3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce

Analysis

max time kernel
151s
max time network
189s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe
Size

548KB
MD5

7433061971233a4134cbac454a2f736c
SHA1

2e2dc1d3f18df33b30d3d85633da142d48c51a84
SHA256

3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce
SHA512

3d26dc69dc7133c7f2ad0088fb6f077382543e52bf3193e7995058dfecb5a1f19906ac5cb3b9624760d5e74b7e30add055c1a269045b7f9d3d54cc0414502e4a
SSDEEP

12288:WbEtWoMZfaFtuKo5qKMnLYuyqnzN+y1kz1LxCOAwst:yloUf+o5qJnV9+y1IXs

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\0b1aca41\\X"	Explorer.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jyCd5od0b9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jiupuap.exe

Executes dropped EXE 11 IoCs

pid	Process
276	jyCd5od0b9.exe
1680	jiupuap.exe
468	2aag.exe
940	2aag.exe
1812	2aag.exe
1804	2aag.exe
240	2aag.exe
560	2aag.exe
1660	3aag.exe
332	csrss.exe
876	X

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/940-83-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/940-84-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/940-85-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1812-89-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1812-91-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1812-92-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1804-96-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1804-98-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1804-99-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1812-106-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1812-110-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1804-113-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/940-112-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/940-108-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1804-115-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/1812-117-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/1804-120-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/240-111-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/240-114-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/240-107-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/240-124-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/240-125-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/240-126-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/940-167-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/1804-168-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral1/memory/240-169-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral1/memory/940-170-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1488	cmd.exe

Loads dropped DLL 10 IoCs

pid	Process
1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe
1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe
276	jyCd5od0b9.exe
276	jyCd5od0b9.exe
1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe
1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe
1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe
1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe
1660	3aag.exe
1660	3aag.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	31.193.3.240
Destination IP	31.193.3.240
Destination IP	31.193.3.240
Destination IP	31.193.3.240
Destination IP	31.193.3.240

Adds Run key to start application 2 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /M"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /e"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /L"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /x"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /U"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /T"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /O"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /G"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /V"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /y"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /u"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /g"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /r"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /s"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /Z"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /P"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /J"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /d"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /m"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /R"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /j"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /A"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /B"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /C"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /O"	jyCd5od0b9.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /E"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /v"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /z"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /w"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /K"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /c"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /h"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /q"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /n"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /I"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /k"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /b"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /a"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /W"	jiupuap.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	jyCd5od0b9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /Y"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /H"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /D"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /o"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /S"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /F"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /Q"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /X"	jiupuap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jiupuap = "C:\\Users\\Admin\\jiupuap.exe /f"	jiupuap.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2aag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	2aag.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 468 set thread context of 940	468	2aag.exe	32
PID 468 set thread context of 1812	468	2aag.exe	33
PID 468 set thread context of 1804	468	2aag.exe	34
PID 468 set thread context of 240	468	2aag.exe	35
PID 468 set thread context of 560	468	2aag.exe	37
PID 1660 set thread context of 1568	1660	3aag.exe	44

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
976	tasklist.exe
1416	tasklist.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{7c04e45a-7eff-1ae5-5f05-3a4f471ab8fb}	3aag.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7c04e45a-7eff-1ae5-5f05-3a4f471ab8fb}\u = "188"	3aag.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7c04e45a-7eff-1ae5-5f05-3a4f471ab8fb}\cid = "10805872581593912355"	3aag.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
276	jyCd5od0b9.exe
276	jyCd5od0b9.exe
1812	2aag.exe
1804	2aag.exe
1812	2aag.exe
1812	2aag.exe
1812	2aag.exe
1812	2aag.exe
1812	2aag.exe
1680	jiupuap.exe
1812	2aag.exe
1812	2aag.exe
1680	jiupuap.exe
1680	jiupuap.exe
1660	3aag.exe
1660	3aag.exe
1660	3aag.exe
1680	jiupuap.exe
1812	2aag.exe
1812	2aag.exe
1812	2aag.exe
1660	3aag.exe
1680	jiupuap.exe
876	X
1812	2aag.exe
1804	2aag.exe
1812	2aag.exe
1680	jiupuap.exe
1680	jiupuap.exe
1812	2aag.exe
1680	jiupuap.exe
1812	2aag.exe
1812	2aag.exe
1680	jiupuap.exe
1812	2aag.exe
1680	jiupuap.exe
1812	2aag.exe
1680	jiupuap.exe
1812	2aag.exe
1812	2aag.exe
1680	jiupuap.exe
1812	2aag.exe
1812	2aag.exe
1680	jiupuap.exe
1680	jiupuap.exe
1812	2aag.exe
1680	jiupuap.exe
1812	2aag.exe
1812	2aag.exe
1680	jiupuap.exe
1812	2aag.exe
1812	2aag.exe
1680	jiupuap.exe
1680	jiupuap.exe
1680	jiupuap.exe
1812	2aag.exe
1812	2aag.exe
1812	2aag.exe
1812	2aag.exe
1680	jiupuap.exe
1812	2aag.exe
1812	2aag.exe
1812	2aag.exe
1680	jiupuap.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	tasklist.exe
Token: SeDebugPrivilege	1660	3aag.exe
Token: SeDebugPrivilege	1660	3aag.exe
Token: SeDebugPrivilege	1416	tasklist.exe
Token: SeShutdownPrivilege	1212	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe
276	jyCd5od0b9.exe
1680	jiupuap.exe
468	2aag.exe
940	2aag.exe
240	2aag.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 276	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	28
PID 1428 wrote to memory of 276	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	28
PID 1428 wrote to memory of 276	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	28
PID 1428 wrote to memory of 276	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	28
PID 276 wrote to memory of 1680	276	jyCd5od0b9.exe	29
PID 276 wrote to memory of 1680	276	jyCd5od0b9.exe	29
PID 276 wrote to memory of 1680	276	jyCd5od0b9.exe	29
PID 276 wrote to memory of 1680	276	jyCd5od0b9.exe	29
PID 1428 wrote to memory of 468	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	31
PID 1428 wrote to memory of 468	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	31
PID 1428 wrote to memory of 468	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	31
PID 1428 wrote to memory of 468	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	31
PID 468 wrote to memory of 940	468	2aag.exe	32
PID 468 wrote to memory of 940	468	2aag.exe	32
PID 468 wrote to memory of 940	468	2aag.exe	32
PID 468 wrote to memory of 940	468	2aag.exe	32
PID 276 wrote to memory of 1176	276	jyCd5od0b9.exe	30
PID 276 wrote to memory of 1176	276	jyCd5od0b9.exe	30
PID 276 wrote to memory of 1176	276	jyCd5od0b9.exe	30
PID 276 wrote to memory of 1176	276	jyCd5od0b9.exe	30
PID 468 wrote to memory of 940	468	2aag.exe	32
PID 468 wrote to memory of 940	468	2aag.exe	32
PID 468 wrote to memory of 940	468	2aag.exe	32
PID 468 wrote to memory of 940	468	2aag.exe	32
PID 468 wrote to memory of 1812	468	2aag.exe	33
PID 468 wrote to memory of 1812	468	2aag.exe	33
PID 468 wrote to memory of 1812	468	2aag.exe	33
PID 468 wrote to memory of 1812	468	2aag.exe	33
PID 468 wrote to memory of 1812	468	2aag.exe	33
PID 468 wrote to memory of 1812	468	2aag.exe	33
PID 468 wrote to memory of 1812	468	2aag.exe	33
PID 468 wrote to memory of 1812	468	2aag.exe	33
PID 468 wrote to memory of 1804	468	2aag.exe	34
PID 468 wrote to memory of 1804	468	2aag.exe	34
PID 468 wrote to memory of 1804	468	2aag.exe	34
PID 468 wrote to memory of 1804	468	2aag.exe	34
PID 468 wrote to memory of 1804	468	2aag.exe	34
PID 468 wrote to memory of 1804	468	2aag.exe	34
PID 468 wrote to memory of 1804	468	2aag.exe	34
PID 468 wrote to memory of 1804	468	2aag.exe	34
PID 468 wrote to memory of 240	468	2aag.exe	35
PID 468 wrote to memory of 240	468	2aag.exe	35
PID 468 wrote to memory of 240	468	2aag.exe	35
PID 468 wrote to memory of 240	468	2aag.exe	35
PID 468 wrote to memory of 240	468	2aag.exe	35
PID 468 wrote to memory of 240	468	2aag.exe	35
PID 468 wrote to memory of 240	468	2aag.exe	35
PID 468 wrote to memory of 240	468	2aag.exe	35
PID 468 wrote to memory of 560	468	2aag.exe	37
PID 468 wrote to memory of 560	468	2aag.exe	37
PID 468 wrote to memory of 560	468	2aag.exe	37
PID 468 wrote to memory of 560	468	2aag.exe	37
PID 468 wrote to memory of 560	468	2aag.exe	37
PID 1176 wrote to memory of 976	1176	cmd.exe	38
PID 1176 wrote to memory of 976	1176	cmd.exe	38
PID 1176 wrote to memory of 976	1176	cmd.exe	38
PID 1176 wrote to memory of 976	1176	cmd.exe	38
PID 1428 wrote to memory of 1660	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	41
PID 1428 wrote to memory of 1660	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	41
PID 1428 wrote to memory of 1660	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	41
PID 1428 wrote to memory of 1660	1428	3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe	41
PID 1660 wrote to memory of 1212	1660	3aag.exe	12
PID 1660 wrote to memory of 332	1660	3aag.exe	26
PID 1660 wrote to memory of 876	1660	3aag.exe	42

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies WinLogon for persistence
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1212
- C:\Users\Admin\AppData\Local\Temp\3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe
  "C:\Users\Admin\AppData\Local\Temp\3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Users\Admin\jyCd5od0b9.exe
    C:\Users\Admin\jyCd5od0b9.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:276
  - - C:\Users\Admin\jiupuap.exe
      "C:\Users\Admin\jiupuap.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1680
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del jyCd5od0b9.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:976
- - C:\Users\Admin\2aag.exe
    C:\Users\Admin\2aag.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Users\Admin\2aag.exe
      "C:\Users\Admin\2aag.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
  - - C:\Users\Admin\2aag.exe
      "C:\Users\Admin\2aag.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1812
  - - C:\Users\Admin\2aag.exe
      "C:\Users\Admin\2aag.exe"
      4⤵
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      PID:1804
  - - C:\Users\Admin\2aag.exe
      "C:\Users\Admin\2aag.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:240
  - - C:\Users\Admin\2aag.exe
      "C:\Users\Admin\2aag.exe"
      4⤵
      Executes dropped EXE
      PID:560
- - C:\Users\Admin\3aag.exe
    C:\Users\Admin\3aag.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Users\Admin\AppData\Local\0b1aca41\X
      *0*bc*6a09d423*31.193.3.240:53
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:876
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del 3b117713fb73f1a6f2a44ac1087d78e3501e9c301aa4b69346dbc2b9664a24ce.exe
    3⤵
    - Deletes itself
    PID:1488
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:332

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\2aag.exe

Filesize
128KB

MD5
2b4ee5d4acacc3528ba7c3a58bd29c41

SHA1
81b91ba52c39da729feecf26c02798b981662448

SHA256
78c58e327fb0dbc782ba27eabb7ba2765c20d9ac44df3460e6059d0c97c0ad12

SHA512
fde7b774c2853664c2d97baba56df64ce38c56104cd0c6f2702730f69c1db6f8b8e03856e125d92e1bc737dad2f9dd1f0f5cad565e5cd4cd093be93da8d8d965

Download Submit
C:\Users\Admin\2aag.exe

Filesize
128KB

MD5
2b4ee5d4acacc3528ba7c3a58bd29c41

SHA1
81b91ba52c39da729feecf26c02798b981662448

SHA256
78c58e327fb0dbc782ba27eabb7ba2765c20d9ac44df3460e6059d0c97c0ad12

SHA512
fde7b774c2853664c2d97baba56df64ce38c56104cd0c6f2702730f69c1db6f8b8e03856e125d92e1bc737dad2f9dd1f0f5cad565e5cd4cd093be93da8d8d965

Download Submit
C:\Users\Admin\2aag.exe

Filesize
128KB

MD5
2b4ee5d4acacc3528ba7c3a58bd29c41

SHA1
81b91ba52c39da729feecf26c02798b981662448

SHA256
78c58e327fb0dbc782ba27eabb7ba2765c20d9ac44df3460e6059d0c97c0ad12

SHA512
fde7b774c2853664c2d97baba56df64ce38c56104cd0c6f2702730f69c1db6f8b8e03856e125d92e1bc737dad2f9dd1f0f5cad565e5cd4cd093be93da8d8d965

Download Submit
C:\Users\Admin\2aag.exe

Filesize
128KB

MD5
2b4ee5d4acacc3528ba7c3a58bd29c41

SHA1
81b91ba52c39da729feecf26c02798b981662448

SHA256
78c58e327fb0dbc782ba27eabb7ba2765c20d9ac44df3460e6059d0c97c0ad12

SHA512
fde7b774c2853664c2d97baba56df64ce38c56104cd0c6f2702730f69c1db6f8b8e03856e125d92e1bc737dad2f9dd1f0f5cad565e5cd4cd093be93da8d8d965

Download Submit
C:\Users\Admin\2aag.exe

Filesize
128KB

MD5
2b4ee5d4acacc3528ba7c3a58bd29c41

SHA1
81b91ba52c39da729feecf26c02798b981662448

SHA256
78c58e327fb0dbc782ba27eabb7ba2765c20d9ac44df3460e6059d0c97c0ad12

SHA512
fde7b774c2853664c2d97baba56df64ce38c56104cd0c6f2702730f69c1db6f8b8e03856e125d92e1bc737dad2f9dd1f0f5cad565e5cd4cd093be93da8d8d965

Download Submit
C:\Users\Admin\2aag.exe

Filesize
128KB

MD5
2b4ee5d4acacc3528ba7c3a58bd29c41

SHA1
81b91ba52c39da729feecf26c02798b981662448

SHA256
78c58e327fb0dbc782ba27eabb7ba2765c20d9ac44df3460e6059d0c97c0ad12

SHA512
fde7b774c2853664c2d97baba56df64ce38c56104cd0c6f2702730f69c1db6f8b8e03856e125d92e1bc737dad2f9dd1f0f5cad565e5cd4cd093be93da8d8d965

Download Submit
C:\Users\Admin\2aag.exe

Filesize
128KB

MD5
2b4ee5d4acacc3528ba7c3a58bd29c41

SHA1
81b91ba52c39da729feecf26c02798b981662448

SHA256
78c58e327fb0dbc782ba27eabb7ba2765c20d9ac44df3460e6059d0c97c0ad12

SHA512
fde7b774c2853664c2d97baba56df64ce38c56104cd0c6f2702730f69c1db6f8b8e03856e125d92e1bc737dad2f9dd1f0f5cad565e5cd4cd093be93da8d8d965

Download Submit
C:\Users\Admin\3aag.exe

Filesize
286KB

MD5
cb278b7760c080ea4f57aea471f0f674

SHA1
2c052b2db7a196d127c2b84b62563d0c98ec0413

SHA256
74cb6a456be0e9bad997e8c97475c47ab27c40d3627484f7b38a86bd01c78930

SHA512
dbdf6a95b53a53f3a3dd929e0b1d63d512c00e9d28bf2f05c3e63707f0208f4f311adc637bb97a9d05bdb6bad9d6c7021aeec8c99ffe7033212e7763d4046bd3

Download Submit
C:\Users\Admin\3aag.exe

Filesize
286KB

MD5
cb278b7760c080ea4f57aea471f0f674

SHA1
2c052b2db7a196d127c2b84b62563d0c98ec0413

SHA256
74cb6a456be0e9bad997e8c97475c47ab27c40d3627484f7b38a86bd01c78930

SHA512
dbdf6a95b53a53f3a3dd929e0b1d63d512c00e9d28bf2f05c3e63707f0208f4f311adc637bb97a9d05bdb6bad9d6c7021aeec8c99ffe7033212e7763d4046bd3

Download Submit
C:\Users\Admin\AppData\Local\0b1aca41\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
C:\Users\Admin\jiupuap.exe

Filesize
260KB

MD5
590abda3a15f76d75fb0da6906f57ccd

SHA1
98ec0509bfe1eeb6561d587ecf29a595322aee39

SHA256
4b2bf9bf78de283e4ee0c4822eda75ffa283cc411c4bbe06cf7218a040025150

SHA512
a23c6524c8e6855671dbe78c37baebdb42cfb599ffbd208b26d80f8119d7c3c298ed18e10d1cfbab120b51ae9687a473a542c02b7af5320d78acfea9bb64e090

Download Submit
C:\Users\Admin\jiupuap.exe

Filesize
260KB

MD5
590abda3a15f76d75fb0da6906f57ccd

SHA1
98ec0509bfe1eeb6561d587ecf29a595322aee39

SHA256
4b2bf9bf78de283e4ee0c4822eda75ffa283cc411c4bbe06cf7218a040025150

SHA512
a23c6524c8e6855671dbe78c37baebdb42cfb599ffbd208b26d80f8119d7c3c298ed18e10d1cfbab120b51ae9687a473a542c02b7af5320d78acfea9bb64e090

Download Submit
C:\Users\Admin\jyCd5od0b9.exe

Filesize
260KB

MD5
b0c9b92f068e2ac7770334e56e0c5017

SHA1
4d73d45c04e4e8af4fa81403d812fac1b94a75c0

SHA256
6a1fbc078e3b75354607179c7af71cdc80e40d5a787929fe9d174998a7b75888

SHA512
0d08f35abc9363db287449953a23d69f49bb11a2755378b82b66acba07f2588acce85a2f0f9c7a1fbdc7e049507ff5293e9ec33fc8cc847c860c80bb39c8c26a

Download Submit
C:\Users\Admin\jyCd5od0b9.exe

Filesize
260KB

MD5
b0c9b92f068e2ac7770334e56e0c5017

SHA1
4d73d45c04e4e8af4fa81403d812fac1b94a75c0

SHA256
6a1fbc078e3b75354607179c7af71cdc80e40d5a787929fe9d174998a7b75888

SHA512
0d08f35abc9363db287449953a23d69f49bb11a2755378b82b66acba07f2588acce85a2f0f9c7a1fbdc7e049507ff5293e9ec33fc8cc847c860c80bb39c8c26a

Download Submit
C:\Windows\system32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\Users\Admin\2aag.exe

Filesize
128KB

MD5
2b4ee5d4acacc3528ba7c3a58bd29c41

SHA1
81b91ba52c39da729feecf26c02798b981662448

SHA256
78c58e327fb0dbc782ba27eabb7ba2765c20d9ac44df3460e6059d0c97c0ad12

SHA512
fde7b774c2853664c2d97baba56df64ce38c56104cd0c6f2702730f69c1db6f8b8e03856e125d92e1bc737dad2f9dd1f0f5cad565e5cd4cd093be93da8d8d965

Download Submit
\Users\Admin\2aag.exe

Filesize
128KB

MD5
2b4ee5d4acacc3528ba7c3a58bd29c41

SHA1
81b91ba52c39da729feecf26c02798b981662448

SHA256
78c58e327fb0dbc782ba27eabb7ba2765c20d9ac44df3460e6059d0c97c0ad12

SHA512
fde7b774c2853664c2d97baba56df64ce38c56104cd0c6f2702730f69c1db6f8b8e03856e125d92e1bc737dad2f9dd1f0f5cad565e5cd4cd093be93da8d8d965

Download Submit
\Users\Admin\3aag.exe

Filesize
286KB

MD5
cb278b7760c080ea4f57aea471f0f674

SHA1
2c052b2db7a196d127c2b84b62563d0c98ec0413

SHA256
74cb6a456be0e9bad997e8c97475c47ab27c40d3627484f7b38a86bd01c78930

SHA512
dbdf6a95b53a53f3a3dd929e0b1d63d512c00e9d28bf2f05c3e63707f0208f4f311adc637bb97a9d05bdb6bad9d6c7021aeec8c99ffe7033212e7763d4046bd3

Download Submit
\Users\Admin\3aag.exe

Filesize
286KB

MD5
cb278b7760c080ea4f57aea471f0f674

SHA1
2c052b2db7a196d127c2b84b62563d0c98ec0413

SHA256
74cb6a456be0e9bad997e8c97475c47ab27c40d3627484f7b38a86bd01c78930

SHA512
dbdf6a95b53a53f3a3dd929e0b1d63d512c00e9d28bf2f05c3e63707f0208f4f311adc637bb97a9d05bdb6bad9d6c7021aeec8c99ffe7033212e7763d4046bd3

Download Submit
\Users\Admin\AppData\Local\0b1aca41\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\Users\Admin\AppData\Local\0b1aca41\X

Filesize
38KB

MD5
72de2dadaf875e2fd7614e100419033c

SHA1
5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

SHA256
c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

SHA512
e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

Download Submit
\Users\Admin\jiupuap.exe

Filesize
260KB

MD5
590abda3a15f76d75fb0da6906f57ccd

SHA1
98ec0509bfe1eeb6561d587ecf29a595322aee39

SHA256
4b2bf9bf78de283e4ee0c4822eda75ffa283cc411c4bbe06cf7218a040025150

SHA512
a23c6524c8e6855671dbe78c37baebdb42cfb599ffbd208b26d80f8119d7c3c298ed18e10d1cfbab120b51ae9687a473a542c02b7af5320d78acfea9bb64e090

Download Submit
\Users\Admin\jiupuap.exe

Filesize
260KB

MD5
590abda3a15f76d75fb0da6906f57ccd

SHA1
98ec0509bfe1eeb6561d587ecf29a595322aee39

SHA256
4b2bf9bf78de283e4ee0c4822eda75ffa283cc411c4bbe06cf7218a040025150

SHA512
a23c6524c8e6855671dbe78c37baebdb42cfb599ffbd208b26d80f8119d7c3c298ed18e10d1cfbab120b51ae9687a473a542c02b7af5320d78acfea9bb64e090

Download Submit
\Users\Admin\jyCd5od0b9.exe

Filesize
260KB

MD5
b0c9b92f068e2ac7770334e56e0c5017

SHA1
4d73d45c04e4e8af4fa81403d812fac1b94a75c0

SHA256
6a1fbc078e3b75354607179c7af71cdc80e40d5a787929fe9d174998a7b75888

SHA512
0d08f35abc9363db287449953a23d69f49bb11a2755378b82b66acba07f2588acce85a2f0f9c7a1fbdc7e049507ff5293e9ec33fc8cc847c860c80bb39c8c26a

Download Submit
\Users\Admin\jyCd5od0b9.exe

Filesize
260KB

MD5
b0c9b92f068e2ac7770334e56e0c5017

SHA1
4d73d45c04e4e8af4fa81403d812fac1b94a75c0

SHA256
6a1fbc078e3b75354607179c7af71cdc80e40d5a787929fe9d174998a7b75888

SHA512
0d08f35abc9363db287449953a23d69f49bb11a2755378b82b66acba07f2588acce85a2f0f9c7a1fbdc7e049507ff5293e9ec33fc8cc847c860c80bb39c8c26a

Download Submit
\Windows\System32\consrv.dll

Filesize
29KB

MD5
1149c1bd71248a9d170e4568fb08df30

SHA1
6f77f183d65709901f476c5d6eebaed060a495f9

SHA256
c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

SHA512
9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
0aea8f4a7e1249d8371b302cfeee61bc

SHA1
d6b56649e7cfeb4f5e99d8b02f647d3829eb6bfb

SHA256
e16f78b590bc5107fca8d426de5f638974bd11d492d98e28ce5c1f732bc8558c

SHA512
5c120746c4596f4a978d81d08dcc729c8dd847d3a0db0a65dbf082139b0e462360367ac796199e75b2777d13034cb87cd4d3d653be211af1180cab763552cb75

Download Submit
memory/240-111-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/240-126-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/240-125-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/240-124-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/240-169-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/240-107-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/240-114-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/332-164-0x0000000000A90000-0x0000000000A9B000-memory.dmp

Filesize
44KB

Download
memory/940-108-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/940-84-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/940-81-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/940-112-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/940-167-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/940-170-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/940-85-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/940-83-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1212-166-0x0000000002230000-0x000000000223B000-memory.dmp

Filesize
44KB

Download
memory/1212-155-0x0000000002220000-0x000000000222B000-memory.dmp

Filesize
44KB

Download
memory/1212-173-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/1212-165-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/1212-159-0x0000000002220000-0x000000000222B000-memory.dmp

Filesize
44KB

Download
memory/1212-148-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1212-144-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1212-140-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1212-163-0x0000000002220000-0x000000000222B000-memory.dmp

Filesize
44KB

Download
memory/1428-56-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1660-138-0x0000000030670000-0x00000000306C2000-memory.dmp

Filesize
328KB

Download
memory/1660-176-0x0000000030670000-0x00000000306C2000-memory.dmp

Filesize
328KB

Download
memory/1660-172-0x000000000065C000-0x0000000000693000-memory.dmp

Filesize
220KB

Download
memory/1660-171-0x0000000030670000-0x00000000306C2000-memory.dmp

Filesize
328KB

Download
memory/1660-139-0x000000000065C000-0x0000000000693000-memory.dmp

Filesize
220KB

Download
memory/1660-177-0x000000000065C000-0x0000000000693000-memory.dmp

Filesize
220KB

Download
memory/1804-98-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1804-115-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1804-113-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1804-120-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1804-168-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1804-99-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1804-96-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1804-95-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1812-106-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1812-110-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1812-92-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1812-117-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1812-91-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1812-89-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1812-88-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download