Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

a06cde0c42...af.exe

windows7-x64

10

a06cde0c42...af.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 07:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a06cde0c4240c9cb0da4b2cd36b2e9c116cd19aab6724a088484f4dc95a87aaf.exe

  • Size

    160KB

  • MD5

    43e5f86f81586d8d6c1b4fac4b6b4cd0

  • SHA1

    c6940a2c2817359ab1a0b7ea560be3c0f97a72dc

  • SHA256

    a06cde0c4240c9cb0da4b2cd36b2e9c116cd19aab6724a088484f4dc95a87aaf

  • SHA512

    ace1b9deafa47bab4b7209ba4d9b214ecd5a054d0df1760fce5691cfa922e9a7513f2b1cca0de0b807261511a6bf0e36927ba5bbb773549b1812d0d38b63f6ee

  • SSDEEP

    3072:TGrNIkMzZwveK8ss81GITFJ/G4bSGXO7QD56i:qrNrMzKeRIhzG4mG+MD59

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 16 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs
    evasion
  • Disables RegEdit via registry modification 16 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 63 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 56 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 50 IoCs
  • Drops file in Windows directory 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 32 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 7 IoCs
  • Suspicious use of SetWindowsHookEx 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 24 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\a06cde0c4240c9cb0da4b2cd36b2e9c116cd19aab6724a088484f4dc95a87aaf.exe
    "C:\Users\Admin\AppData\Local\Temp\a06cde0c4240c9cb0da4b2cd36b2e9c116cd19aab6724a088484f4dc95a87aaf.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies system executable filetype association
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1304
    • C:\Windows\D3_08.exe
      C:\Windows\D3_08.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2036
      • C:\Windows\D3_08.exe
        C:\Windows\D3_08.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1464
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        PID:1712
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1604
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1556
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1504
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1360
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:796
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:756
      • C:\Windows\D3_08.exe
        C:\Windows\D3_08.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1788
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1080
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1416
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1616
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1336
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1992
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1064
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:764
      • C:\Windows\D3_08.exe
        C:\Windows\D3_08.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1820
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1032
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1156
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1564
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1956
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:112
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1800
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:584
      • C:\Windows\D3_08.exe
        C:\Windows\D3_08.exe
        3⤵
        • Executes dropped EXE
        PID:1808
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1564
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1208
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1972
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1388
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2040
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1624
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1520
      • C:\Windows\D3_08.exe
        C:\Windows\D3_08.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1932
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:1612
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:624
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1524
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1968
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1788
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1012
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1368
      • C:\Windows\D3_08.exe
        C:\Windows\D3_08.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1732
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:860
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1828
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1720
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1324
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1880
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:940
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:948
      • C:\Windows\D3_08.exe
        C:\Windows\D3_08.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1952
      • C:\Windows\SysWOW64\IExplorer.exe
        C:\Windows\system32\IExplorer.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:828
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1668
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1540
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:676
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1152
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:624
    • C:\Windows\D3_08.exe
      C:\Windows\D3_08.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:836
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:1956
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:996
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1804
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1132
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1572
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:552

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\D3_08.exe
    Filesize

    160KB

    MD5

    b3f55db28664875f5e8a1ce323713d4f

    SHA1

    710ecad5b0884126975702ccef4bf62a4cf0b176

    SHA256

    029a8b23c5cec1f47cbfa1f515d7a4d61161036e4f8901c5bd02454380f01801

    SHA512

    120c7782245257bfa9fb52e77ad97ec4a0792d415ff813dafcd7f8effdaea7282911b1b89d00a37cdf9e9828bc199da1c7f9b132e40d6309dc835dadf4ae02df

    Download Submit

  • C:\D3_08.exe
    Filesize

    160KB

    MD5

    7f089dc8b3b8800f1223fa74cc8fb7c4

    SHA1

    103878011dd72756bf8ff1048c3e618bb464365b

    SHA256

    0ffadbde334b714f01bb080a832db1b4639c1f715721a7b4957a7e91f28c344d

    SHA512

    86aeb3592015b80da7c2e040ceb0e7e776a2383d5e2bf728010f569d3456788a351992d4d1f6cf7520ea73ee76eb0cb0f3e1b9dccaf9e4d0290403a59d18617f

    Download Submit

  • C:\D3_08.exe
    Filesize

    160KB

    MD5

    4a99ee77956437c0a451a057c88aa5b3

    SHA1

    4c88c92450d0af8b0ed781e28c2134e0d215c4ac

    SHA256

    bfe5937b81f0fddb8bcee1cdbbd90658cd738df6d27e95498bb795f4e117ef7f

    SHA512

    58ecadcdcc1acf5b56c30951a1a36dc433971807b2a4496dc7cde650273ed8d19fe483bcf82e5010a783c66517d66b7236d05d27fa63e08dd595aa270854f29a

    Download Submit

  • C:\D3_08.exe
    Filesize

    160KB

    MD5

    5ab236c1fa2a066fc95d9ecc51877549

    SHA1

    a04892dfadc5b8c5b42c019e7a14c3eb6e7f33da

    SHA256

    0bc715fbaeaecb54a2dc8ad18796bd5b7a48f50daf8f94842a3048a2bb0000a8

    SHA512

    8bed42e13a02c9d7bdba40469605c7cb7e82342950fc3e3c438ce74ee9e109cb60988fa89eac627c82d2c3b467dc2c71161f52f9eb44840cc1f3494fc5187466

    Download Submit

  • C:\D3_08.exe
    Filesize

    160KB

    MD5

    29ea75488f249d270e91a512ec4c3530

    SHA1

    6c7854dd88168187b39659dba81ccda8692e9a41

    SHA256

    d4048a50688c7a7eb8e0bbc3068755b38fd3aaf0d8536c27f8a86c3f13da849a

    SHA512

    bce88f998c37b194b1d5b391c15cc79415c35d7a3171cfd80b5d3e5865748fa70a9e9bd122df3c994e1c63ac8dca64363ebe0d45662ec9fa7449a9a0983bd4ff

    Download Submit

  • C:\PuRn4m4.txt
    Filesize

    441B

    MD5

    de8b6c4c740b3046924d844032767852

    SHA1

    256842ccefd03f97013f51ec8bd25f842acec59a

    SHA256

    c8cfecfb4260f0488e4152cdaaca8854865f0e20d15e9e37cba26f81db38c195

    SHA512

    a08b0e866da0dbf21dae68deccd826e0a376695088c27fcddea444d01a8ca0f5cf01d282b9f2d9a4183e2503f7d2d7c850c722bd7976050b79c56feb70c6de29

    Download Submit

  • C:\PuRn4m4.txt
    Filesize

    441B

    MD5

    de8b6c4c740b3046924d844032767852

    SHA1

    256842ccefd03f97013f51ec8bd25f842acec59a

    SHA256

    c8cfecfb4260f0488e4152cdaaca8854865f0e20d15e9e37cba26f81db38c195

    SHA512

    a08b0e866da0dbf21dae68deccd826e0a376695088c27fcddea444d01a8ca0f5cf01d282b9f2d9a4183e2503f7d2d7c850c722bd7976050b79c56feb70c6de29

    Download Submit

  • C:\PuRn4m4.txt
    Filesize

    441B

    MD5

    de8b6c4c740b3046924d844032767852

    SHA1

    256842ccefd03f97013f51ec8bd25f842acec59a

    SHA256

    c8cfecfb4260f0488e4152cdaaca8854865f0e20d15e9e37cba26f81db38c195

    SHA512

    a08b0e866da0dbf21dae68deccd826e0a376695088c27fcddea444d01a8ca0f5cf01d282b9f2d9a4183e2503f7d2d7c850c722bd7976050b79c56feb70c6de29

    Download Submit

  • C:\PuRn4m4.txt
    Filesize

    441B

    MD5

    de8b6c4c740b3046924d844032767852

    SHA1

    256842ccefd03f97013f51ec8bd25f842acec59a

    SHA256

    c8cfecfb4260f0488e4152cdaaca8854865f0e20d15e9e37cba26f81db38c195

    SHA512

    a08b0e866da0dbf21dae68deccd826e0a376695088c27fcddea444d01a8ca0f5cf01d282b9f2d9a4183e2503f7d2d7c850c722bd7976050b79c56feb70c6de29

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
    Filesize

    160KB

    MD5

    5ab236c1fa2a066fc95d9ecc51877549

    SHA1

    a04892dfadc5b8c5b42c019e7a14c3eb6e7f33da

    SHA256

    0bc715fbaeaecb54a2dc8ad18796bd5b7a48f50daf8f94842a3048a2bb0000a8

    SHA512

    8bed42e13a02c9d7bdba40469605c7cb7e82342950fc3e3c438ce74ee9e109cb60988fa89eac627c82d2c3b467dc2c71161f52f9eb44840cc1f3494fc5187466

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
    Filesize

    160KB

    MD5

    718fb77923a31333c5646e515e1210a1

    SHA1

    8379ea345b416b848a6c3b91a23a24849a59c922

    SHA256

    836efa3f85480ab5b5632cacc39f324bb349f0c52d97da131c61b4b02fa35ea8

    SHA512

    f02ad1237777f7f836fb7d65f7797ae20a8f06165e1c8b92eab54b87b5abaa552efa6f1f98fbc223945fe91d952df7b1f16cfb54e5d33b36aebe60ba54a18266

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
    Filesize

    160KB

    MD5

    b5b175eecdb5da3081e92bb20ad63ac2

    SHA1

    db9627fb7e95ce5fa51038a72e48f5789ddd66e5

    SHA256

    66b388e614e5f754e18b5f0ff1d1f06ae0583d7683aca7a6781804a3479a4631

    SHA512

    09df28c4c48be45259d7fb4308e37b974ed285bd0517dbae44903cd27cb7d21192fc9a63b4f8733e73454b824f6ef796c6818bc8cfdcbe3d1f896d1140903ac4

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
    Filesize

    160KB

    MD5

    29ea75488f249d270e91a512ec4c3530

    SHA1

    6c7854dd88168187b39659dba81ccda8692e9a41

    SHA256

    d4048a50688c7a7eb8e0bbc3068755b38fd3aaf0d8536c27f8a86c3f13da849a

    SHA512

    bce88f998c37b194b1d5b391c15cc79415c35d7a3171cfd80b5d3e5865748fa70a9e9bd122df3c994e1c63ac8dca64363ebe0d45662ec9fa7449a9a0983bd4ff

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
    Filesize

    160KB

    MD5

    4a99ee77956437c0a451a057c88aa5b3

    SHA1

    4c88c92450d0af8b0ed781e28c2134e0d215c4ac

    SHA256

    bfe5937b81f0fddb8bcee1cdbbd90658cd738df6d27e95498bb795f4e117ef7f

    SHA512

    58ecadcdcc1acf5b56c30951a1a36dc433971807b2a4496dc7cde650273ed8d19fe483bcf82e5010a783c66517d66b7236d05d27fa63e08dd595aa270854f29a

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
    Filesize

    160KB

    MD5

    4a99ee77956437c0a451a057c88aa5b3

    SHA1

    4c88c92450d0af8b0ed781e28c2134e0d215c4ac

    SHA256

    bfe5937b81f0fddb8bcee1cdbbd90658cd738df6d27e95498bb795f4e117ef7f

    SHA512

    58ecadcdcc1acf5b56c30951a1a36dc433971807b2a4496dc7cde650273ed8d19fe483bcf82e5010a783c66517d66b7236d05d27fa63e08dd595aa270854f29a

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
    Filesize

    160KB

    MD5

    5ab236c1fa2a066fc95d9ecc51877549

    SHA1

    a04892dfadc5b8c5b42c019e7a14c3eb6e7f33da

    SHA256

    0bc715fbaeaecb54a2dc8ad18796bd5b7a48f50daf8f94842a3048a2bb0000a8

    SHA512

    8bed42e13a02c9d7bdba40469605c7cb7e82342950fc3e3c438ce74ee9e109cb60988fa89eac627c82d2c3b467dc2c71161f52f9eb44840cc1f3494fc5187466

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.exe
    Filesize

    160KB

    MD5

    718fb77923a31333c5646e515e1210a1

    SHA1

    8379ea345b416b848a6c3b91a23a24849a59c922

    SHA256

    836efa3f85480ab5b5632cacc39f324bb349f0c52d97da131c61b4b02fa35ea8

    SHA512

    f02ad1237777f7f836fb7d65f7797ae20a8f06165e1c8b92eab54b87b5abaa552efa6f1f98fbc223945fe91d952df7b1f16cfb54e5d33b36aebe60ba54a18266

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    Filesize

    160KB

    MD5

    b5b175eecdb5da3081e92bb20ad63ac2

    SHA1

    db9627fb7e95ce5fa51038a72e48f5789ddd66e5

    SHA256

    66b388e614e5f754e18b5f0ff1d1f06ae0583d7683aca7a6781804a3479a4631

    SHA512

    09df28c4c48be45259d7fb4308e37b974ed285bd0517dbae44903cd27cb7d21192fc9a63b4f8733e73454b824f6ef796c6818bc8cfdcbe3d1f896d1140903ac4

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
    Filesize

    160KB

    MD5

    29ea75488f249d270e91a512ec4c3530

    SHA1

    6c7854dd88168187b39659dba81ccda8692e9a41

    SHA256

    d4048a50688c7a7eb8e0bbc3068755b38fd3aaf0d8536c27f8a86c3f13da849a

    SHA512

    bce88f998c37b194b1d5b391c15cc79415c35d7a3171cfd80b5d3e5865748fa70a9e9bd122df3c994e1c63ac8dca64363ebe0d45662ec9fa7449a9a0983bd4ff

    Download Submit

  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    Filesize

    160KB

    MD5

    4a99ee77956437c0a451a057c88aa5b3

    SHA1

    4c88c92450d0af8b0ed781e28c2134e0d215c4ac

    SHA256

    bfe5937b81f0fddb8bcee1cdbbd90658cd738df6d27e95498bb795f4e117ef7f

    SHA512

    58ecadcdcc1acf5b56c30951a1a36dc433971807b2a4496dc7cde650273ed8d19fe483bcf82e5010a783c66517d66b7236d05d27fa63e08dd595aa270854f29a

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    160KB

    MD5

    b3f55db28664875f5e8a1ce323713d4f

    SHA1

    710ecad5b0884126975702ccef4bf62a4cf0b176

    SHA256

    029a8b23c5cec1f47cbfa1f515d7a4d61161036e4f8901c5bd02454380f01801

    SHA512

    120c7782245257bfa9fb52e77ad97ec4a0792d415ff813dafcd7f8effdaea7282911b1b89d00a37cdf9e9828bc199da1c7f9b132e40d6309dc835dadf4ae02df

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    160KB

    MD5

    2cb4f8b51609ef960e00f5483f0793cb

    SHA1

    9fec60af5524ede30e52bfd9f87de46d5a37ae15

    SHA256

    5b29469a20574ca2fea5d8d0d6e0ab8109eb99df94204ae4c729e3a9fc43fa30

    SHA512

    f32c31d7fdfaa53248a95984b170c45200b8b2d7d56ebe865a6c372c778d7941fbc6c8594532071e162237321cd45b6edba5c6a18a0fe5ccf24162e073c78b93

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    160KB

    MD5

    4a99ee77956437c0a451a057c88aa5b3

    SHA1

    4c88c92450d0af8b0ed781e28c2134e0d215c4ac

    SHA256

    bfe5937b81f0fddb8bcee1cdbbd90658cd738df6d27e95498bb795f4e117ef7f

    SHA512

    58ecadcdcc1acf5b56c30951a1a36dc433971807b2a4496dc7cde650273ed8d19fe483bcf82e5010a783c66517d66b7236d05d27fa63e08dd595aa270854f29a

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    160KB

    MD5

    5ab236c1fa2a066fc95d9ecc51877549

    SHA1

    a04892dfadc5b8c5b42c019e7a14c3eb6e7f33da

    SHA256

    0bc715fbaeaecb54a2dc8ad18796bd5b7a48f50daf8f94842a3048a2bb0000a8

    SHA512

    8bed42e13a02c9d7bdba40469605c7cb7e82342950fc3e3c438ce74ee9e109cb60988fa89eac627c82d2c3b467dc2c71161f52f9eb44840cc1f3494fc5187466

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    160KB

    MD5

    29ea75488f249d270e91a512ec4c3530

    SHA1

    6c7854dd88168187b39659dba81ccda8692e9a41

    SHA256

    d4048a50688c7a7eb8e0bbc3068755b38fd3aaf0d8536c27f8a86c3f13da849a

    SHA512

    bce88f998c37b194b1d5b391c15cc79415c35d7a3171cfd80b5d3e5865748fa70a9e9bd122df3c994e1c63ac8dca64363ebe0d45662ec9fa7449a9a0983bd4ff

    Download Submit

  • C:\Windows\D3_08.exe
    Filesize

    160KB

    MD5

    b3f55db28664875f5e8a1ce323713d4f

    SHA1

    710ecad5b0884126975702ccef4bf62a4cf0b176

    SHA256

    029a8b23c5cec1f47cbfa1f515d7a4d61161036e4f8901c5bd02454380f01801

    SHA512

    120c7782245257bfa9fb52e77ad97ec4a0792d415ff813dafcd7f8effdaea7282911b1b89d00a37cdf9e9828bc199da1c7f9b132e40d6309dc835dadf4ae02df

    Download Submit

  • C:\Windows\D3_08.exe
    Filesize

    160KB

    MD5

    b3f55db28664875f5e8a1ce323713d4f

    SHA1

    710ecad5b0884126975702ccef4bf62a4cf0b176

    SHA256

    029a8b23c5cec1f47cbfa1f515d7a4d61161036e4f8901c5bd02454380f01801

    SHA512

    120c7782245257bfa9fb52e77ad97ec4a0792d415ff813dafcd7f8effdaea7282911b1b89d00a37cdf9e9828bc199da1c7f9b132e40d6309dc835dadf4ae02df

    Download Submit

  • C:\Windows\D3_08.exe
    Filesize

    160KB

    MD5

    b3f55db28664875f5e8a1ce323713d4f

    SHA1

    710ecad5b0884126975702ccef4bf62a4cf0b176

    SHA256

    029a8b23c5cec1f47cbfa1f515d7a4d61161036e4f8901c5bd02454380f01801

    SHA512

    120c7782245257bfa9fb52e77ad97ec4a0792d415ff813dafcd7f8effdaea7282911b1b89d00a37cdf9e9828bc199da1c7f9b132e40d6309dc835dadf4ae02df

    Download Submit

  • C:\Windows\D3_08.exe
    Filesize

    160KB

    MD5

    b3f55db28664875f5e8a1ce323713d4f

    SHA1

    710ecad5b0884126975702ccef4bf62a4cf0b176

    SHA256

    029a8b23c5cec1f47cbfa1f515d7a4d61161036e4f8901c5bd02454380f01801

    SHA512

    120c7782245257bfa9fb52e77ad97ec4a0792d415ff813dafcd7f8effdaea7282911b1b89d00a37cdf9e9828bc199da1c7f9b132e40d6309dc835dadf4ae02df

    Download Submit

  • C:\Windows\D3_08.exe
    Filesize

    160KB

    MD5

    b3f55db28664875f5e8a1ce323713d4f

    SHA1

    710ecad5b0884126975702ccef4bf62a4cf0b176

    SHA256

    029a8b23c5cec1f47cbfa1f515d7a4d61161036e4f8901c5bd02454380f01801

    SHA512

    120c7782245257bfa9fb52e77ad97ec4a0792d415ff813dafcd7f8effdaea7282911b1b89d00a37cdf9e9828bc199da1c7f9b132e40d6309dc835dadf4ae02df

    Download Submit

  • C:\Windows\D3_08.exe
    Filesize

    160KB

    MD5

    b3f55db28664875f5e8a1ce323713d4f

    SHA1

    710ecad5b0884126975702ccef4bf62a4cf0b176

    SHA256

    029a8b23c5cec1f47cbfa1f515d7a4d61161036e4f8901c5bd02454380f01801

    SHA512

    120c7782245257bfa9fb52e77ad97ec4a0792d415ff813dafcd7f8effdaea7282911b1b89d00a37cdf9e9828bc199da1c7f9b132e40d6309dc835dadf4ae02df

    Download Submit

  • C:\Windows\D3_08.exe
    Filesize

    160KB

    MD5

    b3f55db28664875f5e8a1ce323713d4f

    SHA1

    710ecad5b0884126975702ccef4bf62a4cf0b176

    SHA256

    029a8b23c5cec1f47cbfa1f515d7a4d61161036e4f8901c5bd02454380f01801

    SHA512

    120c7782245257bfa9fb52e77ad97ec4a0792d415ff813dafcd7f8effdaea7282911b1b89d00a37cdf9e9828bc199da1c7f9b132e40d6309dc835dadf4ae02df

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\IExplorer.exe
    Filesize

    160KB

    MD5

    b35d122cace73127f5d7aa8b4c6eedee

    SHA1

    0ab187bc200591531145fa5190408cb5c97f22c4

    SHA256

    a66930c84048421fef391c8ce773fe64a5bad3bc887c34b6e8f11b7b0dcb13a7

    SHA512

    139a8444f7f8f07b5479202ee54be391483eed3c48cef37b9eaa61897bddb9fe65592a244e1d5277eb065a9c5b7d882760a073cc6df906010f93cdb9ea8418fd

    Download Submit

  • C:\Windows\SysWOW64\IExplorer.exe
    Filesize

    160KB

    MD5

    b35d122cace73127f5d7aa8b4c6eedee

    SHA1

    0ab187bc200591531145fa5190408cb5c97f22c4

    SHA256

    a66930c84048421fef391c8ce773fe64a5bad3bc887c34b6e8f11b7b0dcb13a7

    SHA512

    139a8444f7f8f07b5479202ee54be391483eed3c48cef37b9eaa61897bddb9fe65592a244e1d5277eb065a9c5b7d882760a073cc6df906010f93cdb9ea8418fd

    Download Submit

  • C:\Windows\SysWOW64\IExplorer.exe
    Filesize

    160KB

    MD5

    b35d122cace73127f5d7aa8b4c6eedee

    SHA1

    0ab187bc200591531145fa5190408cb5c97f22c4

    SHA256

    a66930c84048421fef391c8ce773fe64a5bad3bc887c34b6e8f11b7b0dcb13a7

    SHA512

    139a8444f7f8f07b5479202ee54be391483eed3c48cef37b9eaa61897bddb9fe65592a244e1d5277eb065a9c5b7d882760a073cc6df906010f93cdb9ea8418fd

    Download Submit

  • C:\Windows\SysWOW64\MrD3_08.scr
    Filesize

    160KB

    MD5

    b3f55db28664875f5e8a1ce323713d4f

    SHA1

    710ecad5b0884126975702ccef4bf62a4cf0b176

    SHA256

    029a8b23c5cec1f47cbfa1f515d7a4d61161036e4f8901c5bd02454380f01801

    SHA512

    120c7782245257bfa9fb52e77ad97ec4a0792d415ff813dafcd7f8effdaea7282911b1b89d00a37cdf9e9828bc199da1c7f9b132e40d6309dc835dadf4ae02df

    Download Submit

  • C:\Windows\SysWOW64\MrD3_08.scr
    Filesize

    160KB

    MD5

    82b70467a01b152fc36e501cfd718d87

    SHA1

    76aafc6b2563e16ef89455090921bf9dcb19ff14

    SHA256

    525d6a9ead9c0307a2616150d48111ca114bcf1cfb6bc70d36abb87235185668

    SHA512

    0b06e569a9e85ad9630310db3fbc05220edfee5b9703ac3ee36ce9c651199ddc255149f68823287035024c56e32472e7feab86c92228944641d3cc514e8f49c5

    Download Submit

  • C:\Windows\SysWOW64\MrD3_08.scr
    Filesize

    160KB

    MD5

    4a99ee77956437c0a451a057c88aa5b3

    SHA1

    4c88c92450d0af8b0ed781e28c2134e0d215c4ac

    SHA256

    bfe5937b81f0fddb8bcee1cdbbd90658cd738df6d27e95498bb795f4e117ef7f

    SHA512

    58ecadcdcc1acf5b56c30951a1a36dc433971807b2a4496dc7cde650273ed8d19fe483bcf82e5010a783c66517d66b7236d05d27fa63e08dd595aa270854f29a

    Download Submit

  • C:\Windows\SysWOW64\MrD3_08.scr
    Filesize

    160KB

    MD5

    5ab236c1fa2a066fc95d9ecc51877549

    SHA1

    a04892dfadc5b8c5b42c019e7a14c3eb6e7f33da

    SHA256

    0bc715fbaeaecb54a2dc8ad18796bd5b7a48f50daf8f94842a3048a2bb0000a8

    SHA512

    8bed42e13a02c9d7bdba40469605c7cb7e82342950fc3e3c438ce74ee9e109cb60988fa89eac627c82d2c3b467dc2c71161f52f9eb44840cc1f3494fc5187466

    Download Submit

  • C:\Windows\SysWOW64\MrD3_08.scr
    Filesize

    160KB

    MD5

    29ea75488f249d270e91a512ec4c3530

    SHA1

    6c7854dd88168187b39659dba81ccda8692e9a41

    SHA256

    d4048a50688c7a7eb8e0bbc3068755b38fd3aaf0d8536c27f8a86c3f13da849a

    SHA512

    bce88f998c37b194b1d5b391c15cc79415c35d7a3171cfd80b5d3e5865748fa70a9e9bd122df3c994e1c63ac8dca64363ebe0d45662ec9fa7449a9a0983bd4ff

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    160KB

    MD5

    b3f55db28664875f5e8a1ce323713d4f

    SHA1

    710ecad5b0884126975702ccef4bf62a4cf0b176

    SHA256

    029a8b23c5cec1f47cbfa1f515d7a4d61161036e4f8901c5bd02454380f01801

    SHA512

    120c7782245257bfa9fb52e77ad97ec4a0792d415ff813dafcd7f8effdaea7282911b1b89d00a37cdf9e9828bc199da1c7f9b132e40d6309dc835dadf4ae02df

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    160KB

    MD5

    83956a295dead85b09fda0774ce6e34a

    SHA1

    d422833e821fa22a11e1f8c42e0b8075fe94c542

    SHA256

    3f994caea686e8702214d2cf5b5669098df0683cb006d672198efa26b8cf2c05

    SHA512

    b029e8c70710bf989a4a6a993c700b43077f626024e27970527c2465ebcc74e10caf70b5ac9c8b3d02fcb1c71626a14c70b79919e35215769a9df209e0d5fe95

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    160KB

    MD5

    4a99ee77956437c0a451a057c88aa5b3

    SHA1

    4c88c92450d0af8b0ed781e28c2134e0d215c4ac

    SHA256

    bfe5937b81f0fddb8bcee1cdbbd90658cd738df6d27e95498bb795f4e117ef7f

    SHA512

    58ecadcdcc1acf5b56c30951a1a36dc433971807b2a4496dc7cde650273ed8d19fe483bcf82e5010a783c66517d66b7236d05d27fa63e08dd595aa270854f29a

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    160KB

    MD5

    5ab236c1fa2a066fc95d9ecc51877549

    SHA1

    a04892dfadc5b8c5b42c019e7a14c3eb6e7f33da

    SHA256

    0bc715fbaeaecb54a2dc8ad18796bd5b7a48f50daf8f94842a3048a2bb0000a8

    SHA512

    8bed42e13a02c9d7bdba40469605c7cb7e82342950fc3e3c438ce74ee9e109cb60988fa89eac627c82d2c3b467dc2c71161f52f9eb44840cc1f3494fc5187466

    Download Submit

  • C:\Windows\SysWOW64\shell.exe
    Filesize

    160KB

    MD5

    29ea75488f249d270e91a512ec4c3530

    SHA1

    6c7854dd88168187b39659dba81ccda8692e9a41

    SHA256

    d4048a50688c7a7eb8e0bbc3068755b38fd3aaf0d8536c27f8a86c3f13da849a

    SHA512

    bce88f998c37b194b1d5b391c15cc79415c35d7a3171cfd80b5d3e5865748fa70a9e9bd122df3c994e1c63ac8dca64363ebe0d45662ec9fa7449a9a0983bd4ff

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
    Filesize

    160KB

    MD5

    5ab236c1fa2a066fc95d9ecc51877549

    SHA1

    a04892dfadc5b8c5b42c019e7a14c3eb6e7f33da

    SHA256

    0bc715fbaeaecb54a2dc8ad18796bd5b7a48f50daf8f94842a3048a2bb0000a8

    SHA512

    8bed42e13a02c9d7bdba40469605c7cb7e82342950fc3e3c438ce74ee9e109cb60988fa89eac627c82d2c3b467dc2c71161f52f9eb44840cc1f3494fc5187466

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
    Filesize

    160KB

    MD5

    5ab236c1fa2a066fc95d9ecc51877549

    SHA1

    a04892dfadc5b8c5b42c019e7a14c3eb6e7f33da

    SHA256

    0bc715fbaeaecb54a2dc8ad18796bd5b7a48f50daf8f94842a3048a2bb0000a8

    SHA512

    8bed42e13a02c9d7bdba40469605c7cb7e82342950fc3e3c438ce74ee9e109cb60988fa89eac627c82d2c3b467dc2c71161f52f9eb44840cc1f3494fc5187466

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
    Filesize

    160KB

    MD5

    718fb77923a31333c5646e515e1210a1

    SHA1

    8379ea345b416b848a6c3b91a23a24849a59c922

    SHA256

    836efa3f85480ab5b5632cacc39f324bb349f0c52d97da131c61b4b02fa35ea8

    SHA512

    f02ad1237777f7f836fb7d65f7797ae20a8f06165e1c8b92eab54b87b5abaa552efa6f1f98fbc223945fe91d952df7b1f16cfb54e5d33b36aebe60ba54a18266

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
    Filesize

    160KB

    MD5

    718fb77923a31333c5646e515e1210a1

    SHA1

    8379ea345b416b848a6c3b91a23a24849a59c922

    SHA256

    836efa3f85480ab5b5632cacc39f324bb349f0c52d97da131c61b4b02fa35ea8

    SHA512

    f02ad1237777f7f836fb7d65f7797ae20a8f06165e1c8b92eab54b87b5abaa552efa6f1f98fbc223945fe91d952df7b1f16cfb54e5d33b36aebe60ba54a18266

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
    Filesize

    160KB

    MD5

    b5b175eecdb5da3081e92bb20ad63ac2

    SHA1

    db9627fb7e95ce5fa51038a72e48f5789ddd66e5

    SHA256

    66b388e614e5f754e18b5f0ff1d1f06ae0583d7683aca7a6781804a3479a4631

    SHA512

    09df28c4c48be45259d7fb4308e37b974ed285bd0517dbae44903cd27cb7d21192fc9a63b4f8733e73454b824f6ef796c6818bc8cfdcbe3d1f896d1140903ac4

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
    Filesize

    160KB

    MD5

    b5b175eecdb5da3081e92bb20ad63ac2

    SHA1

    db9627fb7e95ce5fa51038a72e48f5789ddd66e5

    SHA256

    66b388e614e5f754e18b5f0ff1d1f06ae0583d7683aca7a6781804a3479a4631

    SHA512

    09df28c4c48be45259d7fb4308e37b974ed285bd0517dbae44903cd27cb7d21192fc9a63b4f8733e73454b824f6ef796c6818bc8cfdcbe3d1f896d1140903ac4

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
    Filesize

    160KB

    MD5

    29ea75488f249d270e91a512ec4c3530

    SHA1

    6c7854dd88168187b39659dba81ccda8692e9a41

    SHA256

    d4048a50688c7a7eb8e0bbc3068755b38fd3aaf0d8536c27f8a86c3f13da849a

    SHA512

    bce88f998c37b194b1d5b391c15cc79415c35d7a3171cfd80b5d3e5865748fa70a9e9bd122df3c994e1c63ac8dca64363ebe0d45662ec9fa7449a9a0983bd4ff

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
    Filesize

    160KB

    MD5

    29ea75488f249d270e91a512ec4c3530

    SHA1

    6c7854dd88168187b39659dba81ccda8692e9a41

    SHA256

    d4048a50688c7a7eb8e0bbc3068755b38fd3aaf0d8536c27f8a86c3f13da849a

    SHA512

    bce88f998c37b194b1d5b391c15cc79415c35d7a3171cfd80b5d3e5865748fa70a9e9bd122df3c994e1c63ac8dca64363ebe0d45662ec9fa7449a9a0983bd4ff

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
    Filesize

    160KB

    MD5

    4a99ee77956437c0a451a057c88aa5b3

    SHA1

    4c88c92450d0af8b0ed781e28c2134e0d215c4ac

    SHA256

    bfe5937b81f0fddb8bcee1cdbbd90658cd738df6d27e95498bb795f4e117ef7f

    SHA512

    58ecadcdcc1acf5b56c30951a1a36dc433971807b2a4496dc7cde650273ed8d19fe483bcf82e5010a783c66517d66b7236d05d27fa63e08dd595aa270854f29a

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
    Filesize

    160KB

    MD5

    4a99ee77956437c0a451a057c88aa5b3

    SHA1

    4c88c92450d0af8b0ed781e28c2134e0d215c4ac

    SHA256

    bfe5937b81f0fddb8bcee1cdbbd90658cd738df6d27e95498bb795f4e117ef7f

    SHA512

    58ecadcdcc1acf5b56c30951a1a36dc433971807b2a4496dc7cde650273ed8d19fe483bcf82e5010a783c66517d66b7236d05d27fa63e08dd595aa270854f29a

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
    Filesize

    160KB

    MD5

    4a99ee77956437c0a451a057c88aa5b3

    SHA1

    4c88c92450d0af8b0ed781e28c2134e0d215c4ac

    SHA256

    bfe5937b81f0fddb8bcee1cdbbd90658cd738df6d27e95498bb795f4e117ef7f

    SHA512

    58ecadcdcc1acf5b56c30951a1a36dc433971807b2a4496dc7cde650273ed8d19fe483bcf82e5010a783c66517d66b7236d05d27fa63e08dd595aa270854f29a

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
    Filesize

    160KB

    MD5

    4a99ee77956437c0a451a057c88aa5b3

    SHA1

    4c88c92450d0af8b0ed781e28c2134e0d215c4ac

    SHA256

    bfe5937b81f0fddb8bcee1cdbbd90658cd738df6d27e95498bb795f4e117ef7f

    SHA512

    58ecadcdcc1acf5b56c30951a1a36dc433971807b2a4496dc7cde650273ed8d19fe483bcf82e5010a783c66517d66b7236d05d27fa63e08dd595aa270854f29a

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    160KB

    MD5

    b35d122cace73127f5d7aa8b4c6eedee

    SHA1

    0ab187bc200591531145fa5190408cb5c97f22c4

    SHA256

    a66930c84048421fef391c8ce773fe64a5bad3bc887c34b6e8f11b7b0dcb13a7

    SHA512

    139a8444f7f8f07b5479202ee54be391483eed3c48cef37b9eaa61897bddb9fe65592a244e1d5277eb065a9c5b7d882760a073cc6df906010f93cdb9ea8418fd

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    160KB

    MD5

    b35d122cace73127f5d7aa8b4c6eedee

    SHA1

    0ab187bc200591531145fa5190408cb5c97f22c4

    SHA256

    a66930c84048421fef391c8ce773fe64a5bad3bc887c34b6e8f11b7b0dcb13a7

    SHA512

    139a8444f7f8f07b5479202ee54be391483eed3c48cef37b9eaa61897bddb9fe65592a244e1d5277eb065a9c5b7d882760a073cc6df906010f93cdb9ea8418fd

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    160KB

    MD5

    b35d122cace73127f5d7aa8b4c6eedee

    SHA1

    0ab187bc200591531145fa5190408cb5c97f22c4

    SHA256

    a66930c84048421fef391c8ce773fe64a5bad3bc887c34b6e8f11b7b0dcb13a7

    SHA512

    139a8444f7f8f07b5479202ee54be391483eed3c48cef37b9eaa61897bddb9fe65592a244e1d5277eb065a9c5b7d882760a073cc6df906010f93cdb9ea8418fd

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    160KB

    MD5

    b35d122cace73127f5d7aa8b4c6eedee

    SHA1

    0ab187bc200591531145fa5190408cb5c97f22c4

    SHA256

    a66930c84048421fef391c8ce773fe64a5bad3bc887c34b6e8f11b7b0dcb13a7

    SHA512

    139a8444f7f8f07b5479202ee54be391483eed3c48cef37b9eaa61897bddb9fe65592a244e1d5277eb065a9c5b7d882760a073cc6df906010f93cdb9ea8418fd

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    160KB

    MD5

    b35d122cace73127f5d7aa8b4c6eedee

    SHA1

    0ab187bc200591531145fa5190408cb5c97f22c4

    SHA256

    a66930c84048421fef391c8ce773fe64a5bad3bc887c34b6e8f11b7b0dcb13a7

    SHA512

    139a8444f7f8f07b5479202ee54be391483eed3c48cef37b9eaa61897bddb9fe65592a244e1d5277eb065a9c5b7d882760a073cc6df906010f93cdb9ea8418fd

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    160KB

    MD5

    b35d122cace73127f5d7aa8b4c6eedee

    SHA1

    0ab187bc200591531145fa5190408cb5c97f22c4

    SHA256

    a66930c84048421fef391c8ce773fe64a5bad3bc887c34b6e8f11b7b0dcb13a7

    SHA512

    139a8444f7f8f07b5479202ee54be391483eed3c48cef37b9eaa61897bddb9fe65592a244e1d5277eb065a9c5b7d882760a073cc6df906010f93cdb9ea8418fd

    Download Submit

  • memory/1304-56-0x00000000762E1000-0x00000000762E3000-memory.dmp

    Filesize

    8KB

    Download