Analysis
-
max time kernel
1605s -
max time network
1608s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 04:38
Static task
static1
Behavioral task
behavioral1
Sample
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe
Resource
win10v2004-20220414-en
General
-
Target
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe
-
Size
336KB
-
MD5
80fa4c5de221f99fc3c32214346a6b6a
-
SHA1
0c0137d1afdbd423eab14063461a5feed593e226
-
SHA256
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2
-
SHA512
999e18bbda2aae73f28efa59e9844732e058a1455acbb0eb5f7715242f6791bf534f15433220851a8bc71b9f1ac8e478364c1177ccfd7f17a99646d09a3209f2
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Modifies system executable filetype association 2 TTPs 13 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 12 IoCs
Processes:
xk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEpid process 900 xk.exe 976 IExplorer.exe 1156 WINLOGON.EXE 1236 CSRSS.EXE 1660 SERVICES.EXE 588 xk.exe 1600 IExplorer.exe 1648 WINLOGON.EXE 528 CSRSS.EXE 1708 SERVICES.EXE 1564 LSASS.EXE 1116 SMSS.EXE -
Processes:
resource yara_rule C:\Windows\xk.exe upx behavioral1/memory/900-61-0x0000000000400000-0x0000000000430000-memory.dmp upx \Windows\SysWOW64\IExplorer.exe upx \Windows\SysWOW64\IExplorer.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/976-68-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral1/memory/1156-75-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral1/memory/1236-83-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx behavioral1/memory/1660-89-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/1208-90-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Windows\xk.exe upx \Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/588-97-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Windows\SysWOW64\IExplorer.exe upx \Windows\SysWOW64\IExplorer.exe upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral1/memory/1600-104-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral1/memory/1648-111-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral1/memory/528-118-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx behavioral1/memory/1708-125-0x0000000000400000-0x0000000000430000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx behavioral1/memory/1564-132-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx behavioral1/memory/1116-138-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/1208-146-0x0000000000400000-0x0000000000430000-memory.dmp upx -
Loads dropped DLL 20 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exepid process 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\ b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process File opened for modification C:\desktop.ini b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File created C:\desktop.ini b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process File opened (read-only) \??\S: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\T: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\E: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\Q: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\U: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\H: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\P: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\N: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\R: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\W: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\X: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\Y: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\Z: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\F: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\L: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\I: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\J: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\K: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\M: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\O: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\V: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\B: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\G: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Drops file in System32 directory 20 IoCs
Processes:
OUTLOOK.EXEb8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process File created C:\Windows\system32\perfc007.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfc010.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\Mig2.scr b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened for modification C:\Windows\SysWOW64\shell.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File created C:\Windows\system32\perfh00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfh009.dat OUTLOOK.EXE File created C:\Windows\system32\perfc011.dat OUTLOOK.EXE File created C:\Windows\system32\perfh011.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\PerfStringBackup.TMP OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI OUTLOOK.EXE File created C:\Windows\system32\perfh007.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfh010.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\shell.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File created C:\Windows\SysWOW64\IExplorer.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File created C:\Windows\system32\perfc009.dat OUTLOOK.EXE -
Drops file in Windows directory 5 IoCs
Processes:
OUTLOOK.EXEb8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process File opened for modification C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File created C:\Windows\inf\Outlook\0009\outlperf.ini OUTLOOK.EXE File opened for modification C:\Windows\xk.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File created C:\Windows\xk.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File created C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 4 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\ b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Processes:
OUTLOOK.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" OUTLOOK.EXE -
Modifies registry class 64 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E4-0000-0000-C000-000000000046}\ = "_Categories" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063101-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067367-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307C-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A5-0000-0000-C000-000000000046}\ = "_ViewsEvents" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309B-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FF-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CC-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063002-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C2-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307F-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A0-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F2-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E1-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067353-0000-0000-C000-000000000046}\ = "OlkFrameHeaderEvents" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304B-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C4-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063076-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309E-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F4-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067356-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063045-0000-0000-C000-000000000046}\ = "Recipient" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063007-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C7-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D4-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E0-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B2-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672FB-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063024-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304B-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063102-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063048-0000-0000-C000-000000000046}\ = "AddressLists" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063023-0000-0000-C000-000000000046}\ = "_RemoteItem" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063039-0000-0000-C000-000000000046}\ = "_TaskRequestDeclineItem" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006F025-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D0-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063085-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C6-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067367-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EE-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063024-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F8-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307A-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063041-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304A-0000-0000-C000-000000000046}\ = "AddressEntries" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E4-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063071-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F1-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063024-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067353-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F6-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E0-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D3-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DE-0000-0000-C000-000000000046}\ = "_OlkComboBox" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DC-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DD-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F0-0000-0000-C000-000000000046}\ = "OlkTimeControlEvents" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063101-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F0-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F9-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C6-0000-0000-C000-000000000046}\ = "_Stores" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300D-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309C-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063039-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
OUTLOOK.EXEpid process 868 OUTLOOK.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exepid process 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OUTLOOK.EXEpid process 868 OUTLOOK.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
OUTLOOK.EXEpid process 868 OUTLOOK.EXE 868 OUTLOOK.EXE 868 OUTLOOK.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
OUTLOOK.EXEpid process 868 OUTLOOK.EXE 868 OUTLOOK.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exexk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEOUTLOOK.EXEpid process 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 900 xk.exe 976 IExplorer.exe 1156 WINLOGON.EXE 1236 CSRSS.EXE 1660 SERVICES.EXE 588 xk.exe 1600 IExplorer.exe 1648 WINLOGON.EXE 528 CSRSS.EXE 1708 SERVICES.EXE 1564 LSASS.EXE 1116 SMSS.EXE 868 OUTLOOK.EXE -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription pid process target process PID 1208 wrote to memory of 900 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1208 wrote to memory of 900 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1208 wrote to memory of 900 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1208 wrote to memory of 900 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1208 wrote to memory of 976 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1208 wrote to memory of 976 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1208 wrote to memory of 976 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1208 wrote to memory of 976 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1208 wrote to memory of 1156 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1208 wrote to memory of 1156 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1208 wrote to memory of 1156 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1208 wrote to memory of 1156 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1208 wrote to memory of 1236 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1208 wrote to memory of 1236 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1208 wrote to memory of 1236 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1208 wrote to memory of 1236 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1208 wrote to memory of 1660 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1208 wrote to memory of 1660 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1208 wrote to memory of 1660 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1208 wrote to memory of 1660 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1208 wrote to memory of 588 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1208 wrote to memory of 588 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1208 wrote to memory of 588 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1208 wrote to memory of 588 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1208 wrote to memory of 1600 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1208 wrote to memory of 1600 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1208 wrote to memory of 1600 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1208 wrote to memory of 1600 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1208 wrote to memory of 1648 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1208 wrote to memory of 1648 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1208 wrote to memory of 1648 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1208 wrote to memory of 1648 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1208 wrote to memory of 528 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1208 wrote to memory of 528 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1208 wrote to memory of 528 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1208 wrote to memory of 528 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1208 wrote to memory of 1708 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1208 wrote to memory of 1708 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1208 wrote to memory of 1708 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1208 wrote to memory of 1708 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1208 wrote to memory of 1564 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe LSASS.EXE PID 1208 wrote to memory of 1564 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe LSASS.EXE PID 1208 wrote to memory of 1564 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe LSASS.EXE PID 1208 wrote to memory of 1564 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe LSASS.EXE PID 1208 wrote to memory of 1116 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SMSS.EXE PID 1208 wrote to memory of 1116 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SMSS.EXE PID 1208 wrote to memory of 1116 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SMSS.EXE PID 1208 wrote to memory of 1116 1208 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SMSS.EXE -
System policy modification 1 TTPs 4 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
outlook_win_path 1 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe"C:\Users\Admin\AppData\Local\Temp\b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe"1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding1⤵
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD534428972e52ebaab51200b2eadfcbd75
SHA1f0f78b7802d81b3e3228465254e11f7c89bbe479
SHA256983166ff51518eb19906099f2adac7a2173d8da0d5731ca158f47f4963323194
SHA512a2d083ea2717f5720ae0b5069ff7acde06551677acdbe6df1340d1ed783969b5624c0d2ade8cacd09c30510824359fead6972484e75abb5c83baf41e54823ab1
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD55c35023da2ed08e0bdb68682465b0076
SHA1edcb356d5b9a70607944878ab34bdb799b742a6c
SHA256f4409032e5fd66d3f5b02d4a17a017277efdb76ea2e57a5fab26ddcec773074f
SHA512c3d21677ead6c15be3bee933ef39ba2b99202c0e2c843c9b83d83e5d91f58279bbf56a47e137748e0caf9aa4ae8cc608d7cbb3762a36b4810d421acd9c1b1baf
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD5a2647bbfc16088358540cb9588218a89
SHA1e9db79abecaef93e9114218883a76c3a0e3719f2
SHA2564bf26aa048aa0a825e7c1f792f26289d0cceec5c1d74d94b155ce0d3538cec77
SHA5129050ac80871630b4f9372fb8a6837c9fb7ab34a827eb2e88ab01e7fa501b9ef90fb16b00c5b9edaf7f4ac45c31f6802b21c760ba412ef7af5a88859e1595e1ba
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD52a450098c3f0e767bbdf925fea759dfc
SHA1746c2190c275b4a6c11ff08b65277ec03abb15bf
SHA2561b5355262b5613af9364d1a0c48d2b66f9f6733a593fd04bb7965daa501af508
SHA512971bcafcb340117a373d85eddef158ede2d373b8fd54fd383f3a90ebd573907c7f29abf3beb1350a6358879ff00316aae67e8d58fbf996b57589d32dbc41dd3f
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD52a450098c3f0e767bbdf925fea759dfc
SHA1746c2190c275b4a6c11ff08b65277ec03abb15bf
SHA2561b5355262b5613af9364d1a0c48d2b66f9f6733a593fd04bb7965daa501af508
SHA512971bcafcb340117a373d85eddef158ede2d373b8fd54fd383f3a90ebd573907c7f29abf3beb1350a6358879ff00316aae67e8d58fbf996b57589d32dbc41dd3f
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
336KB
MD5948322f95f278c9e64678fd5206108ef
SHA183779737fe90568785bdd8e1625af7acabf0fcc8
SHA256052d8385551b1d1426d08aceb7c473a8ec1a9556f85ef5135c6d47b545de5637
SHA5123b034036587ec6f0a41de136a2b970909abafda3a33b26d3c5e62557d9e506b72cc7e369139f99997e0d80ddf72fed4d4bd927369a4b0f03d7580455f52b3592
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD517914de724028a13ce62c2ec6ea9e547
SHA1bc5c216a338e3af8a7d4eb5dac3fb8453a03b2fd
SHA2564f2e63e38a58f6508c91712ab8f497c49d812ce8e06ba8cff0b16eb07d3e8e13
SHA51224f89530e22ffe1be373ea5e11baed47bf26f2ca05f82dde87526a6e3a223c327d62217423cc1509e11ff1e975fa3947cbff0d79122f470afbc533a5a8518ad2
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD5d0e426282a728faec85a37f1d4f534ea
SHA1d4bf3afa8bd3f46ba6887f20dbee8325057ff15e
SHA256c8fad3b3edf2c1a70dcd65a3005bc2c2533b6c6bce05c018614af1585bd0c406
SHA512f09f32281305b73f81fe2f70dbdffd8434e57c43fcc5828d47f9949c3c6c5c3f31aac8bbf8d49c5e44b98000e487f66c3ec7c2795f5006c26bb42694bd65cb6b
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD5adf6269b983eaf628990019ae2d09d7f
SHA1b197b812dab65a9aa4aad2a3ccb95f61a9f6f71e
SHA256d0b51511ee983ef29236e05b738ea114bf2ee317fc3823d907e5aecae5e1cab7
SHA51299d997c4abf17119b33ffb8b94f37712dec9298be12ea433d1e7be27ea0a55a45a78392ae6c067e548e9aaa3a8e803b816d3b34f62007bebdeb327e91e3581b5
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD5531636f60a0e686d14247fe05fea8105
SHA1374c89bcae5ec44d1fd99532b6f1ffc044916959
SHA25646054f5ea8c4db3aa165370cc047fcd4e01fee34a84367799f9c06278bea0fa0
SHA512b98b0bec4c3a875ae062456f49c3abe50f31c43db34b7924d8829ffaf28ec0794af5fcc1cbdd7d363c99e26da51881efcef147fd487445a7661a657b342369ce
-
C:\Windows\xk.exeFilesize
336KB
MD571df286903681a779da68f29215c9625
SHA11231420cb93fe368bf808ae7dd35d2213c099a15
SHA2564df0bce05faa7b419dbd0779013417dbf7830e12824287e4aca50e1bae78d40f
SHA512ea0b48607e5430973ce8fc4980ec72cfaaf0371c3fffa96cb00e4da1133c3ed274cd397714359fc091595a319f8b6e161fe8f984019e9ee12b146d9bfacd8f77
-
C:\Windows\xk.exeFilesize
336KB
MD5b0304da68b2e94884e5bf40e96bfdb09
SHA1cb4fd4a075ec267711502d56cfe331fc8243d8f4
SHA256eb9964db6d6d71cd21a86247309db5f6a67704a3c75ec51de4f224bc9faa94b0
SHA5128be3ca83a6f79f88b861d9c71b629fb107695ff6afc7524944f620eff5051aa54184176b870fff1e934d36834e26d297594b748c2d0b8309317d3743d5675b3f
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD534428972e52ebaab51200b2eadfcbd75
SHA1f0f78b7802d81b3e3228465254e11f7c89bbe479
SHA256983166ff51518eb19906099f2adac7a2173d8da0d5731ca158f47f4963323194
SHA512a2d083ea2717f5720ae0b5069ff7acde06551677acdbe6df1340d1ed783969b5624c0d2ade8cacd09c30510824359fead6972484e75abb5c83baf41e54823ab1
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD534428972e52ebaab51200b2eadfcbd75
SHA1f0f78b7802d81b3e3228465254e11f7c89bbe479
SHA256983166ff51518eb19906099f2adac7a2173d8da0d5731ca158f47f4963323194
SHA512a2d083ea2717f5720ae0b5069ff7acde06551677acdbe6df1340d1ed783969b5624c0d2ade8cacd09c30510824359fead6972484e75abb5c83baf41e54823ab1
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD55c35023da2ed08e0bdb68682465b0076
SHA1edcb356d5b9a70607944878ab34bdb799b742a6c
SHA256f4409032e5fd66d3f5b02d4a17a017277efdb76ea2e57a5fab26ddcec773074f
SHA512c3d21677ead6c15be3bee933ef39ba2b99202c0e2c843c9b83d83e5d91f58279bbf56a47e137748e0caf9aa4ae8cc608d7cbb3762a36b4810d421acd9c1b1baf
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD55c35023da2ed08e0bdb68682465b0076
SHA1edcb356d5b9a70607944878ab34bdb799b742a6c
SHA256f4409032e5fd66d3f5b02d4a17a017277efdb76ea2e57a5fab26ddcec773074f
SHA512c3d21677ead6c15be3bee933ef39ba2b99202c0e2c843c9b83d83e5d91f58279bbf56a47e137748e0caf9aa4ae8cc608d7cbb3762a36b4810d421acd9c1b1baf
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD5a2647bbfc16088358540cb9588218a89
SHA1e9db79abecaef93e9114218883a76c3a0e3719f2
SHA2564bf26aa048aa0a825e7c1f792f26289d0cceec5c1d74d94b155ce0d3538cec77
SHA5129050ac80871630b4f9372fb8a6837c9fb7ab34a827eb2e88ab01e7fa501b9ef90fb16b00c5b9edaf7f4ac45c31f6802b21c760ba412ef7af5a88859e1595e1ba
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD5a2647bbfc16088358540cb9588218a89
SHA1e9db79abecaef93e9114218883a76c3a0e3719f2
SHA2564bf26aa048aa0a825e7c1f792f26289d0cceec5c1d74d94b155ce0d3538cec77
SHA5129050ac80871630b4f9372fb8a6837c9fb7ab34a827eb2e88ab01e7fa501b9ef90fb16b00c5b9edaf7f4ac45c31f6802b21c760ba412ef7af5a88859e1595e1ba
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD52a450098c3f0e767bbdf925fea759dfc
SHA1746c2190c275b4a6c11ff08b65277ec03abb15bf
SHA2561b5355262b5613af9364d1a0c48d2b66f9f6733a593fd04bb7965daa501af508
SHA512971bcafcb340117a373d85eddef158ede2d373b8fd54fd383f3a90ebd573907c7f29abf3beb1350a6358879ff00316aae67e8d58fbf996b57589d32dbc41dd3f
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD52a450098c3f0e767bbdf925fea759dfc
SHA1746c2190c275b4a6c11ff08b65277ec03abb15bf
SHA2561b5355262b5613af9364d1a0c48d2b66f9f6733a593fd04bb7965daa501af508
SHA512971bcafcb340117a373d85eddef158ede2d373b8fd54fd383f3a90ebd573907c7f29abf3beb1350a6358879ff00316aae67e8d58fbf996b57589d32dbc41dd3f
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD52a450098c3f0e767bbdf925fea759dfc
SHA1746c2190c275b4a6c11ff08b65277ec03abb15bf
SHA2561b5355262b5613af9364d1a0c48d2b66f9f6733a593fd04bb7965daa501af508
SHA512971bcafcb340117a373d85eddef158ede2d373b8fd54fd383f3a90ebd573907c7f29abf3beb1350a6358879ff00316aae67e8d58fbf996b57589d32dbc41dd3f
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD52a450098c3f0e767bbdf925fea759dfc
SHA1746c2190c275b4a6c11ff08b65277ec03abb15bf
SHA2561b5355262b5613af9364d1a0c48d2b66f9f6733a593fd04bb7965daa501af508
SHA512971bcafcb340117a373d85eddef158ede2d373b8fd54fd383f3a90ebd573907c7f29abf3beb1350a6358879ff00316aae67e8d58fbf996b57589d32dbc41dd3f
-
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
336KB
MD5948322f95f278c9e64678fd5206108ef
SHA183779737fe90568785bdd8e1625af7acabf0fcc8
SHA256052d8385551b1d1426d08aceb7c473a8ec1a9556f85ef5135c6d47b545de5637
SHA5123b034036587ec6f0a41de136a2b970909abafda3a33b26d3c5e62557d9e506b72cc7e369139f99997e0d80ddf72fed4d4bd927369a4b0f03d7580455f52b3592
-
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
336KB
MD5948322f95f278c9e64678fd5206108ef
SHA183779737fe90568785bdd8e1625af7acabf0fcc8
SHA256052d8385551b1d1426d08aceb7c473a8ec1a9556f85ef5135c6d47b545de5637
SHA5123b034036587ec6f0a41de136a2b970909abafda3a33b26d3c5e62557d9e506b72cc7e369139f99997e0d80ddf72fed4d4bd927369a4b0f03d7580455f52b3592
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD517914de724028a13ce62c2ec6ea9e547
SHA1bc5c216a338e3af8a7d4eb5dac3fb8453a03b2fd
SHA2564f2e63e38a58f6508c91712ab8f497c49d812ce8e06ba8cff0b16eb07d3e8e13
SHA51224f89530e22ffe1be373ea5e11baed47bf26f2ca05f82dde87526a6e3a223c327d62217423cc1509e11ff1e975fa3947cbff0d79122f470afbc533a5a8518ad2
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD517914de724028a13ce62c2ec6ea9e547
SHA1bc5c216a338e3af8a7d4eb5dac3fb8453a03b2fd
SHA2564f2e63e38a58f6508c91712ab8f497c49d812ce8e06ba8cff0b16eb07d3e8e13
SHA51224f89530e22ffe1be373ea5e11baed47bf26f2ca05f82dde87526a6e3a223c327d62217423cc1509e11ff1e975fa3947cbff0d79122f470afbc533a5a8518ad2
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD5d0e426282a728faec85a37f1d4f534ea
SHA1d4bf3afa8bd3f46ba6887f20dbee8325057ff15e
SHA256c8fad3b3edf2c1a70dcd65a3005bc2c2533b6c6bce05c018614af1585bd0c406
SHA512f09f32281305b73f81fe2f70dbdffd8434e57c43fcc5828d47f9949c3c6c5c3f31aac8bbf8d49c5e44b98000e487f66c3ec7c2795f5006c26bb42694bd65cb6b
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD5d0e426282a728faec85a37f1d4f534ea
SHA1d4bf3afa8bd3f46ba6887f20dbee8325057ff15e
SHA256c8fad3b3edf2c1a70dcd65a3005bc2c2533b6c6bce05c018614af1585bd0c406
SHA512f09f32281305b73f81fe2f70dbdffd8434e57c43fcc5828d47f9949c3c6c5c3f31aac8bbf8d49c5e44b98000e487f66c3ec7c2795f5006c26bb42694bd65cb6b
-
\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD5531636f60a0e686d14247fe05fea8105
SHA1374c89bcae5ec44d1fd99532b6f1ffc044916959
SHA25646054f5ea8c4db3aa165370cc047fcd4e01fee34a84367799f9c06278bea0fa0
SHA512b98b0bec4c3a875ae062456f49c3abe50f31c43db34b7924d8829ffaf28ec0794af5fcc1cbdd7d363c99e26da51881efcef147fd487445a7661a657b342369ce
-
\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD5531636f60a0e686d14247fe05fea8105
SHA1374c89bcae5ec44d1fd99532b6f1ffc044916959
SHA25646054f5ea8c4db3aa165370cc047fcd4e01fee34a84367799f9c06278bea0fa0
SHA512b98b0bec4c3a875ae062456f49c3abe50f31c43db34b7924d8829ffaf28ec0794af5fcc1cbdd7d363c99e26da51881efcef147fd487445a7661a657b342369ce
-
\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD5adf6269b983eaf628990019ae2d09d7f
SHA1b197b812dab65a9aa4aad2a3ccb95f61a9f6f71e
SHA256d0b51511ee983ef29236e05b738ea114bf2ee317fc3823d907e5aecae5e1cab7
SHA51299d997c4abf17119b33ffb8b94f37712dec9298be12ea433d1e7be27ea0a55a45a78392ae6c067e548e9aaa3a8e803b816d3b34f62007bebdeb327e91e3581b5
-
\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD5adf6269b983eaf628990019ae2d09d7f
SHA1b197b812dab65a9aa4aad2a3ccb95f61a9f6f71e
SHA256d0b51511ee983ef29236e05b738ea114bf2ee317fc3823d907e5aecae5e1cab7
SHA51299d997c4abf17119b33ffb8b94f37712dec9298be12ea433d1e7be27ea0a55a45a78392ae6c067e548e9aaa3a8e803b816d3b34f62007bebdeb327e91e3581b5
-
memory/528-118-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/528-113-0x0000000000000000-mapping.dmp
-
memory/588-97-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/588-91-0x0000000000000000-mapping.dmp
-
memory/868-145-0x000000006C821000-0x000000006C823000-memory.dmpFilesize
8KB
-
memory/868-140-0x0000000072231000-0x0000000072233000-memory.dmpFilesize
8KB
-
memory/868-147-0x000000007321D000-0x0000000073228000-memory.dmpFilesize
44KB
-
memory/868-144-0x000000007321D000-0x0000000073228000-memory.dmpFilesize
44KB
-
memory/868-143-0x000000006D071000-0x000000006D073000-memory.dmpFilesize
8KB
-
memory/868-141-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/900-61-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/900-57-0x0000000000000000-mapping.dmp
-
memory/976-64-0x0000000000000000-mapping.dmp
-
memory/976-68-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1116-138-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1116-134-0x0000000000000000-mapping.dmp
-
memory/1156-71-0x0000000000000000-mapping.dmp
-
memory/1156-75-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1208-139-0x0000000000720000-0x0000000000750000-memory.dmpFilesize
192KB
-
memory/1208-92-0x0000000000720000-0x0000000000750000-memory.dmpFilesize
192KB
-
memory/1208-56-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/1208-146-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1208-90-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1236-78-0x0000000000000000-mapping.dmp
-
memory/1236-83-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1564-132-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1564-127-0x0000000000000000-mapping.dmp
-
memory/1600-104-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1600-99-0x0000000000000000-mapping.dmp
-
memory/1648-106-0x0000000000000000-mapping.dmp
-
memory/1648-111-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1660-89-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1660-85-0x0000000000000000-mapping.dmp
-
memory/1708-120-0x0000000000000000-mapping.dmp
-
memory/1708-125-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB