e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44

Analysis

max time kernel
194s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
Size

357KB
MD5

02ea20642c0087fb590956b1e7bb3e00
SHA1

0dbda87c39bbe0b8285177f97b26054e711f9bda
SHA256

e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44
SHA512

037ae198479289dc9f483384d4b9f7acbf3a73daeb20bf241f740a248a3f7e32fec2cf821af7fc312f2d02cc233874b8e319b0d5972a31a3a6cb54903cde7ea9
SSDEEP

6144:wLvXqAa7qdWHTfzj8So9ycK5aRTr+CKS09Omjb7iNV94kiMKTT:ga7MCgTyCKS2jKNVekBw

Score

9^/10

evasion persistence trojan upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\SysWOW64\com\netcfg.dll	acprotect
C:\Windows\SysWOW64\Com\netcfg.dll	acprotect
C:\Windows\SysWOW64\dnsq.dll	acprotect
C:\Windows\SysWOW64\dnsq.dll	acprotect
C:\Windows\SysWOW64\dnsq.dll	acprotect

Drops file in Drivers directory 1 IoCs

Processes:

lsass.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts lsass.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	lsass.exe

Executes dropped EXE 5 IoCs

Processes:

e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.loglsass.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exelsass.exesmss.exe

pid	process
4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
4368	lsass.exe
1780	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
1784	lsass.exe
1236	smss.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

lsass.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	lsass.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3472-132-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/3472-134-0x0000000000400000-0x000000000042C000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	upx
\??\c:\users\admin\appdata\local\temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	upx
behavioral2/memory/4220-141-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/3472-148-0x0000000000400000-0x000000000042C000-memory.dmp	upx
C:\Windows\SysWOW64\Com\lsass.exe	upx
C:\Windows\SysWOW64\com\lsass.exe	upx
behavioral2/memory/4368-153-0x0000000000400000-0x000000000042C000-memory.dmp	upx
C:\Windows\SysWOW64\Com\lsass.exe	upx
behavioral2/memory/4220-158-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/1784-160-0x0000000000400000-0x000000000042C000-memory.dmp	upx
behavioral2/memory/4368-171-0x0000000000400000-0x000000000042C000-memory.dmp	upx
C:\Windows\SysWOW64\com\netcfg.dll	upx
C:\Windows\SysWOW64\Com\netcfg.dll	upx
behavioral2/memory/4980-174-0x0000000010000000-0x0000000010010000-memory.dmp	upx
C:\Windows\SysWOW64\dnsq.dll	upx
behavioral2/memory/4368-176-0x0000000010000000-0x0000000010019000-memory.dmp	upx
C:\Windows\SysWOW64\dnsq.dll	upx
C:\Windows\SysWOW64\dnsq.dll	upx
behavioral2/memory/1236-182-0x0000000010000000-0x0000000010019000-memory.dmp	upx
behavioral2/memory/4368-184-0x0000000010000000-0x0000000010019000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.loglsass.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exelsass.exesmss.exe

pid process

4980 regsvr32.exe
4368 lsass.exe
1236 smss.exe

pid	process
4980	regsvr32.exe
4368	lsass.exe
1236	smss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe

Checks for any installed AV software in registry 1 TTPs 3 IoCs

Security Software Discovery

T1063

Processes:

e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.loglsass.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	lsass.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

lsass.exelsass.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log

Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

lsass.exe

description ioc process

File opened (read-only) \??\E: lsass.exe
File opened (read-only) \??\f: lsass.exe

description	ioc	process
File opened (read-only)	\??\E:	lsass.exe
File opened (read-only)	\??\f:	lsass.exe

Drops autorun.inf file 1 TTPs 7 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

lsass.exe

description	ioc	process
File opened for modification	\??\E:\AUTORUN.INF	lsass.exe
File opened for modification	C:\autorun.inf	lsass.exe
File opened for modification	D:\autorun.inf	lsass.exe
File opened for modification	\??\E:\autorun.inf	lsass.exe
File opened for modification	C:\AUTORUN.INF	lsass.exe
File created	C:\AUTORUN.INF	lsass.exe
File opened for modification	D:\AUTORUN.INF	lsass.exe

Drops file in System32 directory 23 IoCs

Processes:

lsass.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.loge851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\com\netcfg.dll	lsass.exe
File created	C:\Windows\SysWOW64\com\netcfg.000	lsass.exe
File created	C:\Windows\SysWOW64\240611782.log	lsass.exe
File created	C:\Windows\SysWOW64\dnsq.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\dnsq.dll	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\com\lsass.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\smss.exe	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
File opened for modification	C:\Windows\SysWOW64\com\lsass.exe	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
File created	C:\Windows\SysWOW64\com\lsass.exe	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
File created	C:\Windows\SysWOW64\00302.log	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\lsass.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\smss.exe	lsass.exe
File created	C:\Windows\SysWOW64\com\netcfg.dll	lsass.exe
File created	C:\Windows\SysWOW64\com\lsass.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\240630204.log	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\bak	lsass.exe
File opened for modification	C:\Windows\SysWOW64\240611782.log	lsass.exe
File created	C:\Windows\SysWOW64\240630204.log	lsass.exe
File created	C:\Windows\SysWOW64\00302.log	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
File opened for modification	C:\Windows\SysWOW64\com\smss.exe	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
File created	C:\Windows\SysWOW64\com\smss.exe	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
File created	C:\Windows\SysWOW64\00302.log	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
File opened for modification	C:\Windows\SysWOW64\com\netcfg.000	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\ = "ifObj ActiveX Control module"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ = "_DIfObj"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ = "_DIfObj"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ProgID\ = "IFOBJ.IfObjCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\com"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\ = "IfObj Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\ = "IfObj Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ = "IfObj Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ = "_DIfObjEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ = "_DIfObjEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

ping.exe

pid process

3228 ping.exe

pid	process
3228	ping.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.loglsass.exe

pid	process
3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
4368	lsass.exe
4368	lsass.exe

Suspicious behavior: LoadsDriver 3 IoCs

Processes:

pid process

660
660
660

pid	process
660
660
660

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.loglsass.exe

description	pid	process
Token: SeDebugPrivilege	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
Token: SeDebugPrivilege	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
Token: SeDebugPrivilege	4368	lsass.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.loglsass.exelsass.exe

pid	process
3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
4368	lsass.exe
4368	lsass.exe
4368	lsass.exe
4368	lsass.exe
1784	lsass.exe
1784	lsass.exe
1784	lsass.exe
1784	lsass.exe
4368	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exee851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.loglsass.exe

description	pid	process	target process
PID 3472 wrote to memory of 1400	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	cmd.exe
PID 3472 wrote to memory of 1400	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	cmd.exe
PID 3472 wrote to memory of 1400	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	cmd.exe
PID 3472 wrote to memory of 1004	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	cacls.exe
PID 3472 wrote to memory of 1004	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	cacls.exe
PID 3472 wrote to memory of 1004	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	cacls.exe
PID 3472 wrote to memory of 2748	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	cacls.exe
PID 3472 wrote to memory of 2748	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	cacls.exe
PID 3472 wrote to memory of 2748	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	cacls.exe
PID 3472 wrote to memory of 4220	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
PID 3472 wrote to memory of 4220	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
PID 3472 wrote to memory of 4220	3472	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
PID 4220 wrote to memory of 228	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cmd.exe
PID 4220 wrote to memory of 228	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cmd.exe
PID 4220 wrote to memory of 228	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cmd.exe
PID 4220 wrote to memory of 4268	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 4268	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 4268	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 3856	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 3856	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 3856	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 4560	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 4560	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 4560	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 3660	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 3660	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 3660	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cacls.exe
PID 4220 wrote to memory of 4360	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cmd.exe
PID 4220 wrote to memory of 4360	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cmd.exe
PID 4220 wrote to memory of 4360	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cmd.exe
PID 4220 wrote to memory of 3160	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cmd.exe
PID 4220 wrote to memory of 3160	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cmd.exe
PID 4220 wrote to memory of 3160	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	cmd.exe
PID 4220 wrote to memory of 4368	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	lsass.exe
PID 4220 wrote to memory of 4368	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	lsass.exe
PID 4220 wrote to memory of 4368	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	lsass.exe
PID 4220 wrote to memory of 1780	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
PID 4220 wrote to memory of 1780	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
PID 4220 wrote to memory of 1780	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
PID 4220 wrote to memory of 1784	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	lsass.exe
PID 4220 wrote to memory of 1784	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	lsass.exe
PID 4220 wrote to memory of 1784	4220	e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log	lsass.exe
PID 4368 wrote to memory of 3700	4368	lsass.exe	cmd.exe
PID 4368 wrote to memory of 3700	4368	lsass.exe	cmd.exe
PID 4368 wrote to memory of 3700	4368	lsass.exe	cmd.exe
PID 4368 wrote to memory of 1776	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 1776	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 1776	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 3516	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 3516	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 3516	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 3732	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 3732	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 3732	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 1252	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 1252	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 1252	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 2196	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 2196	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 2196	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 2380	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 2380	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 2380	4368	lsass.exe	cacls.exe
PID 4368 wrote to memory of 4576	4368	lsass.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
"C:\Users\Admin\AppData\Local\Temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe"
1⤵
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c echo ok
2⤵
PID:1400

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F
2⤵
PID:1004

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F
2⤵
PID:2748

\??\c:\users\admin\appdata\local\temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
"c:\users\admin\appdata\local\temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log"
2⤵
- Executes dropped EXE
- Sets file execution options in registry
- Checks computer location settings
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c echo ok
3⤵
PID:228

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F
3⤵
PID:4268

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F
3⤵
PID:3856

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Admin:F
3⤵
PID:4560

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Everyone:F
3⤵
PID:3660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\com\smss.exe"
3⤵
PID:4360

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c del /F /Q "C:\Windows\system32\com\lsass.exe"
3⤵
PID:3160

C:\Windows\SysWOW64\com\lsass.exe
"C:\Windows\system32\com\lsass.exe"
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets file execution options in registry
- Checks computer location settings
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c echo ok
4⤵
PID:3700

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F
4⤵
PID:1776

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F
4⤵
PID:3516

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\lsass.exe /e /t /g Admin:F
4⤵
PID:3732

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\lsass.exe /e /t /g Everyone:F
4⤵
PID:1252

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Admin:F
4⤵
PID:2196

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Everyone:F
4⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\com\smss.exe"
4⤵
PID:4576

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\com\lsass.exe"
4⤵
PID:2024

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" C:\Windows\system32\com\netcfg.dll /s
4⤵
- Loads dropped DLL
- Modifies registry class
PID:4980

C:\Windows\SysWOW64\com\smss.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\~.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\dnsq.dll"
4⤵
PID:1140

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\com\bak"
4⤵
PID:4624

C:\Windows\SysWOW64\ping.exe
ping.exe -f -n 1 www.baidu.com
4⤵
- Runs ping.exe
PID:3228

C:\Users\Admin\appdata\local\temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
"C:\Users\Admin\appdata\local\temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe"
3⤵
- Executes dropped EXE
PID:1780

C:\Windows\SysWOW64\com\lsass.exe
^c:\users\admin\appdata\local\temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Security Software Discovery

T1063

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe
Filesize
173KB

MD5
b7bc2a558e1328f666988b22a1cc2a31

SHA1
5b34f85068d97ab3961aaff522fc4751b5c642a8

SHA256
856c78821e9b7f0c7ae35ba3d2641f2cdef6eeed2684a8450a394ecd05528620

SHA512
151c08fbab2929f3c9f7b66fc45f5830b31395fddd28a6fd46df368ac6e4bcc351e3a122a7dc5dd39531adb971668837963ae2739144a2ff853f576996756c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
Filesize
357KB

MD5
02ea20642c0087fb590956b1e7bb3e00

SHA1
0dbda87c39bbe0b8285177f97b26054e711f9bda

SHA256
e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44

SHA512
037ae198479289dc9f483384d4b9f7acbf3a73daeb20bf241f740a248a3f7e32fec2cf821af7fc312f2d02cc233874b8e319b0d5972a31a3a6cb54903cde7ea9

Download Submit
C:\Windows\SysWOW64\Com\lsass.exe
Filesize
92KB

MD5
028dc84a3c086d65be094e87b4fdf103

SHA1
90d8a581379ba836312bcc02e304a60455c79781

SHA256
fd4ae2a4d117abae6506523a10d1b0c39f21fdc1b40a415910ce448de83db04f

SHA512
4536d1b71d59b3f8a211a292d7d10bd1ede5e6d9ddaf6e84c8b9b8feadb4595e7a8bd6cd2f3bed7aea8bbbb5455370324a53ee89cfb6f396d524c26904f45fbc

Download Submit
C:\Windows\SysWOW64\Com\lsass.exe
Filesize
92KB

MD5
028dc84a3c086d65be094e87b4fdf103

SHA1
90d8a581379ba836312bcc02e304a60455c79781

SHA256
fd4ae2a4d117abae6506523a10d1b0c39f21fdc1b40a415910ce448de83db04f

SHA512
4536d1b71d59b3f8a211a292d7d10bd1ede5e6d9ddaf6e84c8b9b8feadb4595e7a8bd6cd2f3bed7aea8bbbb5455370324a53ee89cfb6f396d524c26904f45fbc

Download Submit
C:\Windows\SysWOW64\Com\netcfg.dll
Filesize
16KB

MD5
d1f6b9273cbb2e23aeed11346d0072c5

SHA1
0d012a7c7b37082dcbd5e1688f72eeade705f825

SHA256
dfb2d7cdc6ea056948d09fe139255af2dcc58f3581f4a50f4e5ee0f5a03c39fc

SHA512
4c3ab878131ad38a54d04cf0d268430ab98a67df474a18ee7858c62561d90ec14c34ed63dd973fdf24115ebf17ef65a6a9fc9ac612c247903e881e584dc3b77e

Download Submit
C:\Windows\SysWOW64\Com\smss.exe
Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
C:\Windows\SysWOW64\com\lsass.exe
Filesize
92KB

MD5
028dc84a3c086d65be094e87b4fdf103

SHA1
90d8a581379ba836312bcc02e304a60455c79781

SHA256
fd4ae2a4d117abae6506523a10d1b0c39f21fdc1b40a415910ce448de83db04f

SHA512
4536d1b71d59b3f8a211a292d7d10bd1ede5e6d9ddaf6e84c8b9b8feadb4595e7a8bd6cd2f3bed7aea8bbbb5455370324a53ee89cfb6f396d524c26904f45fbc

Download Submit
C:\Windows\SysWOW64\com\netcfg.dll
Filesize
16KB

MD5
d1f6b9273cbb2e23aeed11346d0072c5

SHA1
0d012a7c7b37082dcbd5e1688f72eeade705f825

SHA256
dfb2d7cdc6ea056948d09fe139255af2dcc58f3581f4a50f4e5ee0f5a03c39fc

SHA512
4c3ab878131ad38a54d04cf0d268430ab98a67df474a18ee7858c62561d90ec14c34ed63dd973fdf24115ebf17ef65a6a9fc9ac612c247903e881e584dc3b77e

Download Submit
C:\Windows\SysWOW64\com\smss.exe
Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
C:\Windows\SysWOW64\com\smss.exe
Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
C:\Windows\SysWOW64\com\smss.exe
Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
C:\Windows\SysWOW64\dnsq.dll
Filesize
31KB

MD5
f515bd3278588b6d58a316d059e2778f

SHA1
ae8d987f33930d305b9d60685549dcabefa8e932

SHA256
5c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310

SHA512
688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c

Download Submit
C:\Windows\SysWOW64\dnsq.dll
Filesize
31KB

MD5
f515bd3278588b6d58a316d059e2778f

SHA1
ae8d987f33930d305b9d60685549dcabefa8e932

SHA256
5c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310

SHA512
688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c

Download Submit
C:\Windows\SysWOW64\dnsq.dll
Filesize
31KB

MD5
f515bd3278588b6d58a316d059e2778f

SHA1
ae8d987f33930d305b9d60685549dcabefa8e932

SHA256
5c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310

SHA512
688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c

Download Submit
\??\c:\users\admin\appdata\local\temp\e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44.exe.log
Filesize
357KB

MD5
02ea20642c0087fb590956b1e7bb3e00

SHA1
0dbda87c39bbe0b8285177f97b26054e711f9bda

SHA256
e851daf2b5aa25915ef74309678a8f0206a2c81368ed648c0459f62aba8c4c44

SHA512
037ae198479289dc9f483384d4b9f7acbf3a73daeb20bf241f740a248a3f7e32fec2cf821af7fc312f2d02cc233874b8e319b0d5972a31a3a6cb54903cde7ea9

Download Submit
memory/228-140-0x0000000000000000-mapping.dmp

Download
memory/1004-135-0x0000000000000000-mapping.dmp

Download
memory/1140-183-0x0000000000000000-mapping.dmp

Download
memory/1236-182-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1236-177-0x0000000000000000-mapping.dmp

Download
memory/1252-164-0x0000000000000000-mapping.dmp

Download
memory/1400-133-0x0000000000000000-mapping.dmp

Download
memory/1776-161-0x0000000000000000-mapping.dmp

Download
memory/1780-154-0x0000000000000000-mapping.dmp

Download
memory/1784-160-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1784-156-0x0000000000000000-mapping.dmp

Download
memory/2024-169-0x0000000000000000-mapping.dmp

Download
memory/2196-165-0x0000000000000000-mapping.dmp

Download
memory/2380-166-0x0000000000000000-mapping.dmp

Download
memory/2748-136-0x0000000000000000-mapping.dmp

Download
memory/3160-149-0x0000000000000000-mapping.dmp

Download
memory/3228-186-0x0000000000000000-mapping.dmp

Download
memory/3472-134-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3472-148-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3472-132-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3516-162-0x0000000000000000-mapping.dmp

Download
memory/3660-145-0x0000000000000000-mapping.dmp

Download
memory/3700-159-0x0000000000000000-mapping.dmp

Download
memory/3732-163-0x0000000000000000-mapping.dmp

Download
memory/3856-143-0x0000000000000000-mapping.dmp

Download
memory/4220-158-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4220-141-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4220-137-0x0000000000000000-mapping.dmp

Download
memory/4268-142-0x0000000000000000-mapping.dmp

Download
memory/4360-146-0x0000000000000000-mapping.dmp

Download
memory/4368-176-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4368-171-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4368-153-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4368-150-0x0000000000000000-mapping.dmp

Download
memory/4368-184-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/4560-144-0x0000000000000000-mapping.dmp

Download
memory/4576-167-0x0000000000000000-mapping.dmp

Download
memory/4624-185-0x0000000000000000-mapping.dmp

Download
memory/4980-174-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4980-170-0x0000000000000000-mapping.dmp

Download