asyncrat | 8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7

Analysis

max time kernel
300s
max time network
303s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/03/2023, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe
Size

47KB
MD5

4df29d7678c4533be7a9ad05e4bf752a
SHA1

c6ee50bf6f5a8525e73b8394e6646de4b56c0deb
SHA256

8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7
SHA512

52861a3bf99ad4be25003952b7802a6f47aea7b335321f2d041426edbfafd84d3f9ef971726214ffd43c737ff7360aa5e1fa595fc3cfbfef1761cb045ac21744
SSDEEP

768:aueq1TFBA3VWU1+fhcvmo2qjwU3dmPIwMbhEe0blghZx6Ue7sbKoRTG72BDZ8x:aueq1TFm92m3dPwM9SblghZ4s6Yd8x

Score

10^/10

asyncrat quasar xmrig default pi-004-a version 3 miner persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

PI-004-A

172.104.148.228:6606

fusioncore32023.hopto.org:6606

Mutex

fusioncore_was_here

Attributes

delay
3
install
true
install_file
WindowsSettingsHelper.exe
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

AsyncRAT-Sharp X SiphonFilter 0.5.8B

Botnet

VERSION 3

ndospjn.ddns.net:4563

Mutex

SDFSSDFSFSFS()YERSFdaDSWGHIUHERGBIE()RYHEIRUYGBEIRUGYREIUGERGERG

Attributes

delay
3
install
true
install_file
dmpF4GD3.tmp.scr.exe
install_folder
%Temp%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
systemupdate64.exe
install_folder
%AppData%
pastebin_config
http://pastebin.com/raw/0vQb3Cug

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Quasar RAT 10 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

description	flow	ioc	Process
	23	ipapi.co	Process not Found
	41	ip-api.com	Process not Found
	55	ip-api.com	Process not Found
	9	api.ipify.org	Process not Found
	11	ipapi.co	Process not Found
	12	ipapi.co	Process not Found
	13	ip-api.com	Process not Found
	18	ipapi.co	Process not Found
Set value (data)		\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000_CLASSES\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe
	92	ip-api.com	Process not Found

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 596 created 1200	596	jnnbkp.exe	13
PID 596 created 1200	596	jnnbkp.exe	13
PID 952 created 1200	952	updater.exe	13
PID 952 created 1200	952	updater.exe	13
PID 1500 created 1200	1500	conhost.exe	13
PID 952 created 1200	952	updater.exe	13
PID 952 created 1200	952	updater.exe	13

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 21 IoCs

rat

resource	yara_rule
behavioral1/memory/336-54-0x0000000000DA0000-0x0000000000DB2000-memory.dmp	asyncrat
behavioral1/files/0x000a0000000122ee-65.dat	asyncrat
behavioral1/files/0x000a0000000122ee-66.dat	asyncrat
behavioral1/files/0x000a0000000122ee-67.dat	asyncrat
behavioral1/memory/1640-68-0x0000000000CA0000-0x0000000000CB2000-memory.dmp	asyncrat
behavioral1/memory/1640-87-0x0000000000590000-0x00000000005B2000-memory.dmp	asyncrat
behavioral1/memory/976-111-0x0000000002640000-0x0000000002680000-memory.dmp	asyncrat
behavioral1/memory/1640-193-0x00000000023A0000-0x00000000023C2000-memory.dmp	asyncrat
behavioral1/files/0x00070000000139ed-221.dat	asyncrat
behavioral1/memory/560-224-0x00000000000B0000-0x00000000000C6000-memory.dmp	asyncrat
behavioral1/files/0x00070000000139ed-222.dat	asyncrat
behavioral1/files/0x00070000000139ed-223.dat	asyncrat
behavioral1/files/0x0008000000013a3c-240.dat	asyncrat
behavioral1/files/0x0008000000013a3c-241.dat	asyncrat
behavioral1/files/0x0008000000013a3c-242.dat	asyncrat
behavioral1/memory/1724-243-0x0000000000D20000-0x0000000000D36000-memory.dmp	asyncrat
behavioral1/memory/964-329-0x00000000026A0000-0x00000000026E0000-memory.dmp	asyncrat
behavioral1/files/0x00060000000146d9-332.dat	asyncrat
behavioral1/files/0x00060000000146d9-333.dat	asyncrat
behavioral1/files/0x00060000000146d9-334.dat	asyncrat
behavioral1/memory/1856-335-0x0000000000D80000-0x0000000000DAA000-memory.dmp	asyncrat

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/1484-404-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-439-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-440-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-462-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-474-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-477-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-479-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-481-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-485-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-491-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-493-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-495-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-497-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-499-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-503-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-507-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1484-509-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig

Blocklisted process makes network request 26 IoCs

flow	pid	Process
37	1484	cmd.exe
40	1484	cmd.exe
43	1484	cmd.exe
46	1484	cmd.exe
50	1484	cmd.exe
57	1484	cmd.exe
59	1484	cmd.exe
62	1484	cmd.exe
64	1484	cmd.exe
66	1484	cmd.exe
68	1484	cmd.exe
70	1484	cmd.exe
73	1484	cmd.exe
75	1484	cmd.exe
77	1484	cmd.exe
80	1484	cmd.exe
82	1484	cmd.exe
84	1484	cmd.exe
86	1484	cmd.exe
88	1484	cmd.exe
90	1484	cmd.exe
94	1484	cmd.exe
96	1484	cmd.exe
98	1484	cmd.exe
101	1484	cmd.exe
106	1484	cmd.exe

Executes dropped EXE 13 IoCs

pid	Process
1640	WindowsSettingsHelper.exe
856	pcnaus.exe
1132	isqbef.exe
1760	cywvvy.exe
560	anlhmf.exe
1724	dmpF4GD3.tmp.scr.exe
596	jnnbkp.exe
1856	xlycvw.exe
952	updater.exe
1716	fhtnpi.exe
560	SystemSecurityHelper.exe
2016	SystemSecurityHelper.exe
1656	SystemSecurityHelper.exe

Loads dropped DLL 10 IoCs

pid	Process
1776	cmd.exe
976	powershell.exe
1816	powershell.exe
1956	powershell.exe
1652	powershell.exe
1356	cmd.exe
668	powershell.exe
964	powershell.exe
1016	taskeng.exe
292	powershell.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1484-404-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-439-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-440-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-462-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-474-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-477-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-479-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-481-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-485-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-491-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-493-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-495-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-497-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-499-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-503-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-507-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1484-509-0x0000000140000000-0x00000001407F4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\System Security Service = "\"C:\\Users\\Admin\\AppData\\Roaming\\SecureSystemHelper\\SystemSecurityHelper.exe\""	SystemSecurityHelper.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 9 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.ipify.org
18	ipapi.co
23	ipapi.co
41	ip-api.com
55	ip-api.com
92	ip-api.com
11	ipapi.co
12	ipapi.co
13	ip-api.com

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	SystemSecurityHelper.exe
File created	C:\autorun.inf	SystemSecurityHelper.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 952 set thread context of 1500	952	updater.exe	97
PID 952 set thread context of 1484	952	updater.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
480	schtasks.exe
1384	schtasks.exe
1976	schtasks.exe
1748	schtasks.exe
920	schtasks.exe
968	schtasks.exe
852	schtasks.exe
1808	schtasks.exe
1696	schtasks.exe
852	schtasks.exe
1652	schtasks.exe

Delays execution with timeout.exe 5 IoCs

evasion

pid	Process
1364	timeout.exe
1924	timeout.exe
736	timeout.exe
888	timeout.exe
1432	timeout.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
1288	taskkill.exe
324	taskkill.exe
1560	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
336	8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe
976	powershell.exe
1640	WindowsSettingsHelper.exe
976	powershell.exe
976	powershell.exe
1816	powershell.exe
1816	powershell.exe
1816	powershell.exe
1640	WindowsSettingsHelper.exe
1956	powershell.exe
1956	powershell.exe
1956	powershell.exe
1640	WindowsSettingsHelper.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
1640	WindowsSettingsHelper.exe
1044	powershell.exe
560	anlhmf.exe
1780	powershell.exe
668	powershell.exe
668	powershell.exe
668	powershell.exe
1640	WindowsSettingsHelper.exe
964	powershell.exe
964	powershell.exe
964	powershell.exe
1640	WindowsSettingsHelper.exe
596	jnnbkp.exe
596	jnnbkp.exe
1296	powershell.exe
596	jnnbkp.exe
596	jnnbkp.exe
1632	powershell.exe
952	updater.exe
952	updater.exe
824	powershell.exe
952	updater.exe
952	updater.exe
1500	conhost.exe
1500	conhost.exe
952	updater.exe
952	updater.exe
952	updater.exe
952	updater.exe
292	powershell.exe
292	powershell.exe
292	powershell.exe
1640	WindowsSettingsHelper.exe
1716	fhtnpi.exe
1716	fhtnpi.exe
1716	fhtnpi.exe
1716	fhtnpi.exe
1716	fhtnpi.exe
560	SystemSecurityHelper.exe
560	SystemSecurityHelper.exe
560	SystemSecurityHelper.exe
560	SystemSecurityHelper.exe
560	SystemSecurityHelper.exe
2016	SystemSecurityHelper.exe
2016	SystemSecurityHelper.exe
2016	SystemSecurityHelper.exe
2016	SystemSecurityHelper.exe
2016	SystemSecurityHelper.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	336	8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe
Token: SeDebugPrivilege	1640	WindowsSettingsHelper.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeDebugPrivilege	856	pcnaus.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	1132	isqbef.exe
Token: SeDebugPrivilege	1288	taskkill.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1760	cywvvy.exe
Token: SeDebugPrivilege	324	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	560	anlhmf.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	1724	dmpF4GD3.tmp.scr.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	1856	xlycvw.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeIncreaseQuotaPrivilege	852	WMIC.exe
Token: SeSecurityPrivilege	852	WMIC.exe
Token: SeTakeOwnershipPrivilege	852	WMIC.exe
Token: SeLoadDriverPrivilege	852	WMIC.exe
Token: SeSystemProfilePrivilege	852	WMIC.exe
Token: SeSystemtimePrivilege	852	WMIC.exe
Token: SeProfSingleProcessPrivilege	852	WMIC.exe
Token: SeIncBasePriorityPrivilege	852	WMIC.exe
Token: SeCreatePagefilePrivilege	852	WMIC.exe
Token: SeBackupPrivilege	852	WMIC.exe
Token: SeRestorePrivilege	852	WMIC.exe
Token: SeShutdownPrivilege	852	WMIC.exe
Token: SeDebugPrivilege	852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	852	WMIC.exe
Token: SeRemoteShutdownPrivilege	852	WMIC.exe
Token: SeUndockPrivilege	852	WMIC.exe
Token: SeManageVolumePrivilege	852	WMIC.exe
Token: 33	852	WMIC.exe
Token: 34	852	WMIC.exe
Token: 35	852	WMIC.exe
Token: SeIncreaseQuotaPrivilege	852	WMIC.exe
Token: SeSecurityPrivilege	852	WMIC.exe
Token: SeTakeOwnershipPrivilege	852	WMIC.exe
Token: SeLoadDriverPrivilege	852	WMIC.exe
Token: SeSystemProfilePrivilege	852	WMIC.exe
Token: SeSystemtimePrivilege	852	WMIC.exe
Token: SeProfSingleProcessPrivilege	852	WMIC.exe
Token: SeIncBasePriorityPrivilege	852	WMIC.exe
Token: SeCreatePagefilePrivilege	852	WMIC.exe
Token: SeBackupPrivilege	852	WMIC.exe
Token: SeRestorePrivilege	852	WMIC.exe
Token: SeShutdownPrivilege	852	WMIC.exe
Token: SeDebugPrivilege	852	WMIC.exe
Token: SeSystemEnvironmentPrivilege	852	WMIC.exe
Token: SeRemoteShutdownPrivilege	852	WMIC.exe
Token: SeUndockPrivilege	852	WMIC.exe
Token: SeManageVolumePrivilege	852	WMIC.exe
Token: 33	852	WMIC.exe
Token: 34	852	WMIC.exe
Token: 35	852	WMIC.exe
Token: SeLockMemoryPrivilege	1484	cmd.exe
Token: SeLockMemoryPrivilege	1484	cmd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
560	SystemSecurityHelper.exe
2016	SystemSecurityHelper.exe
1656	SystemSecurityHelper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 752	336	8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe	29
PID 336 wrote to memory of 752	336	8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe	29
PID 336 wrote to memory of 752	336	8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe	29
PID 336 wrote to memory of 752	336	8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe	29
PID 336 wrote to memory of 1776	336	8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe	31
PID 336 wrote to memory of 1776	336	8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe	31
PID 336 wrote to memory of 1776	336	8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe	31
PID 336 wrote to memory of 1776	336	8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe	31
PID 752 wrote to memory of 968	752	cmd.exe	33
PID 752 wrote to memory of 968	752	cmd.exe	33
PID 752 wrote to memory of 968	752	cmd.exe	33
PID 752 wrote to memory of 968	752	cmd.exe	33
PID 1776 wrote to memory of 1364	1776	cmd.exe	34
PID 1776 wrote to memory of 1364	1776	cmd.exe	34
PID 1776 wrote to memory of 1364	1776	cmd.exe	34
PID 1776 wrote to memory of 1364	1776	cmd.exe	34
PID 1776 wrote to memory of 1640	1776	cmd.exe	35
PID 1776 wrote to memory of 1640	1776	cmd.exe	35
PID 1776 wrote to memory of 1640	1776	cmd.exe	35
PID 1776 wrote to memory of 1640	1776	cmd.exe	35
PID 1640 wrote to memory of 1012	1640	WindowsSettingsHelper.exe	36
PID 1640 wrote to memory of 1012	1640	WindowsSettingsHelper.exe	36
PID 1640 wrote to memory of 1012	1640	WindowsSettingsHelper.exe	36
PID 1640 wrote to memory of 1012	1640	WindowsSettingsHelper.exe	36
PID 1012 wrote to memory of 976	1012	cmd.exe	38
PID 1012 wrote to memory of 976	1012	cmd.exe	38
PID 1012 wrote to memory of 976	1012	cmd.exe	38
PID 1012 wrote to memory of 976	1012	cmd.exe	38
PID 976 wrote to memory of 856	976	powershell.exe	39
PID 976 wrote to memory of 856	976	powershell.exe	39
PID 976 wrote to memory of 856	976	powershell.exe	39
PID 976 wrote to memory of 856	976	powershell.exe	39
PID 1640 wrote to memory of 1344	1640	WindowsSettingsHelper.exe	40
PID 1640 wrote to memory of 1344	1640	WindowsSettingsHelper.exe	40
PID 1640 wrote to memory of 1344	1640	WindowsSettingsHelper.exe	40
PID 1640 wrote to memory of 1344	1640	WindowsSettingsHelper.exe	40
PID 1344 wrote to memory of 1816	1344	cmd.exe	42
PID 1344 wrote to memory of 1816	1344	cmd.exe	42
PID 1344 wrote to memory of 1816	1344	cmd.exe	42
PID 1344 wrote to memory of 1816	1344	cmd.exe	42
PID 1816 wrote to memory of 1132	1816	powershell.exe	43
PID 1816 wrote to memory of 1132	1816	powershell.exe	43
PID 1816 wrote to memory of 1132	1816	powershell.exe	43
PID 1816 wrote to memory of 1132	1816	powershell.exe	43
PID 1132 wrote to memory of 1848	1132	isqbef.exe	44
PID 1132 wrote to memory of 1848	1132	isqbef.exe	44
PID 1132 wrote to memory of 1848	1132	isqbef.exe	44
PID 1132 wrote to memory of 1848	1132	isqbef.exe	44
PID 1848 wrote to memory of 1592	1848	cmd.exe	46
PID 1848 wrote to memory of 1592	1848	cmd.exe	46
PID 1848 wrote to memory of 1592	1848	cmd.exe	46
PID 1848 wrote to memory of 1592	1848	cmd.exe	46
PID 1848 wrote to memory of 1288	1848	cmd.exe	47
PID 1848 wrote to memory of 1288	1848	cmd.exe	47
PID 1848 wrote to memory of 1288	1848	cmd.exe	47
PID 1848 wrote to memory of 1288	1848	cmd.exe	47
PID 1848 wrote to memory of 1924	1848	cmd.exe	48
PID 1848 wrote to memory of 1924	1848	cmd.exe	48
PID 1848 wrote to memory of 1924	1848	cmd.exe	48
PID 1848 wrote to memory of 1924	1848	cmd.exe	48
PID 1640 wrote to memory of 1260	1640	WindowsSettingsHelper.exe	49
PID 1640 wrote to memory of 1260	1640	WindowsSettingsHelper.exe	49
PID 1640 wrote to memory of 1260	1640	WindowsSettingsHelper.exe	49
PID 1640 wrote to memory of 1260	1640	WindowsSettingsHelper.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe
  "C:\Users\Admin\AppData\Local\Temp\8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7.exe"
  2⤵
  - Quasar RAT
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsSettingsHelper" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSettingsHelper.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "WindowsSettingsHelper" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSettingsHelper.exe"'
      4⤵
      Creates scheduled task(s)
      PID:968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1BAC.tmp.bat""
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1364
  - - C:\Users\Admin\AppData\Roaming\WindowsSettingsHelper.exe
      "C:\Users\Admin\AppData\Roaming\WindowsSettingsHelper.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pcnaus.exe"' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1012
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\pcnaus.exe"'
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\pcnaus.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pcnaus.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpE976.tmp.bat
        8⤵
        
        PID:976
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        9⤵
        
        PID:796
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TaskKill /F /IM 856
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:324
        
        C:\Windows\SysWOW64\timeout.exe
        
        Timeout /T 2 /Nobreak
        9⤵
        Delays execution with timeout.exe
        
        PID:736
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\isqbef.exe"' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1344
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\isqbef.exe"'
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\isqbef.exe
        
        "C:\Users\Admin\AppData\Local\Temp\isqbef.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpC034.tmp.bat
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TaskKill /F /IM 1132
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
        
        C:\Windows\SysWOW64\timeout.exe
        
        Timeout /T 2 /Nobreak
        9⤵
        Delays execution with timeout.exe
        
        PID:1924
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\cywvvy.exe"' & exit
        5⤵
        
        PID:1260
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\cywvvy.exe"'
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\cywvvy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cywvvy.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp771.tmp.bat
        8⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\taskkill.exe
        
        TaskKill /F /IM 1760
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560
        
        C:\Windows\SysWOW64\timeout.exe
        
        Timeout /T 2 /Nobreak
        9⤵
        Delays execution with timeout.exe
        
        PID:888
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\anlhmf.exe"' & exit
        5⤵
        
        PID:1320
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\anlhmf.exe"'
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\anlhmf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\anlhmf.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:560
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" System.Byte[] && exit
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1044
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dmpF4GD3.tmp.scr" /tr '"C:\Users\Admin\AppData\Local\Temp\dmpF4GD3.tmp.scr.exe"' & exit
        8⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "dmpF4GD3.tmp.scr" /tr '"C:\Users\Admin\AppData\Local\Temp\dmpF4GD3.tmp.scr.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:852
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3248.tmp.bat""
        8⤵
        Loads dropped DLL
        
        PID:1356
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        9⤵
        Delays execution with timeout.exe
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\dmpF4GD3.tmp.scr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dmpF4GD3.tmp.scr.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" System.Byte[] && exit
        10⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jnnbkp.exe"' & exit
        5⤵
        
        PID:1344
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\jnnbkp.exe"'
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\jnnbkp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jnnbkp.exe"
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:596
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xlycvw.exe"' & exit
        5⤵
        
        PID:1032
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\xlycvw.exe"'
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\xlycvw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xlycvw.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1856
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\fhtnpi.exe"' & exit
        5⤵
        
        PID:1272
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\fhtnpi.exe"'
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:292
        
        C:\Users\Admin\AppData\Local\Temp\fhtnpi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fhtnpi.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1716
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "System Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\fhtnpi.exe" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1808
        
        C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe
        
        "C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops autorun.inf file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:560
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "System Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe" /rl HIGHEST /f
        9⤵
        Creates scheduled task(s)
        
        PID:1696
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe" /sc MINUTE /MO 1
        9⤵
        Creates scheduled task(s)
        
        PID:1976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#rqezufvah#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe' }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn GoogleUpdateTaskMachineQC /tr 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe'
    3⤵
    - Creates scheduled task(s)
    PID:480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#xjgajpl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe" }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
    3⤵
    PID:796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#rqezufvah#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe' }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:824
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn GoogleUpdateTaskMachineQC /tr 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe'
    3⤵
    - Creates scheduled task(s)
    PID:1384
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe lzdvkwahem
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\Admin\AppData\Roaming\Google\Libs\g.log"
  2⤵
  PID:1768
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Name, VideoProcessor
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:852
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\Admin\AppData\Roaming\Google\Libs\g.log"
  2⤵
  PID:1680
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe blsztyoqjdlmvjbd 6E3sjfZq2rJQaxvLPmXgsOowXWHFkczoMF7NhvC0PhwjGTRTNln+sRp1Apr/qrKR4FaIqqStpyPtZagd6tv56WDtm3SYtYAoImvMnEb1rQ6A/ybzQiHQRPfevn3c9oJFhf5u7UyoXRmef/8c+NVsBHj6LSw8WveAlCZu+O4lk9ICm5/dwGl9abULNIYdQKRe+YIZeLnIfBTSpaHbpwd1UW2TPuhVQuX9On0HEBdPUAkQmmXMKAHOLm8btVnZ/eYTIHS5yuZM2EnOT/4I5t8P1FR1Iq18RZU+dh8BA7V0SQkApsXCmFYkgXLfBkInriL0
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  PID:1484

C:\Windows\system32\taskeng.exe
taskeng.exe {BC787B63-64C8-433F-B2BA-78DDA885DBF8} S-1-5-21-3948302646-268491222-1934009652-1000:KXZDHPUW\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:1016
- C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
  C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:952
- C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe
  C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe
  2⤵
  - Executes dropped EXE
  - Drops autorun.inf file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2016
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "System Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1748
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe" /sc MINUTE /MO 1
    3⤵
    - Creates scheduled task(s)
    PID:920
- C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe
  C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1656
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "System Security Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:852
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe" /sc MINUTE /MO 1
    3⤵
    - Creates scheduled task(s)
    PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar66E6.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\anlhmf.exe

Filesize
60KB

MD5
cc03a2d1054638fb5c8d67459ccd4e59

SHA1
1b05d8fcb8744121a9ea2d8ef30e29dd4346ef23

SHA256
62a48313d307b08ac8b76b815404f28fd011fc1881f5a6a01cf040619a3d2b7e

SHA512
5e790522c1b90ce03447d255f081c5883613829bcbf63310aa57e46572a9d21f0829a86ad4b0b75a7618c767656b00c9b4bd067b2864690401069e9ff5a621ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\anlhmf.exe

Filesize
60KB

MD5
cc03a2d1054638fb5c8d67459ccd4e59

SHA1
1b05d8fcb8744121a9ea2d8ef30e29dd4346ef23

SHA256
62a48313d307b08ac8b76b815404f28fd011fc1881f5a6a01cf040619a3d2b7e

SHA512
5e790522c1b90ce03447d255f081c5883613829bcbf63310aa57e46572a9d21f0829a86ad4b0b75a7618c767656b00c9b4bd067b2864690401069e9ff5a621ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\cywvvy.exe

Filesize
2.1MB

MD5
d0a98def92275e8e311b76b6e2e3905c

SHA1
e0b62be18aeacc994723b680321373b0459dd952

SHA256
c177c06ceca5875296f41c54f97639dff8e037aa577d93bde7bdc7b140e1dbe5

SHA512
b7e98b82202e234c1317c5440cb9d66d03b6ba337fdae7b18d31e5fbb6ee54594829138f1c491f72c1a717983d43eedf336aaaca7b17ce3dc025cf49b05551ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\cywvvy.exe

Filesize
2.1MB

MD5
d0a98def92275e8e311b76b6e2e3905c

SHA1
e0b62be18aeacc994723b680321373b0459dd952

SHA256
c177c06ceca5875296f41c54f97639dff8e037aa577d93bde7bdc7b140e1dbe5

SHA512
b7e98b82202e234c1317c5440cb9d66d03b6ba337fdae7b18d31e5fbb6ee54594829138f1c491f72c1a717983d43eedf336aaaca7b17ce3dc025cf49b05551ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\dmpF4GD3.tmp.scr.exe

Filesize
60KB

MD5
cc03a2d1054638fb5c8d67459ccd4e59

SHA1
1b05d8fcb8744121a9ea2d8ef30e29dd4346ef23

SHA256
62a48313d307b08ac8b76b815404f28fd011fc1881f5a6a01cf040619a3d2b7e

SHA512
5e790522c1b90ce03447d255f081c5883613829bcbf63310aa57e46572a9d21f0829a86ad4b0b75a7618c767656b00c9b4bd067b2864690401069e9ff5a621ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\dmpF4GD3.tmp.scr.exe

Filesize
60KB

MD5
cc03a2d1054638fb5c8d67459ccd4e59

SHA1
1b05d8fcb8744121a9ea2d8ef30e29dd4346ef23

SHA256
62a48313d307b08ac8b76b815404f28fd011fc1881f5a6a01cf040619a3d2b7e

SHA512
5e790522c1b90ce03447d255f081c5883613829bcbf63310aa57e46572a9d21f0829a86ad4b0b75a7618c767656b00c9b4bd067b2864690401069e9ff5a621ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\fhtnpi.exe

Filesize
341KB

MD5
76781348f4c89abbdacd706d55095c42

SHA1
53eb8809cfd2c449cda67b4d4c07b6d88af765c1

SHA256
4bd1339ad0e003c37172cd9bfde0c8d82bd0722f4d7ed966b357b23f15bb81b0

SHA512
a97f392276025647194dec12368a6f3a47d79785fb20fc6e985f2483ac0fdcce517afcedd04e5c649b4303d7bad3fcfe8ac6bf0d16e82102dbef7beb048c72e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\fhtnpi.exe

Filesize
341KB

MD5
76781348f4c89abbdacd706d55095c42

SHA1
53eb8809cfd2c449cda67b4d4c07b6d88af765c1

SHA256
4bd1339ad0e003c37172cd9bfde0c8d82bd0722f4d7ed966b357b23f15bb81b0

SHA512
a97f392276025647194dec12368a6f3a47d79785fb20fc6e985f2483ac0fdcce517afcedd04e5c649b4303d7bad3fcfe8ac6bf0d16e82102dbef7beb048c72e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\isqbef.exe

Filesize
2.1MB

MD5
87c951792c579c0575848ce66ccd1a3f

SHA1
3af2e3a01ae646b1de0727bf28177da02b99704a

SHA256
5a5ad4611576d88694960abc8c973d73de5a98e3e914f347866ffacdb8378504

SHA512
cacb87d93b5bb611097a9f12ee761f0f5eea38293b078e3508389d08de8089c0f3610350c60ddf026f01f8b6ce6c98eed196dda4dabdbe468977c9773537cf56

Download Submit
C:\Users\Admin\AppData\Local\Temp\isqbef.exe

Filesize
2.1MB

MD5
87c951792c579c0575848ce66ccd1a3f

SHA1
3af2e3a01ae646b1de0727bf28177da02b99704a

SHA256
5a5ad4611576d88694960abc8c973d73de5a98e3e914f347866ffacdb8378504

SHA512
cacb87d93b5bb611097a9f12ee761f0f5eea38293b078e3508389d08de8089c0f3610350c60ddf026f01f8b6ce6c98eed196dda4dabdbe468977c9773537cf56

Download Submit
C:\Users\Admin\AppData\Local\Temp\jnnbkp.exe

Filesize
2.0MB

MD5
285f25a1a6828a6ae6de46605e57ad37

SHA1
bcaa8d427d70e187068b7f0b1a31fa567554f7ce

SHA256
25b3f7de581553767ce2f232c7275cb46c999dcc6a4f2d5b15c3f6bb2b979bfa

SHA512
73a7c6541fd56b44e794fafeb57d9a3625891b8f8effb1958fe47e1839c092de3c2ef167aab962851476b5ab6cfa0cfc664f7baf489c4c90d424fbe444eb8fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\jnnbkp.exe

Filesize
2.0MB

MD5
285f25a1a6828a6ae6de46605e57ad37

SHA1
bcaa8d427d70e187068b7f0b1a31fa567554f7ce

SHA256
25b3f7de581553767ce2f232c7275cb46c999dcc6a4f2d5b15c3f6bb2b979bfa

SHA512
73a7c6541fd56b44e794fafeb57d9a3625891b8f8effb1958fe47e1839c092de3c2ef167aab962851476b5ab6cfa0cfc664f7baf489c4c90d424fbe444eb8fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcnaus.exe

Filesize
2.1MB

MD5
5966de489c6a199737a4a93c65d61118

SHA1
41235c1003f1d83f0d607d3fedc7df5e97f0709f

SHA256
b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565

SHA512
dcdb87f81f29d4413a0ad57bba33b6d641c8b348ab8b59ead5be8996a2eb68e9eda1242601d547f7c3ea5b44e0c31f609966a3d975673cfadab5336921248b8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcnaus.exe

Filesize
2.1MB

MD5
5966de489c6a199737a4a93c65d61118

SHA1
41235c1003f1d83f0d607d3fedc7df5e97f0709f

SHA256
b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565

SHA512
dcdb87f81f29d4413a0ad57bba33b6d641c8b348ab8b59ead5be8996a2eb68e9eda1242601d547f7c3ea5b44e0c31f609966a3d975673cfadab5336921248b8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1BAC.tmp.bat

Filesize
165B

MD5
ba6ef8b638c8a237aae04ada7a81ad9a

SHA1
9b3d8e9e7a5263a870f2ab751a90913f9c4c5d79

SHA256
fe88a5d7abd6a1c7ca22e43640b5ed68c493e98274c4430766e7ddc4d1f73be2

SHA512
a25bb27af6af065de3cc69c962be9a587994c80c3bf988775a74352b8acdaffad3f423685d2bcd3689be7c80792e2431f7ac38c56c931db54a360ddfce0dd3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1BAC.tmp.bat

Filesize
165B

MD5
ba6ef8b638c8a237aae04ada7a81ad9a

SHA1
9b3d8e9e7a5263a870f2ab751a90913f9c4c5d79

SHA256
fe88a5d7abd6a1c7ca22e43640b5ed68c493e98274c4430766e7ddc4d1f73be2

SHA512
a25bb27af6af065de3cc69c962be9a587994c80c3bf988775a74352b8acdaffad3f423685d2bcd3689be7c80792e2431f7ac38c56c931db54a360ddfce0dd3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3248.tmp.bat

Filesize
163B

MD5
7a395784418bb874713d0f505b8ea06b

SHA1
bdfa81c498c186dcdc7f9c6d5c5870fc47cde38c

SHA256
d659e86dfc09fcfad9b8bd3aabafa489b22445ca120a69ccd9502708f19d1847

SHA512
2f872ce1352bfad3a153c2ecba955fd03a3ccb12abb8fda9b49fab6a3e9dcda51d950d0cf0bce1a1a4146c5762dfe6d1faed7297323356d819705b265147805b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3248.tmp.bat

Filesize
163B

MD5
7a395784418bb874713d0f505b8ea06b

SHA1
bdfa81c498c186dcdc7f9c6d5c5870fc47cde38c

SHA256
d659e86dfc09fcfad9b8bd3aabafa489b22445ca120a69ccd9502708f19d1847

SHA512
2f872ce1352bfad3a153c2ecba955fd03a3ccb12abb8fda9b49fab6a3e9dcda51d950d0cf0bce1a1a4146c5762dfe6d1faed7297323356d819705b265147805b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp771.tmp.bat

Filesize
57B

MD5
eeea4570da8d4016976bdbcdb1b7a8a7

SHA1
db7316458b4352d76d60180cb8286b7f47395b9d

SHA256
01fe22d3c62f2ad09d69c640ed100410f592f858e8f36dda8f740c4d0146d033

SHA512
b316b1431810f517bfdb0cc21a661be4c7b5a10b039ae897759fff3a066b9cf940be2952f8abf895e41fc597a8647ad93dd0e29962d85ac0dc00494cc51a7090

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC034.tmp.bat

Filesize
57B

MD5
695e225a7a51bc5344350c429c854ea1

SHA1
8edb3740435d55f2ac79ab67d5bd20d01d357bef

SHA256
544843bea5d4cc03f2bb2a2ba56710d0fcd479189fbef0cf85abdb8a2898c784

SHA512
56c9318b01ef876d42a6e17535fc081c21bf61ac29f361d726c7bfd86a0706cad6b04605e8cf339c233d6dd2618b57c9a29b5ffc22ac282ad149ac116765014a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE976.tmp.bat

Filesize
56B

MD5
aa2e0bb15c63f5d01d2d6bd51f83e6fa

SHA1
aa45b3dca3255e71299b8bc6b0b01961b4d0c297

SHA256
7ceb037cc00d167b3742755068b384bce4cb6b5d0ec3827338e9a1972e0363a7

SHA512
66e80bdb15aeefce249d0ac235c30dc70764a5746dd0d3c96e22e3c1e5fa01da282d7c179e069dfd168fbd1519be837fce0aeae9acdd1be3ff65b7c9a0f88dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlycvw.exe

Filesize
143KB

MD5
7561817da0ab239f890c00a70f9720cb

SHA1
4bd71beb7b1360295fe3d8b468396ce7c8bf3896

SHA256
719127dde80d39d624ce94bce35a13b09486f64ba1be6383d6e213035b29201b

SHA512
fbd9d44d556fe7ee73d99e4480a3b971e01c2c99da37a78526ca461ef5b10f67bffdbcf6a7ab0541e7c036c482aa93e4215a20c307870447d4282594ffa66b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlycvw.exe

Filesize
143KB

MD5
7561817da0ab239f890c00a70f9720cb

SHA1
4bd71beb7b1360295fe3d8b468396ce7c8bf3896

SHA256
719127dde80d39d624ce94bce35a13b09486f64ba1be6383d6e213035b29201b

SHA512
fbd9d44d556fe7ee73d99e4480a3b971e01c2c99da37a78526ca461ef5b10f67bffdbcf6a7ab0541e7c036c482aa93e4215a20c307870447d4282594ffa66b50

Download Submit
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

Filesize
2.0MB

MD5
285f25a1a6828a6ae6de46605e57ad37

SHA1
bcaa8d427d70e187068b7f0b1a31fa567554f7ce

SHA256
25b3f7de581553767ce2f232c7275cb46c999dcc6a4f2d5b15c3f6bb2b979bfa

SHA512
73a7c6541fd56b44e794fafeb57d9a3625891b8f8effb1958fe47e1839c092de3c2ef167aab962851476b5ab6cfa0cfc664f7baf489c4c90d424fbe444eb8fa9

Download Submit
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

Filesize
2.0MB

MD5
285f25a1a6828a6ae6de46605e57ad37

SHA1
bcaa8d427d70e187068b7f0b1a31fa567554f7ce

SHA256
25b3f7de581553767ce2f232c7275cb46c999dcc6a4f2d5b15c3f6bb2b979bfa

SHA512
73a7c6541fd56b44e794fafeb57d9a3625891b8f8effb1958fe47e1839c092de3c2ef167aab962851476b5ab6cfa0cfc664f7baf489c4c90d424fbe444eb8fa9

Download Submit
C:\Users\Admin\AppData\Roaming\Google\Libs\g.log

Filesize
198B

MD5
37dd19b2be4fa7635ad6a2f3238c4af1

SHA1
e5b2c034636b434faee84e82e3bce3a3d3561943

SHA256
8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07

SHA512
86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
702b17b756b56c829f383d291cb40dee

SHA1
0693c1fa2101109b26bb3c22936357cda60154b8

SHA256
b051298c600220890eb9eb59e923cc4fd6d1aa7ac266cc96ce985e0f583e9c24

SHA512
0e523e1733d4de2a1d544e8a61c7494d3227c6464f53c860d68e62f979036fb75e7a089b8964d9917a984fecde2ad243b5b87484f4283c2348569d74e7444bbf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
702b17b756b56c829f383d291cb40dee

SHA1
0693c1fa2101109b26bb3c22936357cda60154b8

SHA256
b051298c600220890eb9eb59e923cc4fd6d1aa7ac266cc96ce985e0f583e9c24

SHA512
0e523e1733d4de2a1d544e8a61c7494d3227c6464f53c860d68e62f979036fb75e7a089b8964d9917a984fecde2ad243b5b87484f4283c2348569d74e7444bbf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\903ELAKGA0RR0A5PKUB2.temp

Filesize
7KB

MD5
f994674b116c44e841fa3fd5de06f7b2

SHA1
c45d1e542637cf4ea05db710fcf7caa4ca890704

SHA256
eaa4c3e1c45108c62452978cb24a4b481bafcd305cb43958252ad6cb809035c7

SHA512
588725c7b234986b14d409be831a72f06d21ca95216d97747eac9453c3f8e0d597b9d93c56a09f93001f643ec2df882805908a632c7b46ca82d9c0ae37fb9bc8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f994674b116c44e841fa3fd5de06f7b2

SHA1
c45d1e542637cf4ea05db710fcf7caa4ca890704

SHA256
eaa4c3e1c45108c62452978cb24a4b481bafcd305cb43958252ad6cb809035c7

SHA512
588725c7b234986b14d409be831a72f06d21ca95216d97747eac9453c3f8e0d597b9d93c56a09f93001f643ec2df882805908a632c7b46ca82d9c0ae37fb9bc8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f994674b116c44e841fa3fd5de06f7b2

SHA1
c45d1e542637cf4ea05db710fcf7caa4ca890704

SHA256
eaa4c3e1c45108c62452978cb24a4b481bafcd305cb43958252ad6cb809035c7

SHA512
588725c7b234986b14d409be831a72f06d21ca95216d97747eac9453c3f8e0d597b9d93c56a09f93001f643ec2df882805908a632c7b46ca82d9c0ae37fb9bc8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f994674b116c44e841fa3fd5de06f7b2

SHA1
c45d1e542637cf4ea05db710fcf7caa4ca890704

SHA256
eaa4c3e1c45108c62452978cb24a4b481bafcd305cb43958252ad6cb809035c7

SHA512
588725c7b234986b14d409be831a72f06d21ca95216d97747eac9453c3f8e0d597b9d93c56a09f93001f643ec2df882805908a632c7b46ca82d9c0ae37fb9bc8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f994674b116c44e841fa3fd5de06f7b2

SHA1
c45d1e542637cf4ea05db710fcf7caa4ca890704

SHA256
eaa4c3e1c45108c62452978cb24a4b481bafcd305cb43958252ad6cb809035c7

SHA512
588725c7b234986b14d409be831a72f06d21ca95216d97747eac9453c3f8e0d597b9d93c56a09f93001f643ec2df882805908a632c7b46ca82d9c0ae37fb9bc8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f994674b116c44e841fa3fd5de06f7b2

SHA1
c45d1e542637cf4ea05db710fcf7caa4ca890704

SHA256
eaa4c3e1c45108c62452978cb24a4b481bafcd305cb43958252ad6cb809035c7

SHA512
588725c7b234986b14d409be831a72f06d21ca95216d97747eac9453c3f8e0d597b9d93c56a09f93001f643ec2df882805908a632c7b46ca82d9c0ae37fb9bc8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f994674b116c44e841fa3fd5de06f7b2

SHA1
c45d1e542637cf4ea05db710fcf7caa4ca890704

SHA256
eaa4c3e1c45108c62452978cb24a4b481bafcd305cb43958252ad6cb809035c7

SHA512
588725c7b234986b14d409be831a72f06d21ca95216d97747eac9453c3f8e0d597b9d93c56a09f93001f643ec2df882805908a632c7b46ca82d9c0ae37fb9bc8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f994674b116c44e841fa3fd5de06f7b2

SHA1
c45d1e542637cf4ea05db710fcf7caa4ca890704

SHA256
eaa4c3e1c45108c62452978cb24a4b481bafcd305cb43958252ad6cb809035c7

SHA512
588725c7b234986b14d409be831a72f06d21ca95216d97747eac9453c3f8e0d597b9d93c56a09f93001f643ec2df882805908a632c7b46ca82d9c0ae37fb9bc8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f994674b116c44e841fa3fd5de06f7b2

SHA1
c45d1e542637cf4ea05db710fcf7caa4ca890704

SHA256
eaa4c3e1c45108c62452978cb24a4b481bafcd305cb43958252ad6cb809035c7

SHA512
588725c7b234986b14d409be831a72f06d21ca95216d97747eac9453c3f8e0d597b9d93c56a09f93001f643ec2df882805908a632c7b46ca82d9c0ae37fb9bc8

Download Submit
C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe

Filesize
341KB

MD5
76781348f4c89abbdacd706d55095c42

SHA1
53eb8809cfd2c449cda67b4d4c07b6d88af765c1

SHA256
4bd1339ad0e003c37172cd9bfde0c8d82bd0722f4d7ed966b357b23f15bb81b0

SHA512
a97f392276025647194dec12368a6f3a47d79785fb20fc6e985f2483ac0fdcce517afcedd04e5c649b4303d7bad3fcfe8ac6bf0d16e82102dbef7beb048c72e4

Download Submit
C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe

Filesize
341KB

MD5
76781348f4c89abbdacd706d55095c42

SHA1
53eb8809cfd2c449cda67b4d4c07b6d88af765c1

SHA256
4bd1339ad0e003c37172cd9bfde0c8d82bd0722f4d7ed966b357b23f15bb81b0

SHA512
a97f392276025647194dec12368a6f3a47d79785fb20fc6e985f2483ac0fdcce517afcedd04e5c649b4303d7bad3fcfe8ac6bf0d16e82102dbef7beb048c72e4

Download Submit
C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe

Filesize
341KB

MD5
76781348f4c89abbdacd706d55095c42

SHA1
53eb8809cfd2c449cda67b4d4c07b6d88af765c1

SHA256
4bd1339ad0e003c37172cd9bfde0c8d82bd0722f4d7ed966b357b23f15bb81b0

SHA512
a97f392276025647194dec12368a6f3a47d79785fb20fc6e985f2483ac0fdcce517afcedd04e5c649b4303d7bad3fcfe8ac6bf0d16e82102dbef7beb048c72e4

Download Submit
C:\Users\Admin\AppData\Roaming\SecureSystemHelper\SystemSecurityHelper.exe

Filesize
341KB

MD5
76781348f4c89abbdacd706d55095c42

SHA1
53eb8809cfd2c449cda67b4d4c07b6d88af765c1

SHA256
4bd1339ad0e003c37172cd9bfde0c8d82bd0722f4d7ed966b357b23f15bb81b0

SHA512
a97f392276025647194dec12368a6f3a47d79785fb20fc6e985f2483ac0fdcce517afcedd04e5c649b4303d7bad3fcfe8ac6bf0d16e82102dbef7beb048c72e4

Download Submit
C:\Users\Admin\AppData\Roaming\System Security Logs\03-07-2023

Filesize
224B

MD5
0949e5ec402476f0e98cdd6406a78fdb

SHA1
ad7650d12591753588b0f5e138fac6bd388e4730

SHA256
9303139d952ecf825545ce40831cdc1d002413cb8167b2b9136e7e578cccfb42

SHA512
e5925606e75f945e00adf7d18d29db8be5d38622a6e0edc2714e6b196390d9b43c191c6d6b99d645dfede7d6c7c5ef81b3859148c5f2e9fd34dee062f07a8d89

Download Submit
C:\Users\Admin\AppData\Roaming\System Security Logs\03-07-2023

Filesize
224B

MD5
2a9f4bc6ffc059b72b6c6c55885d89a1

SHA1
94aad81e919821190abd4d43e536fbbbe0ee2fc0

SHA256
4f83c1198749d70e96f226ec792a3d56145efa9a24491dcb999a6b0dd1300982

SHA512
71f8db51c600b12c3f1330ca5c303edf00a290810cb652ffdef7c2924d6929bcdb108a085060e9d12a7797a2d5a0194596b6ff103451dd587fd559a97e7a0a76

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSettingsHelper.exe

Filesize
47KB

MD5
4df29d7678c4533be7a9ad05e4bf752a

SHA1
c6ee50bf6f5a8525e73b8394e6646de4b56c0deb

SHA256
8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7

SHA512
52861a3bf99ad4be25003952b7802a6f47aea7b335321f2d041426edbfafd84d3f9ef971726214ffd43c737ff7360aa5e1fa595fc3cfbfef1761cb045ac21744

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSettingsHelper.exe

Filesize
47KB

MD5
4df29d7678c4533be7a9ad05e4bf752a

SHA1
c6ee50bf6f5a8525e73b8394e6646de4b56c0deb

SHA256
8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7

SHA512
52861a3bf99ad4be25003952b7802a6f47aea7b335321f2d041426edbfafd84d3f9ef971726214ffd43c737ff7360aa5e1fa595fc3cfbfef1761cb045ac21744

Download Submit
C:\autorun.inf

Filesize
34B

MD5
2be66b41a1a72d315e8a4ec57979d854

SHA1
421f568c54cad9796d45cc4f5ed605be3a8da049

SHA256
a6edb38914b9dde0adf13eacf47d16ddc505913612d6f27917a651ca65949a06

SHA512
fba514056afec3960d12bbc5c47becafe768c9a9a9df615cb6906da6082069f17c6960641f6eedbad4791fa4cb74c222194cd094cfcdd7400cdd8f51fe0bdd4f

Download Submit
\Users\Admin\AppData\Local\Temp\anlhmf.exe

Filesize
60KB

MD5
cc03a2d1054638fb5c8d67459ccd4e59

SHA1
1b05d8fcb8744121a9ea2d8ef30e29dd4346ef23

SHA256
62a48313d307b08ac8b76b815404f28fd011fc1881f5a6a01cf040619a3d2b7e

SHA512
5e790522c1b90ce03447d255f081c5883613829bcbf63310aa57e46572a9d21f0829a86ad4b0b75a7618c767656b00c9b4bd067b2864690401069e9ff5a621ff

Download Submit
\Users\Admin\AppData\Local\Temp\cywvvy.exe

Filesize
2.1MB

MD5
d0a98def92275e8e311b76b6e2e3905c

SHA1
e0b62be18aeacc994723b680321373b0459dd952

SHA256
c177c06ceca5875296f41c54f97639dff8e037aa577d93bde7bdc7b140e1dbe5

SHA512
b7e98b82202e234c1317c5440cb9d66d03b6ba337fdae7b18d31e5fbb6ee54594829138f1c491f72c1a717983d43eedf336aaaca7b17ce3dc025cf49b05551ac

Download Submit
\Users\Admin\AppData\Local\Temp\dmpF4GD3.tmp.scr.exe

Filesize
60KB

MD5
cc03a2d1054638fb5c8d67459ccd4e59

SHA1
1b05d8fcb8744121a9ea2d8ef30e29dd4346ef23

SHA256
62a48313d307b08ac8b76b815404f28fd011fc1881f5a6a01cf040619a3d2b7e

SHA512
5e790522c1b90ce03447d255f081c5883613829bcbf63310aa57e46572a9d21f0829a86ad4b0b75a7618c767656b00c9b4bd067b2864690401069e9ff5a621ff

Download Submit
\Users\Admin\AppData\Local\Temp\fhtnpi.exe

Filesize
341KB

MD5
76781348f4c89abbdacd706d55095c42

SHA1
53eb8809cfd2c449cda67b4d4c07b6d88af765c1

SHA256
4bd1339ad0e003c37172cd9bfde0c8d82bd0722f4d7ed966b357b23f15bb81b0

SHA512
a97f392276025647194dec12368a6f3a47d79785fb20fc6e985f2483ac0fdcce517afcedd04e5c649b4303d7bad3fcfe8ac6bf0d16e82102dbef7beb048c72e4

Download Submit
\Users\Admin\AppData\Local\Temp\isqbef.exe

Filesize
2.1MB

MD5
87c951792c579c0575848ce66ccd1a3f

SHA1
3af2e3a01ae646b1de0727bf28177da02b99704a

SHA256
5a5ad4611576d88694960abc8c973d73de5a98e3e914f347866ffacdb8378504

SHA512
cacb87d93b5bb611097a9f12ee761f0f5eea38293b078e3508389d08de8089c0f3610350c60ddf026f01f8b6ce6c98eed196dda4dabdbe468977c9773537cf56

Download Submit
\Users\Admin\AppData\Local\Temp\jnnbkp.exe

Filesize
2.0MB

MD5
285f25a1a6828a6ae6de46605e57ad37

SHA1
bcaa8d427d70e187068b7f0b1a31fa567554f7ce

SHA256
25b3f7de581553767ce2f232c7275cb46c999dcc6a4f2d5b15c3f6bb2b979bfa

SHA512
73a7c6541fd56b44e794fafeb57d9a3625891b8f8effb1958fe47e1839c092de3c2ef167aab962851476b5ab6cfa0cfc664f7baf489c4c90d424fbe444eb8fa9

Download Submit
\Users\Admin\AppData\Local\Temp\pcnaus.exe

Filesize
2.1MB

MD5
5966de489c6a199737a4a93c65d61118

SHA1
41235c1003f1d83f0d607d3fedc7df5e97f0709f

SHA256
b9a0ab6783fc1e24b947c012dde5dc639629ebf7845b0f1fb4045b721be96565

SHA512
dcdb87f81f29d4413a0ad57bba33b6d641c8b348ab8b59ead5be8996a2eb68e9eda1242601d547f7c3ea5b44e0c31f609966a3d975673cfadab5336921248b8c

Download Submit
\Users\Admin\AppData\Local\Temp\xlycvw.exe

Filesize
143KB

MD5
7561817da0ab239f890c00a70f9720cb

SHA1
4bd71beb7b1360295fe3d8b468396ce7c8bf3896

SHA256
719127dde80d39d624ce94bce35a13b09486f64ba1be6383d6e213035b29201b

SHA512
fbd9d44d556fe7ee73d99e4480a3b971e01c2c99da37a78526ca461ef5b10f67bffdbcf6a7ab0541e7c036c482aa93e4215a20c307870447d4282594ffa66b50

Download Submit
\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

Filesize
2.0MB

MD5
285f25a1a6828a6ae6de46605e57ad37

SHA1
bcaa8d427d70e187068b7f0b1a31fa567554f7ce

SHA256
25b3f7de581553767ce2f232c7275cb46c999dcc6a4f2d5b15c3f6bb2b979bfa

SHA512
73a7c6541fd56b44e794fafeb57d9a3625891b8f8effb1958fe47e1839c092de3c2ef167aab962851476b5ab6cfa0cfc664f7baf489c4c90d424fbe444eb8fa9

Download Submit
\Users\Admin\AppData\Roaming\WindowsSettingsHelper.exe

Filesize
47KB

MD5
4df29d7678c4533be7a9ad05e4bf752a

SHA1
c6ee50bf6f5a8525e73b8394e6646de4b56c0deb

SHA256
8dd5914e40b211d4ce4ec927bac083975e4e1910498bcbf45f1233a755c2f3a7

SHA512
52861a3bf99ad4be25003952b7802a6f47aea7b335321f2d041426edbfafd84d3f9ef971726214ffd43c737ff7360aa5e1fa595fc3cfbfef1761cb045ac21744

Download Submit
memory/336-54-0x0000000000DA0000-0x0000000000DB2000-memory.dmp

Filesize
72KB

Download
memory/336-55-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/560-469-0x00000000002A0000-0x00000000002A8000-memory.dmp

Filesize
32KB

Download
memory/560-471-0x0000000001F40000-0x0000000001FC0000-memory.dmp

Filesize
512KB

Download
memory/560-224-0x00000000000B0000-0x00000000000C6000-memory.dmp

Filesize
88KB

Download
memory/596-302-0x000000013FE60000-0x0000000140071000-memory.dmp

Filesize
2.1MB

Download
memory/596-347-0x000000013FE60000-0x0000000140071000-memory.dmp

Filesize
2.1MB

Download
memory/824-393-0x0000000002474000-0x0000000002477000-memory.dmp

Filesize
12KB

Download
memory/824-394-0x000000000247B000-0x00000000024B2000-memory.dmp

Filesize
220KB

Download
memory/824-392-0x00000000024F0000-0x00000000024F8000-memory.dmp

Filesize
32KB

Download
memory/824-391-0x000000001B100000-0x000000001B3E2000-memory.dmp

Filesize
2.9MB

Download
memory/856-117-0x0000000004990000-0x00000000049D0000-memory.dmp

Filesize
256KB

Download
memory/856-116-0x0000000000A50000-0x0000000000C64000-memory.dmp

Filesize
2.1MB

Download
memory/856-150-0x0000000004990000-0x00000000049D0000-memory.dmp

Filesize
256KB

Download
memory/952-402-0x000000013F8C0000-0x000000013FAD1000-memory.dmp

Filesize
2.1MB

Download
memory/952-385-0x000000013F8C0000-0x000000013FAD1000-memory.dmp

Filesize
2.1MB

Download
memory/964-329-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/964-331-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/964-330-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/976-111-0x0000000002640000-0x0000000002680000-memory.dmp

Filesize
256KB

Download
memory/976-112-0x0000000002640000-0x0000000002680000-memory.dmp

Filesize
256KB

Download
memory/1132-149-0x00000000043A0000-0x00000000043E0000-memory.dmp

Filesize
256KB

Download
memory/1132-148-0x0000000000A80000-0x0000000000C94000-memory.dmp

Filesize
2.1MB

Download
memory/1296-343-0x0000000002730000-0x00000000027B0000-memory.dmp

Filesize
512KB

Download
memory/1296-345-0x0000000002730000-0x00000000027B0000-memory.dmp

Filesize
512KB

Download
memory/1296-344-0x0000000002730000-0x00000000027B0000-memory.dmp

Filesize
512KB

Download
memory/1296-341-0x000000001AF60000-0x000000001B242000-memory.dmp

Filesize
2.9MB

Download
memory/1296-342-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/1484-481-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-404-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-509-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-507-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-503-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-499-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-497-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-495-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-493-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-491-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-403-0x0000000000140000-0x0000000000160000-memory.dmp

Filesize
128KB

Download
memory/1484-462-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-485-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-440-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-479-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-439-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-477-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1484-474-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1500-476-0x0000000140000000-0x0000000140016000-memory.dmp

Filesize
88KB

Download
memory/1500-438-0x0000000140000000-0x0000000140016000-memory.dmp

Filesize
88KB

Download
memory/1632-356-0x00000000024BB000-0x00000000024F2000-memory.dmp

Filesize
220KB

Download
memory/1632-353-0x000000001B080000-0x000000001B362000-memory.dmp

Filesize
2.9MB

Download
memory/1632-355-0x00000000024B4000-0x00000000024B7000-memory.dmp

Filesize
12KB

Download
memory/1632-354-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/1640-361-0x0000000005180000-0x00000000051FE000-memory.dmp

Filesize
504KB

Download
memory/1640-69-0x00000000023C0000-0x0000000002400000-memory.dmp

Filesize
256KB

Download
memory/1640-118-0x00000000023C0000-0x0000000002400000-memory.dmp

Filesize
256KB

Download
memory/1640-68-0x0000000000CA0000-0x0000000000CB2000-memory.dmp

Filesize
72KB

Download
memory/1640-193-0x00000000023A0000-0x00000000023C2000-memory.dmp

Filesize
136KB

Download
memory/1640-382-0x0000000002490000-0x000000000249A000-memory.dmp

Filesize
40KB

Download
memory/1640-383-0x00000000055C0000-0x0000000005650000-memory.dmp

Filesize
576KB

Download
memory/1640-87-0x0000000000590000-0x00000000005B2000-memory.dmp

Filesize
136KB

Download
memory/1640-384-0x0000000005930000-0x0000000005990000-memory.dmp

Filesize
384KB

Download
memory/1656-502-0x000000001AC50000-0x000000001ACD0000-memory.dmp

Filesize
512KB

Download
memory/1716-463-0x000000001B050000-0x000000001B0D0000-memory.dmp

Filesize
512KB

Download
memory/1716-435-0x0000000001070000-0x0000000001078000-memory.dmp

Filesize
32KB

Download
memory/1716-436-0x0000000000250000-0x00000000002EE000-memory.dmp

Filesize
632KB

Download
memory/1716-437-0x000000001B050000-0x000000001B0D0000-memory.dmp

Filesize
512KB

Download
memory/1724-301-0x0000000000B10000-0x0000000000B50000-memory.dmp

Filesize
256KB

Download
memory/1724-265-0x0000000000B10000-0x0000000000B50000-memory.dmp

Filesize
256KB

Download
memory/1724-243-0x0000000000D20000-0x0000000000D36000-memory.dmp

Filesize
88KB

Download
memory/1760-184-0x0000000000390000-0x00000000005A4000-memory.dmp

Filesize
2.1MB

Download
memory/1760-185-0x0000000000860000-0x00000000008A0000-memory.dmp

Filesize
256KB

Download
memory/1856-360-0x0000000004C80000-0x0000000004CC0000-memory.dmp

Filesize
256KB

Download
memory/1856-335-0x0000000000D80000-0x0000000000DAA000-memory.dmp

Filesize
168KB

Download
memory/1856-395-0x0000000004C80000-0x0000000004CC0000-memory.dmp

Filesize
256KB

Download
memory/1956-179-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/1956-180-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/2016-486-0x000000001A760000-0x000000001A7E0000-memory.dmp

Filesize
512KB

Download
memory/2016-484-0x0000000001300000-0x0000000001308000-memory.dmp

Filesize
32KB

Download