amadey | bfe406b543ca148c2ef6424a32682fbd540810078d52c6f0af8f0edb5951cd67

Analysis

max time kernel
149s
max time network
161s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-07-2023 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

6.8MB
MD5

4fcd70f4d036361d2fef09cf03932f7b
SHA1

b8c39838498676d95a267e8f9ee2bb59edb8e76e
SHA256

bfe406b543ca148c2ef6424a32682fbd540810078d52c6f0af8f0edb5951cd67
SHA512

3bec3c60d903a348712a179bb96cc20ca868abda2019077279877f40b877b2f127b2a60704f276c23fec4da58a5bff78638ca228dfc79726d6afe048120eb9ab
SSDEEP

98304:TBWqiL18HkxPnA8n+wuxT4NqP2ozzv68ZslF8QLkY52P:9RiSk9pnNuiiXi8mF7LkY52P

Score

10^/10

amadey laplas redline clipper evasion infostealer persistence spyware stealer themida trojan

Malware Config

Extracted

Family

amadey

Version

3.80

45.15.156.208/jd9dd3Vw/index.php

second.amadgood.com/jd9dd3Vw/index.php

Extracted

Family

laplas

http://168.100.10.236

Attributes

api_key
f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/1492-202-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/1492-203-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/1492-205-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/1492-207-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline
behavioral1/memory/1492-210-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 2252 created 1268	2252	rdpcllp.exe	10
PID 2252 created 1268	2252	rdpcllp.exe	10
PID 2252 created 1268	2252	rdpcllp.exe	10
PID 2252 created 1268	2252	rdpcllp.exe	10
PID 2252 created 1268	2252	rdpcllp.exe	10
PID 240 created 1268	240	updater.exe	10
PID 240 created 1268	240	updater.exe	10
PID 240 created 1268	240	updater.exe	10
PID 240 created 1268	240	updater.exe	10
PID 240 created 1268	240	updater.exe	10
PID 240 created 1268	240	updater.exe	10

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oneetx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostclp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ntlhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oneetx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oneetx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	tmp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oneetx.exe

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	rdpcllp.exe
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 5 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x0007000000016266-115.dat	net_reactor
behavioral1/files/0x0007000000016266-121.dat	net_reactor
behavioral1/files/0x0007000000016266-123.dat	net_reactor
behavioral1/files/0x0007000000016266-125.dat	net_reactor
behavioral1/memory/2744-126-0x00000000008E0000-0x0000000000C50000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oneetx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostclp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oneetx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oneetx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostclp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oneetx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oneetx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oneetx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	oneetx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	oneetx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tmp.exe

Executes dropped EXE 9 IoCs

pid	Process
2472	oneetx.exe
2744	taskmask.exe
1228	oneetx.exe
2148	taskhostclp.exe
1808	ntlhost.exe
2252	rdpcllp.exe
2704	oneetx.exe
240	updater.exe
2396	oneetx.exe

Loads dropped DLL 6 IoCs

pid	Process
3040	tmp.exe
2472	oneetx.exe
2472	oneetx.exe
2148	taskhostclp.exe
2472	oneetx.exe
808	taskeng.exe

Themida packer 26 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/3040-54-0x0000000000F80000-0x0000000001676000-memory.dmp	themida
behavioral1/memory/3040-57-0x0000000000F80000-0x0000000001676000-memory.dmp	themida
behavioral1/memory/3040-59-0x0000000000F80000-0x0000000001676000-memory.dmp	themida
behavioral1/memory/3040-64-0x0000000000F80000-0x0000000001676000-memory.dmp	themida
behavioral1/memory/3040-65-0x0000000000F80000-0x0000000001676000-memory.dmp	themida
behavioral1/files/0x000c000000012221-71.dat	themida
behavioral1/files/0x000c000000012221-70.dat	themida
behavioral1/memory/3040-73-0x0000000000F80000-0x0000000001676000-memory.dmp	themida
behavioral1/files/0x000c000000012221-74.dat	themida
behavioral1/memory/2472-75-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/memory/2472-84-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/memory/2472-86-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/memory/2472-88-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/memory/2472-89-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/files/0x000c000000012221-90.dat	themida
behavioral1/memory/2472-95-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/files/0x000c000000012221-128.dat	themida
behavioral1/memory/1228-134-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/memory/1228-133-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/memory/1228-132-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/memory/1228-131-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/memory/1228-129-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/memory/2472-153-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/memory/2472-237-0x0000000001370000-0x0000000001A66000-memory.dmp	themida
behavioral1/files/0x000c000000012221-303.dat	themida
behavioral1/files/0x000c000000012221-428.dat	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	taskhostclp.exe

Checks whether UAC is enabled 1 TTPs 7 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	oneetx.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	oneetx.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostclp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	oneetx.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	oneetx.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
3040	tmp.exe
2472	oneetx.exe
1228	oneetx.exe
2148	taskhostclp.exe
1808	ntlhost.exe
2704	oneetx.exe
2396	oneetx.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2744 set thread context of 1492	2744	taskmask.exe	47
PID 240 set thread context of 2032	240	updater.exe	92
PID 240 set thread context of 1028	240	updater.exe	93

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	rdpcllp.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1420	sc.exe
2996	sc.exe
3012	sc.exe
1576	sc.exe
3028	sc.exe
1444	sc.exe
2404	sc.exe
1600	sc.exe
2164	sc.exe
2932	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2372	schtasks.exe
2648	schtasks.exe
2344	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	12	Go-http-client/1.1

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c0b1ade967bdd901	powershell.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
3040	tmp.exe
2472	oneetx.exe
1228	oneetx.exe
2252	rdpcllp.exe
2252	rdpcllp.exe
1492	MsBuild.exe
1492	MsBuild.exe
2252	rdpcllp.exe
2252	rdpcllp.exe
2704	oneetx.exe
2304	powershell.exe
2252	rdpcllp.exe
2252	rdpcllp.exe
2252	rdpcllp.exe
2252	rdpcllp.exe
2252	rdpcllp.exe
2252	rdpcllp.exe
752	powershell.exe
2252	rdpcllp.exe
2252	rdpcllp.exe
240	updater.exe
240	updater.exe
240	updater.exe
240	updater.exe
1524	powershell.exe
240	updater.exe
240	updater.exe
240	updater.exe
240	updater.exe
240	updater.exe
240	updater.exe
2204	powershell.exe
240	updater.exe
240	updater.exe
240	updater.exe
240	updater.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
1028	explorer.exe
2396	oneetx.exe
1028	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	taskmask.exe
Token: SeDebugPrivilege	1492	MsBuild.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeShutdownPrivilege	2280	powercfg.exe
Token: SeShutdownPrivilege	1768	powercfg.exe
Token: SeShutdownPrivilege	3056	powercfg.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeShutdownPrivilege	2328	powercfg.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeShutdownPrivilege	2512	powercfg.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeShutdownPrivilege	1932	powercfg.exe
Token: SeShutdownPrivilege	1708	powercfg.exe
Token: SeShutdownPrivilege	2000	powercfg.exe
Token: SeDebugPrivilege	240	updater.exe
Token: SeLockMemoryPrivilege	1028	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	tmp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2472	3040	tmp.exe	28
PID 3040 wrote to memory of 2472	3040	tmp.exe	28
PID 3040 wrote to memory of 2472	3040	tmp.exe	28
PID 3040 wrote to memory of 2472	3040	tmp.exe	28
PID 2472 wrote to memory of 2372	2472	oneetx.exe	29
PID 2472 wrote to memory of 2372	2472	oneetx.exe	29
PID 2472 wrote to memory of 2372	2472	oneetx.exe	29
PID 2472 wrote to memory of 2372	2472	oneetx.exe	29
PID 2472 wrote to memory of 2808	2472	oneetx.exe	32
PID 2472 wrote to memory of 2808	2472	oneetx.exe	32
PID 2472 wrote to memory of 2808	2472	oneetx.exe	32
PID 2472 wrote to memory of 2808	2472	oneetx.exe	32
PID 2808 wrote to memory of 2712	2808	cmd.exe	33
PID 2808 wrote to memory of 2712	2808	cmd.exe	33
PID 2808 wrote to memory of 2712	2808	cmd.exe	33
PID 2808 wrote to memory of 2712	2808	cmd.exe	33
PID 2808 wrote to memory of 2304	2808	cmd.exe	34
PID 2808 wrote to memory of 2304	2808	cmd.exe	34
PID 2808 wrote to memory of 2304	2808	cmd.exe	34
PID 2808 wrote to memory of 2304	2808	cmd.exe	34
PID 2808 wrote to memory of 2708	2808	cmd.exe	37
PID 2808 wrote to memory of 2708	2808	cmd.exe	37
PID 2808 wrote to memory of 2708	2808	cmd.exe	37
PID 2808 wrote to memory of 2708	2808	cmd.exe	37
PID 2808 wrote to memory of 2536	2808	cmd.exe	38
PID 2808 wrote to memory of 2536	2808	cmd.exe	38
PID 2808 wrote to memory of 2536	2808	cmd.exe	38
PID 2808 wrote to memory of 2536	2808	cmd.exe	38
PID 2808 wrote to memory of 380	2808	cmd.exe	39
PID 2808 wrote to memory of 380	2808	cmd.exe	39
PID 2808 wrote to memory of 380	2808	cmd.exe	39
PID 2808 wrote to memory of 380	2808	cmd.exe	39
PID 2808 wrote to memory of 792	2808	cmd.exe	40
PID 2808 wrote to memory of 792	2808	cmd.exe	40
PID 2808 wrote to memory of 792	2808	cmd.exe	40
PID 2808 wrote to memory of 792	2808	cmd.exe	40
PID 2472 wrote to memory of 2744	2472	oneetx.exe	43
PID 2472 wrote to memory of 2744	2472	oneetx.exe	43
PID 2472 wrote to memory of 2744	2472	oneetx.exe	43
PID 2472 wrote to memory of 2744	2472	oneetx.exe	43
PID 3064 wrote to memory of 1228	3064	taskeng.exe	45
PID 3064 wrote to memory of 1228	3064	taskeng.exe	45
PID 3064 wrote to memory of 1228	3064	taskeng.exe	45
PID 3064 wrote to memory of 1228	3064	taskeng.exe	45
PID 2472 wrote to memory of 2148	2472	oneetx.exe	46
PID 2472 wrote to memory of 2148	2472	oneetx.exe	46
PID 2472 wrote to memory of 2148	2472	oneetx.exe	46
PID 2472 wrote to memory of 2148	2472	oneetx.exe	46
PID 2744 wrote to memory of 1492	2744	taskmask.exe	47
PID 2744 wrote to memory of 1492	2744	taskmask.exe	47
PID 2744 wrote to memory of 1492	2744	taskmask.exe	47
PID 2744 wrote to memory of 1492	2744	taskmask.exe	47
PID 2744 wrote to memory of 1492	2744	taskmask.exe	47
PID 2744 wrote to memory of 1492	2744	taskmask.exe	47
PID 2744 wrote to memory of 1492	2744	taskmask.exe	47
PID 2744 wrote to memory of 1492	2744	taskmask.exe	47
PID 2744 wrote to memory of 1492	2744	taskmask.exe	47
PID 2148 wrote to memory of 1808	2148	taskhostclp.exe	48
PID 2148 wrote to memory of 1808	2148	taskhostclp.exe	48
PID 2148 wrote to memory of 1808	2148	taskhostclp.exe	48
PID 2472 wrote to memory of 2252	2472	oneetx.exe	49
PID 2472 wrote to memory of 2252	2472	oneetx.exe	49
PID 2472 wrote to memory of 2252	2472	oneetx.exe	49
PID 2472 wrote to memory of 2252	2472	oneetx.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:2372
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\eb0f58bce7" /P "Admin:N"&&CACLS "..\eb0f58bce7" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2712
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:2304
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:2708
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2536
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\eb0f58bce7" /P "Admin:N"
        5⤵
        
        PID:380
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\eb0f58bce7" /P "Admin:R" /E
        5⤵
        
        PID:792
  - - C:\Users\Admin\AppData\Local\Temp\1000120001\taskmask.exe
      "C:\Users\Admin\AppData\Local\Temp\1000120001\taskmask.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2744
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\1000121001\taskhostclp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000121001\taskhostclp.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\1000122101\rdpcllp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000122101\rdpcllp.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:1660
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2932
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3012
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2996
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:1576
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3028
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:488
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1768
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fyhjjuwy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:2648
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:1080
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1420
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1444
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2404
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:1600
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2164
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1596
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fyhjjuwy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:2344
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:2032
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1028

C:\Windows\system32\taskeng.exe
taskeng.exe {A4DD275C-D489-4A56-8D02-ADD7BBCF0AEC} S-1-5-21-377084978-2088738870-2818360375-1000:DSWJWADP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe
  C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1228
- C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe
  C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe
  C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2396

C:\Windows\system32\taskeng.exe
taskeng.exe {42ED49D8-F79F-4E29-9D8A-4D04E35A0F8D} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
PID:808
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
10.5MB

MD5
78e97779f936b06a8c4c96240b7bc85b

SHA1
c005df8a050723df4127a429b00b9e1ac489c3ff

SHA256
f4edf7a7d5dba93cbf95ed6b266b64579544676b1f09a27fa487d3c95700eadc

SHA512
cda792eeb136f3d9a4136c4d7a38056835a01d1bad31e4d12f5381a3fdb86b24b7b1690c77c10f8244806b6316be07c78d1ffa4886ecf0a133b1d57d319f08d2

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
10.5MB

MD5
78e97779f936b06a8c4c96240b7bc85b

SHA1
c005df8a050723df4127a429b00b9e1ac489c3ff

SHA256
f4edf7a7d5dba93cbf95ed6b266b64579544676b1f09a27fa487d3c95700eadc

SHA512
cda792eeb136f3d9a4136c4d7a38056835a01d1bad31e4d12f5381a3fdb86b24b7b1690c77c10f8244806b6316be07c78d1ffa4886ecf0a133b1d57d319f08d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000120001\taskmask.exe

Filesize
3.4MB

MD5
126db18bbcf58a186b422970c57e4dbf

SHA1
97246ee3686052bb9e1142ac789b421b1bb067cc

SHA256
85693616d48b2266134fccd7197503d7da7d317c318016ea0f988c414a10e756

SHA512
59a58b17323329286bfc85d410fb7d269f6df82d05fc603871ac4f3440e4cf36e5e4f3a5f19a410fa7f9b4c23785bf38440396e847bb1d87611c2551a12fbca6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000120001\taskmask.exe

Filesize
3.4MB

MD5
126db18bbcf58a186b422970c57e4dbf

SHA1
97246ee3686052bb9e1142ac789b421b1bb067cc

SHA256
85693616d48b2266134fccd7197503d7da7d317c318016ea0f988c414a10e756

SHA512
59a58b17323329286bfc85d410fb7d269f6df82d05fc603871ac4f3440e4cf36e5e4f3a5f19a410fa7f9b4c23785bf38440396e847bb1d87611c2551a12fbca6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000120001\taskmask.exe

Filesize
3.4MB

MD5
126db18bbcf58a186b422970c57e4dbf

SHA1
97246ee3686052bb9e1142ac789b421b1bb067cc

SHA256
85693616d48b2266134fccd7197503d7da7d317c318016ea0f988c414a10e756

SHA512
59a58b17323329286bfc85d410fb7d269f6df82d05fc603871ac4f3440e4cf36e5e4f3a5f19a410fa7f9b4c23785bf38440396e847bb1d87611c2551a12fbca6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000121001\taskhostclp.exe

Filesize
3.2MB

MD5
4472444218925ed8fd4982f141af1978

SHA1
101ff99cec2f571002915f23290d495671967db3

SHA256
613d401501fccdf49d405bb8b6ce5f6fe96a2619db54e1e7a6f2410eb2aec72c

SHA512
b2255bced17a9cf9ab8afb461cea7005d2df77984f3122609d82d9a2f7f5ec3ca23ee8f20f609e60937db134ef721bf90fd759ddbe4df9acbf6216d8d2e15cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000121001\taskhostclp.exe

Filesize
3.2MB

MD5
4472444218925ed8fd4982f141af1978

SHA1
101ff99cec2f571002915f23290d495671967db3

SHA256
613d401501fccdf49d405bb8b6ce5f6fe96a2619db54e1e7a6f2410eb2aec72c

SHA512
b2255bced17a9cf9ab8afb461cea7005d2df77984f3122609d82d9a2f7f5ec3ca23ee8f20f609e60937db134ef721bf90fd759ddbe4df9acbf6216d8d2e15cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000121001\taskhostclp.exe

Filesize
3.2MB

MD5
4472444218925ed8fd4982f141af1978

SHA1
101ff99cec2f571002915f23290d495671967db3

SHA256
613d401501fccdf49d405bb8b6ce5f6fe96a2619db54e1e7a6f2410eb2aec72c

SHA512
b2255bced17a9cf9ab8afb461cea7005d2df77984f3122609d82d9a2f7f5ec3ca23ee8f20f609e60937db134ef721bf90fd759ddbe4df9acbf6216d8d2e15cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000122101\rdpcllp.exe

Filesize
10.5MB

MD5
78e97779f936b06a8c4c96240b7bc85b

SHA1
c005df8a050723df4127a429b00b9e1ac489c3ff

SHA256
f4edf7a7d5dba93cbf95ed6b266b64579544676b1f09a27fa487d3c95700eadc

SHA512
cda792eeb136f3d9a4136c4d7a38056835a01d1bad31e4d12f5381a3fdb86b24b7b1690c77c10f8244806b6316be07c78d1ffa4886ecf0a133b1d57d319f08d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000122101\rdpcllp.exe

Filesize
10.5MB

MD5
78e97779f936b06a8c4c96240b7bc85b

SHA1
c005df8a050723df4127a429b00b9e1ac489c3ff

SHA256
f4edf7a7d5dba93cbf95ed6b266b64579544676b1f09a27fa487d3c95700eadc

SHA512
cda792eeb136f3d9a4136c4d7a38056835a01d1bad31e4d12f5381a3fdb86b24b7b1690c77c10f8244806b6316be07c78d1ffa4886ecf0a133b1d57d319f08d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000122101\rdpcllp.exe

Filesize
10.5MB

MD5
78e97779f936b06a8c4c96240b7bc85b

SHA1
c005df8a050723df4127a429b00b9e1ac489c3ff

SHA256
f4edf7a7d5dba93cbf95ed6b266b64579544676b1f09a27fa487d3c95700eadc

SHA512
cda792eeb136f3d9a4136c4d7a38056835a01d1bad31e4d12f5381a3fdb86b24b7b1690c77c10f8244806b6316be07c78d1ffa4886ecf0a133b1d57d319f08d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\770849782088

Filesize
70KB

MD5
155417cafffe4d49065ac6f2a34a90ad

SHA1
ac278d0697b3ca15ce6ee21a089768445a8ce4d8

SHA256
e92a774dc7eeff09d53e96ceadd5c48b051b1dbe80e8f42d75be0372732b4aa2

SHA512
2a8defb9b1aa64b273bcdbc8a41d6335c1e93f2838ff78ffab4a7ad1beb02600cddbb5854c31b18391c20c464c04e9d3e280c905208bae4cb871282522aa8ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Filesize
6.8MB

MD5
4fcd70f4d036361d2fef09cf03932f7b

SHA1
b8c39838498676d95a267e8f9ee2bb59edb8e76e

SHA256
bfe406b543ca148c2ef6424a32682fbd540810078d52c6f0af8f0edb5951cd67

SHA512
3bec3c60d903a348712a179bb96cc20ca868abda2019077279877f40b877b2f127b2a60704f276c23fec4da58a5bff78638ca228dfc79726d6afe048120eb9ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Filesize
6.8MB

MD5
4fcd70f4d036361d2fef09cf03932f7b

SHA1
b8c39838498676d95a267e8f9ee2bb59edb8e76e

SHA256
bfe406b543ca148c2ef6424a32682fbd540810078d52c6f0af8f0edb5951cd67

SHA512
3bec3c60d903a348712a179bb96cc20ca868abda2019077279877f40b877b2f127b2a60704f276c23fec4da58a5bff78638ca228dfc79726d6afe048120eb9ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Filesize
6.8MB

MD5
4fcd70f4d036361d2fef09cf03932f7b

SHA1
b8c39838498676d95a267e8f9ee2bb59edb8e76e

SHA256
bfe406b543ca148c2ef6424a32682fbd540810078d52c6f0af8f0edb5951cd67

SHA512
3bec3c60d903a348712a179bb96cc20ca868abda2019077279877f40b877b2f127b2a60704f276c23fec4da58a5bff78638ca228dfc79726d6afe048120eb9ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Filesize
6.8MB

MD5
4fcd70f4d036361d2fef09cf03932f7b

SHA1
b8c39838498676d95a267e8f9ee2bb59edb8e76e

SHA256
bfe406b543ca148c2ef6424a32682fbd540810078d52c6f0af8f0edb5951cd67

SHA512
3bec3c60d903a348712a179bb96cc20ca868abda2019077279877f40b877b2f127b2a60704f276c23fec4da58a5bff78638ca228dfc79726d6afe048120eb9ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Filesize
6.8MB

MD5
4fcd70f4d036361d2fef09cf03932f7b

SHA1
b8c39838498676d95a267e8f9ee2bb59edb8e76e

SHA256
bfe406b543ca148c2ef6424a32682fbd540810078d52c6f0af8f0edb5951cd67

SHA512
3bec3c60d903a348712a179bb96cc20ca868abda2019077279877f40b877b2f127b2a60704f276c23fec4da58a5bff78638ca228dfc79726d6afe048120eb9ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Filesize
6.8MB

MD5
4fcd70f4d036361d2fef09cf03932f7b

SHA1
b8c39838498676d95a267e8f9ee2bb59edb8e76e

SHA256
bfe406b543ca148c2ef6424a32682fbd540810078d52c6f0af8f0edb5951cd67

SHA512
3bec3c60d903a348712a179bb96cc20ca868abda2019077279877f40b877b2f127b2a60704f276c23fec4da58a5bff78638ca228dfc79726d6afe048120eb9ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
279904beef7dbffb19fc519f737d7d4a

SHA1
964dbae8527cea1d031edcc04c7a23a08a59c94d

SHA256
358f8cab382402c05c4e59ae0491bb965adac5b901fbce28eb25c9431216b5ff

SHA512
689200522adfdd864eea12b5a52ab008e4ad819b5eba3c9cdbc67999ed113259143dca349544ccf270d208e7a768dda4ec0cffb6a11c27452c25f40831f5eb94

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A7V7BKTUFCWYNEW8U7M2.temp

Filesize
7KB

MD5
279904beef7dbffb19fc519f737d7d4a

SHA1
964dbae8527cea1d031edcc04c7a23a08a59c94d

SHA256
358f8cab382402c05c4e59ae0491bb965adac5b901fbce28eb25c9431216b5ff

SHA512
689200522adfdd864eea12b5a52ab008e4ad819b5eba3c9cdbc67999ed113259143dca349544ccf270d208e7a768dda4ec0cffb6a11c27452c25f40831f5eb94

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
555.1MB

MD5
ccde7b04d09802d94b092b8c6984b074

SHA1
132e00d82a6c6183948b11146012f63c5ef92547

SHA256
f7da24a00bd9fad234eb7dc7f978e6caaa27377c71e81ea1e72aa85dcc25d4ab

SHA512
433f6b168cc9b193c18e5972678c20c06bfc7580c2446ebf4ba50935dd026e3c57c6aa9419093516439eb50678c1e567c94695821fb3e27ddd9aa726bdf68891

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
3e9af076957c5b2f9c9ce5ec994bea05

SHA1
a8c7326f6bceffaeed1c2bb8d7165e56497965fe

SHA256
e332ebfed27e0bb08b84dfda05acc7f0fa1b6281678e0120c5b7c893a75df47e

SHA512
933ba0d69e7b78537348c0dc1bf83fb069f98bb93d31c638dc79c4a48d12d879c474bd61e3cbde44622baef5e20fb92ebf16c66128672e4a6d4ee20afbf9d01f

Download Submit
\Program Files\Google\Chrome\updater.exe

Filesize
10.5MB

MD5
78e97779f936b06a8c4c96240b7bc85b

SHA1
c005df8a050723df4127a429b00b9e1ac489c3ff

SHA256
f4edf7a7d5dba93cbf95ed6b266b64579544676b1f09a27fa487d3c95700eadc

SHA512
cda792eeb136f3d9a4136c4d7a38056835a01d1bad31e4d12f5381a3fdb86b24b7b1690c77c10f8244806b6316be07c78d1ffa4886ecf0a133b1d57d319f08d2

Download Submit
\Users\Admin\AppData\Local\Temp\1000120001\taskmask.exe

Filesize
3.4MB

MD5
126db18bbcf58a186b422970c57e4dbf

SHA1
97246ee3686052bb9e1142ac789b421b1bb067cc

SHA256
85693616d48b2266134fccd7197503d7da7d317c318016ea0f988c414a10e756

SHA512
59a58b17323329286bfc85d410fb7d269f6df82d05fc603871ac4f3440e4cf36e5e4f3a5f19a410fa7f9b4c23785bf38440396e847bb1d87611c2551a12fbca6

Download Submit
\Users\Admin\AppData\Local\Temp\1000121001\taskhostclp.exe

Filesize
3.2MB

MD5
4472444218925ed8fd4982f141af1978

SHA1
101ff99cec2f571002915f23290d495671967db3

SHA256
613d401501fccdf49d405bb8b6ce5f6fe96a2619db54e1e7a6f2410eb2aec72c

SHA512
b2255bced17a9cf9ab8afb461cea7005d2df77984f3122609d82d9a2f7f5ec3ca23ee8f20f609e60937db134ef721bf90fd759ddbe4df9acbf6216d8d2e15cff

Download Submit
\Users\Admin\AppData\Local\Temp\1000122101\rdpcllp.exe

Filesize
10.5MB

MD5
78e97779f936b06a8c4c96240b7bc85b

SHA1
c005df8a050723df4127a429b00b9e1ac489c3ff

SHA256
f4edf7a7d5dba93cbf95ed6b266b64579544676b1f09a27fa487d3c95700eadc

SHA512
cda792eeb136f3d9a4136c4d7a38056835a01d1bad31e4d12f5381a3fdb86b24b7b1690c77c10f8244806b6316be07c78d1ffa4886ecf0a133b1d57d319f08d2

Download Submit
\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Filesize
6.8MB

MD5
4fcd70f4d036361d2fef09cf03932f7b

SHA1
b8c39838498676d95a267e8f9ee2bb59edb8e76e

SHA256
bfe406b543ca148c2ef6424a32682fbd540810078d52c6f0af8f0edb5951cd67

SHA512
3bec3c60d903a348712a179bb96cc20ca868abda2019077279877f40b877b2f127b2a60704f276c23fec4da58a5bff78638ca228dfc79726d6afe048120eb9ab

Download Submit
\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
564.1MB

MD5
bb29feee1b2902d499b7a2d9a3805263

SHA1
d58855562ec7197c176e1b53d39f8aa2b79eda77

SHA256
074a83c07619724b54bfffd4fe8e7a54eeed98228d8a28234ab1ec54923be750

SHA512
7c597970e350c990f03529a44760213e570512f91905a321914d36570f30b419cfb7e5b3e161ddffa04f6a721337d13e7a22744e8bc45364bc8263257ddebc8a

Download Submit
memory/1228-129-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/1228-132-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/1228-133-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/1228-134-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/1228-135-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/1228-136-0x00000000769D0000-0x0000000076A17000-memory.dmp

Filesize
284KB

Download
memory/1228-131-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/1492-241-0x00000000736F0000-0x0000000073DDE000-memory.dmp

Filesize
6.9MB

Download
memory/1492-204-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1492-201-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1492-200-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1492-299-0x00000000736F0000-0x0000000073DDE000-memory.dmp

Filesize
6.9MB

Download
memory/1492-211-0x00000000736F0000-0x0000000073DDE000-memory.dmp

Filesize
6.9MB

Download
memory/1492-210-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1492-286-0x0000000007330000-0x0000000007370000-memory.dmp

Filesize
256KB

Download
memory/1492-212-0x0000000007330000-0x0000000007370000-memory.dmp

Filesize
256KB

Download
memory/1492-202-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1492-203-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1492-207-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1492-205-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1808-222-0x0000000001050000-0x0000000001811000-memory.dmp

Filesize
7.8MB

Download
memory/1808-297-0x0000000001050000-0x0000000001811000-memory.dmp

Filesize
7.8MB

Download
memory/1808-294-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/1808-292-0x0000000001050000-0x0000000001811000-memory.dmp

Filesize
7.8MB

Download
memory/1808-269-0x0000000001050000-0x0000000001811000-memory.dmp

Filesize
7.8MB

Download
memory/1808-236-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/2148-161-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-165-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-198-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/2148-218-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-220-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/2148-151-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-167-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-219-0x00000000286F0000-0x0000000028EB1000-memory.dmp

Filesize
7.8MB

Download
memory/2148-154-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/2148-155-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-156-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-157-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-158-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-159-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-160-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-172-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-162-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-163-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2148-217-0x0000000000050000-0x0000000000811000-memory.dmp

Filesize
7.8MB

Download
memory/2252-238-0x0000000076FA0000-0x0000000076FA2000-memory.dmp

Filesize
8KB

Download
memory/2252-249-0x000000013F170000-0x00000001409DD000-memory.dmp

Filesize
24.4MB

Download
memory/2252-288-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/2252-289-0x0000000076FE0000-0x0000000076FE2000-memory.dmp

Filesize
8KB

Download
memory/2252-295-0x000000013F170000-0x00000001409DD000-memory.dmp

Filesize
24.4MB

Download
memory/2252-298-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/2472-108-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-89-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/2472-75-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/2472-153-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/2472-77-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-237-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/2472-79-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-80-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-81-0x00000000769D0000-0x0000000076A17000-memory.dmp

Filesize
284KB

Download
memory/2472-82-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-83-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-110-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-85-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-169-0x0000000004730000-0x0000000004EF1000-memory.dmp

Filesize
7.8MB

Download
memory/2472-84-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/2472-86-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/2472-87-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-109-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-150-0x0000000004730000-0x0000000004EF1000-memory.dmp

Filesize
7.8MB

Download
memory/2472-107-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-106-0x00000000769D0000-0x0000000076A17000-memory.dmp

Filesize
284KB

Download
memory/2472-105-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-104-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/2472-88-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/2472-95-0x0000000001370000-0x0000000001A66000-memory.dmp

Filesize
7.0MB

Download
memory/2744-170-0x0000000002370000-0x00000000023E4000-memory.dmp

Filesize
464KB

Download
memory/2744-187-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-199-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2744-173-0x0000000000290000-0x00000000002AC000-memory.dmp

Filesize
112KB

Download
memory/2744-197-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-195-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-168-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/2744-193-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-191-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-164-0x00000000736F0000-0x0000000073DDE000-memory.dmp

Filesize
6.9MB

Download
memory/2744-189-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-127-0x00000000736F0000-0x0000000073DDE000-memory.dmp

Filesize
6.9MB

Download
memory/2744-185-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-183-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-181-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-179-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-146-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/2744-177-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-175-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-208-0x00000000736F0000-0x0000000073DDE000-memory.dmp

Filesize
6.9MB

Download
memory/2744-152-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2744-174-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/2744-126-0x00000000008E0000-0x0000000000C50000-memory.dmp

Filesize
3.4MB

Download
memory/3040-78-0x00000000769D0000-0x0000000076A17000-memory.dmp

Filesize
284KB

Download
memory/3040-73-0x0000000000F80000-0x0000000001676000-memory.dmp

Filesize
7.0MB

Download
memory/3040-76-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/3040-65-0x0000000000F80000-0x0000000001676000-memory.dmp

Filesize
7.0MB

Download
memory/3040-54-0x0000000000F80000-0x0000000001676000-memory.dmp

Filesize
7.0MB

Download
memory/3040-64-0x0000000000F80000-0x0000000001676000-memory.dmp

Filesize
7.0MB

Download
memory/3040-60-0x00000000769D0000-0x0000000076A17000-memory.dmp

Filesize
284KB

Download
memory/3040-61-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/3040-63-0x0000000076FE0000-0x0000000076FE2000-memory.dmp

Filesize
8KB

Download
memory/3040-62-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/3040-58-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/3040-59-0x0000000000F80000-0x0000000001676000-memory.dmp

Filesize
7.0MB

Download
memory/3040-56-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download
memory/3040-57-0x0000000000F80000-0x0000000001676000-memory.dmp

Filesize
7.0MB

Download
memory/3040-55-0x00000000750D0000-0x00000000751E0000-memory.dmp

Filesize
1.1MB

Download