cdea3009
SHA1382c1fe42cd16df99e837f971ce5c2d0f02d8935
SHA256ef77a89eab19fd078c2ed29c029481072ef19486228d268d084b4e9f51657a1f
SHA512f09d1c13736b34f4a6a18171ad951a712bfaf9c49e874aa2acca062fb0cc581edaa19a4933d28ab654fd2d2f9de0fdc7609942e2b4414bce211c0032f8b0af15
-
\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD545c3bc896c56cb76d6764371cdea3009
SHA1382c1fe42cd16df99e837f971ce5c2d0f02d8935
SHA256ef77a89eab19fd078c2ed29c029481072ef19486228d268d084b4e9f51657a1f
SHA512f09d1c13736b34f4a6a18171ad951a712bfaf9c49e874aa2acca062fb0cc581edaa19a4933d28ab654fd2d2f9de0fdc7609942e2b4414bce211c0032f8b0af15
-
memory/276-112-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/276-104-0x0000000000000000-mapping.dmp
-
memory/804-148-0x0000000072CA1000-0x0000000072CA3000-memory.dmpFilesize
8KB
-
memory/804-149-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/804-150-0x0000000073C8D000-0x0000000073C98000-memory.dmpFilesize
44KB
-
memory/804-152-0x000000006D521000-0x000000006D523000-memory.dmpFilesize
8KB
-
memory/804-153-0x000000006CE51000-0x000000006CE53000-memory.dmpFilesize
8KB
-
memory/804-155-0x0000000073C8D000-0x0000000073C98000-memory.dmpFilesize
44KB
-
memory/876-133-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/876-128-0x0000000000000000-mapping.dmp
-
memory/908-90-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/908-85-0x0000000000000000-mapping.dmp
-
memory/956-82-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/956-77-0x0000000000000000-mapping.dmp
-
memory/1036-146-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1036-142-0x0000000000000000-mapping.dmp
-
memory/1084-140-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1084-135-0x0000000000000000-mapping.dmp
-
memory/1204-121-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1204-114-0x0000000000000000-mapping.dmp
-
memory/1288-96-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1288-92-0x0000000000000000-mapping.dmp
-
memory/1632-107-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1632-97-0x0000000000000000-mapping.dmp
-
memory/1696-71-0x0000000000000000-mapping.dmp
-
memory/1696-78-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1752-64-0x0000000000000000-mapping.dmp
-
memory/1752-68-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1836-126-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1836-120-0x0000000000000000-mapping.dmp
-
memory/1932-105-0x00000000024D0000-0x0000000002500000-memory.dmpFilesize
192KB
-
memory/1932-101-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1932-147-0x00000000024D0000-0x0000000002500000-memory.dmpFilesize
192KB
-
memory/1932-106-0x00000000024D0000-0x0000000002500000-memory.dmpFilesize
192KB
-
memory/1932-56-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1932-154-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1960-57-0x0000000000000000-mapping.dmp
-
memory/1960-61-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB