Analysis
-
max time kernel
1615s -
max time network
1586s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 04:02
Static task
static1
Behavioral task
behavioral1
Sample
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe
Resource
win10v2004-20220414-en
General
-
Target
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe
-
Size
196KB
-
MD5
0de432f495f6c4c2eb4319cf0c3586ed
-
SHA1
a72ce804d4e7e536236533811492f27ea76c0478
-
SHA256
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa
-
SHA512
9a23466019ca0b1377ace88df146e402e189cfb8cf9269c742457264a257efd6d30c9882cf1105f86d7ccf0aa8cc271c9388a50c4da3812586ed1a7ddccf6230
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Modifies system executable filetype association 2 TTPs 13 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 14 IoCs
Processes:
xk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXELSASS.EXESMSS.EXEpid process 3920 xk.exe 3588 IExplorer.exe 4904 WINLOGON.EXE 4300 CSRSS.EXE 2128 SERVICES.EXE 4720 xk.exe 4616 IExplorer.exe 4696 WINLOGON.EXE 4344 CSRSS.EXE 1300 SERVICES.EXE 960 LSASS.EXE 4976 SMSS.EXE 4796 LSASS.EXE 3728 SMSS.EXE -
Processes:
resource yara_rule behavioral2/memory/4860-130-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Windows\xk.exe upx C:\Windows\xk.exe upx behavioral2/memory/3920-139-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Windows\SysWOW64\IExplorer.exe upx C:\Windows\SysWOW64\IExplorer.exe upx behavioral2/memory/3588-144-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral2/memory/4904-150-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE upx behavioral2/memory/4300-156-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE upx behavioral2/memory/2128-162-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Windows\xk.exe upx behavioral2/memory/4720-168-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Windows\SysWOW64\IExplorer.exe upx C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE upx behavioral2/memory/4616-172-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/4696-179-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE upx C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE upx behavioral2/memory/4344-183-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/1300-187-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE upx behavioral2/memory/960-193-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE upx behavioral2/memory/4976-197-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/4976-200-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/4860-201-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE upx behavioral2/memory/4796-207-0x0000000000400000-0x000000000042F000-memory.dmp upx C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE upx behavioral2/memory/3728-211-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/4860-212-0x0000000000400000-0x000000000042F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run\ b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process File created C:\desktop.ini b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened for modification C:\desktop.ini b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process File opened (read-only) \??\Q: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\G: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\K: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\H: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\O: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\P: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\S: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\W: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\X: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\E: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\F: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\M: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\N: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\R: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\U: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\Y: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\Z: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\B: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\L: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\T: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\V: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\I: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened (read-only) \??\J: b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Drops file in System32 directory 6 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process File opened for modification C:\Windows\SysWOW64\shell.exe b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File created C:\Windows\SysWOW64\shell.exe b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File created C:\Windows\SysWOW64\Mig2.scr b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File created C:\Windows\SysWOW64\IExplorer.exe b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Drops file in Windows directory 2 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process File opened for modification C:\Windows\xk.exe b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe File created C:\Windows\xk.exe b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Modifies Control Panel 4 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\ b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Modifies registry class 15 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exepid process 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exexk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXExk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXELSASS.EXESMSS.EXEpid process 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe 3920 xk.exe 3588 IExplorer.exe 4904 WINLOGON.EXE 4300 CSRSS.EXE 2128 SERVICES.EXE 4720 xk.exe 4616 IExplorer.exe 4696 WINLOGON.EXE 4344 CSRSS.EXE 1300 SERVICES.EXE 960 LSASS.EXE 4976 SMSS.EXE 4796 LSASS.EXE 3728 SMSS.EXE -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription pid process target process PID 4860 wrote to memory of 3920 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe xk.exe PID 4860 wrote to memory of 3920 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe xk.exe PID 4860 wrote to memory of 3920 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe xk.exe PID 4860 wrote to memory of 3588 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe IExplorer.exe PID 4860 wrote to memory of 3588 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe IExplorer.exe PID 4860 wrote to memory of 3588 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe IExplorer.exe PID 4860 wrote to memory of 4904 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe WINLOGON.EXE PID 4860 wrote to memory of 4904 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe WINLOGON.EXE PID 4860 wrote to memory of 4904 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe WINLOGON.EXE PID 4860 wrote to memory of 4300 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe CSRSS.EXE PID 4860 wrote to memory of 4300 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe CSRSS.EXE PID 4860 wrote to memory of 4300 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe CSRSS.EXE PID 4860 wrote to memory of 2128 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SERVICES.EXE PID 4860 wrote to memory of 2128 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SERVICES.EXE PID 4860 wrote to memory of 2128 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SERVICES.EXE PID 4860 wrote to memory of 4720 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe xk.exe PID 4860 wrote to memory of 4720 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe xk.exe PID 4860 wrote to memory of 4720 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe xk.exe PID 4860 wrote to memory of 4616 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe IExplorer.exe PID 4860 wrote to memory of 4616 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe IExplorer.exe PID 4860 wrote to memory of 4616 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe IExplorer.exe PID 4860 wrote to memory of 4696 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe WINLOGON.EXE PID 4860 wrote to memory of 4696 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe WINLOGON.EXE PID 4860 wrote to memory of 4696 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe WINLOGON.EXE PID 4860 wrote to memory of 4344 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe CSRSS.EXE PID 4860 wrote to memory of 4344 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe CSRSS.EXE PID 4860 wrote to memory of 4344 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe CSRSS.EXE PID 4860 wrote to memory of 1300 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SERVICES.EXE PID 4860 wrote to memory of 1300 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SERVICES.EXE PID 4860 wrote to memory of 1300 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SERVICES.EXE PID 4860 wrote to memory of 960 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe LSASS.EXE PID 4860 wrote to memory of 960 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe LSASS.EXE PID 4860 wrote to memory of 960 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe LSASS.EXE PID 4860 wrote to memory of 4976 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SMSS.EXE PID 4860 wrote to memory of 4976 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SMSS.EXE PID 4860 wrote to memory of 4976 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SMSS.EXE PID 4860 wrote to memory of 4796 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe LSASS.EXE PID 4860 wrote to memory of 4796 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe LSASS.EXE PID 4860 wrote to memory of 4796 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe LSASS.EXE PID 4860 wrote to memory of 3728 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SMSS.EXE PID 4860 wrote to memory of 3728 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SMSS.EXE PID 4860 wrote to memory of 3728 4860 b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe SMSS.EXE -
System policy modification 1 TTPs 4 IoCs
Processes:
b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe"C:\Users\Admin\AppData\Local\Temp\b586e273e32d82be2dd0b63643844b390f2cba6e28fdf9f4987820794d4c04fa.exe"1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD54c13fb68c66900252b1ca3621d11f75c
SHA1ceededaea9f5895a5f4ed2faa3523b093fa44373
SHA256843feb2aa276095cfb9d07ee851d068943d8544307a2e290cc32ed6547f0693a
SHA51215ed0c8e7ab11adca945b8d2b8fa160dd3ba31b06765b8c1fca3c10f566f5efbb80136f724602adb32843da98e5f6049fdaaee83f065b8ebd697c13ad7ef69ed
-
C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXEFilesize
196KB
MD55b05b20b6860b156e6ae1d19c53775c1
SHA127e71bf78bd54a27389bbf31e479f6a1fdd97dd2
SHA256cdd8b4865e6328dd6171daa20d5b6c5d56714602868e18e92976d02c431166e5
SHA512e0d656db2e5a6a7c273f554e98cbcec9903cbe152fe1b3099fe35d4880343b62a1364028e963d790318204a6979354795111b17f6dcd0cb3e2be735bef00cb4f
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD5426b3e9dac80fd200e2b8a8114187bd7
SHA1f89d0926a94a76c018f0a9490c9ae397d511d6f6
SHA2567133e7f17e52ea25fdada32730f57c936be75e1fa95fb468ab13bddb25f2adcd
SHA5123d17fae69fd0fcc6752ae7914f9623f4c78fa1ae1e99a5520f4219d8dd38f79ab5c147197a19f57989bd2b6c604213bffae86d5dcd328d09d23821e40fe4f7da
-
C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXEFilesize
196KB
MD5426b3e9dac80fd200e2b8a8114187bd7
SHA1f89d0926a94a76c018f0a9490c9ae397d511d6f6
SHA2567133e7f17e52ea25fdada32730f57c936be75e1fa95fb468ab13bddb25f2adcd
SHA5123d17fae69fd0fcc6752ae7914f9623f4c78fa1ae1e99a5520f4219d8dd38f79ab5c147197a19f57989bd2b6c604213bffae86d5dcd328d09d23821e40fe4f7da
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD5bae44483646c26ecabdfa333865838b7
SHA14d451b06b7f2d296be40265d50d4e3226dcf13ed
SHA256f2c5a0c0e721b1b4f6a3f98e797ecdb6e2f3581b7b743fa8bed72d753559fd62
SHA512c4fc2746f18d50ec7dc8d8831980858d12b12c40145c9f6fa3f15ebd75989ab7a7dde26e21f2c75b1a4b8744ea7ec613f4e4f7e19b6568ba27ed0ae9a1cde9d5
-
C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXEFilesize
196KB
MD5964260988a2d9ebb74af497f8c57b59e
SHA10b3f4360f3f61fc58611a6bd44b97066a30c463c
SHA256926f547da978be55eeb6641333a55992fdc807b821ba79e49ddc18d22947105b
SHA512c52e4bbe7c357f9f8b56dd51913404c151d405833118125e77b8427305bb5808cd7fd38cc06682ac7eff2ca78d5ccbc6a6bfffd1a3f1dc644daf0a2fffb8526d
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD5c7d966d575e6dbcf17205bde11b71f5d
SHA1ead9e3d116b761bdc6a4d9e1a35ef61c44f7e3a3
SHA2566a6ec728b5db9dbfe636158f8a0602009904e02afd1635b3ac2124509b03858e
SHA51220546d709a97e4c64ba3e0ee7aabb1500c30d0a4a1556e92fa49a41ca8e04c63b86a536a81b6a9eb14a989d51b7300d1e9a7b82b06a3653fc4232a1542ca65d4
-
C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXEFilesize
196KB
MD5c7d966d575e6dbcf17205bde11b71f5d
SHA1ead9e3d116b761bdc6a4d9e1a35ef61c44f7e3a3
SHA2566a6ec728b5db9dbfe636158f8a0602009904e02afd1635b3ac2124509b03858e
SHA51220546d709a97e4c64ba3e0ee7aabb1500c30d0a4a1556e92fa49a41ca8e04c63b86a536a81b6a9eb14a989d51b7300d1e9a7b82b06a3653fc4232a1542ca65d4
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5695d2ae61aa8d97e705ee81ce8724b01
SHA188d8baa5ff3b59e7083d2b8b2d6a37aba0a5d1af
SHA256764439b55d2fe1afac381b38960216c935273efc6b054d1896ef99100fd9758e
SHA5129e99dd49ea8391ee67d3f68bf79b61f3a63ad3c4908cd0893958d0de2d1c11d28e903bcdbc5a15b5b567541bfb56361d105010a1045df55c13017c35280c155e
-
C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXEFilesize
196KB
MD52578e08bb1626e90aa74409f84fa95c8
SHA1f7f3dfb636783878774dc276de431e183069c7dc
SHA256062793a37cd167ad80980b264b472098001c8507437b9140f64269c938345154
SHA51220c29acf886d5c97999042882422f1518d31931fa5a5f9d934cdd96a46118fa4c557a0d5fd826ff6781e1e14c3410f41f0912515f760f392116de991aa47c701
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXEFilesize
196KB
MD54c13fb68c66900252b1ca3621d11f75c
SHA1ceededaea9f5895a5f4ed2faa3523b093fa44373
SHA256843feb2aa276095cfb9d07ee851d068943d8544307a2e290cc32ed6547f0693a
SHA51215ed0c8e7ab11adca945b8d2b8fa160dd3ba31b06765b8c1fca3c10f566f5efbb80136f724602adb32843da98e5f6049fdaaee83f065b8ebd697c13ad7ef69ed
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXEFilesize
196KB
MD5426b3e9dac80fd200e2b8a8114187bd7
SHA1f89d0926a94a76c018f0a9490c9ae397d511d6f6
SHA2567133e7f17e52ea25fdada32730f57c936be75e1fa95fb468ab13bddb25f2adcd
SHA5123d17fae69fd0fcc6752ae7914f9623f4c78fa1ae1e99a5520f4219d8dd38f79ab5c147197a19f57989bd2b6c604213bffae86d5dcd328d09d23821e40fe4f7da
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXEFilesize
196KB
MD5bae44483646c26ecabdfa333865838b7
SHA14d451b06b7f2d296be40265d50d4e3226dcf13ed
SHA256f2c5a0c0e721b1b4f6a3f98e797ecdb6e2f3581b7b743fa8bed72d753559fd62
SHA512c4fc2746f18d50ec7dc8d8831980858d12b12c40145c9f6fa3f15ebd75989ab7a7dde26e21f2c75b1a4b8744ea7ec613f4e4f7e19b6568ba27ed0ae9a1cde9d5
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXEFilesize
196KB
MD5c7d966d575e6dbcf17205bde11b71f5d
SHA1ead9e3d116b761bdc6a4d9e1a35ef61c44f7e3a3
SHA2566a6ec728b5db9dbfe636158f8a0602009904e02afd1635b3ac2124509b03858e
SHA51220546d709a97e4c64ba3e0ee7aabb1500c30d0a4a1556e92fa49a41ca8e04c63b86a536a81b6a9eb14a989d51b7300d1e9a7b82b06a3653fc4232a1542ca65d4
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXEFilesize
196KB
MD5695d2ae61aa8d97e705ee81ce8724b01
SHA188d8baa5ff3b59e7083d2b8b2d6a37aba0a5d1af
SHA256764439b55d2fe1afac381b38960216c935273efc6b054d1896ef99100fd9758e
SHA5129e99dd49ea8391ee67d3f68bf79b61f3a63ad3c4908cd0893958d0de2d1c11d28e903bcdbc5a15b5b567541bfb56361d105010a1045df55c13017c35280c155e
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5816f3280776f73fd4ae86a02fc9e9f2c
SHA141f993bd3d736b90efb31ef318c39e4b07e88e57
SHA2565fd9dede776bc7e65da4e0a93eb3c6f8f1c4282533775934696d8ba686a74383
SHA512f48f931ab780e3538803a29b99c3e05848d31dfb9eb713bc2a88b993e0de19fbe999033160ec282ceeae0104d1ca22e26081774b20dfc16a89a4e00d9e251595
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD5816f3280776f73fd4ae86a02fc9e9f2c
SHA141f993bd3d736b90efb31ef318c39e4b07e88e57
SHA2565fd9dede776bc7e65da4e0a93eb3c6f8f1c4282533775934696d8ba686a74383
SHA512f48f931ab780e3538803a29b99c3e05848d31dfb9eb713bc2a88b993e0de19fbe999033160ec282ceeae0104d1ca22e26081774b20dfc16a89a4e00d9e251595
-
C:\Windows\SysWOW64\IExplorer.exeFilesize
196KB
MD50918911152f279cd92b71b1afd939904
SHA1d0a32700945a7bcfe4c5b81ac4a8ee770c37a07a
SHA2562c554a8e52fbac8375bd517d582448a918af036baefac408bc6b554fcf5d7a31
SHA512f729decbdd128404a1843bb7468411d5d17f1f2062c62da6f95acda4ce5515797ff96f88e316f5b7bab8668abe21262e1b3bd53eaa02750edbc78f35d3913d81
-
C:\Windows\xk.exeFilesize
196KB
MD53cf3970be23163fcade9901046739256
SHA13a0dc950221a54a0bd2a3047a24448ad15a2ccac
SHA25662ad2d9acbfa41e98670e493aa208256cef3aec429d9797778cda7e923823072
SHA512c68b7b46c3b4da0b3d483c5721f93881eb26a909b6c579266fbfa8c4e0c7850bbc8c3f4ef4328491f34de5ff1008481a7f358e2ade8cb66343fcf93f1b78ff89
-
C:\Windows\xk.exeFilesize
196KB
MD53cf3970be23163fcade9901046739256
SHA13a0dc950221a54a0bd2a3047a24448ad15a2ccac
SHA25662ad2d9acbfa41e98670e493aa208256cef3aec429d9797778cda7e923823072
SHA512c68b7b46c3b4da0b3d483c5721f93881eb26a909b6c579266fbfa8c4e0c7850bbc8c3f4ef4328491f34de5ff1008481a7f358e2ade8cb66343fcf93f1b78ff89
-
C:\Windows\xk.exeFilesize
196KB
MD5acd680d3a329b9785affce37bd72670f
SHA1f80e43a59fd8d2724f0beb6bf2bccd2c0583fea5
SHA256d50ffd3327e44a8ad4ddfb03ca940bb50420e13a177cd5e2b938d901d38e739c
SHA512ee6a2f3bc297b3ea7eea24fc668d90c6fa4e5fb931caa67bc47d9b88b74789e9ca9cc7af8f1c2f859dff0e5e54753a2856336d860c781df2ddd40bde543e5990
-
memory/960-188-0x0000000000000000-mapping.dmp
-
memory/960-193-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1300-182-0x0000000000000000-mapping.dmp
-
memory/1300-187-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2128-162-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2128-157-0x0000000000000000-mapping.dmp
-
memory/3588-138-0x0000000000000000-mapping.dmp
-
memory/3588-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3728-211-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3728-206-0x0000000000000000-mapping.dmp
-
memory/3920-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3920-133-0x0000000000000000-mapping.dmp
-
memory/4300-151-0x0000000000000000-mapping.dmp
-
memory/4300-156-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4344-183-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4344-177-0x0000000000000000-mapping.dmp
-
memory/4616-172-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4616-167-0x0000000000000000-mapping.dmp
-
memory/4696-179-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4696-173-0x0000000000000000-mapping.dmp
-
memory/4720-163-0x0000000000000000-mapping.dmp
-
memory/4720-168-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4796-202-0x0000000000000000-mapping.dmp
-
memory/4796-207-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4860-201-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4860-130-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4860-212-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4904-150-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4904-145-0x0000000000000000-mapping.dmp
-
memory/4976-197-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4976-200-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4976-194-0x0000000000000000-mapping.dmp