Analysis
-
max time kernel
1627s -
max time network
1630s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 03:53
Static task
static1
Behavioral task
behavioral1
Sample
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe
Resource
win10v2004-20220414-en
General
-
Target
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe
-
Size
196KB
-
MD5
993ee279bc338255e79c3ab5a4a022db
-
SHA1
2004648b06f2633b9831eb71e24313bac3b3f5b2
-
SHA256
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42
-
SHA512
b234176793a37162c0ac9d9234e29c8679f9bcb7776d690bf79c654300bdeeed2860b711116f263068f2cb8d4d764589c6d08e2b87329becb47ab36f993dc5a3
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
Modifies system executable filetype association 2 TTPs 13 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 14 IoCs
Processes:
xk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEpid process 972 xk.exe 2016 IExplorer.exe 1992 WINLOGON.EXE 1968 CSRSS.EXE 1772 SERVICES.EXE 1696 LSASS.EXE 1752 SMSS.EXE 1324 xk.exe 1984 IExplorer.exe 1252 WINLOGON.EXE 1636 CSRSS.EXE 1464 SERVICES.EXE 1340 LSASS.EXE 1032 SMSS.EXE -
Processes:
resource yara_rule C:\Windows\xk.exe upx behavioral1/memory/972-61-0x0000000000400000-0x000000000042F000-memory.dmp upx \Windows\SysWOW64\IExplorer.exe upx \Windows\SysWOW64\IExplorer.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/2016-68-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral1/memory/1992-75-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral1/memory/1968-82-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx behavioral1/memory/1772-89-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral1/memory/1696-96-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx behavioral1/memory/1752-103-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Windows\xk.exe upx behavioral1/memory/1324-109-0x0000000000400000-0x000000000042F000-memory.dmp upx \Windows\SysWOW64\IExplorer.exe upx \Windows\SysWOW64\IExplorer.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral1/memory/1984-116-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral1/memory/776-120-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral1/memory/1636-132-0x0000000000400000-0x000000000042F000-memory.dmp upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral1/memory/1464-141-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx behavioral1/memory/1340-146-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx behavioral1/memory/1032-152-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral1/memory/776-160-0x0000000000400000-0x000000000042F000-memory.dmp upx -
Loads dropped DLL 24 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exepid process 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE Key opened \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription ioc process File opened for modification C:\desktop.ini 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File created C:\desktop.ini 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription ioc process File opened (read-only) \??\O: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\Q: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\V: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\W: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\J: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\F: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\K: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\M: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\N: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\R: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\S: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\Z: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\E: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\G: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\I: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\L: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\P: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\T: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\U: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\Y: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\B: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\X: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened (read-only) \??\H: 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
Drops file in System32 directory 20 IoCs
Processes:
OUTLOOK.EXE3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription ioc process File created C:\Windows\system32\perfh009.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfc011.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\Mig2.scr 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File created C:\Windows\SysWOW64\PerfStringBackup.TMP OUTLOOK.EXE File created C:\Windows\system32\perfc007.dat OUTLOOK.EXE File created C:\Windows\system32\perfc009.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\shell.exe 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI OUTLOOK.EXE File created C:\Windows\system32\perfh00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfh010.dat OUTLOOK.EXE File created C:\Windows\system32\perfh011.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\shell.exe 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File created C:\Windows\system32\perfh007.dat OUTLOOK.EXE File created C:\Windows\system32\perfc010.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\IExplorer.exe 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File created C:\Windows\system32\perfc00C.dat OUTLOOK.EXE -
Drops file in Windows directory 5 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exeOUTLOOK.EXEdescription ioc process File opened for modification C:\Windows\xk.exe 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File created C:\Windows\xk.exe 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe File created C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File opened for modification C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File created C:\Windows\inf\Outlook\0009\outlperf.ini OUTLOOK.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 4 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Control Panel\Desktop\ 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
Processes:
OUTLOOK.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote OUTLOOK.EXE -
Modifies registry class 64 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DD-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DE-0000-0000-C000-000000000046}\ = "_ToOrFromRuleCondition" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300E-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A5-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063025-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063043-0000-0000-C000-000000000046}\ = "Action" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063006-0000-0000-C000-000000000046}\ = "MAPIFolder" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E7-0000-0000-C000-000000000046}\ = "_NavigationModules" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063071-0000-0000-C000-000000000046}\ = "OutlookBarStorage" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063071-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A0-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E9-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EE-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063045-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C5-0000-0000-C000-000000000046}\ = "_Account" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C5-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063024-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063107-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303C-0000-0000-C000-000000000046} OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E6-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063049-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304D-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006F025-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DA-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F5-0000-0000-C000-000000000046}\ = "OlkCategoryEvents" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302B-0000-0000-C000-000000000046}\ = "ItemEvents_10" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063105-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304C-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A0-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063107-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006F025-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063042-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E8-0000-0000-C000-000000000046}\ = "_NavigationModule" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E5-0000-0000-C000-000000000046}\ = "_Column" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300B-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300C-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B0-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063044-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50BB9B50-811D-11CE-B565-00AA00608FAA}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302D-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F9-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303F-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CC-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D2-0000-0000-C000-000000000046}\ = "_Table" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307F-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630F7-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309B-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067366-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E4-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E4-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063036-0000-0000-C000-000000000046} OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672EE-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063022-0000-0000-C000-000000000046}\ = "_JournalItem" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FA-0000-0000-C000-000000000046}\ = "_AddressRuleCondition" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063079-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309E-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006309D-0000-0000-C000-000000000046}\TypeLib\Version = "9.4" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063036-0000-0000-C000-000000000046}\ProxyStubClsid32 OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303C-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303D-0000-0000-C000-000000000046}\ = "UserProperties" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D9-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063062-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}" OUTLOOK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063104-0000-0000-C000-000000000046}\TypeLib OUTLOOK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E1-0000-0000-C000-000000000046}\ = "_Columns" OUTLOOK.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
OUTLOOK.EXEpid process 240 OUTLOOK.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exepid process 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OUTLOOK.EXEpid process 240 OUTLOOK.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
OUTLOOK.EXEpid process 240 OUTLOOK.EXE 240 OUTLOOK.EXE 240 OUTLOOK.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
OUTLOOK.EXEpid process 240 OUTLOOK.EXE 240 OUTLOOK.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exexk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEOUTLOOK.EXEpid process 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe 972 xk.exe 2016 IExplorer.exe 1992 WINLOGON.EXE 1968 CSRSS.EXE 1772 SERVICES.EXE 1696 LSASS.EXE 1752 SMSS.EXE 1324 xk.exe 1984 IExplorer.exe 1252 WINLOGON.EXE 1636 CSRSS.EXE 1464 SERVICES.EXE 1340 LSASS.EXE 1032 SMSS.EXE 240 OUTLOOK.EXE -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription pid process target process PID 776 wrote to memory of 972 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe xk.exe PID 776 wrote to memory of 972 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe xk.exe PID 776 wrote to memory of 972 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe xk.exe PID 776 wrote to memory of 972 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe xk.exe PID 776 wrote to memory of 2016 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe IExplorer.exe PID 776 wrote to memory of 2016 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe IExplorer.exe PID 776 wrote to memory of 2016 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe IExplorer.exe PID 776 wrote to memory of 2016 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe IExplorer.exe PID 776 wrote to memory of 1992 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe WINLOGON.EXE PID 776 wrote to memory of 1992 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe WINLOGON.EXE PID 776 wrote to memory of 1992 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe WINLOGON.EXE PID 776 wrote to memory of 1992 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe WINLOGON.EXE PID 776 wrote to memory of 1968 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe CSRSS.EXE PID 776 wrote to memory of 1968 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe CSRSS.EXE PID 776 wrote to memory of 1968 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe CSRSS.EXE PID 776 wrote to memory of 1968 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe CSRSS.EXE PID 776 wrote to memory of 1772 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SERVICES.EXE PID 776 wrote to memory of 1772 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SERVICES.EXE PID 776 wrote to memory of 1772 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SERVICES.EXE PID 776 wrote to memory of 1772 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SERVICES.EXE PID 776 wrote to memory of 1696 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe LSASS.EXE PID 776 wrote to memory of 1696 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe LSASS.EXE PID 776 wrote to memory of 1696 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe LSASS.EXE PID 776 wrote to memory of 1696 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe LSASS.EXE PID 776 wrote to memory of 1752 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SMSS.EXE PID 776 wrote to memory of 1752 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SMSS.EXE PID 776 wrote to memory of 1752 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SMSS.EXE PID 776 wrote to memory of 1752 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SMSS.EXE PID 776 wrote to memory of 1324 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe xk.exe PID 776 wrote to memory of 1324 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe xk.exe PID 776 wrote to memory of 1324 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe xk.exe PID 776 wrote to memory of 1324 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe xk.exe PID 776 wrote to memory of 1984 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe IExplorer.exe PID 776 wrote to memory of 1984 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe IExplorer.exe PID 776 wrote to memory of 1984 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe IExplorer.exe PID 776 wrote to memory of 1984 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe IExplorer.exe PID 776 wrote to memory of 1252 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe WINLOGON.EXE PID 776 wrote to memory of 1252 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe WINLOGON.EXE PID 776 wrote to memory of 1252 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe WINLOGON.EXE PID 776 wrote to memory of 1252 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe WINLOGON.EXE PID 776 wrote to memory of 1636 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe CSRSS.EXE PID 776 wrote to memory of 1636 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe CSRSS.EXE PID 776 wrote to memory of 1636 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe CSRSS.EXE PID 776 wrote to memory of 1636 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe CSRSS.EXE PID 776 wrote to memory of 1464 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SERVICES.EXE PID 776 wrote to memory of 1464 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SERVICES.EXE PID 776 wrote to memory of 1464 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SERVICES.EXE PID 776 wrote to memory of 1464 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SERVICES.EXE PID 776 wrote to memory of 1340 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe LSASS.EXE PID 776 wrote to memory of 1340 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe LSASS.EXE PID 776 wrote to memory of 1340 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe LSASS.EXE PID 776 wrote to memory of 1340 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe LSASS.EXE PID 776 wrote to memory of 1032 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SMSS.EXE PID 776 wrote to memory of 1032 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SMSS.EXE PID 776 wrote to memory of 1032 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SMSS.EXE PID 776 wrote to memory of 1032 776 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe SMSS.EXE -
System policy modification 1 TTPs 4 IoCs
Processes:
3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe -
outlook_win_path 1 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe"C:\Users\Admin\AppData\Local\Temp\3880f8fe33d6d52589a613b5d764e1d864c6ceeac2abd5ac7911176ce6315a42.exe"1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding1⤵
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD5df611a5510ca67d25dc0d3811c732f43
SHA1d3016cc9cd5c94a27072bd279289519ea9acf3fd
SHA25609e783b727c5aefb30d4421ab71a92dc76548ec370f7477b33cd124902f05925
SHA512a8f1152cdf316b41139c555598a60497850c398bd3014db91bd178a95138250dd159b70b778ed31264a0e796bcb7ea360d6840499156b15110ca84d58fd36258
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD53a7cdc417e0c0d6664815ee69822f9f2
SHA1379a22494e9cc31e1b0820a8fad44fef51fa68c2
SHA25608548d9942140023396c7a5b821c3e08384868fa1e534a9f7fe6022bbc9b36fa
SHA512f7358b6b07db05e4a3f78e7c186628e636c58f3f09723b57f0f34703b758c0109c859db25df013dda3e0e1fe4db77805456956b612b461a3a4ed7916f6fba683
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD5813ee53e51865b9a72179a34abe74f9a
SHA16ebaeaa277d1241ce3df6d8c271941dc0841751d
SHA25609fc72cd5c682346c8e24d08a6c46700c36e16f1cfa7cf60e912902f23267f23
SHA5129a7af824fcb6e8bbe9f71c716f6278feec5eaf7d340ebea11e52aef04bef5db212c75554c1f5ab7177916af7f1d302dc1ee7d82a32f7692170aef41edd846091
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD5d1a369ce3ca1109a2951ca437720d793
SHA1defcf09285d290965aad6dc03f6bd3e617a0e059
SHA2565b2089d414a3420e57452e8b03dcdbef320dbc828e312077a60a4688665a7c10
SHA512d3301f5d8e5cfc4b6aa2947df6a2db64d7d813109deddfc9a8e08c11ad279fbf506785888b890e0ed6179360ff7448ce1560a07b3713addd79d3404e821af257
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD58f44af6a58ebe8e22970fc413e3b3ff4
SHA19185f327426ed547eac29f2834a1f95171fcab11
SHA2564b6bd2183859d11f828908a4d32f0eb26f8c6a0c50263e8a238b1bb16139589e
SHA512f72e2c85eacf13bce9e2623d6d513b11d7db227466638529b5e07d220dec5ca4d8c681f0708d6f0b0d1bd7e4fc4b493cb85b32b0a6c15a60b7e97738182f5257
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD5b73cd71093ebdb9fd75240630f4e21e6
SHA12b2aaaa64d91785df53fa883a4f2fc7fbcdf8c48
SHA256d476c731316182fa26d870d4780461286dcbe0a47bdd3bd4a1dc3813524e4348
SHA512423aa6ae43b74f60b0b50f287033867bc98c744fe78d980eccf89864549a4c4c4b647eabb386a33a4da07a3e2cc870a0c59a901139a6ed9119f221dc22dc7584
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD5b6a202adcc7da5f234f4dcf140301fd9
SHA1f994ccbeb13479e42486ae77c5b33471563164a1
SHA256d638a608d706798f069bd1de8d895b298ca1b44c06759763d8ad260ed9bf7234
SHA51252ed79b718c55990d61fa781e45da442e6a8d397675fd05b53250f607d8130167a2797866de8b2be9c485b6f299d017f45fe1397391e730b8f458d26a445091f
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD5b6a202adcc7da5f234f4dcf140301fd9
SHA1f994ccbeb13479e42486ae77c5b33471563164a1
SHA256d638a608d706798f069bd1de8d895b298ca1b44c06759763d8ad260ed9bf7234
SHA51252ed79b718c55990d61fa781e45da442e6a8d397675fd05b53250f607d8130167a2797866de8b2be9c485b6f299d017f45fe1397391e730b8f458d26a445091f
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5b499d2c7e002df27a73a38af0aefe2b8
SHA14a62303b92ae39b561e44d74209434f4665105f8
SHA256c8cd8d7db2e71d653e297bee588ae0628d4eddf3d2bac969e7dac081fa027c80
SHA51263e0f20f912673d41f1b5bb6e1a940007be4a460d3395812beff6eef25a9802067ae4a44dba14733ca0fd035e3776765781d265fb6c4612d7559c6c93f06a2b1
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5be701db721557487b8349dcb4ac2ca48
SHA100f0cf2137d7adea2eeffa5c51ab6257dc56fbfb
SHA256c447aa9a90d98f49cd1f4b34ca4372a27c384a0d82f2d9089448d662204f01b4
SHA512c250beb4ce3faaf53f878565964467994914a926c6a70c90e28c1892ad0fd2ddd667d23d93675211d07ee7b5b50d8288a4347db78246f82db62028dba1b595ff
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5989f6f7622b2394ed591d275fb802601
SHA177625a8fa44f120f4df18bf7ac651b51fd4b4750
SHA256d9173855dc05416b891156ee9cde2a68cb856cbcf8d3a7bb915ae80a46e88324
SHA512cad6ea9f244e63b27b9d629aea923fb817735d614d3982bbb664a50f0a0591feca8401aa5dca24737b13eb26d56a7872ab66e435f7817427bf3582ba79ad9ad0
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5f1fbd27b4caee463601a29331fdff0d8
SHA153bb96f8a0bdcea1631ea9fcba4430e04de14aa0
SHA256c2fe66f39cc1e5e76bb1b2f87dd0c054fa46fdef159b2527e1e86c95892a72cd
SHA512ad50055ee8894855c60e5b4f819e827fde363407fe8984eeddbac691a3fcae799b38bb8330e52aa6af18357d95ab1158a0bf4c77f16ba7a2a4e3f98b0288a19c
-
C:\Windows\xk.exeFilesize
196KB
MD5fc17cb4b3877a3f46eaee29e4bfe7933
SHA1acfec20418a251bb24903281a867b3b6d58df96e
SHA2565fcdc80bd664fa80ea3e110b44e38d780010dfd5ada116f9028e3e563e2b8450
SHA512fa22752494d3b93775a56f6ce729a4a2585999804f0785f6b7336c0838256a2199bb69a43a1226bcd47a5077b57a0e1e678e581a5fba7d7d8647f91f70aa32ca
-
C:\Windows\xk.exeFilesize
196KB
MD5075edb8b7d97965c5929da8393e1a8d1
SHA173c20dced7ba450a07a206703a2c63584868266b
SHA25645e857ce1321adc8ecbe4940d2a01d6ee5ee08b6f79a7ac2aba826b3e391da7a
SHA512598cbd6c8ea6570d6be523824338cb52b2f4c9b5d971f28b8f0e594518c6faf3585db19aea51d3b122d8411d23dc25b08f771d7dfb250b16d862e139dbd59d66
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD5df611a5510ca67d25dc0d3811c732f43
SHA1d3016cc9cd5c94a27072bd279289519ea9acf3fd
SHA25609e783b727c5aefb30d4421ab71a92dc76548ec370f7477b33cd124902f05925
SHA512a8f1152cdf316b41139c555598a60497850c398bd3014db91bd178a95138250dd159b70b778ed31264a0e796bcb7ea360d6840499156b15110ca84d58fd36258
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD5df611a5510ca67d25dc0d3811c732f43
SHA1d3016cc9cd5c94a27072bd279289519ea9acf3fd
SHA25609e783b727c5aefb30d4421ab71a92dc76548ec370f7477b33cd124902f05925
SHA512a8f1152cdf316b41139c555598a60497850c398bd3014db91bd178a95138250dd159b70b778ed31264a0e796bcb7ea360d6840499156b15110ca84d58fd36258
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD53a7cdc417e0c0d6664815ee69822f9f2
SHA1379a22494e9cc31e1b0820a8fad44fef51fa68c2
SHA25608548d9942140023396c7a5b821c3e08384868fa1e534a9f7fe6022bbc9b36fa
SHA512f7358b6b07db05e4a3f78e7c186628e636c58f3f09723b57f0f34703b758c0109c859db25df013dda3e0e1fe4db77805456956b612b461a3a4ed7916f6fba683
-
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD53a7cdc417e0c0d6664815ee69822f9f2
SHA1379a22494e9cc31e1b0820a8fad44fef51fa68c2
SHA25608548d9942140023396c7a5b821c3e08384868fa1e534a9f7fe6022bbc9b36fa
SHA512f7358b6b07db05e4a3f78e7c186628e636c58f3f09723b57f0f34703b758c0109c859db25df013dda3e0e1fe4db77805456956b612b461a3a4ed7916f6fba683
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD5813ee53e51865b9a72179a34abe74f9a
SHA16ebaeaa277d1241ce3df6d8c271941dc0841751d
SHA25609fc72cd5c682346c8e24d08a6c46700c36e16f1cfa7cf60e912902f23267f23
SHA5129a7af824fcb6e8bbe9f71c716f6278feec5eaf7d340ebea11e52aef04bef5db212c75554c1f5ab7177916af7f1d302dc1ee7d82a32f7692170aef41edd846091
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD5813ee53e51865b9a72179a34abe74f9a
SHA16ebaeaa277d1241ce3df6d8c271941dc0841751d
SHA25609fc72cd5c682346c8e24d08a6c46700c36e16f1cfa7cf60e912902f23267f23
SHA5129a7af824fcb6e8bbe9f71c716f6278feec5eaf7d340ebea11e52aef04bef5db212c75554c1f5ab7177916af7f1d302dc1ee7d82a32f7692170aef41edd846091
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD5d1a369ce3ca1109a2951ca437720d793
SHA1defcf09285d290965aad6dc03f6bd3e617a0e059
SHA2565b2089d414a3420e57452e8b03dcdbef320dbc828e312077a60a4688665a7c10
SHA512d3301f5d8e5cfc4b6aa2947df6a2db64d7d813109deddfc9a8e08c11ad279fbf506785888b890e0ed6179360ff7448ce1560a07b3713addd79d3404e821af257
-
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD5d1a369ce3ca1109a2951ca437720d793
SHA1defcf09285d290965aad6dc03f6bd3e617a0e059
SHA2565b2089d414a3420e57452e8b03dcdbef320dbc828e312077a60a4688665a7c10
SHA512d3301f5d8e5cfc4b6aa2947df6a2db64d7d813109deddfc9a8e08c11ad279fbf506785888b890e0ed6179360ff7448ce1560a07b3713addd79d3404e821af257
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD58f44af6a58ebe8e22970fc413e3b3ff4
SHA19185f327426ed547eac29f2834a1f95171fcab11
SHA2564b6bd2183859d11f828908a4d32f0eb26f8c6a0c50263e8a238b1bb16139589e
SHA512f72e2c85eacf13bce9e2623d6d513b11d7db227466638529b5e07d220dec5ca4d8c681f0708d6f0b0d1bd7e4fc4b493cb85b32b0a6c15a60b7e97738182f5257
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD58f44af6a58ebe8e22970fc413e3b3ff4
SHA19185f327426ed547eac29f2834a1f95171fcab11
SHA2564b6bd2183859d11f828908a4d32f0eb26f8c6a0c50263e8a238b1bb16139589e
SHA512f72e2c85eacf13bce9e2623d6d513b11d7db227466638529b5e07d220dec5ca4d8c681f0708d6f0b0d1bd7e4fc4b493cb85b32b0a6c15a60b7e97738182f5257
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD5b73cd71093ebdb9fd75240630f4e21e6
SHA12b2aaaa64d91785df53fa883a4f2fc7fbcdf8c48
SHA256d476c731316182fa26d870d4780461286dcbe0a47bdd3bd4a1dc3813524e4348
SHA512423aa6ae43b74f60b0b50f287033867bc98c744fe78d980eccf89864549a4c4c4b647eabb386a33a4da07a3e2cc870a0c59a901139a6ed9119f221dc22dc7584
-
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD5b73cd71093ebdb9fd75240630f4e21e6
SHA12b2aaaa64d91785df53fa883a4f2fc7fbcdf8c48
SHA256d476c731316182fa26d870d4780461286dcbe0a47bdd3bd4a1dc3813524e4348
SHA512423aa6ae43b74f60b0b50f287033867bc98c744fe78d980eccf89864549a4c4c4b647eabb386a33a4da07a3e2cc870a0c59a901139a6ed9119f221dc22dc7584
-
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD5b6a202adcc7da5f234f4dcf140301fd9
SHA1f994ccbeb13479e42486ae77c5b33471563164a1
SHA256d638a608d706798f069bd1de8d895b298ca1b44c06759763d8ad260ed9bf7234
SHA51252ed79b718c55990d61fa781e45da442e6a8d397675fd05b53250f607d8130167a2797866de8b2be9c485b6f299d017f45fe1397391e730b8f458d26a445091f
-
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD5b6a202adcc7da5f234f4dcf140301fd9
SHA1f994ccbeb13479e42486ae77c5b33471563164a1
SHA256d638a608d706798f069bd1de8d895b298ca1b44c06759763d8ad260ed9bf7234
SHA51252ed79b718c55990d61fa781e45da442e6a8d397675fd05b53250f607d8130167a2797866de8b2be9c485b6f299d017f45fe1397391e730b8f458d26a445091f
-
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD5b6a202adcc7da5f234f4dcf140301fd9
SHA1f994ccbeb13479e42486ae77c5b33471563164a1
SHA256d638a608d706798f069bd1de8d895b298ca1b44c06759763d8ad260ed9bf7234
SHA51252ed79b718c55990d61fa781e45da442e6a8d397675fd05b53250f607d8130167a2797866de8b2be9c485b6f299d017f45fe1397391e730b8f458d26a445091f
-
\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD5b6a202adcc7da5f234f4dcf140301fd9
SHA1f994ccbeb13479e42486ae77c5b33471563164a1
SHA256d638a608d706798f069bd1de8d895b298ca1b44c06759763d8ad260ed9bf7234
SHA51252ed79b718c55990d61fa781e45da442e6a8d397675fd05b53250f607d8130167a2797866de8b2be9c485b6f299d017f45fe1397391e730b8f458d26a445091f
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5b499d2c7e002df27a73a38af0aefe2b8
SHA14a62303b92ae39b561e44d74209434f4665105f8
SHA256c8cd8d7db2e71d653e297bee588ae0628d4eddf3d2bac969e7dac081fa027c80
SHA51263e0f20f912673d41f1b5bb6e1a940007be4a460d3395812beff6eef25a9802067ae4a44dba14733ca0fd035e3776765781d265fb6c4612d7559c6c93f06a2b1
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5b499d2c7e002df27a73a38af0aefe2b8
SHA14a62303b92ae39b561e44d74209434f4665105f8
SHA256c8cd8d7db2e71d653e297bee588ae0628d4eddf3d2bac969e7dac081fa027c80
SHA51263e0f20f912673d41f1b5bb6e1a940007be4a460d3395812beff6eef25a9802067ae4a44dba14733ca0fd035e3776765781d265fb6c4612d7559c6c93f06a2b1
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5be701db721557487b8349dcb4ac2ca48
SHA100f0cf2137d7adea2eeffa5c51ab6257dc56fbfb
SHA256c447aa9a90d98f49cd1f4b34ca4372a27c384a0d82f2d9089448d662204f01b4
SHA512c250beb4ce3faaf53f878565964467994914a926c6a70c90e28c1892ad0fd2ddd667d23d93675211d07ee7b5b50d8288a4347db78246f82db62028dba1b595ff
-
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5be701db721557487b8349dcb4ac2ca48
SHA100f0cf2137d7adea2eeffa5c51ab6257dc56fbfb
SHA256c447aa9a90d98f49cd1f4b34ca4372a27c384a0d82f2d9089448d662204f01b4
SHA512c250beb4ce3faaf53f878565964467994914a926c6a70c90e28c1892ad0fd2ddd667d23d93675211d07ee7b5b50d8288a4347db78246f82db62028dba1b595ff
-
\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5989f6f7622b2394ed591d275fb802601
SHA177625a8fa44f120f4df18bf7ac651b51fd4b4750
SHA256d9173855dc05416b891156ee9cde2a68cb856cbcf8d3a7bb915ae80a46e88324
SHA512cad6ea9f244e63b27b9d629aea923fb817735d614d3982bbb664a50f0a0591feca8401aa5dca24737b13eb26d56a7872ab66e435f7817427bf3582ba79ad9ad0
-
\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5989f6f7622b2394ed591d275fb802601
SHA177625a8fa44f120f4df18bf7ac651b51fd4b4750
SHA256d9173855dc05416b891156ee9cde2a68cb856cbcf8d3a7bb915ae80a46e88324
SHA512cad6ea9f244e63b27b9d629aea923fb817735d614d3982bbb664a50f0a0591feca8401aa5dca24737b13eb26d56a7872ab66e435f7817427bf3582ba79ad9ad0
-
\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5f1fbd27b4caee463601a29331fdff0d8
SHA153bb96f8a0bdcea1631ea9fcba4430e04de14aa0
SHA256c2fe66f39cc1e5e76bb1b2f87dd0c054fa46fdef159b2527e1e86c95892a72cd
SHA512ad50055ee8894855c60e5b4f819e827fde363407fe8984eeddbac691a3fcae799b38bb8330e52aa6af18357d95ab1158a0bf4c77f16ba7a2a4e3f98b0288a19c
-
\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5f1fbd27b4caee463601a29331fdff0d8
SHA153bb96f8a0bdcea1631ea9fcba4430e04de14aa0
SHA256c2fe66f39cc1e5e76bb1b2f87dd0c054fa46fdef159b2527e1e86c95892a72cd
SHA512ad50055ee8894855c60e5b4f819e827fde363407fe8984eeddbac691a3fcae799b38bb8330e52aa6af18357d95ab1158a0bf4c77f16ba7a2a4e3f98b0288a19c
-
memory/240-154-0x0000000072391000-0x0000000072393000-memory.dmpFilesize
8KB
-
memory/240-159-0x000000006C981000-0x000000006C983000-memory.dmpFilesize
8KB
-
memory/240-158-0x000000006D1B1000-0x000000006D1B3000-memory.dmpFilesize
8KB
-
memory/240-156-0x000000007337D000-0x0000000073388000-memory.dmpFilesize
44KB
-
memory/240-155-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/240-162-0x000000007337D000-0x0000000073388000-memory.dmpFilesize
44KB
-
memory/776-161-0x00000000005C0000-0x00000000005EF000-memory.dmpFilesize
188KB
-
memory/776-160-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/776-56-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/776-120-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/776-122-0x00000000005C0000-0x00000000005EF000-memory.dmpFilesize
188KB
-
memory/776-124-0x00000000005C0000-0x00000000005EF000-memory.dmpFilesize
188KB
-
memory/776-153-0x00000000005C0000-0x00000000005EF000-memory.dmpFilesize
188KB
-
memory/972-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/972-57-0x0000000000000000-mapping.dmp
-
memory/1032-152-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1032-148-0x0000000000000000-mapping.dmp
-
memory/1252-118-0x0000000000000000-mapping.dmp
-
memory/1324-104-0x0000000000000000-mapping.dmp
-
memory/1324-109-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1340-146-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1340-140-0x0000000000000000-mapping.dmp
-
memory/1464-134-0x0000000000000000-mapping.dmp
-
memory/1464-141-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1636-132-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1636-127-0x0000000000000000-mapping.dmp
-
memory/1696-92-0x0000000000000000-mapping.dmp
-
memory/1696-96-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1752-99-0x0000000000000000-mapping.dmp
-
memory/1752-103-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1772-85-0x0000000000000000-mapping.dmp
-
memory/1772-89-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1968-78-0x0000000000000000-mapping.dmp
-
memory/1968-82-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1984-116-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1984-111-0x0000000000000000-mapping.dmp
-
memory/1992-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1992-71-0x0000000000000000-mapping.dmp
-
memory/2016-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2016-64-0x0000000000000000-mapping.dmp