Analysis
-
max time kernel
1568s -
max time network
1586s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 04:38
Static task
static1
Behavioral task
behavioral1
Sample
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe
Resource
win10v2004-20220414-en
General
-
Target
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe
-
Size
336KB
-
MD5
80fa4c5de221f99fc3c32214346a6b6a
-
SHA1
0c0137d1afdbd423eab14063461a5feed593e226
-
SHA256
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2
-
SHA512
999e18bbda2aae73f28efa59e9844732e058a1455acbb0eb5f7715242f6791bf534f15433220851a8bc71b9f1ac8e478364c1177ccfd7f17a99646d09a3209f2
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Modifies system executable filetype association 2 TTPs 13 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 14 IoCs
Processes:
xk.exeIExplorer.exeWINLOGON.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEpid process 2212 xk.exe 1160 IExplorer.exe 4924 WINLOGON.EXE 980 xk.exe 3768 IExplorer.exe 1108 WINLOGON.EXE 3712 CSRSS.EXE 4700 SERVICES.EXE 3240 LSASS.EXE 2024 SMSS.EXE 2960 CSRSS.EXE 3680 SERVICES.EXE 4104 LSASS.EXE 224 SMSS.EXE -
Processes:
resource yara_rule behavioral2/memory/1056-130-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Windows\xk.exe upx C:\Windows\xk.exe upx behavioral2/memory/2212-139-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Windows\SysWOW64\IExplorer.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral2/memory/1160-144-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral2/memory/4924-150-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Windows\xk.exe upx behavioral2/memory/980-156-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral2/memory/3768-158-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral2/memory/3768-161-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/1108-166-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE upx behavioral2/memory/3712-172-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE upx behavioral2/memory/4700-178-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE upx behavioral2/memory/3240-184-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE upx behavioral2/memory/2024-190-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/1056-191-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral2/memory/2960-196-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx behavioral2/memory/3680-199-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/3680-203-0x0000000000400000-0x0000000000430000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx behavioral2/memory/4104-207-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/224-212-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/1056-213-0x0000000000400000-0x0000000000430000-memory.dmp upx -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run\ b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process File opened for modification C:\desktop.ini b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File created C:\desktop.ini b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process File opened (read-only) \??\U: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\F: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\K: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\L: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\M: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\O: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\P: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\T: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\W: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\H: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\I: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\N: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\B: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\E: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\G: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\Q: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\V: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\X: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\Y: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\J: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\R: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\S: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened (read-only) \??\Z: b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Drops file in System32 directory 6 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process File opened for modification C:\Windows\SysWOW64\shell.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File created C:\Windows\SysWOW64\shell.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File created C:\Windows\SysWOW64\Mig2.scr b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File created C:\Windows\SysWOW64\IExplorer.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Drops file in Windows directory 2 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process File opened for modification C:\Windows\xk.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe File created C:\Windows\xk.exe b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Modifies Control Panel 4 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\ b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Modifies registry class 15 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exepid process 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exexk.exeIExplorer.exeWINLOGON.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEpid process 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe 2212 xk.exe 1160 IExplorer.exe 4924 WINLOGON.EXE 980 xk.exe 3768 IExplorer.exe 1108 WINLOGON.EXE 3712 CSRSS.EXE 4700 SERVICES.EXE 3240 LSASS.EXE 2024 SMSS.EXE 2960 CSRSS.EXE 3680 SERVICES.EXE 4104 LSASS.EXE 224 SMSS.EXE -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription pid process target process PID 1056 wrote to memory of 2212 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1056 wrote to memory of 2212 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1056 wrote to memory of 2212 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1056 wrote to memory of 1160 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1056 wrote to memory of 1160 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1056 wrote to memory of 1160 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1056 wrote to memory of 4924 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1056 wrote to memory of 4924 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1056 wrote to memory of 4924 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1056 wrote to memory of 980 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1056 wrote to memory of 980 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1056 wrote to memory of 980 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe xk.exe PID 1056 wrote to memory of 3768 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1056 wrote to memory of 3768 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1056 wrote to memory of 3768 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe IExplorer.exe PID 1056 wrote to memory of 1108 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1056 wrote to memory of 1108 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1056 wrote to memory of 1108 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe WINLOGON.EXE PID 1056 wrote to memory of 3712 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1056 wrote to memory of 3712 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1056 wrote to memory of 3712 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1056 wrote to memory of 4700 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1056 wrote to memory of 4700 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1056 wrote to memory of 4700 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1056 wrote to memory of 3240 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe LSASS.EXE PID 1056 wrote to memory of 3240 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe LSASS.EXE PID 1056 wrote to memory of 3240 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe LSASS.EXE PID 1056 wrote to memory of 2024 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SMSS.EXE PID 1056 wrote to memory of 2024 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SMSS.EXE PID 1056 wrote to memory of 2024 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SMSS.EXE PID 1056 wrote to memory of 2960 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1056 wrote to memory of 2960 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1056 wrote to memory of 2960 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe CSRSS.EXE PID 1056 wrote to memory of 3680 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1056 wrote to memory of 3680 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1056 wrote to memory of 3680 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SERVICES.EXE PID 1056 wrote to memory of 4104 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe LSASS.EXE PID 1056 wrote to memory of 4104 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe LSASS.EXE PID 1056 wrote to memory of 4104 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe LSASS.EXE PID 1056 wrote to memory of 224 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SMSS.EXE PID 1056 wrote to memory of 224 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SMSS.EXE PID 1056 wrote to memory of 224 1056 b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe SMSS.EXE -
System policy modification 1 TTPs 4 IoCs
Processes:
b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe"C:\Users\Admin\AppData\Local\Temp\b8e309c3d298b53ddf03e0e0e6b06eb6e3c6471c3718df83fa65211a374254d2.exe"1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD5f0a7bb2669094b719f19368aa347329c
SHA13844710c7e17b81a6d0048a944a45128353c2266
SHA256d8d0227e3d926e897cf815d08ff5e54715b3324772ac7d43f3d1346d04f741af
SHA512b3f4bc794d4d24769b2c89211ec78915b9a076b9c2b8194139cf041f4d667a7fd5397e6799bb47b518ab69e568bfb1faacb72329d32e485b43ee9dbfee844d1c
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
336KB
MD5f0a7bb2669094b719f19368aa347329c
SHA13844710c7e17b81a6d0048a944a45128353c2266
SHA256d8d0227e3d926e897cf815d08ff5e54715b3324772ac7d43f3d1346d04f741af
SHA512b3f4bc794d4d24769b2c89211ec78915b9a076b9c2b8194139cf041f4d667a7fd5397e6799bb47b518ab69e568bfb1faacb72329d32e485b43ee9dbfee844d1c
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD5545a2dfd767565e49a458fdb067cf248
SHA126b97e370527f158582d2430b1e4f76d51106857
SHA256c9e5e91719300e9a77262ed67354c4596439ad3711d90e7d2a9cd317440b9939
SHA5121868874fc26a4d131f0f8facf6e4f250097f50922f2b582041b4e218c5a557de2a597c2de649a1667454567729cfdc5f8c687d24c20f372b6f7692ff159465e4
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
336KB
MD5545a2dfd767565e49a458fdb067cf248
SHA126b97e370527f158582d2430b1e4f76d51106857
SHA256c9e5e91719300e9a77262ed67354c4596439ad3711d90e7d2a9cd317440b9939
SHA5121868874fc26a4d131f0f8facf6e4f250097f50922f2b582041b4e218c5a557de2a597c2de649a1667454567729cfdc5f8c687d24c20f372b6f7692ff159465e4
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD5661ed8ab6259378a4fb24d465f5543c3
SHA12ca180aa645f033ef0a692c5a0438be6d340c0fe
SHA2564f1a95d446464d55e3a24e838a65b93e401f59913a258e0371a0273c792e25c4
SHA512fc995be81db6d1654c6b5ff24a67147f1a75628471c74822ba8fe0e12b3ab156ca48816618d17d3ffbdb7d9d60c041346f8f22e4bd6322f0417ac205832fd6f0
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
336KB
MD5661ed8ab6259378a4fb24d465f5543c3
SHA12ca180aa645f033ef0a692c5a0438be6d340c0fe
SHA2564f1a95d446464d55e3a24e838a65b93e401f59913a258e0371a0273c792e25c4
SHA512fc995be81db6d1654c6b5ff24a67147f1a75628471c74822ba8fe0e12b3ab156ca48816618d17d3ffbdb7d9d60c041346f8f22e4bd6322f0417ac205832fd6f0
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
336KB
MD5ecc7c1b0bb137107f439c9ba363a4858
SHA1b9d42a45e81f903866b23b5a0cff54bf54079240
SHA2567d49f1776f16d6b13bac120671dde2d756033b2832aaea4f4415997ee8660f05
SHA5122e9a4b485fe33697b05e949d10c4fcc8d7bdfea0ddba6a0476caa35a03340c6cbc29c8b9495752df918b7ecb078126b4fb5593787dc3452ead2a2b505142e21e
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
336KB
MD5ecc7c1b0bb137107f439c9ba363a4858
SHA1b9d42a45e81f903866b23b5a0cff54bf54079240
SHA2567d49f1776f16d6b13bac120671dde2d756033b2832aaea4f4415997ee8660f05
SHA5122e9a4b485fe33697b05e949d10c4fcc8d7bdfea0ddba6a0476caa35a03340c6cbc29c8b9495752df918b7ecb078126b4fb5593787dc3452ead2a2b505142e21e
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD56220133249e28ff86fc1e18229d48433
SHA110d5fd97f09c0bc5dfbdeaa1fc1c9148764383ef
SHA2560d626d3512bb0661eacdb063934242a9d18394e4d91a9df922d299f1c8c79636
SHA512a718bc26e3cde4da47b2a6d3a46305b631a3d291ec23a0a8299e7bd1fd2f188d2ba7a1f27e507c2e3794a7adeb137d5613dbd3f726e4d9d86f27461bae5abede
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
336KB
MD59065a93acdad756fc551a6e8f666e0d0
SHA1e6bd90f874465d9364607ab545b4bb3567f0814a
SHA2564098d25d22ed6bbe47b374c67e4f0bc49cf117f82162999615b257b488b1b3cf
SHA51281eaf9cf35ed411577b326dfbd2c1edb4587428d4b0d7ae7269f1d67112b9ba75d773d65e6169d46ab1df62e3ca3ece974d3b7406ef897dd21c1726c87541cfe
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXEFilesize
336KB
MD5f0a7bb2669094b719f19368aa347329c
SHA13844710c7e17b81a6d0048a944a45128353c2266
SHA256d8d0227e3d926e897cf815d08ff5e54715b3324772ac7d43f3d1346d04f741af
SHA512b3f4bc794d4d24769b2c89211ec78915b9a076b9c2b8194139cf041f4d667a7fd5397e6799bb47b518ab69e568bfb1faacb72329d32e485b43ee9dbfee844d1c
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXEFilesize
336KB
MD5545a2dfd767565e49a458fdb067cf248
SHA126b97e370527f158582d2430b1e4f76d51106857
SHA256c9e5e91719300e9a77262ed67354c4596439ad3711d90e7d2a9cd317440b9939
SHA5121868874fc26a4d131f0f8facf6e4f250097f50922f2b582041b4e218c5a557de2a597c2de649a1667454567729cfdc5f8c687d24c20f372b6f7692ff159465e4
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXEFilesize
336KB
MD5661ed8ab6259378a4fb24d465f5543c3
SHA12ca180aa645f033ef0a692c5a0438be6d340c0fe
SHA2564f1a95d446464d55e3a24e838a65b93e401f59913a258e0371a0273c792e25c4
SHA512fc995be81db6d1654c6b5ff24a67147f1a75628471c74822ba8fe0e12b3ab156ca48816618d17d3ffbdb7d9d60c041346f8f22e4bd6322f0417ac205832fd6f0
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXEFilesize
336KB
MD5ecc7c1b0bb137107f439c9ba363a4858
SHA1b9d42a45e81f903866b23b5a0cff54bf54079240
SHA2567d49f1776f16d6b13bac120671dde2d756033b2832aaea4f4415997ee8660f05
SHA5122e9a4b485fe33697b05e949d10c4fcc8d7bdfea0ddba6a0476caa35a03340c6cbc29c8b9495752df918b7ecb078126b4fb5593787dc3452ead2a2b505142e21e
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXEFilesize
336KB
MD56220133249e28ff86fc1e18229d48433
SHA110d5fd97f09c0bc5dfbdeaa1fc1c9148764383ef
SHA2560d626d3512bb0661eacdb063934242a9d18394e4d91a9df922d299f1c8c79636
SHA512a718bc26e3cde4da47b2a6d3a46305b631a3d291ec23a0a8299e7bd1fd2f188d2ba7a1f27e507c2e3794a7adeb137d5613dbd3f726e4d9d86f27461bae5abede
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD58be03c3677797a5836dda2e10ee31d69
SHA1dfa0f58f84cc25935dc52a764d9cd35b5765b58f
SHA2566d66b4b8262f696f6d1110becad2cffdb34b01aa997d22d21fe60940c071e957
SHA5123ecaf6febc0309d3c1e0dbc5cd57e8372a00bb916cdf2bb6318d4b4cbc9e568b0df2c134eb88917037262b55eaf380b4613370cf942a84e7e0322eba1f006f96
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD58be03c3677797a5836dda2e10ee31d69
SHA1dfa0f58f84cc25935dc52a764d9cd35b5765b58f
SHA2566d66b4b8262f696f6d1110becad2cffdb34b01aa997d22d21fe60940c071e957
SHA5123ecaf6febc0309d3c1e0dbc5cd57e8372a00bb916cdf2bb6318d4b4cbc9e568b0df2c134eb88917037262b55eaf380b4613370cf942a84e7e0322eba1f006f96
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
336KB
MD504546a39ed45819e3f555b2a90fcdfac
SHA153c4b63e2285c9bb51751f5a576e9d30ba4aa706
SHA256727cb9214fee3d8ad042c99189913220c4023c5953178505211d020854614979
SHA5122f19595b898f614c227802a9a21ad48160fb1ea355d2ada6dbcbc2dcab835305249e0311827476ea4c39e256e4849c684a1e6c59f900bb8c50d5e0896235ee76
-
C:\Windows\xk.exeFilesize
336KB
MD5370ac308341cfda89f546a422c04d600
SHA187caa039b2806d60a80448abed03b37b7387ee1d
SHA2567d7f66053303d72c187720b868326c66539afe358bf9b50e20acfe35f7881fe2
SHA512975195fd8901ffcb436006a3f7b19b050138d1c0cf9621e1577ccbeb56cfdf10ba587553ddc27afffd6c7055f04ecd960570912f4ac290715b892f293d1d6958
-
C:\Windows\xk.exeFilesize
336KB
MD5370ac308341cfda89f546a422c04d600
SHA187caa039b2806d60a80448abed03b37b7387ee1d
SHA2567d7f66053303d72c187720b868326c66539afe358bf9b50e20acfe35f7881fe2
SHA512975195fd8901ffcb436006a3f7b19b050138d1c0cf9621e1577ccbeb56cfdf10ba587553ddc27afffd6c7055f04ecd960570912f4ac290715b892f293d1d6958
-
C:\Windows\xk.exeFilesize
336KB
MD558cb85e305d89d632b10ccddb4fff67d
SHA13af34fb3419443ff923062d2a9fe9a41f20bd527
SHA256a5b8941babb83272b77ee2c06414978cd71436d2bb6fc3f14f119cc7a3738bdf
SHA512cd47bf4ab43920d9a18533b48fe01d74a9cafbb4ff238cbe7187f202cbb904a67020cf52cc8a37bd88b621231d51bc231421f7587490fb351cd12eb0c8a9d8a0
-
memory/224-208-0x0000000000000000-mapping.dmp
-
memory/224-212-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/980-151-0x0000000000000000-mapping.dmp
-
memory/980-156-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1056-191-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1056-130-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1056-213-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1108-166-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1108-162-0x0000000000000000-mapping.dmp
-
memory/1160-144-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1160-138-0x0000000000000000-mapping.dmp
-
memory/2024-190-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2024-185-0x0000000000000000-mapping.dmp
-
memory/2212-133-0x0000000000000000-mapping.dmp
-
memory/2212-139-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2960-196-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2960-192-0x0000000000000000-mapping.dmp
-
memory/3240-184-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3240-179-0x0000000000000000-mapping.dmp
-
memory/3680-203-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3680-199-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3680-197-0x0000000000000000-mapping.dmp
-
memory/3712-172-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3712-167-0x0000000000000000-mapping.dmp
-
memory/3768-158-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3768-161-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3768-155-0x0000000000000000-mapping.dmp
-
memory/4104-202-0x0000000000000000-mapping.dmp
-
memory/4104-207-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4700-173-0x0000000000000000-mapping.dmp
-
memory/4700-178-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4924-150-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4924-145-0x0000000000000000-mapping.dmp