Analysis
-
max time kernel
165s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe
Resource
win10v2004-20230220-en
General
-
Target
5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe
-
Size
1.5MB
-
MD5
ee19c02edc80174071bcd1306c2a8406
-
SHA1
f1e150c5b3a9c4b01ad633a03a57de79e0d6570f
-
SHA256
5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75
-
SHA512
c3d6308ec2939b6efdef4db59fd115daf582e1a25b1ce251c9c6076c0655264483d782c1bd9bea0c57616d9039102cf4fbf660fd3700c86f8bf74055e428b0b6
-
SSDEEP
24576:EydBMwYRHEWGEHkdtryKmrRYXXyGWLyUWAena6Zjkoqc:TLaHWtOK2CEaacw
Malware Config
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 3 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/1884-6696-0x0000000005200000-0x0000000005818000-memory.dmp redline_stealer behavioral2/memory/2056-6734-0x0000000005140000-0x0000000005768000-memory.dmp redline_stealer behavioral2/memory/2056-6743-0x0000000005A00000-0x0000000005A66000-memory.dmp redline_stealer -
Processes:
1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
26628038.exew61MO23.exeoneetx.exexLorO71.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation 26628038.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation w61MO23.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation xLorO71.exe -
Executes dropped EXE 16 IoCs
Processes:
za265333.exeza571665.exeza966696.exe26628038.exe1.exeu14115753.exew61MO23.exeoneetx.exexLorO71.exeDelta2023.exe1.exeoneetx.exeEngine.exeys490490.exeBondage.exe.pifoneetx.exepid process 4888 za265333.exe 3628 za571665.exe 3912 za966696.exe 3720 26628038.exe 4488 1.exe 4524 u14115753.exe 4152 w61MO23.exe 4080 oneetx.exe 400 xLorO71.exe 844 Delta2023.exe 1884 1.exe 3624 oneetx.exe 1000 Engine.exe 3488 ys490490.exe 2208 Bondage.exe.pif 4452 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4272 rundll32.exe -
Processes:
1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 1.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
za265333.exeza571665.exeza966696.exe5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za265333.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za265333.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za571665.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za571665.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za966696.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" za966696.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 992 4524 WerFault.exe u14115753.exe 4068 400 WerFault.exe xLorO71.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1060 schtasks.exe 2144 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1529757233-3489015626-3409890339-1000\{4846AC91-994E-4207-A2B9-D791C9FE9C56} svchost.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
1.exepowershell.exepowershell.exeBondage.exe.pifpid process 4488 1.exe 4488 1.exe 2056 powershell.exe 2056 powershell.exe 2056 powershell.exe 1288 powershell.exe 1288 powershell.exe 1288 powershell.exe 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
26628038.exe1.exeu14115753.exexLorO71.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3720 26628038.exe Token: SeDebugPrivilege 4488 1.exe Token: SeDebugPrivilege 4524 u14115753.exe Token: SeDebugPrivilege 400 xLorO71.exe Token: SeDebugPrivilege 2056 powershell.exe Token: SeDebugPrivilege 1288 powershell.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
w61MO23.exeBondage.exe.pifpid process 4152 w61MO23.exe 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
Bondage.exe.pifpid process 2208 Bondage.exe.pif 2208 Bondage.exe.pif 2208 Bondage.exe.pif -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 100 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exeza265333.exeza571665.exeza966696.exe26628038.exew61MO23.exeoneetx.exexLorO71.exeDelta2023.exeEngine.execmd.execmd.exedescription pid process target process PID 4764 wrote to memory of 4888 4764 5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe za265333.exe PID 4764 wrote to memory of 4888 4764 5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe za265333.exe PID 4764 wrote to memory of 4888 4764 5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe za265333.exe PID 4888 wrote to memory of 3628 4888 za265333.exe za571665.exe PID 4888 wrote to memory of 3628 4888 za265333.exe za571665.exe PID 4888 wrote to memory of 3628 4888 za265333.exe za571665.exe PID 3628 wrote to memory of 3912 3628 za571665.exe za966696.exe PID 3628 wrote to memory of 3912 3628 za571665.exe za966696.exe PID 3628 wrote to memory of 3912 3628 za571665.exe za966696.exe PID 3912 wrote to memory of 3720 3912 za966696.exe 26628038.exe PID 3912 wrote to memory of 3720 3912 za966696.exe 26628038.exe PID 3912 wrote to memory of 3720 3912 za966696.exe 26628038.exe PID 3720 wrote to memory of 4488 3720 26628038.exe 1.exe PID 3720 wrote to memory of 4488 3720 26628038.exe 1.exe PID 3912 wrote to memory of 4524 3912 za966696.exe u14115753.exe PID 3912 wrote to memory of 4524 3912 za966696.exe u14115753.exe PID 3912 wrote to memory of 4524 3912 za966696.exe u14115753.exe PID 3628 wrote to memory of 4152 3628 za571665.exe w61MO23.exe PID 3628 wrote to memory of 4152 3628 za571665.exe w61MO23.exe PID 3628 wrote to memory of 4152 3628 za571665.exe w61MO23.exe PID 4152 wrote to memory of 4080 4152 w61MO23.exe oneetx.exe PID 4152 wrote to memory of 4080 4152 w61MO23.exe oneetx.exe PID 4152 wrote to memory of 4080 4152 w61MO23.exe oneetx.exe PID 4888 wrote to memory of 400 4888 za265333.exe xLorO71.exe PID 4888 wrote to memory of 400 4888 za265333.exe xLorO71.exe PID 4888 wrote to memory of 400 4888 za265333.exe xLorO71.exe PID 4080 wrote to memory of 1060 4080 oneetx.exe schtasks.exe PID 4080 wrote to memory of 1060 4080 oneetx.exe schtasks.exe PID 4080 wrote to memory of 1060 4080 oneetx.exe schtasks.exe PID 4080 wrote to memory of 844 4080 oneetx.exe Delta2023.exe PID 4080 wrote to memory of 844 4080 oneetx.exe Delta2023.exe PID 4080 wrote to memory of 844 4080 oneetx.exe Delta2023.exe PID 400 wrote to memory of 1884 400 xLorO71.exe 1.exe PID 400 wrote to memory of 1884 400 xLorO71.exe 1.exe PID 400 wrote to memory of 1884 400 xLorO71.exe 1.exe PID 844 wrote to memory of 1000 844 Delta2023.exe Engine.exe PID 844 wrote to memory of 1000 844 Delta2023.exe Engine.exe PID 844 wrote to memory of 1000 844 Delta2023.exe Engine.exe PID 4764 wrote to memory of 3488 4764 5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe ys490490.exe PID 4764 wrote to memory of 3488 4764 5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe ys490490.exe PID 4764 wrote to memory of 3488 4764 5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe ys490490.exe PID 1000 wrote to memory of 216 1000 Engine.exe cmd.exe PID 1000 wrote to memory of 216 1000 Engine.exe cmd.exe PID 1000 wrote to memory of 216 1000 Engine.exe cmd.exe PID 216 wrote to memory of 4688 216 cmd.exe cmd.exe PID 216 wrote to memory of 4688 216 cmd.exe cmd.exe PID 216 wrote to memory of 4688 216 cmd.exe cmd.exe PID 4688 wrote to memory of 2056 4688 cmd.exe powershell.exe PID 4688 wrote to memory of 2056 4688 cmd.exe powershell.exe PID 4688 wrote to memory of 2056 4688 cmd.exe powershell.exe PID 4688 wrote to memory of 1288 4688 cmd.exe powershell.exe PID 4688 wrote to memory of 1288 4688 cmd.exe powershell.exe PID 4688 wrote to memory of 1288 4688 cmd.exe powershell.exe PID 4080 wrote to memory of 4272 4080 oneetx.exe rundll32.exe PID 4080 wrote to memory of 4272 4080 oneetx.exe rundll32.exe PID 4080 wrote to memory of 4272 4080 oneetx.exe rundll32.exe PID 4688 wrote to memory of 3652 4688 cmd.exe findstr.exe PID 4688 wrote to memory of 3652 4688 cmd.exe findstr.exe PID 4688 wrote to memory of 3652 4688 cmd.exe findstr.exe PID 4688 wrote to memory of 2208 4688 cmd.exe Bondage.exe.pif PID 4688 wrote to memory of 2208 4688 cmd.exe Bondage.exe.pif PID 4688 wrote to memory of 2208 4688 cmd.exe Bondage.exe.pif PID 4688 wrote to memory of 1932 4688 cmd.exe PING.EXE PID 4688 wrote to memory of 1932 4688 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe"C:\Users\Admin\AppData\Local\Temp\5646a554a65769048705e3ae7a9118acbc53643d8115529b75d03dbf7e654a75.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za265333.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za265333.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za571665.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za571665.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za966696.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za966696.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\26628038.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\26628038.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u14115753.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u14115753.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4524 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 12646⤵
- Program crash
PID:992 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w61MO23.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w61MO23.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F6⤵
- Creates scheduled task(s)
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\1000092001\Delta2023.exe"C:\Users\Admin\AppData\Local\Temp\1000092001\Delta2023.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\Engine.exeC:\Users\Admin\AppData\Local\Temp\SETUP_3032\Engine.exe /TH_ID=_4484 /OriginExe="C:\Users\Admin\AppData\Local\Temp\1000092001\Delta2023.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cmd < Yugoslavia8⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\cmd.execmd9⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avastui10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avgui10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^TiesHighsFridayPromisedOrganismsPromotedStronglyBannersTermExplainOrganisedPhpLastingMaritime$" Finding10⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\smzntdjf.xp4\27976\Bondage.exe.pif27976\\Bondage.exe.pif 27976\\M10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2208 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "dZVxEGlqbg" /tr "C:\Users\Admin\AppData\Roaming\claRXiEwVe\dZVxEGlqbg.exe.com C:\Users\Admin\AppData\Roaming\claRXiEwVe\H" /sc onlogon /F /RL HIGHEST11⤵
- Creates scheduled task(s)
PID:2144 -
C:\Windows\SysWOW64\PING.EXEping localhost -n 1810⤵
- Runs ping.exe
PID:1932 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xLorO71.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xLorO71.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
PID:1884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 14564⤵
- Program crash
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys490490.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys490490.exe2⤵
- Executes dropped EXE
PID:3488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4524 -ip 45241⤵PID:2004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 400 -ip 4001⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:3624
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:100
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4680
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
PID:4452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵PID:1224
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD5def65711d78669d7f8e69313be4acf2e
SHA16522ebf1de09eeb981e270bd95114bc69a49cda6
SHA256aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
SHA51205b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5a16f8619ba4749274cdc556c04d0efbd
SHA1b254f0462857e930baaf8c06e09dd20ca98f155c
SHA256b81dafe08ab461f760d68545f24d0c3f527b0741f567c220e872452062036d6f
SHA512655a4037577512abfd4fe69bf6f4762eb088e76dfba6bfe9148feb22cca54b56035ec9ad76b1bf67b3eb206ac2061d0a86cc12e96238e1dd603f992826c70580
-
C:\Users\Admin\AppData\Local\Temp\1000092001\Delta2023.exeFilesize
1.7MB
MD54f24c94182a964c6706c1920a73822c0
SHA15fd5f215270c5f7ff7828d8e1fe7e784094ae2f0
SHA25645afb3a562e84e75c19fe08404921b2c05900a6037f04d5aa61eca9ea7254ef3
SHA512d1f7d8b5b6f1f3464a2946b861bc7c919623ad3fddeb7899d546fae93f6d864fd614a88b043c46d990942eaf59076a72702ad17dca26b178c8312c75219ce1fd
-
C:\Users\Admin\AppData\Local\Temp\1000092001\Delta2023.exeFilesize
1.7MB
MD54f24c94182a964c6706c1920a73822c0
SHA15fd5f215270c5f7ff7828d8e1fe7e784094ae2f0
SHA25645afb3a562e84e75c19fe08404921b2c05900a6037f04d5aa61eca9ea7254ef3
SHA512d1f7d8b5b6f1f3464a2946b861bc7c919623ad3fddeb7899d546fae93f6d864fd614a88b043c46d990942eaf59076a72702ad17dca26b178c8312c75219ce1fd
-
C:\Users\Admin\AppData\Local\Temp\1000092001\Delta2023.exeFilesize
1.7MB
MD54f24c94182a964c6706c1920a73822c0
SHA15fd5f215270c5f7ff7828d8e1fe7e784094ae2f0
SHA25645afb3a562e84e75c19fe08404921b2c05900a6037f04d5aa61eca9ea7254ef3
SHA512d1f7d8b5b6f1f3464a2946b861bc7c919623ad3fddeb7899d546fae93f6d864fd614a88b043c46d990942eaf59076a72702ad17dca26b178c8312c75219ce1fd
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
229KB
MD5ce5803218604f5a7b5843e7be82c5204
SHA1cbfb0b33c881d6e517467a7a83cd9ae9ebab7bef
SHA256e05d02b51e01f68d1e86dd95d004c27025ecdc4fcb38b972934ad12053c627f0
SHA51249bd7f638d43e20a7eb377faee36e940bfb0c6e3dddcd20dd7ce092700c29a61c4254113728d7d886aa1011e2d02082f3fdd214952521f7faf351bb8c548cc9c
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
229KB
MD5ce5803218604f5a7b5843e7be82c5204
SHA1cbfb0b33c881d6e517467a7a83cd9ae9ebab7bef
SHA256e05d02b51e01f68d1e86dd95d004c27025ecdc4fcb38b972934ad12053c627f0
SHA51249bd7f638d43e20a7eb377faee36e940bfb0c6e3dddcd20dd7ce092700c29a61c4254113728d7d886aa1011e2d02082f3fdd214952521f7faf351bb8c548cc9c
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
229KB
MD5ce5803218604f5a7b5843e7be82c5204
SHA1cbfb0b33c881d6e517467a7a83cd9ae9ebab7bef
SHA256e05d02b51e01f68d1e86dd95d004c27025ecdc4fcb38b972934ad12053c627f0
SHA51249bd7f638d43e20a7eb377faee36e940bfb0c6e3dddcd20dd7ce092700c29a61c4254113728d7d886aa1011e2d02082f3fdd214952521f7faf351bb8c548cc9c
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
229KB
MD5ce5803218604f5a7b5843e7be82c5204
SHA1cbfb0b33c881d6e517467a7a83cd9ae9ebab7bef
SHA256e05d02b51e01f68d1e86dd95d004c27025ecdc4fcb38b972934ad12053c627f0
SHA51249bd7f638d43e20a7eb377faee36e940bfb0c6e3dddcd20dd7ce092700c29a61c4254113728d7d886aa1011e2d02082f3fdd214952521f7faf351bb8c548cc9c
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
229KB
MD5ce5803218604f5a7b5843e7be82c5204
SHA1cbfb0b33c881d6e517467a7a83cd9ae9ebab7bef
SHA256e05d02b51e01f68d1e86dd95d004c27025ecdc4fcb38b972934ad12053c627f0
SHA51249bd7f638d43e20a7eb377faee36e940bfb0c6e3dddcd20dd7ce092700c29a61c4254113728d7d886aa1011e2d02082f3fdd214952521f7faf351bb8c548cc9c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys490490.exeFilesize
168KB
MD5f1516d0ff9ed6f5cd8ceea1e878c327b
SHA106201b2fad7a8166f0572b43e0b77f46ae631cac
SHA25617c5a224a869017a809ad3bf7e32a60ce00ed83f6d6c80fe66f11f4106861036
SHA512b801119440249561cbe96de6a70e0d9fd5084dcae587ed5432f5a4482b789d56b9d24cd0ed6e811c302023c6d181e29a56a4f977a5b85691e75d77edfd068b64
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ys490490.exeFilesize
168KB
MD5f1516d0ff9ed6f5cd8ceea1e878c327b
SHA106201b2fad7a8166f0572b43e0b77f46ae631cac
SHA25617c5a224a869017a809ad3bf7e32a60ce00ed83f6d6c80fe66f11f4106861036
SHA512b801119440249561cbe96de6a70e0d9fd5084dcae587ed5432f5a4482b789d56b9d24cd0ed6e811c302023c6d181e29a56a4f977a5b85691e75d77edfd068b64
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za265333.exeFilesize
1.3MB
MD5a8a6ef2febad43893677a572fa95be38
SHA169e8b6d96cd4a696b05e0134613f142a7e69bff6
SHA256e530058dc47a1440e15d65bc073de8077b191c42fc43875fcf3010d883cb2adc
SHA512ffbde4fcd9ff5fe40782be3770a3f43396ccf2b5b4ec21d17ba2768bff0bcd001f71194c32e924e4b785bad277123ade5d7b4acd1d3af1657d500285cdeb66dd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za265333.exeFilesize
1.3MB
MD5a8a6ef2febad43893677a572fa95be38
SHA169e8b6d96cd4a696b05e0134613f142a7e69bff6
SHA256e530058dc47a1440e15d65bc073de8077b191c42fc43875fcf3010d883cb2adc
SHA512ffbde4fcd9ff5fe40782be3770a3f43396ccf2b5b4ec21d17ba2768bff0bcd001f71194c32e924e4b785bad277123ade5d7b4acd1d3af1657d500285cdeb66dd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xLorO71.exeFilesize
582KB
MD5b8862a816b0ebf13894d3cb9203030d1
SHA1c5da30742deb0bfee95fe43b3b35c5bb00b16d87
SHA256684e8c37549e58e744794725a043a23201f760bad0deb7677b0457bc39f88887
SHA512d910415ebdbccdcbff488ef1e5f6cec49cd84bfd471cbeee25a2b3b97d7a7f3e259b0e8ea8ed3d23a6b97e603619e8affa7891826dd6efb7162b8572ead3f0b2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xLorO71.exeFilesize
582KB
MD5b8862a816b0ebf13894d3cb9203030d1
SHA1c5da30742deb0bfee95fe43b3b35c5bb00b16d87
SHA256684e8c37549e58e744794725a043a23201f760bad0deb7677b0457bc39f88887
SHA512d910415ebdbccdcbff488ef1e5f6cec49cd84bfd471cbeee25a2b3b97d7a7f3e259b0e8ea8ed3d23a6b97e603619e8affa7891826dd6efb7162b8572ead3f0b2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za571665.exeFilesize
862KB
MD566395e26e84dc21c79985fd3a139b5e3
SHA11b1307f6ce9ae56ee22c90cc5e8289be72d8fbc3
SHA2567e7cfe0ed4d33db41b4fd83d2d26c2338c62ec4583f5c7bc5aef1fb8bd181030
SHA512cb0dbf34779e21c1750f2288a8d7daee18382616848ca30271492b92730c9d7ca222ed185e9c4f921bf1d0b475d6077f9eb9f437dbf1a3f996763d5804d982c3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za571665.exeFilesize
862KB
MD566395e26e84dc21c79985fd3a139b5e3
SHA11b1307f6ce9ae56ee22c90cc5e8289be72d8fbc3
SHA2567e7cfe0ed4d33db41b4fd83d2d26c2338c62ec4583f5c7bc5aef1fb8bd181030
SHA512cb0dbf34779e21c1750f2288a8d7daee18382616848ca30271492b92730c9d7ca222ed185e9c4f921bf1d0b475d6077f9eb9f437dbf1a3f996763d5804d982c3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w61MO23.exeFilesize
229KB
MD5ce5803218604f5a7b5843e7be82c5204
SHA1cbfb0b33c881d6e517467a7a83cd9ae9ebab7bef
SHA256e05d02b51e01f68d1e86dd95d004c27025ecdc4fcb38b972934ad12053c627f0
SHA51249bd7f638d43e20a7eb377faee36e940bfb0c6e3dddcd20dd7ce092700c29a61c4254113728d7d886aa1011e2d02082f3fdd214952521f7faf351bb8c548cc9c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w61MO23.exeFilesize
229KB
MD5ce5803218604f5a7b5843e7be82c5204
SHA1cbfb0b33c881d6e517467a7a83cd9ae9ebab7bef
SHA256e05d02b51e01f68d1e86dd95d004c27025ecdc4fcb38b972934ad12053c627f0
SHA51249bd7f638d43e20a7eb377faee36e940bfb0c6e3dddcd20dd7ce092700c29a61c4254113728d7d886aa1011e2d02082f3fdd214952521f7faf351bb8c548cc9c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za966696.exeFilesize
679KB
MD5937f6dedf6857f63d25fcba51be5814c
SHA138491ffc15c92cca4980309276a18801d631db89
SHA2560543b203b2304754d6ee2ac1786f79891949767ff1682ea0a0b30e1ec6528e28
SHA5128870fa67cf45b8ff3390d09f9751096ba5d18a9855db87baef84e2ebe636be1155fdcecdfde27091a2a75d0c12926544d8edbf5f67e3bbf8d92431b83fdbc6c0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za966696.exeFilesize
679KB
MD5937f6dedf6857f63d25fcba51be5814c
SHA138491ffc15c92cca4980309276a18801d631db89
SHA2560543b203b2304754d6ee2ac1786f79891949767ff1682ea0a0b30e1ec6528e28
SHA5128870fa67cf45b8ff3390d09f9751096ba5d18a9855db87baef84e2ebe636be1155fdcecdfde27091a2a75d0c12926544d8edbf5f67e3bbf8d92431b83fdbc6c0
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\26628038.exeFilesize
301KB
MD5e7b0bcef13515391e5b51b1b2844714b
SHA1bca78d7c9224224dbe5912f7f1a57d33f9c46b99
SHA256abd9b763cd3ae279fff255957be9f44831f1a8cf26eda089de5e9e1684d22783
SHA5123c4af3b85745d9360889aa5417cf35b0b4a56ae5bbec512d6700acd88dca273238a78db31bd772907c3ebaf51d7f264078d884ddcb440f0a0b3598d68cfe2a22
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\26628038.exeFilesize
301KB
MD5e7b0bcef13515391e5b51b1b2844714b
SHA1bca78d7c9224224dbe5912f7f1a57d33f9c46b99
SHA256abd9b763cd3ae279fff255957be9f44831f1a8cf26eda089de5e9e1684d22783
SHA5123c4af3b85745d9360889aa5417cf35b0b4a56ae5bbec512d6700acd88dca273238a78db31bd772907c3ebaf51d7f264078d884ddcb440f0a0b3598d68cfe2a22
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u14115753.exeFilesize
521KB
MD55ba11eccd1e4cbdd689ac719f33317b2
SHA18aea6cb401a737b36463ffc64ee32625d1bb6165
SHA2564d8e85653b120795e233db5833504b1826d51990ec07178a19921ba286282535
SHA512a9449254bac0b5418dc20555970d2c2235ffe23e12b5078fba46924b33c15caf9540ec5b8d17eb26f0600693cc2f38c5532e765b3ac87e84bd23029fbd536c3f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u14115753.exeFilesize
521KB
MD55ba11eccd1e4cbdd689ac719f33317b2
SHA18aea6cb401a737b36463ffc64ee32625d1bb6165
SHA2564d8e85653b120795e233db5833504b1826d51990ec07178a19921ba286282535
SHA512a9449254bac0b5418dc20555970d2c2235ffe23e12b5078fba46924b33c15caf9540ec5b8d17eb26f0600693cc2f38c5532e765b3ac87e84bd23029fbd536c3f
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\00000#CancerFilesize
101KB
MD5d4c65e691f5a42538b02417f60c042be
SHA17726b2bd52dc94a9d3e79f2e82e92dd8820997ad
SHA256d71b5a80bc3d6fce71c6fc6efb62542bd5536d7d3805d92067a29f512bd12c33
SHA512e487f30b27b178a09d381802767f7425d63e6538bc9b0d5406ea39cf7f7c2c586d53850e460b897a49014b61e75ffbe817b4a93b9460a18ed89d223048dab62f
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\00001#FotoFilesize
199KB
MD560ad6b661b7d878936b63c39e7d94555
SHA1655ca3b2c75ad015a02470c92e8d7b9d58541524
SHA256650f797d33d5ecf29e1876324de2507a3b97cad3cc00c1e25ff02420a2e4e70e
SHA512f44b3d36f26666c079354085471d44b2838c24553fd0797e12c3c96b14794aa24073574379e1e0abce3b38aaaa179dd1bf05c51ca3831aff82c90fe6699cc606
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\00002#GpFilesize
74KB
MD54f39ba8b1c907e52d53215ea79a1896f
SHA1975c70c4973697cce66c149a00cc8b20e79526be
SHA256ace9abce7314ca6736b6b6acf5a1f96c7d24f7764678f99ffb795a897a6e7bf2
SHA512e862921fbad7a8118a1c12f1c9ca33b7f41251b69b0dc48dcbf3c40350174f5db8946c75797b0042e3d9633821b66e523212a1998a901f712bc8b0053d1e7572
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\00003#ManagementFilesize
154KB
MD5b0525ab549845919679f78453f554c1f
SHA13d2179acba0634cc71003502923c3a4a52b31d14
SHA25631c86eb615672da32e64560553d46cb18c25e7ea794e4637cfac3c4be0a9fb47
SHA512b983c3517cf878e99ad94d0227c25edb52e82c5ead93c7cbfa6ea2543d483db20be2f210029237131e8e5517497e910abcdb119edf88cdb7eac9e61c4f2a3087
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\00004#PieceFilesize
43KB
MD5bf7a0cdf40d3aa9fc94c9accd73298d2
SHA1a049a7323a8468d1bbd3e96a1ace4266fce4429c
SHA25696eab71166cc7df7ec1eae988487d76d463c080f1da98b194bc60a1701e5d3ae
SHA5126a0eb5de2f23ff986c90835b7b24e5299fdb882186bcc88fece6a6a4363871dda00b8313ee729557778cf4c14456e9c25d79108be35f31df1d9b697f5d89009e
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\00005#PrototypeFilesize
33KB
MD5ad1b6b16c6c6c23f01288183183ed0c1
SHA1b60363ebd25d9953f202423b34e0c81fa24dafb6
SHA25694fca15d4913ccc5955aef8942cb475306a6815190fe27ff742b40a808ff860e
SHA512d461bf0dd5b20b1cb5dc07128be156b3ab144607c5794956635ca7ce90a2d643d539b2f6dd063c8889e01e074db74cacd41940a3d3bb53cd2406f77f0ccac6ce
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\00006#StandsFilesize
1.2MB
MD54a1f67fc0cacc5cf1c9ab1ab05e25ec6
SHA1e955600ae7c0f6bec15a4126f1be10acc6a6b875
SHA256ed299bf8533de2b3f0965295aa5be53e8486dfa0887e20de0b4c6c2fd3b30b4b
SHA512e0f1a52209c13937afcdb954e59daba04d80f82cba702788e1d6d359f2e4dd189d01455f32a167b6014c68e5d670686d2ace1bfea0b8c31b3c91f2f052669675
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\00007#SueFilesize
157KB
MD5f51e203d3f2ac1e4f6ed5a89f5805fcb
SHA176195a680f2e178c03d35719a0adc776fe901289
SHA256c6a7beb722fefad0a7f6f2057cbfda9a8cec198e56f2946191aeb9de7578b2ca
SHA5128c2ab71bf608066d3a63cdac2924d8a6d6c983e8257aed07691f5dace70442de5e72ba0f3bfe8b6395314178ddde219ca5005e65aed305165a06cae2dba16bec
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\00008#WelfareFilesize
54KB
MD5f5802553964d59c3874a7ea7f0313c68
SHA1106f605a2e7704cb8341b27ca982f5f70d09bc0f
SHA25635cc1497dc397cf46815bfb41953a134170bbea3fd0d5178ca45b6bbb01084f9
SHA5128f495fc3ceda40788b3dc7a2eec223e3d40b5edf1ff4ed159f20a256f1ba71d8baba135b3b1bf9f6f07851dc99bd4e29fd2af1bc7984bccca4fc390c0fc83b23
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\00009#WinesFilesize
110KB
MD531ae6922272bfd6c6a863b679940d005
SHA1df93b1021c3bb2087b249a82d4cbcd599659fcd6
SHA25677031c9bf9a778abef4672a2b749dd7fb662a29b3e69ea391fe04dd4944601d8
SHA512f0765279accdefbf611088e92433d258700bc97d28468b6cbd34c1be5b7cf27a54763009214bd4ce052c4bec87debd9464e2f040028fba40fb32da20d82669bd
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\00010#YugoslaviaFilesize
15KB
MD59852c7adb40127bf8e29ae2346482129
SHA1d5decd97f329dc62f824a17b204a214a83a1292b
SHA25685ad2b1fd775ecd859922d5550f76f87f8e8e9dd84d878ee786450a8aefee1ac
SHA5120a89fa89340df63de408b106ac4503a649ac2bf60978f40452263b8690d81cedf9d812e4b71988a84e6fdb36fdd8dfc0ec30a78d1df2f0cb044b7afa3accc56b
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\Engine.exeFilesize
1.3MB
MD5e4656c54b03a03f816ab33101a324cdc
SHA148cd8d9c5a20d36362214d727e184fe4e0075d4f
SHA256bb998a1e5e162c305a942ade944230c62b0e3bfe347a2a30c33af497109467ba
SHA512c2980491ab8417feddb609391e14b8f662182f2ca28af47902b74687ac420d8fb2aee4ea9df858668a7affa03c799b2a478213d5629444e9276147096110f7ba
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\Engine.exeFilesize
1.3MB
MD5e4656c54b03a03f816ab33101a324cdc
SHA148cd8d9c5a20d36362214d727e184fe4e0075d4f
SHA256bb998a1e5e162c305a942ade944230c62b0e3bfe347a2a30c33af497109467ba
SHA512c2980491ab8417feddb609391e14b8f662182f2ca28af47902b74687ac420d8fb2aee4ea9df858668a7affa03c799b2a478213d5629444e9276147096110f7ba
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\Modern_Icon.bmpFilesize
7KB
MD51dd88f67f029710d5c5858a6293a93f1
SHA13e5ef66613415fe9467b2a24ccc27d8f997e7df6
SHA256b5dad33ceb6eb1ac2a05fbda76e29a73038403939218a88367925c3a20c05532
SHA5127071fd64038e0058c8c586c63c62677c0ca403768100f90323cf9c0bc7b7fcb538391e6f3606bd7970b8769445606ada47adcdcfc1e991e25caf272a13e10c94
-
C:\Users\Admin\AppData\Local\Temp\SETUP_3032\Setup.txtFilesize
2KB
MD59f82e028a899fe0dded45d76ed1ed06f
SHA1fc0e0f3e34451087e28d8c51c486a52934e59d4a
SHA2563dd4285197d7ad7004789eee6464594666ae8e5d913bec23e57151608bd3b109
SHA51222d4ad271965c8c5fbe038ead00cb374c299e89f7d669ea7657064e5b3c18f4dc7f9d51b102dc388c6f79e805c7196c085edf6e990e6bb33c41ac36854192b18
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4w4idpgl.mcm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\smzntdjf.xp4\27976\Bondage.exe.pifFilesize
925KB
MD50162a97ed477353bc35776a7addffd5c
SHA110db8fe20bbce0f10517c510ec73532cf6feb227
SHA25615600ccdef5a64b40d206d89234a51be1e11bd878dcefc5986590bcf40d9d571
SHA5129638cab1aabe78c22a3d3528a391544f697d792640d831516b63fa52c393ee96bb588223e70163d059208cc5a14481c5ff7ef6ba9ac572322798a823d67f01f5
-
C:\Users\Admin\AppData\Local\Temp\smzntdjf.xp4\27976\Bondage.exe.pifFilesize
925KB
MD50162a97ed477353bc35776a7addffd5c
SHA110db8fe20bbce0f10517c510ec73532cf6feb227
SHA25615600ccdef5a64b40d206d89234a51be1e11bd878dcefc5986590bcf40d9d571
SHA5129638cab1aabe78c22a3d3528a391544f697d792640d831516b63fa52c393ee96bb588223e70163d059208cc5a14481c5ff7ef6ba9ac572322798a823d67f01f5
-
C:\Users\Admin\AppData\Local\Temp\smzntdjf.xp4\FindingFilesize
925KB
MD5f39dff6e12fa4e21277d39149fa7da7e
SHA1804aa8256d1a98311d737e13ef62db0fa7d15ec0
SHA25627deb687c50fe4c33b19f43ccb0d4cbdaa8292511df2a93c138d6740862e9fd0
SHA512cceca80987fcfad926734a7c2ed16919a237ceb02f391fe9de667405f014498b10bcf735547e5ee53f9b146ed56b24db025be285422c53dac2770f1885d31f5c
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
C:\Users\Admin\Videos\Captures\desktop.iniFilesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/400-4528-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/400-4527-0x0000000000910000-0x000000000096B000-memory.dmpFilesize
364KB
-
memory/400-6686-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/400-6656-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/400-6654-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/400-6652-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/400-6650-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/400-4531-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/400-4530-0x00000000050D0000-0x00000000050E0000-memory.dmpFilesize
64KB
-
memory/1000-6687-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/1000-6692-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/1288-6766-0x0000000004E60000-0x0000000004E70000-memory.dmpFilesize
64KB
-
memory/1288-6765-0x0000000004E60000-0x0000000004E70000-memory.dmpFilesize
64KB
-
memory/1884-6705-0x0000000004A70000-0x0000000004AAC000-memory.dmpFilesize
240KB
-
memory/1884-6703-0x0000000004990000-0x00000000049A0000-memory.dmpFilesize
64KB
-
memory/1884-6789-0x0000000004990000-0x00000000049A0000-memory.dmpFilesize
64KB
-
memory/1884-6680-0x00000000001C0000-0x00000000001EE000-memory.dmpFilesize
184KB
-
memory/1884-6696-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/2056-6750-0x0000000006550000-0x00000000065E6000-memory.dmpFilesize
600KB
-
memory/2056-6733-0x00000000026D0000-0x0000000002706000-memory.dmpFilesize
216KB
-
memory/2056-6734-0x0000000005140000-0x0000000005768000-memory.dmpFilesize
6.2MB
-
memory/2056-6735-0x0000000002780000-0x0000000002790000-memory.dmpFilesize
64KB
-
memory/2056-6751-0x00000000064E0000-0x00000000064FA000-memory.dmpFilesize
104KB
-
memory/2056-6748-0x0000000005FF0000-0x000000000600E000-memory.dmpFilesize
120KB
-
memory/2056-6743-0x0000000005A00000-0x0000000005A66000-memory.dmpFilesize
408KB
-
memory/2056-6737-0x0000000005920000-0x0000000005986000-memory.dmpFilesize
408KB
-
memory/2056-6752-0x0000000006FD0000-0x0000000006FF2000-memory.dmpFilesize
136KB
-
memory/2056-6736-0x0000000005040000-0x0000000005062000-memory.dmpFilesize
136KB
-
memory/3488-6700-0x0000000000FC0000-0x0000000000FEE000-memory.dmpFilesize
184KB
-
memory/3488-6702-0x0000000005930000-0x0000000005940000-memory.dmpFilesize
64KB
-
memory/3488-6704-0x000000000AD30000-0x000000000AD42000-memory.dmpFilesize
72KB
-
memory/3488-6788-0x0000000005930000-0x0000000005940000-memory.dmpFilesize
64KB
-
memory/3488-6701-0x000000000AE00000-0x000000000AF0A000-memory.dmpFilesize
1.0MB
-
memory/3720-166-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-163-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-184-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-186-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-188-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-181-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-180-0x0000000004920000-0x0000000004930000-memory.dmpFilesize
64KB
-
memory/3720-190-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-196-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-198-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-194-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-192-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-200-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-202-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-161-0x0000000004920000-0x0000000004930000-memory.dmpFilesize
64KB
-
memory/3720-210-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-178-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-176-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-174-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-172-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-212-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-170-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-168-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-208-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-164-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-214-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-216-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-218-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-220-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-222-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-224-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-204-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-206-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-226-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-2298-0x0000000004920000-0x0000000004930000-memory.dmpFilesize
64KB
-
memory/3720-2295-0x0000000004920000-0x0000000004930000-memory.dmpFilesize
64KB
-
memory/3720-2294-0x0000000004920000-0x0000000004930000-memory.dmpFilesize
64KB
-
memory/3720-182-0x0000000004920000-0x0000000004930000-memory.dmpFilesize
64KB
-
memory/3720-2293-0x0000000004920000-0x0000000004930000-memory.dmpFilesize
64KB
-
memory/3720-228-0x0000000004F80000-0x0000000004FD1000-memory.dmpFilesize
324KB
-
memory/3720-162-0x0000000004990000-0x0000000004F34000-memory.dmpFilesize
5.6MB
-
memory/4488-2308-0x0000000000CD0000-0x0000000000CDA000-memory.dmpFilesize
40KB
-
memory/4524-2471-0x0000000000900000-0x000000000094C000-memory.dmpFilesize
304KB
-
memory/4524-2475-0x0000000002730000-0x0000000002740000-memory.dmpFilesize
64KB
-
memory/4524-2473-0x0000000002730000-0x0000000002740000-memory.dmpFilesize
64KB
-
memory/4524-2477-0x0000000002730000-0x0000000002740000-memory.dmpFilesize
64KB
-
memory/4524-4446-0x0000000002730000-0x0000000002740000-memory.dmpFilesize
64KB
-
memory/4524-4448-0x0000000002730000-0x0000000002740000-memory.dmpFilesize
64KB
-
memory/4524-4449-0x0000000002730000-0x0000000002740000-memory.dmpFilesize
64KB
-
memory/4524-4450-0x0000000002730000-0x0000000002740000-memory.dmpFilesize
64KB
-
memory/4524-4452-0x0000000005710000-0x00000000057A2000-memory.dmpFilesize
584KB