Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 01:11
Behavioral task
behavioral1
Sample
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe
Resource
win10v2004-20220901-en
General
-
Target
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe
-
Size
272KB
-
MD5
15baf936ad283c5b3075acca81b2d8c0
-
SHA1
ac2a303b5206d85049e05546e7917a8b62c66d75
-
SHA256
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf
-
SHA512
96f7aed1fa623d60ae1d5191b6d3810aa6ba8dc789ea79ee3d72a6a2ecfddaf633e6b6703125fffe5d63dcd95328e9496c240385e2470c2041187396699227ae
-
SSDEEP
6144:KD3vjxbG3rR1qxwzcP2vrcff/KBAOROq952w:KD9bG3rexwz5vrcffiBTB52w
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 5 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Windows\SysWOW64\dnsq.dll acprotect C:\Windows\SysWOW64\dnsq.dll acprotect C:\Windows\SysWOW64\dnsq.dll acprotect C:\Windows\SysWOW64\com\netcfg.dll acprotect C:\Windows\SysWOW64\Com\netcfg.dll acprotect -
Executes dropped EXE 5 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exelsass.exesmss.exepid process 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 1808 lsass.exe 4196 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 5056 lsass.exe 5036 smss.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options lsass.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe -
Processes:
resource yara_rule behavioral2/memory/1884-132-0x0000000000400000-0x000000000042C000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log upx \??\c:\users\admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log upx behavioral2/memory/1884-139-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4604-140-0x0000000000400000-0x000000000042C000-memory.dmp upx C:\Windows\SysWOW64\com\lsass.exe upx C:\Windows\SysWOW64\Com\lsass.exe upx C:\Windows\SysWOW64\Com\lsass.exe upx behavioral2/memory/4604-156-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1808-158-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/5056-159-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/5056-160-0x0000000000400000-0x000000000042C000-memory.dmp upx C:\Windows\SysWOW64\dnsq.dll upx C:\Windows\SysWOW64\dnsq.dll upx C:\Windows\SysWOW64\dnsq.dll upx C:\Windows\SysWOW64\com\netcfg.dll upx C:\Windows\SysWOW64\Com\netcfg.dll upx behavioral2/memory/1808-179-0x0000000010000000-0x0000000010019000-memory.dmp upx behavioral2/memory/5036-180-0x0000000010000000-0x0000000010019000-memory.dmp upx behavioral2/memory/1808-183-0x0000000000400000-0x000000000042C000-memory.dmp upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation lsass.exe -
Loads dropped DLL 3 IoCs
Processes:
lsass.exesmss.exeregsvr32.exepid process 1808 lsass.exe 5036 smss.exe 4316 regsvr32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe -
Checks for any installed AV software in registry 1 TTPs 3 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService lsass.exe -
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exelsass.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lsass.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lsass.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
lsass.exedescription ioc process File opened (read-only) \??\E: lsass.exe File opened (read-only) \??\f: lsass.exe -
Drops autorun.inf file 1 TTPs 7 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
lsass.exedescription ioc process File created C:\AUTORUN.INF lsass.exe File opened for modification D:\AUTORUN.INF lsass.exe File opened for modification \??\E:\AUTORUN.INF lsass.exe File opened for modification C:\autorun.inf lsass.exe File opened for modification D:\autorun.inf lsass.exe File opened for modification \??\E:\autorun.inf lsass.exe File opened for modification C:\AUTORUN.INF lsass.exe -
Drops file in System32 directory 23 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exedescription ioc process File created C:\Windows\SysWOW64\00302.log 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log File opened for modification C:\Windows\SysWOW64\com\smss.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log File opened for modification C:\Windows\SysWOW64\com\lsass.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log File opened for modification C:\Windows\SysWOW64\com\smss.exe lsass.exe File opened for modification C:\Windows\SysWOW64\com\netcfg.dll lsass.exe File created C:\Windows\SysWOW64\240568501.log lsass.exe File created C:\Windows\SysWOW64\dnsq.dll lsass.exe File created C:\Windows\SysWOW64\00302.log 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe File opened for modification C:\Windows\SysWOW64\com\lsass.exe lsass.exe File created C:\Windows\SysWOW64\com\netcfg.000 lsass.exe File created C:\Windows\SysWOW64\com\netcfg.dll lsass.exe File opened for modification \??\c:\windows\SysWOW64\com\lsass.exe lsass.exe File created C:\Windows\SysWOW64\com\lsass.exe lsass.exe File created C:\Windows\SysWOW64\240568547.log lsass.exe File opened for modification C:\Windows\SysWOW64\com\bak lsass.exe File created C:\Windows\SysWOW64\00302.log lsass.exe File opened for modification C:\Windows\SysWOW64\com\smss.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe File created C:\Windows\SysWOW64\com\smss.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe File created C:\Windows\SysWOW64\com\lsass.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log File opened for modification C:\Windows\SysWOW64\com\netcfg.000 lsass.exe File opened for modification C:\Windows\SysWOW64\240568501.log lsass.exe File opened for modification C:\Windows\SysWOW64\dnsq.dll lsass.exe File opened for modification C:\Windows\SysWOW64\240568547.log lsass.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ = "IfObj Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\FLAGS\ = "2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ = "_DIfObjEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\ = "IfObj Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll, 1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ProgID\ = "IFOBJ.IfObjCtrl.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\CLSID\ = "{D9901239-34A2-448D-A000-3705544ECE9D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Control\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\com" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\1\ = "131473" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ = "_DIfObjEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ = "_DIfObj" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ = "_DIfObj" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\ = "ifObj ActiveX Control module" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}" regsvr32.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exepid process 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 1808 lsass.exe 1808 lsass.exe -
Suspicious behavior: LoadsDriver 3 IoCs
Processes:
pid process 656 656 656 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exedescription pid process Token: SeDebugPrivilege 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Token: SeDebugPrivilege 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log Token: SeDebugPrivilege 1808 lsass.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exelsass.exepid process 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 1808 lsass.exe 1808 lsass.exe 1808 lsass.exe 1808 lsass.exe 5056 lsass.exe 5056 lsass.exe 5056 lsass.exe 5056 lsass.exe 1808 lsass.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exedescription pid process target process PID 1884 wrote to memory of 3284 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cmd.exe PID 1884 wrote to memory of 3284 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cmd.exe PID 1884 wrote to memory of 3284 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cmd.exe PID 1884 wrote to memory of 4220 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1884 wrote to memory of 4220 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1884 wrote to memory of 4220 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1884 wrote to memory of 2408 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1884 wrote to memory of 2408 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1884 wrote to memory of 2408 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1884 wrote to memory of 4604 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log PID 1884 wrote to memory of 4604 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log PID 1884 wrote to memory of 4604 1884 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log PID 4604 wrote to memory of 1732 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 4604 wrote to memory of 1732 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 4604 wrote to memory of 1732 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 4604 wrote to memory of 4924 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 4924 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 4924 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 4980 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 4980 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 4980 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 1444 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 1444 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 1444 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 3036 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 3036 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 3036 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 4604 wrote to memory of 4528 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 4604 wrote to memory of 4528 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 4604 wrote to memory of 4528 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 4604 wrote to memory of 4696 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 4604 wrote to memory of 4696 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 4604 wrote to memory of 4696 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 4604 wrote to memory of 1808 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log lsass.exe PID 4604 wrote to memory of 1808 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log lsass.exe PID 4604 wrote to memory of 1808 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log lsass.exe PID 4604 wrote to memory of 4196 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe PID 4604 wrote to memory of 4196 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe PID 4604 wrote to memory of 4196 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe PID 4604 wrote to memory of 5056 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log lsass.exe PID 4604 wrote to memory of 5056 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log lsass.exe PID 4604 wrote to memory of 5056 4604 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log lsass.exe PID 1808 wrote to memory of 4592 1808 lsass.exe cmd.exe PID 1808 wrote to memory of 4592 1808 lsass.exe cmd.exe PID 1808 wrote to memory of 4592 1808 lsass.exe cmd.exe PID 1808 wrote to memory of 312 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 312 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 312 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 1512 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 1512 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 1512 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 4180 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 4180 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 4180 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 4140 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 4140 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 4140 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 316 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 316 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 316 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 1508 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 1508 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 1508 1808 lsass.exe cacls.exe PID 1808 wrote to memory of 2412 1808 lsass.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe"C:\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe"1⤵
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c echo ok2⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F2⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F2⤵
-
\??\c:\users\admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log"c:\users\admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log"2⤵
- Executes dropped EXE
- Sets file execution options in registry
- Checks computer location settings
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c echo ok3⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F3⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F3⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Admin:F3⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Everyone:F3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /s /q "C:\Windows\system32\com\smss.exe"3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Windows\system32\com\lsass.exe"3⤵
-
C:\Windows\SysWOW64\com\lsass.exe"C:\Windows\system32\com\lsass.exe"3⤵
- Executes dropped EXE
- Sets file execution options in registry
- Checks computer location settings
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c echo ok4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\lsass.exe /e /t /g Admin:F4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\lsass.exe /e /t /g Everyone:F4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Admin:F4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Everyone:F4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /s /q "C:\Windows\system32\com\smss.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /s /q "C:\Windows\system32\com\lsass.exe"4⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Windows\system32\com\netcfg.dll /s4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\com\smss.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\~.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /s /q "C:\Windows\system32\dnsq.dll"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /s /q "C:\Windows\system32\com\bak"4⤵
-
C:\Windows\SysWOW64\ping.exeping.exe -f -n 1 www.baidu.com4⤵
- Runs ping.exe
-
C:\Users\Admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe"C:\Users\Admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\com\lsass.exe^c:\users\admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exeFilesize
88KB
MD5cf2ffd93807eb73965d5a4f438260658
SHA1114c7ff564ea417493604c1c03b5d414308c54f7
SHA25628957191fc57c5aba81e89989bf48f86a57e8df3f966eea0d96b5bf7b7b163e8
SHA5125c691c8003050dd9385dfbdb9b5556003ee05915fc0e87e08d55e95362f9c7a1429a0ad3ec70fb333c4647d5d02b8cb1797156e3939843073a0554b745f8efa4
-
C:\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.logFilesize
272KB
MD515baf936ad283c5b3075acca81b2d8c0
SHA1ac2a303b5206d85049e05546e7917a8b62c66d75
SHA2568548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf
SHA51296f7aed1fa623d60ae1d5191b6d3810aa6ba8dc789ea79ee3d72a6a2ecfddaf633e6b6703125fffe5d63dcd95328e9496c240385e2470c2041187396699227ae
-
C:\Windows\SysWOW64\Com\lsass.exeFilesize
92KB
MD5dc67758a5be75ce168a118b4982b3dbe
SHA1cfe27b21c63e73d46cc8e4ef4f91812ce4a79d36
SHA2561aac5652d94e369a50c9c502380350eaf2770d3779f932e5dba807942e29a0ff
SHA512ba82562f35e9105b63c8fb805bb9706f0864633461f05c475a9d1893ddf08bfe153b0c3a712553ba39c9011f49f2a0ced54f4e2e901739afebad1b4665ddd917
-
C:\Windows\SysWOW64\Com\lsass.exeFilesize
92KB
MD5dc67758a5be75ce168a118b4982b3dbe
SHA1cfe27b21c63e73d46cc8e4ef4f91812ce4a79d36
SHA2561aac5652d94e369a50c9c502380350eaf2770d3779f932e5dba807942e29a0ff
SHA512ba82562f35e9105b63c8fb805bb9706f0864633461f05c475a9d1893ddf08bfe153b0c3a712553ba39c9011f49f2a0ced54f4e2e901739afebad1b4665ddd917
-
C:\Windows\SysWOW64\Com\netcfg.dllFilesize
16KB
MD5d1f6b9273cbb2e23aeed11346d0072c5
SHA10d012a7c7b37082dcbd5e1688f72eeade705f825
SHA256dfb2d7cdc6ea056948d09fe139255af2dcc58f3581f4a50f4e5ee0f5a03c39fc
SHA5124c3ab878131ad38a54d04cf0d268430ab98a67df474a18ee7858c62561d90ec14c34ed63dd973fdf24115ebf17ef65a6a9fc9ac612c247903e881e584dc3b77e
-
C:\Windows\SysWOW64\Com\smss.exeFilesize
40KB
MD5ae1cd1d740c265b7f18f827f9e37afab
SHA16b976bc56e4021e7237b3cd4dbe412b6949fb0a0
SHA256a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11
SHA512c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571
-
C:\Windows\SysWOW64\com\lsass.exeFilesize
92KB
MD5dc67758a5be75ce168a118b4982b3dbe
SHA1cfe27b21c63e73d46cc8e4ef4f91812ce4a79d36
SHA2561aac5652d94e369a50c9c502380350eaf2770d3779f932e5dba807942e29a0ff
SHA512ba82562f35e9105b63c8fb805bb9706f0864633461f05c475a9d1893ddf08bfe153b0c3a712553ba39c9011f49f2a0ced54f4e2e901739afebad1b4665ddd917
-
C:\Windows\SysWOW64\com\netcfg.dllFilesize
16KB
MD5d1f6b9273cbb2e23aeed11346d0072c5
SHA10d012a7c7b37082dcbd5e1688f72eeade705f825
SHA256dfb2d7cdc6ea056948d09fe139255af2dcc58f3581f4a50f4e5ee0f5a03c39fc
SHA5124c3ab878131ad38a54d04cf0d268430ab98a67df474a18ee7858c62561d90ec14c34ed63dd973fdf24115ebf17ef65a6a9fc9ac612c247903e881e584dc3b77e
-
C:\Windows\SysWOW64\com\smss.exeFilesize
40KB
MD5ae1cd1d740c265b7f18f827f9e37afab
SHA16b976bc56e4021e7237b3cd4dbe412b6949fb0a0
SHA256a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11
SHA512c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571
-
C:\Windows\SysWOW64\com\smss.exeFilesize
40KB
MD5ae1cd1d740c265b7f18f827f9e37afab
SHA16b976bc56e4021e7237b3cd4dbe412b6949fb0a0
SHA256a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11
SHA512c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571
-
C:\Windows\SysWOW64\com\smss.exeFilesize
40KB
MD5ae1cd1d740c265b7f18f827f9e37afab
SHA16b976bc56e4021e7237b3cd4dbe412b6949fb0a0
SHA256a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11
SHA512c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571
-
C:\Windows\SysWOW64\dnsq.dllFilesize
31KB
MD5f515bd3278588b6d58a316d059e2778f
SHA1ae8d987f33930d305b9d60685549dcabefa8e932
SHA2565c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310
SHA512688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c
-
C:\Windows\SysWOW64\dnsq.dllFilesize
31KB
MD5f515bd3278588b6d58a316d059e2778f
SHA1ae8d987f33930d305b9d60685549dcabefa8e932
SHA2565c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310
SHA512688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c
-
C:\Windows\SysWOW64\dnsq.dllFilesize
31KB
MD5f515bd3278588b6d58a316d059e2778f
SHA1ae8d987f33930d305b9d60685549dcabefa8e932
SHA2565c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310
SHA512688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c
-
\??\c:\users\admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.logFilesize
272KB
MD515baf936ad283c5b3075acca81b2d8c0
SHA1ac2a303b5206d85049e05546e7917a8b62c66d75
SHA2568548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf
SHA51296f7aed1fa623d60ae1d5191b6d3810aa6ba8dc789ea79ee3d72a6a2ecfddaf633e6b6703125fffe5d63dcd95328e9496c240385e2470c2041187396699227ae
-
memory/312-161-0x0000000000000000-mapping.dmp
-
memory/316-165-0x0000000000000000-mapping.dmp
-
memory/1348-169-0x0000000000000000-mapping.dmp
-
memory/1444-144-0x0000000000000000-mapping.dmp
-
memory/1508-166-0x0000000000000000-mapping.dmp
-
memory/1512-162-0x0000000000000000-mapping.dmp
-
memory/1732-141-0x0000000000000000-mapping.dmp
-
memory/1808-183-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1808-158-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1808-179-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/1808-149-0x0000000000000000-mapping.dmp
-
memory/1884-132-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1884-139-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2324-184-0x0000000000000000-mapping.dmp
-
memory/2404-182-0x0000000000000000-mapping.dmp
-
memory/2408-135-0x0000000000000000-mapping.dmp
-
memory/2412-167-0x0000000000000000-mapping.dmp
-
memory/3036-145-0x0000000000000000-mapping.dmp
-
memory/3284-133-0x0000000000000000-mapping.dmp
-
memory/3728-181-0x0000000000000000-mapping.dmp
-
memory/4140-164-0x0000000000000000-mapping.dmp
-
memory/4180-163-0x0000000000000000-mapping.dmp
-
memory/4196-152-0x0000000000000000-mapping.dmp
-
memory/4220-134-0x0000000000000000-mapping.dmp
-
memory/4316-170-0x0000000000000000-mapping.dmp
-
memory/4528-146-0x0000000000000000-mapping.dmp
-
memory/4592-157-0x0000000000000000-mapping.dmp
-
memory/4604-136-0x0000000000000000-mapping.dmp
-
memory/4604-140-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4604-156-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4696-148-0x0000000000000000-mapping.dmp
-
memory/4924-142-0x0000000000000000-mapping.dmp
-
memory/4980-143-0x0000000000000000-mapping.dmp
-
memory/5036-172-0x0000000000000000-mapping.dmp
-
memory/5036-180-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/5056-154-0x0000000000000000-mapping.dmp
-
memory/5056-159-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/5056-160-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB