Analysis
-
max time kernel
1690s -
max time network
1602s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 04:32
Static task
static1
Behavioral task
behavioral1
Sample
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe
Resource
win10v2004-20220414-en
General
-
Target
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe
-
Size
336KB
-
MD5
76e0568cd550d31fe8f8974b69918a72
-
SHA1
1b9dc5b41bddce2db51c9951ebc9efc211178358
-
SHA256
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288
-
SHA512
26d13b91bbb14e537a9f216973b21e28facdce6fb03184fa4a6c2343acc86eecab820513772d1e31c0bb8de79b3744edd67cd8919d5947f1f4ee8463cc157ce8
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Modifies system executable filetype association 2 TTPs 13 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 14 IoCs
Processes:
xk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXELSASS.EXESMSS.EXEpid process 1624 xk.exe 4200 IExplorer.exe 3360 WINLOGON.EXE 4360 CSRSS.EXE 1596 SERVICES.EXE 3232 xk.exe 4884 IExplorer.exe 4400 WINLOGON.EXE 4248 CSRSS.EXE 4012 SERVICES.EXE 1964 LSASS.EXE 2076 SMSS.EXE 1104 LSASS.EXE 4700 SMSS.EXE -
Processes:
resource yara_rule behavioral2/memory/3484-132-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Windows\xk.exe upx C:\Windows\xk.exe upx behavioral2/memory/1624-138-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Windows\SysWOW64\IExplorer.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral2/memory/4200-144-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE upx behavioral2/memory/3360-150-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE upx behavioral2/memory/4360-156-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx behavioral2/memory/1596-162-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Windows\xk.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral2/memory/3232-168-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/4884-172-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral2/memory/4400-177-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral2/memory/4248-182-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx behavioral2/memory/4012-188-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE upx behavioral2/memory/1964-193-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE upx behavioral2/memory/2076-199-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/3484-200-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral2/memory/1104-206-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx behavioral2/memory/4700-210-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/3484-211-0x0000000000400000-0x0000000000430000-memory.dmp upx -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process File opened for modification C:\desktop.ini 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\desktop.ini 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process File opened (read-only) \??\H: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\I: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\K: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\L: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\V: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\W: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\Y: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\B: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\J: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\M: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\N: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\P: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\S: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\Z: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\E: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\O: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\Q: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\R: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\X: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\F: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\G: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\T: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened (read-only) \??\U: 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Drops file in System32 directory 6 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process File opened for modification C:\Windows\SysWOW64\shell.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\Windows\SysWOW64\shell.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\Windows\SysWOW64\Mig2.scr 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\Windows\SysWOW64\IExplorer.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Drops file in Windows directory 2 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process File opened for modification C:\Windows\xk.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe File created C:\Windows\xk.exe 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Modifies Control Panel 4 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\ 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Modifies registry class 15 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exepid process 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exexk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXELSASS.EXESMSS.EXEpid process 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe 1624 xk.exe 4200 IExplorer.exe 3360 WINLOGON.EXE 4360 CSRSS.EXE 1596 SERVICES.EXE 3232 xk.exe 4884 IExplorer.exe 4400 WINLOGON.EXE 4248 CSRSS.EXE 4012 SERVICES.EXE 1964 LSASS.EXE 2076 SMSS.EXE 1104 LSASS.EXE 4700 SMSS.EXE -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription pid process target process PID 3484 wrote to memory of 1624 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 3484 wrote to memory of 1624 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 3484 wrote to memory of 1624 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 3484 wrote to memory of 4200 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 3484 wrote to memory of 4200 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 3484 wrote to memory of 4200 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 3484 wrote to memory of 3360 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 3484 wrote to memory of 3360 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 3484 wrote to memory of 3360 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 3484 wrote to memory of 4360 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 3484 wrote to memory of 4360 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 3484 wrote to memory of 4360 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 3484 wrote to memory of 1596 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 3484 wrote to memory of 1596 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 3484 wrote to memory of 1596 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 3484 wrote to memory of 3232 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 3484 wrote to memory of 3232 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 3484 wrote to memory of 3232 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe xk.exe PID 3484 wrote to memory of 4884 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 3484 wrote to memory of 4884 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 3484 wrote to memory of 4884 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe IExplorer.exe PID 3484 wrote to memory of 4400 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 3484 wrote to memory of 4400 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 3484 wrote to memory of 4400 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe WINLOGON.EXE PID 3484 wrote to memory of 4248 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 3484 wrote to memory of 4248 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 3484 wrote to memory of 4248 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe CSRSS.EXE PID 3484 wrote to memory of 4012 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 3484 wrote to memory of 4012 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 3484 wrote to memory of 4012 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SERVICES.EXE PID 3484 wrote to memory of 1964 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 3484 wrote to memory of 1964 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 3484 wrote to memory of 1964 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 3484 wrote to memory of 2076 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SMSS.EXE PID 3484 wrote to memory of 2076 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SMSS.EXE PID 3484 wrote to memory of 2076 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SMSS.EXE PID 3484 wrote to memory of 1104 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 3484 wrote to memory of 1104 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 3484 wrote to memory of 1104 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe LSASS.EXE PID 3484 wrote to memory of 4700 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SMSS.EXE PID 3484 wrote to memory of 4700 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SMSS.EXE PID 3484 wrote to memory of 4700 3484 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe SMSS.EXE -
System policy modification 1 TTPs 4 IoCs
Processes:
99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe"C:\Users\Admin\AppData\Local\Temp\99cd30e5e45b85b12ac72c685b0c2937cd9b8edb71d7f359a6829353be77a288.exe"1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD500c5da328a34940ee06f0693ef11c892
SHA14af9c8056edfe4df1736d0f5cadcdedc45791e49
SHA2563e7fef18836383515dbcad5c19f1ffe9eaf5dc5062d06e65877f8a8ae4bcddf7
SHA512078d2e803aae83d47c331464bd4c50b81b5d047f757eaa4e155c3fe1ba1b3ff89eb21fed018ea077d1d1067dcd901a3372ce5ebcc579e66791c64d5222a0cb50
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD5508f2e69f7120c8cda3fb90cee296db6
SHA1719715a34421ea9b98b978657d94f02d58308f5c
SHA256f3833d2d06ab5de361e8d12347132245ab0ce56208619e6eab206bbdf8e7797a
SHA512f4bacb15d49cb90cf6d203b7742e47f27e5cba1f98b938580d737d5babbc30d87f42cac2de2a0b87d98fe58e6e1c2021f716d71256ae37a8e362989899ec4b73
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD5b76c5c7bd9a105b67c974275af66477d
SHA153bc35314f086f19e6131b5c9fa00b79d6f06278
SHA2560785f06118197a82ade1094c9581a32d4647ebd44a470263b313a61efdc6e38b
SHA512ee4e5d720196b5d0a5f9f389a037c4848270b9c19ceb52678ffa7b05440c3be50c56de1fe06f66f8016d1cc390747beb817908bb6029d8a9e5251509592fb0b5
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD5b76c5c7bd9a105b67c974275af66477d
SHA153bc35314f086f19e6131b5c9fa00b79d6f06278
SHA2560785f06118197a82ade1094c9581a32d4647ebd44a470263b313a61efdc6e38b
SHA512ee4e5d720196b5d0a5f9f389a037c4848270b9c19ceb52678ffa7b05440c3be50c56de1fe06f66f8016d1cc390747beb817908bb6029d8a9e5251509592fb0b5
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD5cf804c6b179c8c4c7a8af046e94f47c5
SHA181186eba7a8ff69cc0782e47dfd0d46cc8aecb3e
SHA256b25b8edca6e91971c846f10ae119208c3bfcdf559091025b9c655210a5a96018
SHA512b88d67c79913c0e9f83e86b87504779de067b027b03dfef6a94a98e8ddd05b29921544a42f4f28f2eeb3c5492173c8d951b61420da8fbda454c91a94e183ad47
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD5d0741143ed0af128965488da1950d155
SHA16fd4dbe24947fea5207066cdaccca8b73490ac72
SHA256f51f3ddb7c1695e28b98007e0e45e7b5ad4c5691d5574460659f851dd0706e3e
SHA512a3e30835330223f271291cbd5c1524c5f0494dd89f58a784041467056fdb358f764697db4430c35145a11596dfa4fb46c68bf5c2325286b620b2817db9b7add9
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
336KB
MD574aa3fe48ca621eab1dfebf6e268d783
SHA15f0849892bd71cc63ae42322fa7930ee99c74f95
SHA2569e661853b73e81c761b5b42ffa5b62e11371c45d07d23a80862813887345c640
SHA5125596ca0b7fe99d16d48690861d00f4ed3ebf18de8f2ea4ecf67e31d519994d67ee301e03c241ed58b78501ab271fbbf6ccb54b4f244d6f420a7d7349235e2121
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
336KB
MD574aa3fe48ca621eab1dfebf6e268d783
SHA15f0849892bd71cc63ae42322fa7930ee99c74f95
SHA2569e661853b73e81c761b5b42ffa5b62e11371c45d07d23a80862813887345c640
SHA5125596ca0b7fe99d16d48690861d00f4ed3ebf18de8f2ea4ecf67e31d519994d67ee301e03c241ed58b78501ab271fbbf6ccb54b4f244d6f420a7d7349235e2121
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD54e23b0ec60495a9f4e6f336e8615e7ba
SHA1851048def50a8ed06db1e3455513cec3b44cedff
SHA2562ba4f93f71e9f5e228bb0604b16f9c7c1f390c4a579a86698b6805ac0fa252e5
SHA512594b17f00390d2e27d1f1d47afb179f785be3379cee1d12cf761dd665993098f1f90e222ab1bc84702dd1733db3d669d2669cf16fab14c347afeb9a15401c597
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD5a59f968506b9d78807ec200404acd989
SHA17d4d08b8ad41e1bb175635cc4a9eeeafd7b9eeee
SHA256caea2eb9dcd7c2a5e2133df2e167ae5600c90ea2c42dc0fa1eb195e4ff2d706d
SHA5126639c6f6d1d0a2d6dadb06af45c1562e247eb82ca29a41816b64dc29c0d307f908bc356de58998606614f573d0aae3d5e8694f89172cc7cd151e5fa6482c3056
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXEFilesize
336KB
MD500c5da328a34940ee06f0693ef11c892
SHA14af9c8056edfe4df1736d0f5cadcdedc45791e49
SHA2563e7fef18836383515dbcad5c19f1ffe9eaf5dc5062d06e65877f8a8ae4bcddf7
SHA512078d2e803aae83d47c331464bd4c50b81b5d047f757eaa4e155c3fe1ba1b3ff89eb21fed018ea077d1d1067dcd901a3372ce5ebcc579e66791c64d5222a0cb50
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXEFilesize
336KB
MD5b76c5c7bd9a105b67c974275af66477d
SHA153bc35314f086f19e6131b5c9fa00b79d6f06278
SHA2560785f06118197a82ade1094c9581a32d4647ebd44a470263b313a61efdc6e38b
SHA512ee4e5d720196b5d0a5f9f389a037c4848270b9c19ceb52678ffa7b05440c3be50c56de1fe06f66f8016d1cc390747beb817908bb6029d8a9e5251509592fb0b5
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXEFilesize
336KB
MD5cf804c6b179c8c4c7a8af046e94f47c5
SHA181186eba7a8ff69cc0782e47dfd0d46cc8aecb3e
SHA256b25b8edca6e91971c846f10ae119208c3bfcdf559091025b9c655210a5a96018
SHA512b88d67c79913c0e9f83e86b87504779de067b027b03dfef6a94a98e8ddd05b29921544a42f4f28f2eeb3c5492173c8d951b61420da8fbda454c91a94e183ad47
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXEFilesize
336KB
MD574aa3fe48ca621eab1dfebf6e268d783
SHA15f0849892bd71cc63ae42322fa7930ee99c74f95
SHA2569e661853b73e81c761b5b42ffa5b62e11371c45d07d23a80862813887345c640
SHA5125596ca0b7fe99d16d48690861d00f4ed3ebf18de8f2ea4ecf67e31d519994d67ee301e03c241ed58b78501ab271fbbf6ccb54b4f244d6f420a7d7349235e2121
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXEFilesize
336KB
MD54e23b0ec60495a9f4e6f336e8615e7ba
SHA1851048def50a8ed06db1e3455513cec3b44cedff
SHA2562ba4f93f71e9f5e228bb0604b16f9c7c1f390c4a579a86698b6805ac0fa252e5
SHA512594b17f00390d2e27d1f1d47afb179f785be3379cee1d12cf761dd665993098f1f90e222ab1bc84702dd1733db3d669d2669cf16fab14c347afeb9a15401c597
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD55ed8bee35f33ccb6091ec1c9e43b72e8
SHA1d1c947696beea81bbd30fecf2e223ca400dfe7fc
SHA25609e2ac2d383e575637f42202e2007a37e4bb772ea967d667d458b29ac728c264
SHA51295cbf64572dca9fd5220e47e2f4636c7f5ab235a8832ee514a24779a9582a4094d4d1bae2bb1c98e333a540e20071e7194eb08fdd11fa1c87ff2c4f66637a322
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD55ed8bee35f33ccb6091ec1c9e43b72e8
SHA1d1c947696beea81bbd30fecf2e223ca400dfe7fc
SHA25609e2ac2d383e575637f42202e2007a37e4bb772ea967d667d458b29ac728c264
SHA51295cbf64572dca9fd5220e47e2f4636c7f5ab235a8832ee514a24779a9582a4094d4d1bae2bb1c98e333a540e20071e7194eb08fdd11fa1c87ff2c4f66637a322
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD5bc8f228e33f146af01f38c793ef4f903
SHA1cbdaa9429cb97ac4baabcd387f022346ac3f0c18
SHA25694d364d3472d50d229177b50d69da4de143ae6d8fd5939cb2fac02798ff0709c
SHA512e97093eb6c6559816bd3367e734189cd73467ba4523af21dd02e35617615007cf211d2cd336395fcb126b06042365be34653efb62cd42d7a6d502b8caaa157c8
-
C:\Windows\xk.exeFilesize
336KB
MD5d1fcb1a87b21b68cfc9b8713f5c45c15
SHA125ee2dc92ef9817d8597138644b2939822fb38e2
SHA256fcb22b25463c90a21960ba2f4187b6d05ca409a13f3cbeb5822afc5e99c2111c
SHA5129405a6c9f4180eee6663a004ff71d10e91f72e52b9972ae78e0910e710bc23bb330b066d168af89ebc11f18d471e94250d894e75ccebe419c1f4e82b7a7f3923
-
C:\Windows\xk.exeFilesize
336KB
MD5d1fcb1a87b21b68cfc9b8713f5c45c15
SHA125ee2dc92ef9817d8597138644b2939822fb38e2
SHA256fcb22b25463c90a21960ba2f4187b6d05ca409a13f3cbeb5822afc5e99c2111c
SHA5129405a6c9f4180eee6663a004ff71d10e91f72e52b9972ae78e0910e710bc23bb330b066d168af89ebc11f18d471e94250d894e75ccebe419c1f4e82b7a7f3923
-
C:\Windows\xk.exeFilesize
336KB
MD513c8bb0cb1193e71c51047c2d214a9f2
SHA10c7f1b6c799216843df7c3a82ae01fb842e11ed8
SHA256ff0a44e471cecb26c93be3312b327d11e0d0667b778f138e493ae9b32050fc84
SHA512222c9332107f70fc0b39ad9dddf069a82a23bb75aeee98670b7875a0900c5e3bef249bd0d974fd1ad688f6deedb822a09962504bdf563292592a072de1dc08ef
-
memory/1104-201-0x0000000000000000-mapping.dmp
-
memory/1104-206-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1596-157-0x0000000000000000-mapping.dmp
-
memory/1596-162-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1624-133-0x0000000000000000-mapping.dmp
-
memory/1624-138-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1964-193-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1964-187-0x0000000000000000-mapping.dmp
-
memory/2076-194-0x0000000000000000-mapping.dmp
-
memory/2076-199-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3232-168-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3232-163-0x0000000000000000-mapping.dmp
-
memory/3360-150-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3360-145-0x0000000000000000-mapping.dmp
-
memory/3484-200-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3484-211-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3484-132-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4012-188-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4012-183-0x0000000000000000-mapping.dmp
-
memory/4200-139-0x0000000000000000-mapping.dmp
-
memory/4200-144-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4248-178-0x0000000000000000-mapping.dmp
-
memory/4248-182-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4360-151-0x0000000000000000-mapping.dmp
-
memory/4360-156-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4400-173-0x0000000000000000-mapping.dmp
-
memory/4400-177-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4700-205-0x0000000000000000-mapping.dmp
-
memory/4700-210-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4884-167-0x0000000000000000-mapping.dmp
-
memory/4884-172-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB