Analysis
-
max time kernel
1617s -
max time network
1588s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 03:56
Static task
static1
Behavioral task
behavioral1
Sample
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe
Resource
win10v2004-20220414-en
General
-
Target
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe
-
Size
196KB
-
MD5
76a87f38773537055dc197c98182f4aa
-
SHA1
c43348da0830418f4faba651caf147c830da0f06
-
SHA256
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138
-
SHA512
d387ca6d152e5a8267af15dcd60ff42976320b86f0617f91db81804b80b37bda8c5be19445320cdc3bc62417637e96687fa96adfb854106bb2c08633ed3c0f7b
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Modifies system executable filetype association 2 TTPs 13 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 14 IoCs
Processes:
xk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEpid process 4956 xk.exe 4932 IExplorer.exe 1824 WINLOGON.EXE 1572 CSRSS.EXE 4052 SERVICES.EXE 2840 LSASS.EXE 4540 SMSS.EXE 4040 xk.exe 2644 IExplorer.exe 4164 WINLOGON.EXE 2712 CSRSS.EXE 3292 SERVICES.EXE 928 LSASS.EXE 608 SMSS.EXE -
Processes:
resource yara_rule behavioral2/memory/2804-132-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Windows\xk.exe upx C:\Windows\xk.exe upx behavioral2/memory/4956-138-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Windows\SysWOW64\IExplorer.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral2/memory/4932-144-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE upx behavioral2/memory/1824-150-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE upx behavioral2/memory/1572-156-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE upx behavioral2/memory/4052-162-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral2/memory/2840-168-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE upx behavioral2/memory/4540-174-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/2804-175-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Windows\xk.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral2/memory/4040-180-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/2644-185-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral2/memory/4164-190-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx behavioral2/memory/2712-196-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx behavioral2/memory/3292-200-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral2/memory/928-206-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx behavioral2/memory/608-210-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/2804-211-0x0000000000400000-0x000000000042F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process File opened for modification C:\desktop.ini 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File created C:\desktop.ini 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process File opened (read-only) \??\M: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\P: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\Q: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\R: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\X: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\H: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\J: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\L: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\I: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\K: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\O: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\V: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\W: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\B: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\E: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\G: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\Z: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\F: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\N: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\U: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\S: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\T: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened (read-only) \??\Y: 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Drops file in System32 directory 6 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process File opened for modification C:\Windows\SysWOW64\shell.exe 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File created C:\Windows\SysWOW64\shell.exe 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File created C:\Windows\SysWOW64\Mig2.scr 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File created C:\Windows\SysWOW64\IExplorer.exe 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Drops file in Windows directory 2 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process File opened for modification C:\Windows\xk.exe 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe File created C:\Windows\xk.exe 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Modifies Control Panel 4 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\ 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Modifies registry class 15 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exepid process 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exexk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEpid process 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe 4956 xk.exe 4932 IExplorer.exe 1824 WINLOGON.EXE 1572 CSRSS.EXE 4052 SERVICES.EXE 2840 LSASS.EXE 4540 SMSS.EXE 4040 xk.exe 2644 IExplorer.exe 4164 WINLOGON.EXE 2712 CSRSS.EXE 3292 SERVICES.EXE 928 LSASS.EXE 608 SMSS.EXE -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription pid process target process PID 2804 wrote to memory of 4956 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe xk.exe PID 2804 wrote to memory of 4956 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe xk.exe PID 2804 wrote to memory of 4956 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe xk.exe PID 2804 wrote to memory of 4932 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe IExplorer.exe PID 2804 wrote to memory of 4932 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe IExplorer.exe PID 2804 wrote to memory of 4932 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe IExplorer.exe PID 2804 wrote to memory of 1824 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe WINLOGON.EXE PID 2804 wrote to memory of 1824 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe WINLOGON.EXE PID 2804 wrote to memory of 1824 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe WINLOGON.EXE PID 2804 wrote to memory of 1572 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe CSRSS.EXE PID 2804 wrote to memory of 1572 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe CSRSS.EXE PID 2804 wrote to memory of 1572 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe CSRSS.EXE PID 2804 wrote to memory of 4052 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SERVICES.EXE PID 2804 wrote to memory of 4052 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SERVICES.EXE PID 2804 wrote to memory of 4052 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SERVICES.EXE PID 2804 wrote to memory of 2840 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe LSASS.EXE PID 2804 wrote to memory of 2840 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe LSASS.EXE PID 2804 wrote to memory of 2840 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe LSASS.EXE PID 2804 wrote to memory of 4540 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SMSS.EXE PID 2804 wrote to memory of 4540 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SMSS.EXE PID 2804 wrote to memory of 4540 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SMSS.EXE PID 2804 wrote to memory of 4040 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe xk.exe PID 2804 wrote to memory of 4040 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe xk.exe PID 2804 wrote to memory of 4040 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe xk.exe PID 2804 wrote to memory of 2644 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe IExplorer.exe PID 2804 wrote to memory of 2644 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe IExplorer.exe PID 2804 wrote to memory of 2644 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe IExplorer.exe PID 2804 wrote to memory of 4164 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe WINLOGON.EXE PID 2804 wrote to memory of 4164 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe WINLOGON.EXE PID 2804 wrote to memory of 4164 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe WINLOGON.EXE PID 2804 wrote to memory of 2712 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe CSRSS.EXE PID 2804 wrote to memory of 2712 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe CSRSS.EXE PID 2804 wrote to memory of 2712 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe CSRSS.EXE PID 2804 wrote to memory of 3292 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SERVICES.EXE PID 2804 wrote to memory of 3292 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SERVICES.EXE PID 2804 wrote to memory of 3292 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SERVICES.EXE PID 2804 wrote to memory of 928 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe LSASS.EXE PID 2804 wrote to memory of 928 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe LSASS.EXE PID 2804 wrote to memory of 928 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe LSASS.EXE PID 2804 wrote to memory of 608 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SMSS.EXE PID 2804 wrote to memory of 608 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SMSS.EXE PID 2804 wrote to memory of 608 2804 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe SMSS.EXE -
System policy modification 1 TTPs 4 IoCs
Processes:
5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe"C:\Users\Admin\AppData\Local\Temp\5ccdbaba0b4e818fd6a30898ec037389a6d1249cc5a642b9f9760c55c7104138.exe"1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD5691f19c911b15959ebef247289e6622a
SHA16d1d994a34a839eb871bb2774ca92225b5a0a143
SHA256de8d2f7fd94da7305362c9d24628246d2b28a38999145f7b3bf52670b9d9f9b9
SHA512b5817e983150ecd2fe69a16e2d48e1a525dcbced1aba245669af3e02af2523b8de176eee406380835bcc0f025f06eddcd2ee4dd5df80127b30e725a2aec7b987
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD5fc29722cfaa1993f4ada62904b344f58
SHA18b3a9d5df526c18f7ac0c59d04ea429350bfe6a2
SHA256695e682c2e3173000c6904cdc4e1f926faf7bf41aff4eae1c85bc9d21d26ce4d
SHA5129caa23ef442ee3ebd09bbe352e96e98bc0f7e07465ee5b6b791f86a93efa0ebfad98816d18a7c39ff2651c3d10adcca2e90b4cfe202013a270607e89389648d1
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD516656ad1f70257af03e40a67eb31e3c2
SHA1bf0ba8c8cd5cb69ae4b7f2cd0bc2fae82b46755f
SHA256a92426d65b782ecc6872b0af40fe148ae048e08ac7aa616dbc29a82bf990ecdc
SHA51269f85685fbf8f4886215ba7ba176acd88cf40c09080791c6f3fc7d85f705b4363f83f3ce4171030c352e57c09f73556d4766b31672e1c4c9e66d445914a8244b
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD5a8f8c1cba6287e99c0e9bba3a03458b3
SHA10366943020024b5eb16a1672aa94469737ff8286
SHA2563a1d375399c5a458120048af6deddfed8a3474e81b4ddebc32f6a1f87567bcc2
SHA512cb7cbe942aefc9871235f9d871ed597c86ff1b5670615eaf1afe68512ebd477be775e59814e1c39a401d89244e8e9826d4e8e6062543fc819e6a72dc54e78feb
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD54051f71d32da3e668dea9120b38710e3
SHA1046e2f85e8bef600f973a52de54eef171cbd7a7e
SHA2567b64be8b230c770312ded323231d1702ff3400950e076c691c9b73ecd7c374a6
SHA51200530123463e3d88fd5001b4d62a64e9e45d77eceef99f932a66a5bc4867db7a4167e8dc36617893e18935aa07b0fc253090fe63b46052f13f17937be193ee72
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD5fcb5e21b8a23d98983e1139d39042573
SHA1746fca6739ca8758008e42e9aa90f5d03102b7db
SHA25681fcf3455dbcac6b5dce908073e8e68497b346543490fde5c1639faacc73353e
SHA512860f09f23dd91291c48d9c0caf2f816cb18ee6e8a79342af2522312d267d38211cb53499c8641d1ee3e7173122879b5bf8abe42726239a3db6636784f5a4172d
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD5931abc8f67cde6655246998382d08fc9
SHA1ab96fdf9a76732c01b4a459b6618c626685dab5b
SHA25626d5d036d16ab692c3eeca3a93c1688982706a5ef012809d8adcbc199c53c08f
SHA5121c4798e5338656286045be5dbb72b75d7baed21a1080bef7b0080ba4231dbe7b240ab169ba56b52f35b4edca629152de0fab5e63fdc26a53c9bfb41d40a6a04a
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD59c1147031f8b1aedc446db44a9007480
SHA19c5d6e55db9397357c6349201d877a03880d54d1
SHA256ac7ad530dd3511c8e507881acd7e367955702f9f9af087f420b1d8c81b88de36
SHA512c156266872e838e75b10bedf4ddef3feb61c6314107cf851023a4e5ea5b72aa332ce446e26b8dd0bb481bde1d6205727983d879f326aee72216c75e037041805
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD53992e19f37aa555697dc55a5541e40e2
SHA18658559cf343fef71862e59e625cb87fd0f1e7f8
SHA256efd6ca01d1f36ab971965dda1dd6104a4151f205fe8242965f3be222c85b02c6
SHA512abc6a5e04312a0a09d7e69a94ed8c52f4ad89f364d189733fb69b795a810ff13ecbde858ebde5eacb76edac720adef98e7ffc3e4f7de69ca4705e4f299654267
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5e81d33bbf5b4171b8aaead25922c3d88
SHA16a410222f0292e6ae1857a34823b811f37375286
SHA256d074efcdaadae165f8204f5935fc60655e1f0ac4b05b171bf7bd53fa84349f22
SHA5121d543a4c72e778bf820788d613c843fdfd3dec715d523c718156d73951a337a3513d11ad6541c02a8f57491efdc3cf126fbb57c3bc1b2e4afc68160e8d69be5a
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXEFilesize
196KB
MD5691f19c911b15959ebef247289e6622a
SHA16d1d994a34a839eb871bb2774ca92225b5a0a143
SHA256de8d2f7fd94da7305362c9d24628246d2b28a38999145f7b3bf52670b9d9f9b9
SHA512b5817e983150ecd2fe69a16e2d48e1a525dcbced1aba245669af3e02af2523b8de176eee406380835bcc0f025f06eddcd2ee4dd5df80127b30e725a2aec7b987
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXEFilesize
196KB
MD516656ad1f70257af03e40a67eb31e3c2
SHA1bf0ba8c8cd5cb69ae4b7f2cd0bc2fae82b46755f
SHA256a92426d65b782ecc6872b0af40fe148ae048e08ac7aa616dbc29a82bf990ecdc
SHA51269f85685fbf8f4886215ba7ba176acd88cf40c09080791c6f3fc7d85f705b4363f83f3ce4171030c352e57c09f73556d4766b31672e1c4c9e66d445914a8244b
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXEFilesize
196KB
MD54051f71d32da3e668dea9120b38710e3
SHA1046e2f85e8bef600f973a52de54eef171cbd7a7e
SHA2567b64be8b230c770312ded323231d1702ff3400950e076c691c9b73ecd7c374a6
SHA51200530123463e3d88fd5001b4d62a64e9e45d77eceef99f932a66a5bc4867db7a4167e8dc36617893e18935aa07b0fc253090fe63b46052f13f17937be193ee72
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXEFilesize
196KB
MD5931abc8f67cde6655246998382d08fc9
SHA1ab96fdf9a76732c01b4a459b6618c626685dab5b
SHA25626d5d036d16ab692c3eeca3a93c1688982706a5ef012809d8adcbc199c53c08f
SHA5121c4798e5338656286045be5dbb72b75d7baed21a1080bef7b0080ba4231dbe7b240ab169ba56b52f35b4edca629152de0fab5e63fdc26a53c9bfb41d40a6a04a
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXEFilesize
196KB
MD53992e19f37aa555697dc55a5541e40e2
SHA18658559cf343fef71862e59e625cb87fd0f1e7f8
SHA256efd6ca01d1f36ab971965dda1dd6104a4151f205fe8242965f3be222c85b02c6
SHA512abc6a5e04312a0a09d7e69a94ed8c52f4ad89f364d189733fb69b795a810ff13ecbde858ebde5eacb76edac720adef98e7ffc3e4f7de69ca4705e4f299654267
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD59520947ce5fa89bdfc33de9da015b6ff
SHA110fa6c1641038a90e1a096f35b225056b5fe66c5
SHA256f1393eab33a87edca9ceddd4fc16ff9153c59bed2352794164a871aa5721ab7d
SHA51235e87d6cf57277864635f579fe691a8808b93294e00892f4808dc41bf7b24ed81b5df89200b2a7ffdabb34a2ce5460211dbd5d1b9120cdca6ae7ff53d5a98671
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD59520947ce5fa89bdfc33de9da015b6ff
SHA110fa6c1641038a90e1a096f35b225056b5fe66c5
SHA256f1393eab33a87edca9ceddd4fc16ff9153c59bed2352794164a871aa5721ab7d
SHA51235e87d6cf57277864635f579fe691a8808b93294e00892f4808dc41bf7b24ed81b5df89200b2a7ffdabb34a2ce5460211dbd5d1b9120cdca6ae7ff53d5a98671
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5743a9d7c15c08bd58e0058b2ce2c7626
SHA1a726081c2e306ce85f44eae518fd9e82904df7f5
SHA2567ec506ab9034a8243cba86c0da0b46f7c16cd9edc1fe64f50dfe3cc6584098a0
SHA5120dc2f9795bc7404f7061714a9136e34cb78627ff93af5dc4779f14d916c6040bdf0c016c6cc27ebd20ec7cfc43742c95c27d8c1574955cba75f6d310a5305984
-
C:\Windows\xk.exeFilesize
196KB
MD5424e0ca73647cc6a635429bb7f2ef671
SHA11c420163f43f482e3111e93542da92275e7ff277
SHA2560787c1f0a987bdeffb43eaa0c308586939bec8f3d37cbae6e0fd9df77902a89d
SHA512efd376993cc667397a1de75a9a3dde0857ba97388a09d51c11c562f0d5b30def55b08aca65f84a2f6dec1acc46cf65fca11380b367f6dac0fb625590cd87ee32
-
C:\Windows\xk.exeFilesize
196KB
MD5424e0ca73647cc6a635429bb7f2ef671
SHA11c420163f43f482e3111e93542da92275e7ff277
SHA2560787c1f0a987bdeffb43eaa0c308586939bec8f3d37cbae6e0fd9df77902a89d
SHA512efd376993cc667397a1de75a9a3dde0857ba97388a09d51c11c562f0d5b30def55b08aca65f84a2f6dec1acc46cf65fca11380b367f6dac0fb625590cd87ee32
-
C:\Windows\xk.exeFilesize
196KB
MD55ab417f0731261d56b21377699b9ff49
SHA1eedcfb3143ea64e92869b85cbbd2ce4b303653c7
SHA256464ffba40f771f04561cd0fde9ac03b80aaeefa02ed9db71f00ee439ae5e3003
SHA5124e992bf42c44e7864d0a690d5402adbe85dad7582eb2cf74fa73d5bf9011e2356e4e7bccbedf268ca4d8c837f968b99c759a31608dc3d5305542824a30272249
-
memory/608-205-0x0000000000000000-mapping.dmp
-
memory/608-210-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/928-201-0x0000000000000000-mapping.dmp
-
memory/928-206-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1572-151-0x0000000000000000-mapping.dmp
-
memory/1572-156-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1824-145-0x0000000000000000-mapping.dmp
-
memory/1824-150-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2644-181-0x0000000000000000-mapping.dmp
-
memory/2644-185-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2712-196-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2712-191-0x0000000000000000-mapping.dmp
-
memory/2804-211-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2804-175-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2804-132-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2840-168-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2840-163-0x0000000000000000-mapping.dmp
-
memory/3292-200-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3292-195-0x0000000000000000-mapping.dmp
-
memory/4040-176-0x0000000000000000-mapping.dmp
-
memory/4040-180-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4052-162-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4052-157-0x0000000000000000-mapping.dmp
-
memory/4164-186-0x0000000000000000-mapping.dmp
-
memory/4164-190-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4540-169-0x0000000000000000-mapping.dmp
-
memory/4540-174-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4932-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4932-139-0x0000000000000000-mapping.dmp
-
memory/4956-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4956-133-0x0000000000000000-mapping.dmp