f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

Analysis

max time kernel
108s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe
Size

27KB
MD5

63eb97adb46a95d147a1729cfef2e630
SHA1

79583e7feafad53a34eb242acf16b16c673298ff
SHA256

f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8
SHA512

0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6
SSDEEP

768:Ew2yxtc4RpZBEWU53p//vcEBymKyPBu3iNBe:Ew37pvTUNpHvcIyF2FN0

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 32 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\nodkrnc16.exe"	SVCHOSTs5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	SMSSs1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	ctfmons10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	fxdkx17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\Hichkas7.exe"	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\LSASSs2.exe"	nodkrnc16.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\SVCHOSTs5.exe"	danger19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	ctfmons10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	Hichkas7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	CSRSSs3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	danger19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\fxdkx17.exe"	SVCHOSTs5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\ctfmons10.exe"	fxdkx17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\salaks11.exe"	fxdkx17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\microsoft14.exe"	Hichkas7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\SMSSs1.exe"	microsoft14.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\SVCHOSTs5.exe"	CSRSSs3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\Dl1Host9.exe"	kav3215.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\SVCHOSTs5.exe"	nvsvm32l20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\LSASSs2.exe"	SVCHOSTs5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\fxdkx17.exe"	LSASSs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	microsoft14.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	SVCHOSTs5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\ctfmons10.exe"	LSASSs2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\kav3215.exe"	ctfmons10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\CSRSSs3.exe"	SMSSs1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\danger19.exe"	ctfmons10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\system32\\nvsvm32l20.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	nvsvm32l20.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	SVCHOSTs5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \\system32\\.exe"	LSASSs2.exe

Executes dropped EXE 19 IoCs

pid	Process
732	Hichkas7.exe
1684	microsoft14.exe
1604	SMSSs1.exe
1376	CSRSSs3.exe
1928	SVCHOSTs5.exe
628	nodkrnc16.exe
1604	LSASSs2.exe
1936	ctfmons10.exe
1412	danger19.exe
1812	SVCHOSTs5.exe
2120	fxdkx17.exe
2296	ctfmons10.exe
2452	kav3215.exe
2584	explorer.exe
2776	nvsvm32l20.exe
2892	SVCHOSTs5.exe
3020	LSASSs2.exe
2256	fxdkx17.exe
2464	salaks11.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1348-54-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x00090000000135a6-63.dat	upx
behavioral1/files/0x00090000000135a6-62.dat	upx
behavioral1/files/0x00090000000135a6-65.dat	upx
behavioral1/files/0x00090000000135a6-72.dat	upx
behavioral1/files/0x0007000000013aad-75.dat	upx
behavioral1/files/0x0007000000013aad-77.dat	upx
behavioral1/files/0x0007000000013aad-80.dat	upx
behavioral1/memory/1348-79-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/732-88-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x0007000000013aad-89.dat	upx
behavioral1/files/0x00090000000139e4-91.dat	upx
behavioral1/files/0x00090000000139e4-92.dat	upx
behavioral1/files/0x00090000000139e4-94.dat	upx
behavioral1/memory/1684-97-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1604-99-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1684-105-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x00090000000139e4-106.dat	upx
behavioral1/files/0x0009000000005c50-108.dat	upx
behavioral1/memory/1604-111-0x0000000000490000-0x00000000004AB000-memory.dmp	upx
behavioral1/files/0x0009000000005c50-112.dat	upx
behavioral1/files/0x0009000000005c50-114.dat	upx
behavioral1/files/0x0009000000005c50-122.dat	upx
behavioral1/memory/1604-125-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x000600000001411b-126.dat	upx
behavioral1/files/0x000600000001411b-127.dat	upx
behavioral1/files/0x000600000001411b-129.dat	upx
behavioral1/memory/1376-134-0x0000000002420000-0x000000000243B000-memory.dmp	upx
behavioral1/memory/1928-135-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1376-137-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x000600000001411b-139.dat	upx
behavioral1/files/0x00060000000141af-143.dat	upx
behavioral1/memory/1376-142-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x00060000000141af-144.dat	upx
behavioral1/files/0x00060000000141af-146.dat	upx
behavioral1/memory/628-149-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x00060000000141af-156.dat	upx
behavioral1/memory/1928-159-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x00080000000140fd-160.dat	upx
behavioral1/files/0x00080000000140fd-161.dat	upx
behavioral1/files/0x00080000000140fd-163.dat	upx
behavioral1/memory/1604-167-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x00080000000140fd-173.dat	upx
behavioral1/memory/628-176-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x0006000000014209-177.dat	upx
behavioral1/files/0x0006000000014209-178.dat	upx
behavioral1/files/0x0006000000014209-180.dat	upx
behavioral1/files/0x0006000000014209-188.dat	upx
behavioral1/memory/1604-191-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x0006000000014294-193.dat	upx
behavioral1/files/0x0006000000014294-192.dat	upx
behavioral1/files/0x0006000000014294-195.dat	upx
behavioral1/memory/1412-198-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1936-199-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x0006000000014294-207.dat	upx
behavioral1/memory/1936-206-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x000600000001411b-209.dat	upx
behavioral1/files/0x000600000001411b-210.dat	upx
behavioral1/files/0x000600000001411b-212.dat	upx
behavioral1/memory/1812-215-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x000600000001411b-219.dat	upx
behavioral1/memory/1412-222-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x00080000000141f2-224.dat	upx
behavioral1/files/0x00080000000141f2-225.dat	upx

Loads dropped DLL 38 IoCs

pid	Process
1348	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe
1348	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe
732	Hichkas7.exe
732	Hichkas7.exe
1684	microsoft14.exe
1684	microsoft14.exe
1604	SMSSs1.exe
1604	SMSSs1.exe
1376	CSRSSs3.exe
1376	CSRSSs3.exe
1928	SVCHOSTs5.exe
1928	SVCHOSTs5.exe
628	nodkrnc16.exe
628	nodkrnc16.exe
1604	LSASSs2.exe
1604	LSASSs2.exe
1936	ctfmons10.exe
1936	ctfmons10.exe
1412	danger19.exe
1412	danger19.exe
1812	SVCHOSTs5.exe
1812	SVCHOSTs5.exe
2120	fxdkx17.exe
2120	fxdkx17.exe
2296	ctfmons10.exe
2296	ctfmons10.exe
2452	kav3215.exe
2452	kav3215.exe
2584	explorer.exe
2584	explorer.exe
2776	nvsvm32l20.exe
2776	nvsvm32l20.exe
2892	SVCHOSTs5.exe
2892	SVCHOSTs5.exe
3020	LSASSs2.exe
3020	LSASSs2.exe
2256	fxdkx17.exe
2256	fxdkx17.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fxdkx17.exe	fxdkx17.exe
File opened for modification	C:\Windows\SysWOW64\Hichkas7.exe	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe
File created	C:\Windows\SysWOW64\SMSSs1.exe	microsoft14.exe
File created	C:\Windows\SysWOW64\nodkrnc16.exe	SVCHOSTs5.exe
File created	C:\Windows\SysWOW64\danger19.exe	ctfmons10.exe
File opened for modification	C:\Windows\SysWOW64\ctfmons10.exe	fxdkx17.exe
File opened for modification	C:\Windows\SysWOW64\nvsvm32l20.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\LSASSs2.exe	LSASSs2.exe
File opened for modification	C:\Windows\SysWOW64\SVCHOSTs5.exe	SVCHOSTs5.exe
File opened for modification	C:\Windows\SysWOW64\ctfmons10.exe	ctfmons10.exe
File opened for modification	C:\Windows\SysWOW64\SVCHOSTs5.exe	SVCHOSTs5.exe
File opened for modification	C:\Windows\SysWOW64\LSASSs2.exe	SVCHOSTs5.exe
File created	C:\Windows\SysWOW64\CSRSSs3.exe	SMSSs1.exe
File opened for modification	C:\Windows\SysWOW64\SVCHOSTs5.exe	SVCHOSTs5.exe
File created	C:\Windows\SysWOW64\Dl1Host9.exe	kav3215.exe
File created	C:\Windows\SysWOW64\Hichkas7.exe	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe
File created	C:\Windows\SysWOW64\microsoft14.exe	Hichkas7.exe
File created	C:\Windows\SysWOW64\nvsvm32l20.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\fxdkx17.exe	LSASSs2.exe
File opened for modification	C:\Windows\SysWOW64\microsoft14.exe	Hichkas7.exe
File opened for modification	C:\Windows\SysWOW64\SMSSs1.exe	SMSSs1.exe
File opened for modification	C:\Windows\SysWOW64\ctfmons10.exe	LSASSs2.exe
File opened for modification	C:\Windows\SysWOW64\danger19.exe	danger19.exe
File opened for modification	C:\Windows\SysWOW64\SVCHOSTs5.exe	danger19.exe
File opened for modification	C:\Windows\SysWOW64\fxdkx17.exe	fxdkx17.exe
File created	C:\Windows\SysWOW64\kav3215.exe	ctfmons10.exe
File opened for modification	C:\Windows\SysWOW64\nvsvm32l20.exe	nvsvm32l20.exe
File opened for modification	C:\Windows\SysWOW64\microsoft14.exe	microsoft14.exe
File opened for modification	C:\Windows\SysWOW64\SMSSs1.exe	microsoft14.exe
File opened for modification	C:\Windows\SysWOW64\CSRSSs3.exe	CSRSSs3.exe
File opened for modification	C:\Windows\SysWOW64\SVCHOSTs5.exe	CSRSSs3.exe
File created	C:\Windows\SysWOW64\LSASSs2.exe	nodkrnc16.exe
File opened for modification	C:\Windows\SysWOW64\LSASSs2.exe	nodkrnc16.exe
File opened for modification	C:\Windows\SysWOW64\Dl1Host9.exe	kav3215.exe
File opened for modification	C:\Windows\SysWOW64\SVCHOSTs5.exe	nvsvm32l20.exe
File opened for modification	C:\Windows\SysWOW64\Hichkas7.exe	Hichkas7.exe
File opened for modification	C:\Windows\SysWOW64\nodkrnc16.exe	SVCHOSTs5.exe
File opened for modification	C:\Windows\SysWOW64\danger19.exe	ctfmons10.exe
File opened for modification	C:\Windows\SysWOW64\fxdkx17.exe	SVCHOSTs5.exe
File opened for modification	C:\Windows\SysWOW64\kav3215.exe	kav3215.exe
File created	C:\Windows\SysWOW64\salaks11.exe	fxdkx17.exe
File opened for modification	C:\Windows\SysWOW64\kav3215.exe	ctfmons10.exe
File opened for modification	C:\Windows\SysWOW64\CSRSSs3.exe	SMSSs1.exe
File created	C:\Windows\SysWOW64\SVCHOSTs5.exe	CSRSSs3.exe
File opened for modification	C:\Windows\SysWOW64\nodkrnc16.exe	nodkrnc16.exe
File opened for modification	C:\Windows\SysWOW64\LSASSs2.exe	LSASSs2.exe
File created	C:\Windows\SysWOW64\ctfmons10.exe	LSASSs2.exe
File opened for modification	C:\Windows\SysWOW64\ctfmons10.exe	ctfmons10.exe
File created	C:\Windows\SysWOW64\fxdkx17.exe	SVCHOSTs5.exe
File opened for modification	C:\Windows\SysWOW64\Dl1Host9.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\salaks11.exe	fxdkx17.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\hfname.hvm	microsoft14.exe
File opened for modification	C:\Windows\hfname.hvm	SMSSs1.exe
File opened for modification	C:\Windows\hfname.hvm	LSASSs2.exe
File opened for modification	C:\Windows\hfname.hvm	fxdkx17.exe
File opened for modification	C:\Windows\hfname.hvm	SVCHOSTs5.exe
File opened for modification	C:\Windows\hfname.hvm	ctfmons10.exe
File opened for modification	C:\Windows\hfname.hvm	fxdkx17.exe
File opened for modification	C:\Windows\hfname.hvm	explorer.exe
File created	C:\Windows\hfname.hvm	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe
File opened for modification	C:\Windows\hfname.hvm	Hichkas7.exe
File opened for modification	C:\Windows\hfname.hvm	danger19.exe
File opened for modification	C:\Windows\hfname.hvm	SVCHOSTs5.exe
File opened for modification	C:\Windows\hfname.hvm	kav3215.exe
File opened for modification	C:\Windows\hfname.hvm	nvsvm32l20.exe
File opened for modification	C:\Windows\hfname.hvm	SVCHOSTs5.exe
File opened for modification	C:\Windows\hfname.hvm	CSRSSs3.exe
File opened for modification	C:\Windows\hfname.hvm	nodkrnc16.exe
File opened for modification	C:\Windows\hfname.hvm	LSASSs2.exe
File opened for modification	C:\Windows\hfname.hvm	ctfmons10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000000c55437310204c6f63616c00380008000400efbe0c55e2700c5543732a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 = 5600310000000000425515311000537973574f57363400003e0008000400efbeee3a881a425515312a000000460d000000000100000000000000000000000000000053007900730057004f00570036003400000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 520031000000000042551531100057696e646f7773003c0008000400efbeee3a851a425515312a0000008a020000000001000000000000000000000000000000570069006e0064006f0077007300000016000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	explorer.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1348	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe
732	Hichkas7.exe
1684	microsoft14.exe
1604	SMSSs1.exe
1376	CSRSSs3.exe
1928	SVCHOSTs5.exe
628	nodkrnc16.exe
1604	LSASSs2.exe
1936	ctfmons10.exe
1412	danger19.exe
1812	SVCHOSTs5.exe
2120	fxdkx17.exe
2296	ctfmons10.exe
2452	kav3215.exe
2584	explorer.exe
2776	nvsvm32l20.exe
2892	SVCHOSTs5.exe
3020	LSASSs2.exe
2256	fxdkx17.exe
2464	salaks11.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 672	1348	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe	26
PID 1348 wrote to memory of 672	1348	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe	26
PID 1348 wrote to memory of 672	1348	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe	26
PID 1348 wrote to memory of 672	1348	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe	26
PID 1348 wrote to memory of 732	1348	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe	28
PID 1348 wrote to memory of 732	1348	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe	28
PID 1348 wrote to memory of 732	1348	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe	28
PID 1348 wrote to memory of 732	1348	f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe	28
PID 732 wrote to memory of 940	732	Hichkas7.exe	29
PID 732 wrote to memory of 940	732	Hichkas7.exe	29
PID 732 wrote to memory of 940	732	Hichkas7.exe	29
PID 732 wrote to memory of 940	732	Hichkas7.exe	29
PID 732 wrote to memory of 1684	732	Hichkas7.exe	31
PID 732 wrote to memory of 1684	732	Hichkas7.exe	31
PID 732 wrote to memory of 1684	732	Hichkas7.exe	31
PID 732 wrote to memory of 1684	732	Hichkas7.exe	31
PID 1684 wrote to memory of 1028	1684	microsoft14.exe	32
PID 1684 wrote to memory of 1028	1684	microsoft14.exe	32
PID 1684 wrote to memory of 1028	1684	microsoft14.exe	32
PID 1684 wrote to memory of 1028	1684	microsoft14.exe	32
PID 1684 wrote to memory of 1604	1684	microsoft14.exe	34
PID 1684 wrote to memory of 1604	1684	microsoft14.exe	34
PID 1684 wrote to memory of 1604	1684	microsoft14.exe	34
PID 1684 wrote to memory of 1604	1684	microsoft14.exe	34
PID 1604 wrote to memory of 1288	1604	SMSSs1.exe	35
PID 1604 wrote to memory of 1288	1604	SMSSs1.exe	35
PID 1604 wrote to memory of 1288	1604	SMSSs1.exe	35
PID 1604 wrote to memory of 1288	1604	SMSSs1.exe	35
PID 1604 wrote to memory of 1376	1604	SMSSs1.exe	37
PID 1604 wrote to memory of 1376	1604	SMSSs1.exe	37
PID 1604 wrote to memory of 1376	1604	SMSSs1.exe	37
PID 1604 wrote to memory of 1376	1604	SMSSs1.exe	37
PID 1376 wrote to memory of 1220	1376	CSRSSs3.exe	38
PID 1376 wrote to memory of 1220	1376	CSRSSs3.exe	38
PID 1376 wrote to memory of 1220	1376	CSRSSs3.exe	38
PID 1376 wrote to memory of 1220	1376	CSRSSs3.exe	38
PID 1376 wrote to memory of 1928	1376	CSRSSs3.exe	40
PID 1376 wrote to memory of 1928	1376	CSRSSs3.exe	40
PID 1376 wrote to memory of 1928	1376	CSRSSs3.exe	40
PID 1376 wrote to memory of 1928	1376	CSRSSs3.exe	40
PID 1928 wrote to memory of 1716	1928	SVCHOSTs5.exe	41
PID 1928 wrote to memory of 1716	1928	SVCHOSTs5.exe	41
PID 1928 wrote to memory of 1716	1928	SVCHOSTs5.exe	41
PID 1928 wrote to memory of 1716	1928	SVCHOSTs5.exe	41
PID 1928 wrote to memory of 628	1928	SVCHOSTs5.exe	43
PID 1928 wrote to memory of 628	1928	SVCHOSTs5.exe	43
PID 1928 wrote to memory of 628	1928	SVCHOSTs5.exe	43
PID 1928 wrote to memory of 628	1928	SVCHOSTs5.exe	43
PID 628 wrote to memory of 1812	628	nodkrnc16.exe	55
PID 628 wrote to memory of 1812	628	nodkrnc16.exe	55
PID 628 wrote to memory of 1812	628	nodkrnc16.exe	55
PID 628 wrote to memory of 1812	628	nodkrnc16.exe	55
PID 628 wrote to memory of 1604	628	nodkrnc16.exe	46
PID 628 wrote to memory of 1604	628	nodkrnc16.exe	46
PID 628 wrote to memory of 1604	628	nodkrnc16.exe	46
PID 628 wrote to memory of 1604	628	nodkrnc16.exe	46
PID 1604 wrote to memory of 336	1604	LSASSs2.exe	47
PID 1604 wrote to memory of 336	1604	LSASSs2.exe	47
PID 1604 wrote to memory of 336	1604	LSASSs2.exe	47
PID 1604 wrote to memory of 336	1604	LSASSs2.exe	47
PID 1604 wrote to memory of 1936	1604	LSASSs2.exe	49
PID 1604 wrote to memory of 1936	1604	LSASSs2.exe	49
PID 1604 wrote to memory of 1936	1604	LSASSs2.exe	49
PID 1604 wrote to memory of 1936	1604	LSASSs2.exe	49

C:\Users\Admin\AppData\Local\Temp\f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe
"C:\Users\Admin\AppData\Local\Temp\f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:672
- C:\Windows\SysWOW64\Hichkas7.exe
  C:\Windows\system32\Hichkas7.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe C:\Windows\SysWOW64
    3⤵
    PID:940
- - C:\Windows\SysWOW64\microsoft14.exe
    C:\Windows\system32\microsoft14.exe
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe C:\Windows\SysWOW64
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\SMSSs1.exe
      C:\Windows\system32\SMSSs1.exe
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1604
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        5⤵
        
        PID:1288
    - - C:\Windows\SysWOW64\CSRSSs3.exe
        
        C:\Windows\system32\CSRSSs3.exe
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1376
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        6⤵
        
        PID:1220
      - C:\Windows\SysWOW64\SVCHOSTs5.exe
        
        C:\Windows\system32\SVCHOSTs5.exe
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        7⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\nodkrnc16.exe
        
        C:\Windows\system32\nodkrnc16.exe
        7⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        8⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\LSASSs2.exe
        
        C:\Windows\system32\LSASSs2.exe
        8⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        9⤵
        
        PID:336
        
        C:\Windows\SysWOW64\ctfmons10.exe
        
        C:\Windows\system32\ctfmons10.exe
        9⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1936
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        10⤵
        
        PID:852
        
        C:\Windows\SysWOW64\danger19.exe
        
        C:\Windows\system32\danger19.exe
        10⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1412
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        11⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\SVCHOSTs5.exe
        
        C:\Windows\system32\SVCHOSTs5.exe
        11⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1812
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        12⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\fxdkx17.exe
        
        C:\Windows\system32\fxdkx17.exe
        12⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        13⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\ctfmons10.exe
        
        C:\Windows\system32\ctfmons10.exe
        13⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        14⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\kav3215.exe
        
        C:\Windows\system32\kav3215.exe
        14⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2452
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        15⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Dl1Host9.exe
        
        C:\Windows\system32\Dl1Host9.exe
        15⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        16⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\nvsvm32l20.exe
        
        C:\Windows\system32\nvsvm32l20.exe
        16⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        17⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\SVCHOSTs5.exe
        
        C:\Windows\system32\SVCHOSTs5.exe
        17⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        18⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\LSASSs2.exe
        
        C:\Windows\system32\LSASSs2.exe
        18⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        19⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\fxdkx17.exe
        
        C:\Windows\system32\fxdkx17.exe
        19⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        20⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\salaks11.exe
        
        C:\Windows\system32\salaks11.exe
        20⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        21⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\ctfmons10.exe
        
        C:\Windows\system32\ctfmons10.exe
        21⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        22⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Rundlls6.exe
        
        C:\Windows\system32\Rundlls6.exe
        22⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        23⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\SMSSs1.exe
        
        C:\Windows\system32\SMSSs1.exe
        23⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        24⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\microsoft14.exe
        
        C:\Windows\system32\microsoft14.exe
        24⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        25⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\exis18.exe
        
        C:\Windows\system32\exis18.exe
        25⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        26⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\danger19.exe
        
        C:\Windows\system32\danger19.exe
        26⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe C:\Windows\SysWOW64
        27⤵
        
        PID:2384

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:912

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1840

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1576

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2016

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1032

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1408

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:724

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2084

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2568

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2716

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2864

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2992

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2400

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1612

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2584

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2936

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:988

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2052

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\CSRSSs3.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\CSRSSs3.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\Hichkas7.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\Hichkas7.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\LSASSs2.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\LSASSs2.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\SMSSs1.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\SMSSs1.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\SVCHOSTs5.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\SVCHOSTs5.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\SVCHOSTs5.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\SVCHOSTs5.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\ctfmons10.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\ctfmons10.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\ctfmons10.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\ctfmons10.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\danger19.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\danger19.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\fxdkx17.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\fxdkx17.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\kav3215.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\kav3215.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\microsoft14.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\microsoft14.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\nodkrnc16.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\SysWOW64\nodkrnc16.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
C:\Windows\hfname.hvm

Filesize
9B

MD5
6b6c789a27b294b4362e6460f6db332c

SHA1
7be780446122e795ee2ebbcf758ac0474dac72cf

SHA256
fd55e48ca5f16348bff787354c1e58aef8fa3b6284840dedd218377deaae53ee

SHA512
a3a6f2ad04ab1b28fe660388e84342701e6206e941aca5228d17181ad4d0aac43438aa206e848783f418547b9b807fb9654faa86647d17f86c5534fd79a07c76

Download Submit
C:\Windows\hfname.hvm

Filesize
11B

MD5
92438c517a4ca0f7b07322176fdaa65c

SHA1
2a4d38e35e2117405c9b8cd8f12dd0c3b1533e72

SHA256
9f6a9e26c5572d6c36e323a31f1adc7aefabcc54a41c1467cdb0b9ab18aa91a5

SHA512
9fd4bfcc4d5b6c69cc0e957beccd76a0dc9de723a4aff8a6d3084caf8a6281f986313708f58d88c6ee1f23a30d0d89275c11377dc3c23fbe720500dccc4e9ce1

Download Submit
C:\Windows\hfname.hvm

Filesize
11B

MD5
f0b9950d44c35d35154c0d86d64d3f46

SHA1
b654c040624a0cae1fa33aea7295c778acbdb286

SHA256
7dc91735ed103a3e6fecc704c155b81122396b2dc0b083c9daf03b7f928cbdef

SHA512
4f8ff5f273126b61599bee6424af4c72854a47358ea64a5b4fa753a56453c769f052e34c837ad61f9814702eca2142e05f0af4c7a5d73d4c13ae969f1b2e8569

Download Submit
C:\Windows\hfname.hvm

Filesize
9B

MD5
be1a8ea43c364a0c06e6ecebf1716052

SHA1
1f96345d63da2c0e425c7038cc542d8c7f6cbc5b

SHA256
2761a492910143b1afc1d2a47265a052de821fdd6deaf9daaf0361f5b78c5dd2

SHA512
d87c3b7de1716806ae2ff32be83695e7674c3c41c60e81af844730a6b07ef32a975d60959a3cc47f518b829b5cb213c9010610c00faa8c5b63f294e602eaed5f

Download Submit
C:\Windows\hfname.hvm

Filesize
11B

MD5
67ab066d4e5240717f9339c3951f707e

SHA1
2090640982fd15ae6d28f7ece92cbac56b031a2c

SHA256
5449910620b9101e6a6fb076419e328a789ec2fb81e63d8b90042dd0f7188b6d

SHA512
3467a016a8858366c8c3fe408ab5bac219864e647286f5d509fedad8978ad882f758ea7bb8af109dbd37a7bf424402bacea3a1e6e7332af7e7382b8dd9767a36

Download Submit
C:\Windows\hfname.hvm

Filesize
10B

MD5
65c1775bf09afae3cde31c956ddbeb22

SHA1
3e6f8539d989ea40f8b0876ffeaca3b61a917215

SHA256
42ba873f1509fe2f9d157ddcfe29b0762256719f1d064f954d2b17b5144fec66

SHA512
bfe63aa93329ce44fc15378c92700bf220fb9f0076258d4f3a151fa6e25ddafb075ea49413ca5b971c328c4ac519573b0dff63efa9bf722df94188a3b9d31a0d

Download Submit
C:\Windows\hfname.hvm

Filesize
11B

MD5
92438c517a4ca0f7b07322176fdaa65c

SHA1
2a4d38e35e2117405c9b8cd8f12dd0c3b1533e72

SHA256
9f6a9e26c5572d6c36e323a31f1adc7aefabcc54a41c1467cdb0b9ab18aa91a5

SHA512
9fd4bfcc4d5b6c69cc0e957beccd76a0dc9de723a4aff8a6d3084caf8a6281f986313708f58d88c6ee1f23a30d0d89275c11377dc3c23fbe720500dccc4e9ce1

Download Submit
C:\Windows\hfname.hvm

Filesize
9B

MD5
93137da41b5c39fd45ef3a9282b0efe1

SHA1
80a20c9405fcbf5e0717881c79a54547dd2cfdca

SHA256
7b1c1fe8fc43e840c22e2ee5c11c8ecb56792f7e47f5382b441660392f233663

SHA512
87107eb2cec209b40010b189f15c69c55cafdba7b2a2eaa4157475a80b24c07ddb2f440eabb284314225e4aaaa23e4aa20997dd80d610272929a15369a1f321e

Download Submit
C:\Windows\hfname.hvm

Filesize
11B

MD5
67ab066d4e5240717f9339c3951f707e

SHA1
2090640982fd15ae6d28f7ece92cbac56b031a2c

SHA256
5449910620b9101e6a6fb076419e328a789ec2fb81e63d8b90042dd0f7188b6d

SHA512
3467a016a8858366c8c3fe408ab5bac219864e647286f5d509fedad8978ad882f758ea7bb8af109dbd37a7bf424402bacea3a1e6e7332af7e7382b8dd9767a36

Download Submit
C:\Windows\hfname.hvm

Filesize
9B

MD5
39f24184ddfd17cd420364bd9c0a367e

SHA1
103bf52dcef6ca1489b354a5f052d2b7bdc6dd95

SHA256
064ad41ad2acacaf0207359e97a4dcf3bfc11d8e6f330d2a3670fcd97ca7763a

SHA512
ab8a362b518458aee196a8e686866db25951e8652f69f105b1706517a137bb35032d151506fe5f338dd48de98801746de3a9696786de10007091cfb856f34236

Download Submit
C:\Windows\hfname.hvm

Filesize
13B

MD5
3f373a3ae03500f00700825ef42428d0

SHA1
4fdcc6b229769c5cfe1da13fd7d6db915b1bc482

SHA256
4b5e03fe403deb83816f7f8ee2c864792881ee9820b683bda7b54585e81a7cbf

SHA512
6647a2f8ca3470048e64c28f5004e5f3bc9f8e96563535fe90b89c8813b1da7d64b50318d8bff045119a38c07f0184a85ae661c1d895fbd0ca2914c301009518

Download Submit
C:\Windows\hfname.hvm

Filesize
8B

MD5
911561c167aa310406c480a6686bc6fe

SHA1
1f7fc2f9a9a31e0f825f6eb909a81ad03a9fe152

SHA256
a68fb2cf3936f196fdb461fa00aa23e947ed3b85602870c84b44a4881fb7fb70

SHA512
11e060cc9f13e3755bcc4019087c40e923975483e22de00683e9208cd0040cb313661f0d3ed0cefd73eaf6c733802398bc11cd846f14608ee64df37ebcf7fb52

Download Submit
\Windows\SysWOW64\CSRSSs3.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\CSRSSs3.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\Hichkas7.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\Hichkas7.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\LSASSs2.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\LSASSs2.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\SMSSs1.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\SMSSs1.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\SVCHOSTs5.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\SVCHOSTs5.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\SVCHOSTs5.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\SVCHOSTs5.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\ctfmons10.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\ctfmons10.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\ctfmons10.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\ctfmons10.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\danger19.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\danger19.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\fxdkx17.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\fxdkx17.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\kav3215.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\kav3215.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\microsoft14.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\microsoft14.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\nodkrnc16.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
\Windows\SysWOW64\nodkrnc16.exe

Filesize
27KB

MD5
63eb97adb46a95d147a1729cfef2e630

SHA1
79583e7feafad53a34eb242acf16b16c673298ff

SHA256
f7c0c49b54a8e9d8695715997b007eb0c178988bfc78ac87f1fe1b35e784e6d8

SHA512
0a7dfc8bd489aeb4dd8ed06b0a8b989c0b1495275d4fbd4caa92743d7f99f77dc9209da2c1d71ae15f4b9323271d0740a2860bca9167d4b45a04f500892926c6

Download Submit
memory/628-166-0x00000000002A0000-0x00000000002BB000-memory.dmp

Filesize
108KB

Download
memory/628-149-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/628-176-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/672-58-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/672-59-0x00000000747E1000-0x00000000747E3000-memory.dmp

Filesize
8KB

Download
memory/732-88-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/940-70-0x00000000747D1000-0x00000000747D3000-memory.dmp

Filesize
8KB

Download
memory/1028-86-0x0000000074661000-0x0000000074663000-memory.dmp

Filesize
8KB

Download
memory/1124-76-0x0000000003740000-0x0000000003750000-memory.dmp

Filesize
64KB

Download
memory/1312-60-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Filesize
8KB

Download
memory/1348-79-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1348-54-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1376-137-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1376-134-0x0000000002420000-0x000000000243B000-memory.dmp

Filesize
108KB

Download
memory/1376-142-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1412-222-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1412-198-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1412-391-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1412-382-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1604-125-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1604-99-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1604-191-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1604-167-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1604-111-0x0000000000490000-0x00000000004AB000-memory.dmp

Filesize
108KB

Download
memory/1684-105-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1684-97-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1684-98-0x00000000004F0000-0x000000000050B000-memory.dmp

Filesize
108KB

Download
memory/1716-136-0x0000000074671000-0x0000000074673000-memory.dmp

Filesize
8KB

Download
memory/1812-215-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1812-233-0x0000000000440000-0x000000000045B000-memory.dmp

Filesize
108KB

Download
memory/1812-241-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1812-230-0x0000000000440000-0x000000000045B000-memory.dmp

Filesize
108KB

Download
memory/1928-159-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1928-135-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-206-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-197-0x00000000002B0000-0x00000000002CB000-memory.dmp

Filesize
108KB

Download
memory/1936-199-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2120-253-0x00000000005B0000-0x00000000005CB000-memory.dmp

Filesize
108KB

Download
memory/2120-234-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2120-264-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2256-338-0x00000000003C0000-0x00000000003DB000-memory.dmp

Filesize
108KB

Download
memory/2256-346-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2296-265-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/2296-274-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2296-254-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2452-285-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2452-266-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2452-278-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/2452-286-0x00000000003E0000-0x00000000003FB000-memory.dmp

Filesize
108KB

Download
memory/2464-359-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2464-339-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2464-350-0x0000000000440000-0x000000000045B000-memory.dmp

Filesize
108KB

Download
memory/2464-351-0x0000000000440000-0x000000000045B000-memory.dmp

Filesize
108KB

Download
memory/2584-279-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2584-293-0x00000000002D0000-0x00000000002EB000-memory.dmp

Filesize
108KB

Download
memory/2584-295-0x00000000002D0000-0x00000000002EB000-memory.dmp

Filesize
108KB

Download
memory/2584-299-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2736-352-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2736-370-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2776-315-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2776-311-0x00000000002A0000-0x00000000002BB000-memory.dmp

Filesize
108KB

Download
memory/2776-312-0x00000000002A0000-0x00000000002BB000-memory.dmp

Filesize
108KB

Download
memory/2776-296-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2892-325-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2892-313-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2900-380-0x00000000002A0000-0x00000000002BB000-memory.dmp

Filesize
108KB

Download
memory/2900-381-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2900-366-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2924-399-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3020-323-0x00000000004B0000-0x00000000004CB000-memory.dmp

Filesize
108KB

Download
memory/3020-337-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads