hawkeye | 3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

Analysis

max time kernel
152s
max time network
122s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
Size

689KB
MD5

8b5ffdaa14fcd0ef04739be00e6a1a1e
SHA1

90405e319f18a427a35bf1943a5d3de4773ed9ac
SHA256

3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27
SHA512

9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55
SSDEEP

12288:Ym1/fFLmbJR9Y980FP5z7FziTLUXkKa4X0DA:zmbiP5dkU0A

Score

10^/10

hawkeye keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.mail.ru
Port:
587
Username:
[email protected]
Password:
general123

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

NirSoft WebBrowserPassView 52 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1312-60-0x0000000000400000-0x000000000046C000-memory.dmp	WebBrowserPassView
behavioral1/memory/1312-61-0x0000000000400000-0x000000000046C000-memory.dmp	WebBrowserPassView
behavioral1/memory/1312-62-0x0000000000400000-0x000000000046C000-memory.dmp	WebBrowserPassView
behavioral1/memory/1312-63-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1312-65-0x0000000000400000-0x000000000046C000-memory.dmp	WebBrowserPassView
behavioral1/memory/1312-67-0x0000000000400000-0x000000000046C000-memory.dmp	WebBrowserPassView
behavioral1/memory/552-77-0x0000000000442628-mapping.dmp	WebBrowserPassView
behavioral1/memory/552-76-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/552-80-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/552-82-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/552-90-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/552-91-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/1648-104-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/572-120-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1568-134-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1948-149-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/932-163-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/864-178-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1100-197-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1520-212-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1552-226-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/688-241-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/888-255-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1764-274-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1540-293-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1908-307-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1532-326-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1600-340-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/820-354-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1748-369-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1896-383-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1240-397-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1000-411-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/828-425-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1212-439-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1768-453-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/460-467-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/112-481-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1792-495-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/964-514-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1856-533-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1620-547-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1008-561-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1784-575-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1112-589-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1900-603-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/2032-617-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/840-637-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1852-651-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1988-672-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1524-686-0x0000000000466A0E-mapping.dmp	WebBrowserPassView
behavioral1/memory/2068-700-0x0000000000466A0E-mapping.dmp	WebBrowserPassView

Nirsoft 52 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1312-60-0x0000000000400000-0x000000000046C000-memory.dmp	Nirsoft
behavioral1/memory/1312-61-0x0000000000400000-0x000000000046C000-memory.dmp	Nirsoft
behavioral1/memory/1312-62-0x0000000000400000-0x000000000046C000-memory.dmp	Nirsoft
behavioral1/memory/1312-63-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1312-65-0x0000000000400000-0x000000000046C000-memory.dmp	Nirsoft
behavioral1/memory/1312-67-0x0000000000400000-0x000000000046C000-memory.dmp	Nirsoft
behavioral1/memory/552-77-0x0000000000442628-mapping.dmp	Nirsoft
behavioral1/memory/552-76-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/552-80-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/552-82-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/552-90-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/552-91-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/1648-104-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/572-120-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1568-134-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1948-149-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/932-163-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/864-178-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1100-197-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1520-212-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1552-226-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/688-241-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/888-255-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1764-274-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1540-293-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1908-307-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1532-326-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1600-340-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/820-354-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1748-369-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1896-383-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1240-397-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1000-411-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/828-425-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1212-439-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1768-453-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/460-467-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/112-481-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1792-495-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/964-514-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1856-533-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1620-547-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1008-561-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1784-575-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1112-589-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1900-603-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/2032-617-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/840-637-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1852-651-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1988-672-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/1524-686-0x0000000000466A0E-mapping.dmp	Nirsoft
behavioral1/memory/2068-700-0x0000000000466A0E-mapping.dmp	Nirsoft

Executes dropped EXE 43 IoCs

Processes:

IpOverUsbSvrc.exeatiesrx.exeIpOverUsbSvrc.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exe

pid	process
1748	IpOverUsbSvrc.exe
544	atiesrx.exe
1308	IpOverUsbSvrc.exe
1648	atiesrx.exe
572	atiesrx.exe
1568	atiesrx.exe
1948	atiesrx.exe
932	atiesrx.exe
864	atiesrx.exe
1100	atiesrx.exe
1520	atiesrx.exe
1552	atiesrx.exe
688	atiesrx.exe
888	atiesrx.exe
1764	atiesrx.exe
1540	atiesrx.exe
1908	atiesrx.exe
1532	atiesrx.exe
1600	atiesrx.exe
820	atiesrx.exe
1748	atiesrx.exe
1896	atiesrx.exe
1240	atiesrx.exe
1000	atiesrx.exe
828	atiesrx.exe
1212	atiesrx.exe
1768	atiesrx.exe
460	atiesrx.exe
112	atiesrx.exe
1792	atiesrx.exe
964	atiesrx.exe
1856	atiesrx.exe
1620	atiesrx.exe
1008	atiesrx.exe
1784	atiesrx.exe
1112	atiesrx.exe
1900	atiesrx.exe
2032	atiesrx.exe
840	atiesrx.exe
1852	atiesrx.exe
1988	atiesrx.exe
1524	atiesrx.exe
2068	atiesrx.exe

Loads dropped DLL 2 IoCs

Processes:

3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exeIpOverUsbSvrc.exe

pid process

1780 3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1748 IpOverUsbSvrc.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

IpOverUsbSvrc.exeIpOverUsbSvrc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 whatismyipaddress.com
6 whatismyipaddress.com
7 whatismyipaddress.com

flow	ioc
4	whatismyipaddress.com
6	whatismyipaddress.com
7	whatismyipaddress.com

Suspicious use of SetThreadContext 42 IoCs

Processes:

3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exeatiesrx.exe

description	pid	process	target process
PID 1780 set thread context of 1312	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
PID 1312 set thread context of 552	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	vbc.exe
PID 544 set thread context of 1648	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 572	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1568	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1948	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 932	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 864	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1100	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1520	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1552	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 688	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 888	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1764	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1540	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1908	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1532	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1600	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 820	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1748	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1896	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1240	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1000	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 828	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1212	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1768	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 460	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 112	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1792	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 964	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1856	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1620	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1008	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1784	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1112	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1900	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 2032	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 840	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1852	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1988	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 1524	544	atiesrx.exe	atiesrx.exe
PID 544 set thread context of 2068	544	atiesrx.exe	atiesrx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exeIpOverUsbSvrc.exe

pid	process
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1748	IpOverUsbSvrc.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1748	IpOverUsbSvrc.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1748	IpOverUsbSvrc.exe
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exeIpOverUsbSvrc.exeatiesrx.exeIpOverUsbSvrc.exe

description	pid	process
Token: SeDebugPrivilege	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
Token: SeDebugPrivilege	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
Token: SeDebugPrivilege	1748	IpOverUsbSvrc.exe
Token: SeDebugPrivilege	544	atiesrx.exe
Token: SeDebugPrivilege	1308	IpOverUsbSvrc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe

pid process

1312 3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe

pid	process
1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exeIpOverUsbSvrc.exeatiesrx.exe

description	pid	process	target process
PID 1780 wrote to memory of 1312	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
PID 1780 wrote to memory of 1312	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
PID 1780 wrote to memory of 1312	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
PID 1780 wrote to memory of 1312	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
PID 1780 wrote to memory of 1312	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
PID 1780 wrote to memory of 1312	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
PID 1780 wrote to memory of 1312	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
PID 1780 wrote to memory of 1312	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
PID 1780 wrote to memory of 1312	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
PID 1780 wrote to memory of 1748	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	IpOverUsbSvrc.exe
PID 1780 wrote to memory of 1748	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	IpOverUsbSvrc.exe
PID 1780 wrote to memory of 1748	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	IpOverUsbSvrc.exe
PID 1780 wrote to memory of 1748	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	IpOverUsbSvrc.exe
PID 1312 wrote to memory of 552	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	vbc.exe
PID 1312 wrote to memory of 552	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	vbc.exe
PID 1312 wrote to memory of 552	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	vbc.exe
PID 1312 wrote to memory of 552	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	vbc.exe
PID 1312 wrote to memory of 552	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	vbc.exe
PID 1312 wrote to memory of 552	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	vbc.exe
PID 1312 wrote to memory of 552	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	vbc.exe
PID 1312 wrote to memory of 552	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	vbc.exe
PID 1312 wrote to memory of 552	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	vbc.exe
PID 1312 wrote to memory of 552	1312	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	vbc.exe
PID 1748 wrote to memory of 544	1748	IpOverUsbSvrc.exe	atiesrx.exe
PID 1748 wrote to memory of 544	1748	IpOverUsbSvrc.exe	atiesrx.exe
PID 1748 wrote to memory of 544	1748	IpOverUsbSvrc.exe	atiesrx.exe
PID 1748 wrote to memory of 544	1748	IpOverUsbSvrc.exe	atiesrx.exe
PID 1780 wrote to memory of 1308	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	IpOverUsbSvrc.exe
PID 1780 wrote to memory of 1308	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	IpOverUsbSvrc.exe
PID 1780 wrote to memory of 1308	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	IpOverUsbSvrc.exe
PID 1780 wrote to memory of 1308	1780	3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe	IpOverUsbSvrc.exe
PID 544 wrote to memory of 1648	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1648	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1648	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1648	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1648	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1648	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1648	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1648	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1648	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 572	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 572	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 572	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 572	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 572	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 572	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 572	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 572	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 572	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1568	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1568	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1568	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1568	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1568	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1568	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1568	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1568	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1568	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1948	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1948	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1948	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1948	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1948	544	atiesrx.exe	atiesrx.exe
PID 544 wrote to memory of 1948	544	atiesrx.exe	atiesrx.exe

C:\Users\Admin\AppData\Local\Temp\3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
"C:\Users\Admin\AppData\Local\Temp\3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780

C:\Users\Admin\AppData\Local\Temp\3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe
"C:\Users\Admin\AppData\Local\Temp\3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
3⤵
PID:552

C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1648

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:572

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1568

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1948

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:932

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:864

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1100

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1520

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1552

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:688

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:888

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1764

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1540

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1908

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1532

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1600

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:820

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1748

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1896

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1240

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1000

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:828

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1212

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1768

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:460

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:112

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1792

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:964

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1856

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1620

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1008

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1784

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1112

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1900

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2032

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:840

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1852

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1988

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1524

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2068

C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe

Filesize
7KB

MD5
75e2b1e76cfa816dc39afe47a71bf1e6

SHA1
8684430c09c4d7e3ef7e9fe9d25c9e4cf6fc39bf

SHA256
96f866ee12f737f05c398bba493049ba11a433dc4a1f7bc6bc697cd15ec21042

SHA512
6ddb18eaf80bc49fc561ab7bc8a0308444b79f440f6ca08f9c901e29dd55362c3206f239866654ff0bc0fb3c92d9fce64b1d7ebf287f6ee775b4a91fd702fb5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe

Filesize
7KB

MD5
75e2b1e76cfa816dc39afe47a71bf1e6

SHA1
8684430c09c4d7e3ef7e9fe9d25c9e4cf6fc39bf

SHA256
96f866ee12f737f05c398bba493049ba11a433dc4a1f7bc6bc697cd15ec21042

SHA512
6ddb18eaf80bc49fc561ab7bc8a0308444b79f440f6ca08f9c901e29dd55362c3206f239866654ff0bc0fb3c92d9fce64b1d7ebf287f6ee775b4a91fd702fb5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe

Filesize
7KB

MD5
75e2b1e76cfa816dc39afe47a71bf1e6

SHA1
8684430c09c4d7e3ef7e9fe9d25c9e4cf6fc39bf

SHA256
96f866ee12f737f05c398bba493049ba11a433dc4a1f7bc6bc697cd15ec21042

SHA512
6ddb18eaf80bc49fc561ab7bc8a0308444b79f440f6ca08f9c901e29dd55362c3206f239866654ff0bc0fb3c92d9fce64b1d7ebf287f6ee775b4a91fd702fb5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe

Filesize
7KB

MD5
75e2b1e76cfa816dc39afe47a71bf1e6

SHA1
8684430c09c4d7e3ef7e9fe9d25c9e4cf6fc39bf

SHA256
96f866ee12f737f05c398bba493049ba11a433dc4a1f7bc6bc697cd15ec21042

SHA512
6ddb18eaf80bc49fc561ab7bc8a0308444b79f440f6ca08f9c901e29dd55362c3206f239866654ff0bc0fb3c92d9fce64b1d7ebf287f6ee775b4a91fd702fb5b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe

Filesize
689KB

MD5
8b5ffdaa14fcd0ef04739be00e6a1a1e

SHA1
90405e319f18a427a35bf1943a5d3de4773ed9ac

SHA256
3e9fd762c062c02d7ad19b78824798891ff3d5de18d5f3702729ced46d213d27

SHA512
9b657fb6fee157f8ac8f2739cfc600e70d5cc9ad8f240ef16901dc57f944e41d14be24e2be583f14fadaca538409fa8bc305766d0f61499bb0e2a5bff7141b55

Download Submit
memory/112-488-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/112-481-0x0000000000466A0E-mapping.dmp

Download
memory/460-467-0x0000000000466A0E-mapping.dmp

Download
memory/460-474-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/544-86-0x0000000000000000-mapping.dmp

Download
memory/544-89-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/544-93-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/552-76-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/552-80-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/552-82-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/552-90-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/552-77-0x0000000000442628-mapping.dmp

Download
memory/552-91-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/572-120-0x0000000000466A0E-mapping.dmp

Download
memory/572-127-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/688-248-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/688-241-0x0000000000466A0E-mapping.dmp

Download
memory/820-362-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/820-361-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/820-354-0x0000000000466A0E-mapping.dmp

Download
memory/828-432-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/828-425-0x0000000000466A0E-mapping.dmp

Download
memory/840-637-0x0000000000466A0E-mapping.dmp

Download
memory/840-644-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/864-190-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/864-178-0x0000000000466A0E-mapping.dmp

Download
memory/888-255-0x0000000000466A0E-mapping.dmp

Download
memory/888-267-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/932-163-0x0000000000466A0E-mapping.dmp

Download
memory/932-170-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/932-171-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/964-514-0x0000000000466A0E-mapping.dmp

Download
memory/964-526-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1000-411-0x0000000000466A0E-mapping.dmp

Download
memory/1000-418-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1000-656-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1008-568-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1008-561-0x0000000000466A0E-mapping.dmp

Download
memory/1100-197-0x0000000000466A0E-mapping.dmp

Download
memory/1100-205-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1100-204-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1112-589-0x0000000000466A0E-mapping.dmp

Download
memory/1112-596-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1212-446-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1212-657-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1212-439-0x0000000000466A0E-mapping.dmp

Download
memory/1240-397-0x0000000000466A0E-mapping.dmp

Download
memory/1240-404-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1308-233-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1308-111-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1308-95-0x0000000000000000-mapping.dmp

Download
memory/1312-61-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1312-57-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1312-60-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1312-67-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1312-62-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1312-58-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1312-81-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1312-63-0x0000000000466A0E-mapping.dmp

Download
memory/1312-65-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1312-69-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1520-219-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1520-212-0x0000000000466A0E-mapping.dmp

Download
memory/1524-693-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1524-686-0x0000000000466A0E-mapping.dmp

Download
memory/1532-326-0x0000000000466A0E-mapping.dmp

Download
memory/1532-333-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1540-293-0x0000000000466A0E-mapping.dmp

Download
memory/1540-300-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1552-234-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1552-226-0x0000000000466A0E-mapping.dmp

Download
memory/1568-142-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1568-141-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1568-134-0x0000000000466A0E-mapping.dmp

Download
memory/1600-347-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1600-340-0x0000000000466A0E-mapping.dmp

Download
memory/1620-547-0x0000000000466A0E-mapping.dmp

Download
memory/1620-554-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1648-104-0x0000000000466A0E-mapping.dmp

Download
memory/1648-112-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1648-113-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1748-83-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1748-75-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1748-71-0x0000000000000000-mapping.dmp

Download
memory/1748-94-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1748-369-0x0000000000466A0E-mapping.dmp

Download
memory/1748-376-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1764-286-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1764-274-0x0000000000466A0E-mapping.dmp

Download
memory/1768-460-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1768-453-0x0000000000466A0E-mapping.dmp

Download
memory/1780-54-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/1780-55-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1780-56-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1784-582-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1784-575-0x0000000000466A0E-mapping.dmp

Download
memory/1792-495-0x0000000000466A0E-mapping.dmp

Download
memory/1792-507-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1852-665-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1852-651-0x0000000000466A0E-mapping.dmp

Download
memory/1856-533-0x0000000000466A0E-mapping.dmp

Download
memory/1856-540-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1896-383-0x0000000000466A0E-mapping.dmp

Download
memory/1896-390-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1900-610-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1900-603-0x0000000000466A0E-mapping.dmp

Download
memory/1908-307-0x0000000000466A0E-mapping.dmp

Download
memory/1908-319-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1948-149-0x0000000000466A0E-mapping.dmp

Download
memory/1948-156-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1988-679-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/1988-672-0x0000000000466A0E-mapping.dmp

Download
memory/2032-630-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/2032-629-0x0000000074C50000-0x00000000751FB000-memory.dmp

Filesize
5.7MB

Download
memory/2032-617-0x0000000000466A0E-mapping.dmp

Download
memory/2068-700-0x0000000000466A0E-mapping.dmp

Download