Analysis
-
max time kernel
1627s -
max time network
1631s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 03:51
Static task
static1
Behavioral task
behavioral1
Sample
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe
Resource
win10v2004-20220414-en
General
-
Target
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe
-
Size
196KB
-
MD5
1ba9fd2b8039378fd9a5e38d751abb72
-
SHA1
c92e8099ec14f07854f69484bb7a9916d7884198
-
SHA256
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9
-
SHA512
eb620ffde4784863ef8ab764629ac0e0f8597ce5eaef00ffb8a35496e1e805ce14952d9fa3194ffeec0eb2cd909dcee7dd057c7778bdf7c3d2b02e2b718bbebc
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
Modifies system executable filetype association 2 TTPs 13 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 13 IoCs
Processes:
xk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEpid process 952 xk.exe 1688 IExplorer.exe 1216 WINLOGON.EXE 1972 CSRSS.EXE 1716 SERVICES.EXE 1180 LSASS.EXE 1160 xk.exe 1504 IExplorer.exe 936 WINLOGON.EXE 1940 CSRSS.EXE 588 SERVICES.EXE 280 LSASS.EXE 1416 SMSS.EXE -
Processes:
resource yara_rule C:\Windows\xk.exe upx \Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/952-61-0x0000000000400000-0x000000000042F000-memory.dmp upx \Windows\SysWOW64\IExplorer.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/1688-68-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral1/memory/1216-75-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral1/memory/1972-82-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx behavioral1/memory/1716-89-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral1/memory/1180-96-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Windows\xk.exe upx \Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/1564-105-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/1160-104-0x0000000000400000-0x000000000042F000-memory.dmp upx \Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/1504-111-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral1/memory/936-118-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral1/memory/1940-125-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx behavioral1/memory/588-134-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral1/memory/280-138-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx behavioral1/memory/1416-145-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/1564-153-0x0000000000400000-0x000000000042F000-memory.dmp upx -
Loads dropped DLL 22 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exepid process 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process File created C:\desktop.ini 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened for modification C:\desktop.ini 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process File opened (read-only) \??\L: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\M: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\N: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\O: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\U: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\Y: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\Z: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\F: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\S: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\V: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\P: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\H: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\I: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\J: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\K: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\Q: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\R: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\W: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\B: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\X: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\G: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\T: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened (read-only) \??\E: 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
Drops file in System32 directory 20 IoCs
Processes:
OUTLOOK.EXE2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI OUTLOOK.EXE File created C:\Windows\system32\perfh007.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfc010.dat OUTLOOK.EXE File created C:\Windows\system32\perfh010.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\IExplorer.exe 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File created C:\Windows\SysWOW64\PerfStringBackup.TMP OUTLOOK.EXE File created C:\Windows\system32\perfc00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00C.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\shell.exe 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File created C:\Windows\SysWOW64\Mig2.scr 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File created C:\Windows\system32\perfc009.dat OUTLOOK.EXE File created C:\Windows\system32\perfh009.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfc011.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\shell.exe 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File created C:\Windows\system32\perfh011.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\Mig2.scr 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File created C:\Windows\system32\perfc007.dat OUTLOOK.EXE -
Drops file in Windows directory 5 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exeOUTLOOK.EXEdescription ioc process File opened for modification C:\Windows\xk.exe 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File created C:\Windows\xk.exe 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe File created C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File opened for modification C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File created C:\Windows\inf\Outlook\0009\outlperf.ini OUTLOOK.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 4 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\ 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
Processes:
OUTLOOK.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" OUTLOOK.EXE -
Modifies registry class 64 IoCs
Processes:
OUTLOOK.EXE2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672D9-0000-0000-C000-000000000046}\ = "_OlkLabel" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E1-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F4-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063077-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063098-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DA-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307D-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063070-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300D-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A1-0000-0000-C000-000000000046}\ = "_ViewFields" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E6-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CC-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308D-0000-0000-C000-000000000046}\ = "_Views" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303A-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C8-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307F-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309B-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DB-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FA-0000-0000-C000-000000000046}\ = "_AddressRuleCondition" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063049-0000-0000-C000-000000000046}\ = "AddressList" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063095-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063089-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063044-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E9-0000-0000-C000-000000000046}\ = "_MailModule" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F8-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CC-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D6-0000-0000-C000-000000000046}\ = "_MarkAsTaskRuleAction" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D8-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E5-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063072-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300E-0000-0000-C000-000000000046}\ = "ApplicationEvents_10" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F7-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D8-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D3-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307D-0000-0000-C000-000000000046}\ = "InspectorEvents" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067368-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006F025-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063049-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063089-0000-0000-C000-000000000046}\ = "Link" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063089-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307A-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303F-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E3-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063047-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063085-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067367-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A2-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063008-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A0-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E4-0000-0000-C000-000000000046}\ = "OlkListBoxEvents" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304A-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C5-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D4-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302F-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063039-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F9-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DC-0000-0000-C000-000000000046}\ = "_CategoryRuleCondition" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063025-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304A-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063087-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D9-0000-0000-C000-000000000046}\ = "_RuleCondition" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063047-0000-0000-C000-000000000046}\ = "_UserDefinedProperties" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063047-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
OUTLOOK.EXEpid process 1432 OUTLOOK.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exepid process 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OUTLOOK.EXEpid process 1432 OUTLOOK.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
OUTLOOK.EXEpid process 1432 OUTLOOK.EXE 1432 OUTLOOK.EXE 1432 OUTLOOK.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
OUTLOOK.EXEpid process 1432 OUTLOOK.EXE 1432 OUTLOOK.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exexk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEOUTLOOK.EXEpid process 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe 952 xk.exe 1688 IExplorer.exe 1216 WINLOGON.EXE 1972 CSRSS.EXE 1716 SERVICES.EXE 1180 LSASS.EXE 1160 xk.exe 1504 IExplorer.exe 936 WINLOGON.EXE 1940 CSRSS.EXE 588 SERVICES.EXE 280 LSASS.EXE 1416 SMSS.EXE 1432 OUTLOOK.EXE -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription pid process target process PID 1564 wrote to memory of 952 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe xk.exe PID 1564 wrote to memory of 952 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe xk.exe PID 1564 wrote to memory of 952 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe xk.exe PID 1564 wrote to memory of 952 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe xk.exe PID 1564 wrote to memory of 1688 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe IExplorer.exe PID 1564 wrote to memory of 1688 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe IExplorer.exe PID 1564 wrote to memory of 1688 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe IExplorer.exe PID 1564 wrote to memory of 1688 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe IExplorer.exe PID 1564 wrote to memory of 1216 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe WINLOGON.EXE PID 1564 wrote to memory of 1216 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe WINLOGON.EXE PID 1564 wrote to memory of 1216 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe WINLOGON.EXE PID 1564 wrote to memory of 1216 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe WINLOGON.EXE PID 1564 wrote to memory of 1972 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe CSRSS.EXE PID 1564 wrote to memory of 1972 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe CSRSS.EXE PID 1564 wrote to memory of 1972 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe CSRSS.EXE PID 1564 wrote to memory of 1972 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe CSRSS.EXE PID 1564 wrote to memory of 1716 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SERVICES.EXE PID 1564 wrote to memory of 1716 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SERVICES.EXE PID 1564 wrote to memory of 1716 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SERVICES.EXE PID 1564 wrote to memory of 1716 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SERVICES.EXE PID 1564 wrote to memory of 1180 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe LSASS.EXE PID 1564 wrote to memory of 1180 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe LSASS.EXE PID 1564 wrote to memory of 1180 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe LSASS.EXE PID 1564 wrote to memory of 1180 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe LSASS.EXE PID 1564 wrote to memory of 1160 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe xk.exe PID 1564 wrote to memory of 1160 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe xk.exe PID 1564 wrote to memory of 1160 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe xk.exe PID 1564 wrote to memory of 1160 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe xk.exe PID 1564 wrote to memory of 1504 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe IExplorer.exe PID 1564 wrote to memory of 1504 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe IExplorer.exe PID 1564 wrote to memory of 1504 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe IExplorer.exe PID 1564 wrote to memory of 1504 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe IExplorer.exe PID 1564 wrote to memory of 936 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe WINLOGON.EXE PID 1564 wrote to memory of 936 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe WINLOGON.EXE PID 1564 wrote to memory of 936 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe WINLOGON.EXE PID 1564 wrote to memory of 936 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe WINLOGON.EXE PID 1564 wrote to memory of 1940 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe CSRSS.EXE PID 1564 wrote to memory of 1940 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe CSRSS.EXE PID 1564 wrote to memory of 1940 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe CSRSS.EXE PID 1564 wrote to memory of 1940 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe CSRSS.EXE PID 1564 wrote to memory of 588 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SERVICES.EXE PID 1564 wrote to memory of 588 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SERVICES.EXE PID 1564 wrote to memory of 588 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SERVICES.EXE PID 1564 wrote to memory of 588 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SERVICES.EXE PID 1564 wrote to memory of 280 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe LSASS.EXE PID 1564 wrote to memory of 280 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe LSASS.EXE PID 1564 wrote to memory of 280 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe LSASS.EXE PID 1564 wrote to memory of 280 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe LSASS.EXE PID 1564 wrote to memory of 1416 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SMSS.EXE PID 1564 wrote to memory of 1416 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SMSS.EXE PID 1564 wrote to memory of 1416 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SMSS.EXE PID 1564 wrote to memory of 1416 1564 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe SMSS.EXE -
System policy modification 1 TTPs 4 IoCs
Processes:
2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe -
outlook_win_path 1 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe"C:\Users\Admin\AppData\Local\Temp\2eace38cef7c9a579b7f79251c3ae26ee3da290c7b90f0f7b6682136407dfca9.exe"1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding1⤵
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD59f6a37dba32bf863f9b09f160f5b5634
SHA16e806a1c8b01eb5a9ae634e52299b514b284a62b
SHA256de5938e9179b982967cc2626994dd42dc3a65ab898df575e622ca89cc709ef84
SHA5121d29805f19a2e40e6fe8b1dd43fbd2f25e3df56836a0207468b7fc381f18e8009137d6328aed1539edf149c9db3b5bdb7948ecb6c956f426d8ecdefd0732cb5e
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD518ea38a88a70cff816635c77816a931f
SHA1558e3e2c8822a30732d7d95d70832b875f2c26d2
SHA25673331122d91abe2357022fd410bcdbffad96a61f1837994d2392a67b02f5033e
SHA5121206d4e75760ff99096b3a830488af0591cf16edc66c40a2e93a271b2e3b037f12d7fc6fd4362bce7047a207d37cc5e7f67119a9aec3db24ba30494b34d941b8
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD59ed517ad4743327594f4e531dc593978
SHA14c5e4e497d51493e8fc3c95c60ff8e899aec5055
SHA2560e27841aabfb18ce9881047036ffc2a243af7c1bb9ac078956493518549670cb
SHA512b2d90fa46e3a99757bd9b43cd53ff415d94219e039df9361de718e1ff92361f7c34b0a0847b3f4fc84f13c5882faf9b9293ba8ced709642ec12ed31646e7b761
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD59ed517ad4743327594f4e531dc593978
SHA14c5e4e497d51493e8fc3c95c60ff8e899aec5055
SHA2560e27841aabfb18ce9881047036ffc2a243af7c1bb9ac078956493518549670cb
SHA512b2d90fa46e3a99757bd9b43cd53ff415d94219e039df9361de718e1ff92361f7c34b0a0847b3f4fc84f13c5882faf9b9293ba8ced709642ec12ed31646e7b761
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD56c2f81abffd33771e53e3d7ea7ab1e90
SHA13e094f2abb3a5fd157df526c82faae3d018515cf
SHA2563c7bbffbecb50402d43dede42766d25e80bdeb0fc2597b10a5b41951c005bcea
SHA512b0480342671f70c9a122fe3346eb467a4faed7c4946ed75b79619f0cd720c75f14587c69453504ae11f1fce2751372010bf7702ca56c696318d93ba587328b89
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD525f115a8bcadeccdfe02f6311ed87031
SHA124339c0cac3009ae6611f169260285fb0aa87fb8
SHA256818dcf2852f3a8d9bd34bd2950eb92b997dc9370887259c24fab095b9f6ff4da
SHA512d80ae1f86db1e5c7a0e35ae714ccfde1a8e8012d9be7b1ca33f3c3a9440fbb79f84e661e7deef2031cc567f18aefa62a0daca38bbd3a5c1d34e44865eb6dfa80
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD56280e71d19c2b9eafdd6026db81d52db
SHA156e51c579c9990259828bb218974fa8ab90f898e
SHA256bd06b662ee7e0dc8d48faa2f2cf9e4c5b343a17d2c390f6c8428a286bd13eec1
SHA5122fd3d5a7b8b21ecd0fec9f3affd993cfa190e210d41512bcddf0e7d7fa1a02a161d305d29940d061979062e9f173bcea81c52b8f74c6d702553086202449eb1e
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5e51b8c2e20f5c18326e1931727af32fb
SHA1930384b8c43f8378e7ce916870eba4a87993f787
SHA25622697b28aff43a2dcfff322cd5c6f1ae509ce8c1ede1ece9617b2899f52ce852
SHA51265d0194858f94d618b3b1df9287a1619e9bf5081c1658a63209b494e602e55b3faa4a3ddf2f5df1cf4f7714eee48c0892f557ea620872d4da0f2331426313e03
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD550116a376bbcaa2a1008ee51b89dbdc9
SHA1fafadced08b6c8b2442e7b31ad464d7aa2752ad6
SHA256203d27d1cf5477d598effc9569d01e29e56fcf85c445a853b0407e4f8a7fe6f5
SHA512603181cc1a94b8c58abba7728c391c34722a8b7990dc793349c85fd75fca69b637f5f634dd6b80eb6e9aa4270da0ae90d8ca28b8b019010075fda62b4157758a
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5b0c05007f49ec9dc6d5647c399a87be7
SHA1ea1cbe9edd602ddbb39d094bf50a0392c0ca5ba9
SHA2569c12170d1ace213737fd5b4e3e1011a6b3e7a6135fb09764decfc51548b53745
SHA512076ee5f7c1d4aeef702d13ca17c3e048c3be7cca9d7dc8380a0f44aa5fbb2840a7c5bb5dd39fdd74f9977e711ca3a7d1e7acf80e4747e9c5a18c034dc10050e8
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD57af88c3d9a0ef167d45443c6da954f65
SHA1a2c2fe138b419b8ed5ebfdada1c59242b73bccf8
SHA25685b622f4719e918b3176474747bdab21569337fc548cfbc9f2640171249e333b
SHA5122d4fa21c2ddf909dba6264875fde133106175299376e061c8a9fc0610ce3daee3ec32fe19e567f7fc2fd26cf98a9a02c767266cce6f606476b86b96f5dc591da
-
C:\Windows\xk.exeFilesize
196KB
MD575fb2d41e226e318141d8e2e5ec41519
SHA16f07507accd0fca950abf4cf71013ffaee45ca49
SHA25669a604cdb15f88509ad5b86779d6052198463d74655e711f57a757008607d9d1
SHA512e5df3e16828a046e3f5fb446798e904741f507f8a4e33583acd89ca3eec33070d84e92057b338ae2426b5480bae62de1cbbd162a6b3b461253db6dce8ca1e4ca
-
C:\Windows\xk.exeFilesize
196KB
MD5dd04cf57f2edd1dc29feb94491098326
SHA1c93a04ef7798f3361c7db87a88bee13aaf85e477
SHA256eeb69fa8623859e38e22309a37255a9cb7ece31a9c270b5197b9377858cdd445
SHA512246efe5b3a846158ac964b5e3e36c6a4d0895a7ebd16896bdcdcd4ad36ce695d179b3c13938fa1a0d434c5203baecff4facdb4639e10c2f4d69c709c828cbca0
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD59f6a37dba32bf863f9b09f160f5b5634
SHA16e806a1c8b01eb5a9ae634e52299b514b284a62b
SHA256de5938e9179b982967cc2626994dd42dc3a65ab898df575e622ca89cc709ef84
SHA5121d29805f19a2e40e6fe8b1dd43fbd2f25e3df56836a0207468b7fc381f18e8009137d6328aed1539edf149c9db3b5bdb7948ecb6c956f426d8ecdefd0732cb5e
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD59f6a37dba32bf863f9b09f160f5b5634
SHA16e806a1c8b01eb5a9ae634e52299b514b284a62b
SHA256de5938e9179b982967cc2626994dd42dc3a65ab898df575e622ca89cc709ef84
SHA5121d29805f19a2e40e6fe8b1dd43fbd2f25e3df56836a0207468b7fc381f18e8009137d6328aed1539edf149c9db3b5bdb7948ecb6c956f426d8ecdefd0732cb5e
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD518ea38a88a70cff816635c77816a931f
SHA1558e3e2c8822a30732d7d95d70832b875f2c26d2
SHA25673331122d91abe2357022fd410bcdbffad96a61f1837994d2392a67b02f5033e
SHA5121206d4e75760ff99096b3a830488af0591cf16edc66c40a2e93a271b2e3b037f12d7fc6fd4362bce7047a207d37cc5e7f67119a9aec3db24ba30494b34d941b8
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD518ea38a88a70cff816635c77816a931f
SHA1558e3e2c8822a30732d7d95d70832b875f2c26d2
SHA25673331122d91abe2357022fd410bcdbffad96a61f1837994d2392a67b02f5033e
SHA5121206d4e75760ff99096b3a830488af0591cf16edc66c40a2e93a271b2e3b037f12d7fc6fd4362bce7047a207d37cc5e7f67119a9aec3db24ba30494b34d941b8
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD59ed517ad4743327594f4e531dc593978
SHA14c5e4e497d51493e8fc3c95c60ff8e899aec5055
SHA2560e27841aabfb18ce9881047036ffc2a243af7c1bb9ac078956493518549670cb
SHA512b2d90fa46e3a99757bd9b43cd53ff415d94219e039df9361de718e1ff92361f7c34b0a0847b3f4fc84f13c5882faf9b9293ba8ced709642ec12ed31646e7b761
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD59ed517ad4743327594f4e531dc593978
SHA14c5e4e497d51493e8fc3c95c60ff8e899aec5055
SHA2560e27841aabfb18ce9881047036ffc2a243af7c1bb9ac078956493518549670cb
SHA512b2d90fa46e3a99757bd9b43cd53ff415d94219e039df9361de718e1ff92361f7c34b0a0847b3f4fc84f13c5882faf9b9293ba8ced709642ec12ed31646e7b761
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD59ed517ad4743327594f4e531dc593978
SHA14c5e4e497d51493e8fc3c95c60ff8e899aec5055
SHA2560e27841aabfb18ce9881047036ffc2a243af7c1bb9ac078956493518549670cb
SHA512b2d90fa46e3a99757bd9b43cd53ff415d94219e039df9361de718e1ff92361f7c34b0a0847b3f4fc84f13c5882faf9b9293ba8ced709642ec12ed31646e7b761
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD59ed517ad4743327594f4e531dc593978
SHA14c5e4e497d51493e8fc3c95c60ff8e899aec5055
SHA2560e27841aabfb18ce9881047036ffc2a243af7c1bb9ac078956493518549670cb
SHA512b2d90fa46e3a99757bd9b43cd53ff415d94219e039df9361de718e1ff92361f7c34b0a0847b3f4fc84f13c5882faf9b9293ba8ced709642ec12ed31646e7b761
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD56c2f81abffd33771e53e3d7ea7ab1e90
SHA13e094f2abb3a5fd157df526c82faae3d018515cf
SHA2563c7bbffbecb50402d43dede42766d25e80bdeb0fc2597b10a5b41951c005bcea
SHA512b0480342671f70c9a122fe3346eb467a4faed7c4946ed75b79619f0cd720c75f14587c69453504ae11f1fce2751372010bf7702ca56c696318d93ba587328b89
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD56c2f81abffd33771e53e3d7ea7ab1e90
SHA13e094f2abb3a5fd157df526c82faae3d018515cf
SHA2563c7bbffbecb50402d43dede42766d25e80bdeb0fc2597b10a5b41951c005bcea
SHA512b0480342671f70c9a122fe3346eb467a4faed7c4946ed75b79619f0cd720c75f14587c69453504ae11f1fce2751372010bf7702ca56c696318d93ba587328b89
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD525f115a8bcadeccdfe02f6311ed87031
SHA124339c0cac3009ae6611f169260285fb0aa87fb8
SHA256818dcf2852f3a8d9bd34bd2950eb92b997dc9370887259c24fab095b9f6ff4da
SHA512d80ae1f86db1e5c7a0e35ae714ccfde1a8e8012d9be7b1ca33f3c3a9440fbb79f84e661e7deef2031cc567f18aefa62a0daca38bbd3a5c1d34e44865eb6dfa80
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD525f115a8bcadeccdfe02f6311ed87031
SHA124339c0cac3009ae6611f169260285fb0aa87fb8
SHA256818dcf2852f3a8d9bd34bd2950eb92b997dc9370887259c24fab095b9f6ff4da
SHA512d80ae1f86db1e5c7a0e35ae714ccfde1a8e8012d9be7b1ca33f3c3a9440fbb79f84e661e7deef2031cc567f18aefa62a0daca38bbd3a5c1d34e44865eb6dfa80
-
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD56280e71d19c2b9eafdd6026db81d52db
SHA156e51c579c9990259828bb218974fa8ab90f898e
SHA256bd06b662ee7e0dc8d48faa2f2cf9e4c5b343a17d2c390f6c8428a286bd13eec1
SHA5122fd3d5a7b8b21ecd0fec9f3affd993cfa190e210d41512bcddf0e7d7fa1a02a161d305d29940d061979062e9f173bcea81c52b8f74c6d702553086202449eb1e
-
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD56280e71d19c2b9eafdd6026db81d52db
SHA156e51c579c9990259828bb218974fa8ab90f898e
SHA256bd06b662ee7e0dc8d48faa2f2cf9e4c5b343a17d2c390f6c8428a286bd13eec1
SHA5122fd3d5a7b8b21ecd0fec9f3affd993cfa190e210d41512bcddf0e7d7fa1a02a161d305d29940d061979062e9f173bcea81c52b8f74c6d702553086202449eb1e
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5e51b8c2e20f5c18326e1931727af32fb
SHA1930384b8c43f8378e7ce916870eba4a87993f787
SHA25622697b28aff43a2dcfff322cd5c6f1ae509ce8c1ede1ece9617b2899f52ce852
SHA51265d0194858f94d618b3b1df9287a1619e9bf5081c1658a63209b494e602e55b3faa4a3ddf2f5df1cf4f7714eee48c0892f557ea620872d4da0f2331426313e03
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5e51b8c2e20f5c18326e1931727af32fb
SHA1930384b8c43f8378e7ce916870eba4a87993f787
SHA25622697b28aff43a2dcfff322cd5c6f1ae509ce8c1ede1ece9617b2899f52ce852
SHA51265d0194858f94d618b3b1df9287a1619e9bf5081c1658a63209b494e602e55b3faa4a3ddf2f5df1cf4f7714eee48c0892f557ea620872d4da0f2331426313e03
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD550116a376bbcaa2a1008ee51b89dbdc9
SHA1fafadced08b6c8b2442e7b31ad464d7aa2752ad6
SHA256203d27d1cf5477d598effc9569d01e29e56fcf85c445a853b0407e4f8a7fe6f5
SHA512603181cc1a94b8c58abba7728c391c34722a8b7990dc793349c85fd75fca69b637f5f634dd6b80eb6e9aa4270da0ae90d8ca28b8b019010075fda62b4157758a
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD550116a376bbcaa2a1008ee51b89dbdc9
SHA1fafadced08b6c8b2442e7b31ad464d7aa2752ad6
SHA256203d27d1cf5477d598effc9569d01e29e56fcf85c445a853b0407e4f8a7fe6f5
SHA512603181cc1a94b8c58abba7728c391c34722a8b7990dc793349c85fd75fca69b637f5f634dd6b80eb6e9aa4270da0ae90d8ca28b8b019010075fda62b4157758a
-
\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5b0c05007f49ec9dc6d5647c399a87be7
SHA1ea1cbe9edd602ddbb39d094bf50a0392c0ca5ba9
SHA2569c12170d1ace213737fd5b4e3e1011a6b3e7a6135fb09764decfc51548b53745
SHA512076ee5f7c1d4aeef702d13ca17c3e048c3be7cca9d7dc8380a0f44aa5fbb2840a7c5bb5dd39fdd74f9977e711ca3a7d1e7acf80e4747e9c5a18c034dc10050e8
-
\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5b0c05007f49ec9dc6d5647c399a87be7
SHA1ea1cbe9edd602ddbb39d094bf50a0392c0ca5ba9
SHA2569c12170d1ace213737fd5b4e3e1011a6b3e7a6135fb09764decfc51548b53745
SHA512076ee5f7c1d4aeef702d13ca17c3e048c3be7cca9d7dc8380a0f44aa5fbb2840a7c5bb5dd39fdd74f9977e711ca3a7d1e7acf80e4747e9c5a18c034dc10050e8
-
\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD57af88c3d9a0ef167d45443c6da954f65
SHA1a2c2fe138b419b8ed5ebfdada1c59242b73bccf8
SHA25685b622f4719e918b3176474747bdab21569337fc548cfbc9f2640171249e333b
SHA5122d4fa21c2ddf909dba6264875fde133106175299376e061c8a9fc0610ce3daee3ec32fe19e567f7fc2fd26cf98a9a02c767266cce6f606476b86b96f5dc591da
-
\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD57af88c3d9a0ef167d45443c6da954f65
SHA1a2c2fe138b419b8ed5ebfdada1c59242b73bccf8
SHA25685b622f4719e918b3176474747bdab21569337fc548cfbc9f2640171249e333b
SHA5122d4fa21c2ddf909dba6264875fde133106175299376e061c8a9fc0610ce3daee3ec32fe19e567f7fc2fd26cf98a9a02c767266cce6f606476b86b96f5dc591da
-
memory/280-133-0x0000000000000000-mapping.dmp
-
memory/280-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/588-134-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/588-127-0x0000000000000000-mapping.dmp
-
memory/936-118-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/936-113-0x0000000000000000-mapping.dmp
-
memory/952-57-0x0000000000000000-mapping.dmp
-
memory/952-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1160-97-0x0000000000000000-mapping.dmp
-
memory/1160-104-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1180-96-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1180-92-0x0000000000000000-mapping.dmp
-
memory/1216-71-0x0000000000000000-mapping.dmp
-
memory/1216-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1416-145-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1416-141-0x0000000000000000-mapping.dmp
-
memory/1432-152-0x000000006CA61000-0x000000006CA63000-memory.dmpFilesize
8KB
-
memory/1432-151-0x000000006D271000-0x000000006D273000-memory.dmpFilesize
8KB
-
memory/1432-149-0x00000000739DD000-0x00000000739E8000-memory.dmpFilesize
44KB
-
memory/1432-148-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1432-154-0x00000000739DD000-0x00000000739E8000-memory.dmpFilesize
44KB
-
memory/1432-147-0x00000000729F1000-0x00000000729F3000-memory.dmpFilesize
8KB
-
memory/1504-111-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1504-103-0x0000000000000000-mapping.dmp
-
memory/1564-153-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1564-146-0x0000000001EF0000-0x0000000001F1F000-memory.dmpFilesize
188KB
-
memory/1564-56-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/1564-105-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1564-106-0x0000000001EF0000-0x0000000001F1F000-memory.dmpFilesize
188KB
-
memory/1688-64-0x0000000000000000-mapping.dmp
-
memory/1688-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1716-89-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1716-85-0x0000000000000000-mapping.dmp
-
memory/1940-120-0x0000000000000000-mapping.dmp
-
memory/1940-125-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1972-82-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1972-78-0x0000000000000000-mapping.dmp