Analysis Overview
SHA256
e85a2f66fda8f046665901842e882eed9e913bd952d22beb025dfe4a302fd8c4
Threat Level: Known bad
The file phfxdphmpz.zip was found to be: Known bad.
Malicious Activity Summary
Qakbot/Qbot
Blocklisted process makes network request
Loads dropped DLL
Enumerates connected drives
Drops file in Windows directory
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Uses Volume Shadow Copy service COM API
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-06-02 10:01
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-06-02 10:01
Reported
2023-06-02 10:03
Platform
win7-20230220-en
Max time kernel
149s
Max time network
128s
Command Line
Signatures
Qakbot/Qbot
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\V: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\G: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\B: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Y: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\F: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\J: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\O: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\system32\msiexec.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Installer\6d97ff.msi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\6d97fd.ipi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI1D50.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\INF\setupapi.ev1 | C:\Windows\system32\DrvInst.exe | N/A |
| File opened for modification | C:\Windows\INF\setupapi.dev.log | C:\Windows\system32\DrvInst.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI9A2D.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\INF\setupapi.ev3 | C:\Windows\system32\DrvInst.exe | N/A |
| File created | C:\Windows\Installer\6d97fd.ipi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\ | C:\Windows\system32\msiexec.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad | C:\Windows\system32\msiexec.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Windows\system32\DrvInst.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\system32\DrvInst.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreateTokenPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeMachineAccountPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreatePermanentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeChangeNotifyPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSyncAgentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeEnableDelegationPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreateGlobalPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreateTokenPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeMachineAccountPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreatePermanentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeChangeNotifyPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSyncAgentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeEnableDelegationPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ProjectFunding_406103_Jun01.js
C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A0" "000000000000005C"
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | garokelka.com | udp |
| NL | 217.195.153.225:443 | garokelka.com | tcp |
| US | 8.8.8.8:53 | lakirasa.com | udp |
| BR | 216.238.111.194:443 | lakirasa.com | tcp |
| US | 8.8.8.8:53 | tofinka.com | udp |
| IR | 185.235.138.66:443 | tofinka.com | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| NL | 88.221.25.153:80 | apps.identrust.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab16AF.tmp
| MD5 | fc4666cbca561e864e7fdf883a9e6661 |
| SHA1 | 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5 |
| SHA256 | 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b |
| SHA512 | c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 3ac860860707baaf32469fa7cc7c0192 |
| SHA1 | c33c2acdaba0e6fa41fd2f00f186804722477639 |
| SHA256 | d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904 |
| SHA512 | d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c |
C:\Users\Admin\AppData\Local\Temp\Tar1A9C.tmp
| MD5 | 4ff65ad929cd9a367680e0e5b1c08166 |
| SHA1 | c0af0d4396bd1f15c45f39d3b849ba444233b3a2 |
| SHA256 | c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6 |
| SHA512 | f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9cb6d8cc060107a4ed7c227bb932352c |
| SHA1 | 5101c5f64e6b4c7f72c15233ebf18339f0b8d928 |
| SHA256 | ce6c97f0fdc2fc682c82a53ae23845eb815a851cb497f8086abe71b3d9c3206c |
| SHA512 | c5c463e80667c05096e42de7bc7e0447e9b585f753b003aef49f41440ed03e7d40ef456d970a0f0825a5cb0d35b436d9f8b7b33d6b0e785c718f61e79c816c8f |
C:\Windows\Installer\MSI1D50.tmp
| MD5 | ac1530e6bdff2d5d8c8c7ef5f1dd86cc |
| SHA1 | e5e0b79aa490d7f651544d809d7c4131358d0a93 |
| SHA256 | 97aa0747e674583588faa381484048400701c9248b1da16129a43f0919d47776 |
| SHA512 | 34d874a05af01b902bdf5e3289127f9e935d2b7617ba9bc28058a068161bf90b3aa738cc2be55d1afd8932a369354330b3ab6535b872901e57a6ef69dff39ac4 |
C:\Config.Msi\6d97fe.rbs
| MD5 | 794d3d8390b94e5c088a954625816014 |
| SHA1 | 2e7311f94c6be24caa02afc297c363921ad5eed0 |
| SHA256 | 17954ff926e16b15254147a2eaf944011c3327eccd832017d7c6965188c09738 |
| SHA512 | 7b4a07d8ffa3e5d319194e222ffbe5ff1ea047421a9dc5c36f3873f0582876103452d15cb4f373ddb86244290a4ad886a16ebd03cc797c9b4c04dd7b902fec51 |
C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll
| MD5 | 21245d848c4f37a5886d4538a3788c8d |
| SHA1 | 9260d265f62c5c230d3080effbacad9ac2a05742 |
| SHA256 | 3feebd029d3be8152213bd5494eb1594650d8c7a2a89bc06ded65332fc6d58c3 |
| SHA512 | 4c3929cfc5936124374805cf1d00cabcac32f48604ea2360d6b0b72429b25cac15f2d407f9200a41a450510be34a05e0e3489ddd8022564546b6a0ce32a591f4 |
C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
| MD5 | 0d4c9f15ce74465c59ae36a27f98c817 |
| SHA1 | 9cce8eefa4d3d9c5e161c5dbb860cfe1489c6b1a |
| SHA256 | d24e3399060b51f3a1c9d41a67de2601888a35c99da8db70070d757bb3f1913a |
| SHA512 | 9bed0eafc2cf2a2360850ca1070ffb04ac14f04c78379485998a93f45012b5c11cc7f6f68129f65b8b5f90437cb965908c6a1bb9d83a56b068d6bde1d5fdad1f |
\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll
| MD5 | 21245d848c4f37a5886d4538a3788c8d |
| SHA1 | 9260d265f62c5c230d3080effbacad9ac2a05742 |
| SHA256 | 3feebd029d3be8152213bd5494eb1594650d8c7a2a89bc06ded65332fc6d58c3 |
| SHA512 | 4c3929cfc5936124374805cf1d00cabcac32f48604ea2360d6b0b72429b25cac15f2d407f9200a41a450510be34a05e0e3489ddd8022564546b6a0ce32a591f4 |
\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll
| MD5 | 21245d848c4f37a5886d4538a3788c8d |
| SHA1 | 9260d265f62c5c230d3080effbacad9ac2a05742 |
| SHA256 | 3feebd029d3be8152213bd5494eb1594650d8c7a2a89bc06ded65332fc6d58c3 |
| SHA512 | 4c3929cfc5936124374805cf1d00cabcac32f48604ea2360d6b0b72429b25cac15f2d407f9200a41a450510be34a05e0e3489ddd8022564546b6a0ce32a591f4 |
\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll
| MD5 | 21245d848c4f37a5886d4538a3788c8d |
| SHA1 | 9260d265f62c5c230d3080effbacad9ac2a05742 |
| SHA256 | 3feebd029d3be8152213bd5494eb1594650d8c7a2a89bc06ded65332fc6d58c3 |
| SHA512 | 4c3929cfc5936124374805cf1d00cabcac32f48604ea2360d6b0b72429b25cac15f2d407f9200a41a450510be34a05e0e3489ddd8022564546b6a0ce32a591f4 |
\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll
| MD5 | 21245d848c4f37a5886d4538a3788c8d |
| SHA1 | 9260d265f62c5c230d3080effbacad9ac2a05742 |
| SHA256 | 3feebd029d3be8152213bd5494eb1594650d8c7a2a89bc06ded65332fc6d58c3 |
| SHA512 | 4c3929cfc5936124374805cf1d00cabcac32f48604ea2360d6b0b72429b25cac15f2d407f9200a41a450510be34a05e0e3489ddd8022564546b6a0ce32a591f4 |
memory/1080-156-0x0000000000170000-0x0000000000173000-memory.dmp
memory/1080-157-0x0000000000220000-0x0000000000244000-memory.dmp
\??\PIPE\wkssvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/1684-163-0x00000000000B0000-0x00000000000B2000-memory.dmp
memory/1684-164-0x0000000000080000-0x00000000000A4000-memory.dmp
memory/1684-170-0x0000000000080000-0x00000000000A4000-memory.dmp
memory/1684-171-0x0000000000080000-0x00000000000A4000-memory.dmp
memory/1684-172-0x0000000000080000-0x00000000000A4000-memory.dmp
memory/1684-173-0x0000000000080000-0x00000000000A4000-memory.dmp
memory/1684-174-0x0000000000080000-0x00000000000A4000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-06-02 10:01
Reported
2023-06-02 10:03
Platform
win10v2004-20230220-en
Max time kernel
150s
Max time network
121s
Command Line
Signatures
Qakbot/Qbot
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\system32\msiexec.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Enumerates connected drives
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\G: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Q: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\V: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\W: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\N: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\O: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\T: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Y: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\E: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\F: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\H: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\L: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\U: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\A: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\K: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\M: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\R: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\S: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\X: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\Z: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\B: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\I: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\J: | C:\Windows\system32\msiexec.exe | N/A |
| File opened (read-only) | \??\P: | C:\Windows\system32\msiexec.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Installer\e578d1f.msi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI13A7.tmp | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\ | C:\Windows\system32\msiexec.exe | N/A |
| File created | C:\Windows\Installer\inprogressinstallinfo.ipi | C:\Windows\system32\msiexec.exe | N/A |
| File opened for modification | C:\Windows\Installer\MSI8D5C.tmp | C:\Windows\system32\msiexec.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters | C:\Windows\system32\vssvc.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters | C:\Windows\system32\vssvc.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr | C:\Windows\system32\vssvc.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f9d6c693febb2fce0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f9d6c6930000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900f9d6c693000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9d6c69300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9d6c69300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Windows\system32\vssvc.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Windows\system32\vssvc.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\msiexec.exe | N/A |
| Token: SeCreateTokenPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeMachineAccountPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreatePermanentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeChangeNotifyPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSyncAgentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeEnableDelegationPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreateGlobalPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreateTokenPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeAssignPrimaryTokenPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeMachineAccountPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeTcbPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreatePermanentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeAuditPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeChangeNotifyPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeSyncAgentPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeEnableDelegationPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeCreateGlobalPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\wscript.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
| N/A | N/A | C:\Windows\system32\wscript.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Processes
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ProjectFunding_406103_Jun01.js
C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
C:\Windows\SysWOW64\wermgr.exe
C:\Windows\SysWOW64\wermgr.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | garokelka.com | udp |
| NL | 217.195.153.225:443 | garokelka.com | tcp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.103.197.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.220.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | lakirasa.com | udp |
| BR | 216.238.111.194:443 | lakirasa.com | tcp |
| US | 8.8.8.8:53 | tofinka.com | udp |
| IR | 185.235.138.66:443 | tofinka.com | tcp |
| US | 8.8.8.8:53 | 66.138.235.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.151.224.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.250.217.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| US | 93.184.221.240:80 | tcp |
Files
C:\Windows\Installer\MSI13A7.tmp
| MD5 | 91b232c9a333ba61544a4232c96ab427 |
| SHA1 | 93fcd78bc68207d37c97a6ecb424d11197276b4b |
| SHA256 | 551b9f802218a50dbe8279137959c43e37f8e57315e768b50dcaefebc62632c0 |
| SHA512 | c1d2568e7353f50724abe523fffb6ffc2181dd1920d6870f800619b07d902214d7b5ccc881f4f328f2e244661c1ba8c041510a82f6dbf2c996c20fbfc3ba6150 |
C:\Config.Msi\e578d1e.rbs
| MD5 | 9b32faba324626d5ff9489215f17e700 |
| SHA1 | 59693ce94811fc663a0c69d01b6aa61e44231160 |
| SHA256 | 04259a03359a6726f8ec98f8e93bf72a0296a4047bac2755725cbbc4a25f4b13 |
| SHA512 | d2d63380590ac30492fb4bfcf7cfddfc3f4a3c04a2436f19fe05c26ae20c6d2190399cb109352a8f9299e7c378db75c8f8bada1b7940cb5a0376a143b92a1a2b |
C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll
| MD5 | 5aff39cf05365b14a2d97a5dc187f307 |
| SHA1 | ba6e300d41333bbf638b6abaf8c1b505f0703237 |
| SHA256 | eed89bcfe938e41f982166cd9afba140dca256b4d4820f08c2e05bfc4570170a |
| SHA512 | e3df408f7492ac156dc33b73642e680cc426a67b239ca6007048df26e862441ac3d88b21bfe2f996b86c9b25a6faf50a2befa88a42c3d33de84f6e327dffccdc |
C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
| MD5 | 0d4c9f15ce74465c59ae36a27f98c817 |
| SHA1 | 9cce8eefa4d3d9c5e161c5dbb860cfe1489c6b1a |
| SHA256 | d24e3399060b51f3a1c9d41a67de2601888a35c99da8db70070d757bb3f1913a |
| SHA512 | 9bed0eafc2cf2a2360850ca1070ffb04ac14f04c78379485998a93f45012b5c11cc7f6f68129f65b8b5f90437cb965908c6a1bb9d83a56b068d6bde1d5fdad1f |
C:\Users\Admin\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll
| MD5 | 5aff39cf05365b14a2d97a5dc187f307 |
| SHA1 | ba6e300d41333bbf638b6abaf8c1b505f0703237 |
| SHA256 | eed89bcfe938e41f982166cd9afba140dca256b4d4820f08c2e05bfc4570170a |
| SHA512 | e3df408f7492ac156dc33b73642e680cc426a67b239ca6007048df26e862441ac3d88b21bfe2f996b86c9b25a6faf50a2befa88a42c3d33de84f6e327dffccdc |
memory/3832-165-0x0000000000800000-0x0000000000803000-memory.dmp
memory/3832-166-0x0000000000810000-0x0000000000834000-memory.dmp
memory/2940-171-0x0000000000990000-0x0000000000992000-memory.dmp
memory/2940-172-0x0000000000960000-0x0000000000984000-memory.dmp
memory/2940-178-0x0000000000960000-0x0000000000984000-memory.dmp
memory/2940-179-0x0000000000960000-0x0000000000984000-memory.dmp
memory/2940-180-0x0000000000960000-0x0000000000984000-memory.dmp
memory/2940-181-0x0000000000960000-0x0000000000984000-memory.dmp
memory/2940-182-0x0000000000960000-0x0000000000984000-memory.dmp
\??\Volume{93c6d6f9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{bb5d2234-0341-4dad-95a7-2f3b901f3682}_OnDiskSnapshotProp
| MD5 | 35e9a6be99afba0c305dce133529bf73 |
| SHA1 | aab519bdf9b293e854964b480bc52f0a12d8c95a |
| SHA256 | 6a5cd085975f1bf3867ad4bb27b5c53e105a7201cc41dbe577f3d6f3c95cb472 |
| SHA512 | 1b0d594996ba077790abfea29387aa20008d926b4bd5b08a6e40a693bc2f44abb35ce45881f95ba930973ee4fca33592863a863f03f129fdfa4a92861d38a2a9 |
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
| MD5 | cc58c5430dcfd3c311cc51d5c5ddd74b |
| SHA1 | 84e0271af80d86669c9eda1111e482b2a45a5f98 |
| SHA256 | b37c9f00b5fd3c92673b8b5211c152dd72cdda5d646ebc770df98fe40bac9eee |
| SHA512 | a9b8100dbd845bd70722201490615515755ff48d0e6f01ebc87d7d573e066cf80704958db05650449d2fcf42a12b2f8c5871b53354a280b8ade622db80562cb2 |