Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    22/11/2023, 01:49

General

  • Target

    d25339ece508876c8900d27721f042391a4cc2769805afa377556a416a192c49.exe

  • Size

    66KB

  • MD5

    50b2b692da0c363e301709a28b30afaf

  • SHA1

    098e00413ba405bcc72b71a5869c2d151e93448a

  • SHA256

    d25339ece508876c8900d27721f042391a4cc2769805afa377556a416a192c49

  • SHA512

    d463babcae95c3c200af5ae59aa5f89e2edeb267bb15e843f8a241e17794db1672067cba421ba38cda4e161151d93e5eb2e3bb06cd5ce6bc98d651ebf58f06ce

  • SSDEEP

    1536:UJOjk0yzcRvVSfD8tzsy/jV49Gko0S/aATWJvQ3MJea9yn90+x:UJ70yK4D6P+YxpABJD9F+x

Malware Config

Extracted

Family

xworm

Version

5.0

C2

162.212.154.8:41589

Mutex

1fGBFdYzxtDnKgy4

Attributes
  • Install_directory

    %AppData%

  • install_file

    OneDrive.exe

  • telegram

    https://api.telegram.org/bot6875063177:AAG1OPJLZ36MPY8oqR1DVb1VHR2wOmnCudg/sendMessage?chat_id=2136313574

aes.plain

Extracted

Family

limerat

Attributes
  • aes_key

    devil

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/rPy10VvM

  • delay

    3

  • download_payload

    false

  • install

    true

  • install_name

    Windows Session Manager.exe

  • main_folder

    AppData

  • pin_spread

    false

  • sub_folder

    \Windows\

  • usb_spread

    false

Signatures

  • Detect Xworm Payload 4 IoCs
  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d25339ece508876c8900d27721f042391a4cc2769805afa377556a416a192c49.exe
    "C:\Users\Admin\AppData\Local\Temp\d25339ece508876c8900d27721f042391a4cc2769805afa377556a416a192c49.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2952
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\one.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2264
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /TN "one" /SC ONLOGON /TR "C:\Windows\System32\one.exe" /RL HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:2984
    • C:\Windows\System32\one.exe
      "C:\Windows\System32\one.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\one.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2880
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'one.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1824
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1536
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2324
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\ses.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2736
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /TN "ses" /SC ONLOGON /TR "C:\Windows\System32\ses.exe" /RL HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:556
    • C:\Windows\System32\ses.exe
      "C:\Windows\System32\ses.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:328
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ses.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1092
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1092 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    aa6429885fade7041cf7dca1238e1773

    SHA1

    0437087d73377fd90e61dd1ddf16febe3cf23260

    SHA256

    1ea3bac6df400b4a5a53c26a2104369684e9a36cec1eb1d6ec9206b3b036fd09

    SHA512

    f9c5592091e5877c6111aab64554bc0a9eea0965437fccd21093a73c64623beab053428f078da67c0ce7dbe1919a159c3e4d9a26625027808ceebac4ab478fb3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    59551cd780a6dfe9423348b9bac1efe3

    SHA1

    ba7d4804889feac80315d1a9d22bd1dcac321c9d

    SHA256

    5074032936682136cc7382f12144ff1c3f111979fde1aa75f57f8733159b44d7

    SHA512

    f66b3cac90d8e8d0859c47a292b1c070f4cab01e21deb73cd1dc62cb8baf280824c5e98faaad6b51fc531fa131cad3c12844a32270465f6d4ab071ad3894761c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    00bf96dd60f430d62a5cedf0e97c7b00

    SHA1

    f2fe5eb501c56d23e1f42952a104082b47a57174

    SHA256

    ce675aabb51cdb1392c605de6037917bf175348519f7d68779b9e76b9937c7e9

    SHA512

    303651d9429a30b1d752675920765719390ba9e8f86f87d3ed1991e8dfc7d1b4a79be5ffdadb264fc2b188505535b25c8e0361cb5d4bdcc6f17a7403dd59b287

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    efcfaa7f816450c591704bf4ccbb3d7a

    SHA1

    8bc3c1743449f846eeb17212c58c93d14a2375a8

    SHA256

    e3a0081904ae3e9b3d289357e162d2f80df06d59900e4fbb6cfe98aa2b912532

    SHA512

    79fcf7555e2225af737aec072fe24087de45383c3d31072c06d2cba38c0d9393009796ab39b62055abe58cb9c49cd864430b7ad9417df471e5d6ef90f326448d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e174c8586f323929ac3d3f41080e64af

    SHA1

    76e91e925c6faa3d1b250639ba466030df90f502

    SHA256

    1b372561cbf5002496e558268c919e049d236da9dc3fc23ce2a937791e4ae357

    SHA512

    2e53923b069ae0b57a3c4251768e77793a37a0c3b7f9be08799a8ddc7bc90cf9366a434852a727299c6d4cfcd4e6d0b0f07269e7ffc2fd812fd23316e6a117f6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f8a57950581b0f56aff8454a61fde662

    SHA1

    05584a7e46d97f5ab9ed50a29dc77bbb6cd0ad43

    SHA256

    0f21616fb445d922a7f75bb0cef0df018284c86127d170eb821ca528a4e7e272

    SHA512

    7458b2c50ff4eb021c589a4b84067771640911af26824e674bae1a244b7c06ed14f255ca4aeeb59e8a61d563e7d353235dd98806e266e1596e9449e8dd3d3701

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    be30beb03b5d4102095081d32fdd6d62

    SHA1

    f3e7383047f9cef95911d495a704368e5a8ace02

    SHA256

    d331d5a18b214c7c186067271ce547482b9f61bf176f65959542b14d4bcf89bc

    SHA512

    6617f172a19a33a4bde0000b0cd364bf52e2838171ae8c387f18b343b37566985d7ddb3b16afd31b7dff11b80f4b74660bac1f539d78b2dda58fea0b82126176

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3525b3b90bb9a13905eaa44e136070dd

    SHA1

    73b8cc9b7da59db81ddfc375770fcc5a9ab59d2f

    SHA256

    57db7beaeab7094ead1edf6153a875c200428001d4037184060b0c66eb448ddc

    SHA512

    2f2b6370f5a141061a18dd3b1563b511383212d1367e89d97096144cf4436d86f63c34d1cc9ac53060eccad5cb3dca47dc2d5c62996bac2fc4ce584e8592b903

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7c2c4ab81bfcd717aa615f3f744f1387

    SHA1

    566ff36988a578dda0137604491409d8ebe5167d

    SHA256

    c1e6c416e68c4937615d7a904eedd0d6ddfc387c09e86c47b0d276a12c097a4e

    SHA512

    5314505d7c6505328f9cbff54f80a8bd482824449a362fc50486de6f480d55ceb24e578aa46e8674b226e2a7218c554f4ee694e811b88fd707a26d282b89e7df

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5384e6e2f2ba287db4ef50c5f56b9963

    SHA1

    d3042c720c826dbee4da75a6de2718c0473883ca

    SHA256

    31bc7f8d5198ca3d70e6ed57408ca31638dce766f196f2a766c9739b6e6c9079

    SHA512

    824c72a83116e0ca75197b7c8b44a30cfb9b3281db7cb430258ccea19c149896c820aab1aa7219b363d825bbe74628452c9e53a9a78c640600c8040d7e04803d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d8538c64ea1d53a2f063a2db68e554c2

    SHA1

    a05d7a9b2425440f087f56a1443572fc59ed18cf

    SHA256

    8fb9418cc9aec1a31c0c1c9b20a98459b843f95b3de351263a77cf8a5be188ca

    SHA512

    d995de8286b7bdcc690867406a285b8664f95193ba02065483746bdae4475ae17d5d8a14400b35bb0671c03d326b87c59723805a1ea35ea3c2c673e8ef96b829

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9a5d156a3f3d91a52b56ad99db4b1014

    SHA1

    627febcf0e663febdd720e1cc8d7e0d517d520d4

    SHA256

    c6ddba1d88a06af70cc13bd970d6c8c2278162a7a4400f1ca67aa6b3890447e8

    SHA512

    9764841cb3ba8f940b2843def537b16715217098d1e85d20ad74ba440e71fca82ce9e81504b98c388ae16ce912621569e6d2d486d0af9cf64eafb9c4bd6a9c1b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cec0129d3a00f5234dd084e9db770cee

    SHA1

    c05cbbdc0fbb5c578faa312b250f6c4c92f23b88

    SHA256

    f7443f6f27c86b7c08dcc4c8ab92f6bbbefde366a1aa32b8d34dfd6d4a9bcd65

    SHA512

    6ac1b5e46870486dc73e5a1a8436da6527070e73e75791a1896e66864c529518b5f3384c655e6c6522bfa9dc9f5a66617b78888237c447c688e95a8c39898b5d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9f944880e309d03850cf456a1408f49a

    SHA1

    764fb870030f26ce6a355d86f29bc4bd6c971360

    SHA256

    49d9c594a047aa52279a671ce148c32cd4b311d32215b3fcbeb37acf8fd3841d

    SHA512

    929f83eb97fb58c35ad9c4f9bee07aa9b14e60b1d96234cf0fd7389dedbce1c84caeac3699c084b5a5426b215bde09af6b591b604d34026bbd6d126d3637bd55

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a33a3294b09d11dc2e49a1538a3f36f1

    SHA1

    83ba959d81e4c59b126b00f4dcf4435e9dbfbea7

    SHA256

    a556e38be85ebab2b2684469718de4f58ea2493dae9e054b31d55478e1a5bf95

    SHA512

    7e451cd2ffcc80364891ddaf42605c8b541bda9a2b55617e4f36394658e564fb14446974b477e1497462ebda93850c72b0cb967ef982d6136ad9b2c2a4747c05

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    09d7166ab7b53ce03a77d9a8a92573fa

    SHA1

    f0b9f1c3a19ce91de21eb0c7f5408da2025fa428

    SHA256

    8b9d4dda39708b0c0a1f40695843232fc626af3fc47c3adbc2d96aeb4c84b815

    SHA512

    9bf3326f9e961a584e8c3f0ab9b1abafb3421cc814fa911150f3a103937b556c5baca3926101aad1cf7aed04306adb07745a9d41a74c80316b04fc03d913034b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f44686dd7545bdc56782cbb0c79aa380

    SHA1

    88a7f35f0c1ea37d71ed2d650cf7ec62a612a7d4

    SHA256

    c157b3cbca33f3e38ea024471e7599d41e45a389839e6ca7d6b201b0e45bd0cb

    SHA512

    75771093bcbe2215ee735688afa9e4b2b4dbe713d1a81254641bcffcf888e0e4d82555b37416c53f4b855e5822f983411a627116991f5836772a13d7da696bbf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    11a14211888519e186e9631862a95b83

    SHA1

    6f9f615e557854f857a03f17d46f75664bfedbfa

    SHA256

    7eb12f6918a96d53da401ff6fa42736e6fcd847fa19bd08957298f06118b6d47

    SHA512

    7acf44d87efd35b174614f3090c660af93caf53dcf32d019256698e249a3c126fd9a4cc24a3ea098127bd66ae179d5f759b268548e883533fa6731a3848f86a8

  • C:\Users\Admin\AppData\Local\Temp\CabE997.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\TarEA07.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    c2923641ce31760237c311bf2929342f

    SHA1

    7c4769d09a6c3d416549fb093e978cc6c5e8da9a

    SHA256

    eed4ccfb16f1882f7b45afe890c32e88a8522ebfc6dd384e57a1b927fcf7fe5f

    SHA512

    c5c626f8a21f5b86d269dcf4ef4eae605e9d4dc6999afc97aee088c57234b2d9369de4770b1eeec1c618abbed68b535ff7f14f0b9eb1bc2b0686b0e101ef2a9f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    2ce4955364c2977a6410dd6bedfeef73

    SHA1

    dd9d6656041c533c23bd22f4ad941574c31a4d0d

    SHA256

    5a9ad32f672f5b7b911bb493a43bd02919906f15b24b25e508dc9026620ee583

    SHA512

    7c78370e43d4137381dac88efcf6831095e392810a1b34a552dc8532768a554ec21128b33315f6ad5b508a02903e28c75a9181a153a10c30d305d6bcc7ed3e15

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    c2923641ce31760237c311bf2929342f

    SHA1

    7c4769d09a6c3d416549fb093e978cc6c5e8da9a

    SHA256

    eed4ccfb16f1882f7b45afe890c32e88a8522ebfc6dd384e57a1b927fcf7fe5f

    SHA512

    c5c626f8a21f5b86d269dcf4ef4eae605e9d4dc6999afc97aee088c57234b2d9369de4770b1eeec1c618abbed68b535ff7f14f0b9eb1bc2b0686b0e101ef2a9f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    c2923641ce31760237c311bf2929342f

    SHA1

    7c4769d09a6c3d416549fb093e978cc6c5e8da9a

    SHA256

    eed4ccfb16f1882f7b45afe890c32e88a8522ebfc6dd384e57a1b927fcf7fe5f

    SHA512

    c5c626f8a21f5b86d269dcf4ef4eae605e9d4dc6999afc97aee088c57234b2d9369de4770b1eeec1c618abbed68b535ff7f14f0b9eb1bc2b0686b0e101ef2a9f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    337c3c7d054e596c0fe1cc4949badf98

    SHA1

    6c9f365aa262b0acc261a7560e69425c34a8ee0a

    SHA256

    d8ecfb2e26dbff971f982c240746d3c7d0ba6c1e3f84cb95966ee34eca9c9811

    SHA512

    e92607fa4759199dc59f6a292ee30a2f1861f9bf0eac0eed5c1ab101c147692c9c577f58e9bae7bff31cf4e7680671f1ebf1f8099fcf0340f9a9d69e16d053a1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GEZWN30877WTHN4L193H.temp

    Filesize

    7KB

    MD5

    337c3c7d054e596c0fe1cc4949badf98

    SHA1

    6c9f365aa262b0acc261a7560e69425c34a8ee0a

    SHA256

    d8ecfb2e26dbff971f982c240746d3c7d0ba6c1e3f84cb95966ee34eca9c9811

    SHA512

    e92607fa4759199dc59f6a292ee30a2f1861f9bf0eac0eed5c1ab101c147692c9c577f58e9bae7bff31cf4e7680671f1ebf1f8099fcf0340f9a9d69e16d053a1

  • C:\Users\Admin\AppData\Roaming\OneDrive.exe

    Filesize

    142KB

    MD5

    2f2fed589cef6c6973db3dd854a6ba13

    SHA1

    6a121feaa70814260efcc50a0b48696cd0cf570e

    SHA256

    1d77e69e717573061d58bb385dfe760cbbfbb205a9e1c1ea3428a25ac7319c36

    SHA512

    c8d942892f514afbd5a8f888897b31e6e4d4c2e2d155bf1561dfba03ff382a5c12e810f5bb2cd9ff461524f4dd4012e85363537568ca7b36ad51c2bd4d95aade

  • C:\Windows\System32\one.exe

    Filesize

    142KB

    MD5

    2f2fed589cef6c6973db3dd854a6ba13

    SHA1

    6a121feaa70814260efcc50a0b48696cd0cf570e

    SHA256

    1d77e69e717573061d58bb385dfe760cbbfbb205a9e1c1ea3428a25ac7319c36

    SHA512

    c8d942892f514afbd5a8f888897b31e6e4d4c2e2d155bf1561dfba03ff382a5c12e810f5bb2cd9ff461524f4dd4012e85363537568ca7b36ad51c2bd4d95aade

  • C:\Windows\System32\one.exe

    Filesize

    142KB

    MD5

    2f2fed589cef6c6973db3dd854a6ba13

    SHA1

    6a121feaa70814260efcc50a0b48696cd0cf570e

    SHA256

    1d77e69e717573061d58bb385dfe760cbbfbb205a9e1c1ea3428a25ac7319c36

    SHA512

    c8d942892f514afbd5a8f888897b31e6e4d4c2e2d155bf1561dfba03ff382a5c12e810f5bb2cd9ff461524f4dd4012e85363537568ca7b36ad51c2bd4d95aade

  • C:\Windows\System32\ses.exe

    Filesize

    28KB

    MD5

    ab9502a920271fd1cf060f388a45fcd0

    SHA1

    c7292f1d76eae037d3ea5dbbc171eee21bc944d8

    SHA256

    e0fb281db34b9fa35971cb1af42175d6b5650c46f261771361a1aeed70565787

    SHA512

    7fcf30539e0cf74d4f27904c4205d0d8fd209ffec2ca97fdd1277c3096e1dc8c910ce239b7bd622d4275d4ea24f5be2ca0ae6a3a2687e492fd7774712c620452

  • C:\Windows\System32\ses.exe

    Filesize

    28KB

    MD5

    ab9502a920271fd1cf060f388a45fcd0

    SHA1

    c7292f1d76eae037d3ea5dbbc171eee21bc944d8

    SHA256

    e0fb281db34b9fa35971cb1af42175d6b5650c46f261771361a1aeed70565787

    SHA512

    7fcf30539e0cf74d4f27904c4205d0d8fd209ffec2ca97fdd1277c3096e1dc8c910ce239b7bd622d4275d4ea24f5be2ca0ae6a3a2687e492fd7774712c620452

  • memory/1536-91-0x000007FEEE3D0000-0x000007FEEED6D000-memory.dmp

    Filesize

    9.6MB

  • memory/1536-88-0x00000000029B0000-0x0000000002A30000-memory.dmp

    Filesize

    512KB

  • memory/1536-87-0x000007FEEE3D0000-0x000007FEEED6D000-memory.dmp

    Filesize

    9.6MB

  • memory/1536-86-0x00000000029B0000-0x0000000002A30000-memory.dmp

    Filesize

    512KB

  • memory/1536-85-0x000007FEEE3D0000-0x000007FEEED6D000-memory.dmp

    Filesize

    9.6MB

  • memory/1536-90-0x00000000029B0000-0x0000000002A30000-memory.dmp

    Filesize

    512KB

  • memory/1536-83-0x000000001B400000-0x000000001B6E2000-memory.dmp

    Filesize

    2.9MB

  • memory/1536-84-0x0000000001F10000-0x0000000001F18000-memory.dmp

    Filesize

    32KB

  • memory/1536-89-0x00000000029B0000-0x0000000002A30000-memory.dmp

    Filesize

    512KB

  • memory/1824-73-0x000007FEEDA30000-0x000007FEEE3CD000-memory.dmp

    Filesize

    9.6MB

  • memory/1824-68-0x0000000002980000-0x0000000002A00000-memory.dmp

    Filesize

    512KB

  • memory/1824-67-0x000007FEEDA30000-0x000007FEEE3CD000-memory.dmp

    Filesize

    9.6MB

  • memory/1824-69-0x000007FEEDA30000-0x000007FEEE3CD000-memory.dmp

    Filesize

    9.6MB

  • memory/1824-70-0x0000000002980000-0x0000000002A00000-memory.dmp

    Filesize

    512KB

  • memory/1824-66-0x000000001B290000-0x000000001B572000-memory.dmp

    Filesize

    2.9MB

  • memory/1824-72-0x0000000002980000-0x0000000002A00000-memory.dmp

    Filesize

    512KB

  • memory/2264-11-0x000007FEEE3D0000-0x000007FEEED6D000-memory.dmp

    Filesize

    9.6MB

  • memory/2264-7-0x000007FEEE3D0000-0x000007FEEED6D000-memory.dmp

    Filesize

    9.6MB

  • memory/2264-8-0x0000000001FD0000-0x0000000002050000-memory.dmp

    Filesize

    512KB

  • memory/2264-9-0x0000000001FD0000-0x0000000002050000-memory.dmp

    Filesize

    512KB

  • memory/2264-10-0x000000001B140000-0x000000001B422000-memory.dmp

    Filesize

    2.9MB

  • memory/2264-12-0x0000000002050000-0x0000000002058000-memory.dmp

    Filesize

    32KB

  • memory/2264-13-0x0000000001FD0000-0x0000000002050000-memory.dmp

    Filesize

    512KB

  • memory/2264-14-0x0000000001FD0000-0x0000000002050000-memory.dmp

    Filesize

    512KB

  • memory/2264-15-0x000007FEEE3D0000-0x000007FEEED6D000-memory.dmp

    Filesize

    9.6MB

  • memory/2324-105-0x000007FEEDA30000-0x000007FEEE3CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2324-101-0x000007FEEDA30000-0x000007FEEE3CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2324-104-0x0000000002760000-0x00000000027E0000-memory.dmp

    Filesize

    512KB

  • memory/2324-97-0x000000001B310000-0x000000001B5F2000-memory.dmp

    Filesize

    2.9MB

  • memory/2324-98-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

    Filesize

    32KB

  • memory/2324-100-0x0000000002760000-0x00000000027E0000-memory.dmp

    Filesize

    512KB

  • memory/2324-99-0x000007FEEDA30000-0x000007FEEE3CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2324-102-0x0000000002760000-0x00000000027E0000-memory.dmp

    Filesize

    512KB

  • memory/2324-103-0x0000000002760000-0x00000000027E0000-memory.dmp

    Filesize

    512KB

  • memory/2628-536-0x000000001A930000-0x000000001A9B0000-memory.dmp

    Filesize

    512KB

  • memory/2628-71-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

    Filesize

    9.9MB

  • memory/2628-22-0x0000000000C20000-0x0000000000C48000-memory.dmp

    Filesize

    160KB

  • memory/2628-28-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

    Filesize

    9.9MB

  • memory/2628-107-0x000000001A930000-0x000000001A9B0000-memory.dmp

    Filesize

    512KB

  • memory/2736-31-0x0000000002390000-0x0000000002398000-memory.dmp

    Filesize

    32KB

  • memory/2736-36-0x000007FEEDA30000-0x000007FEEE3CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2736-30-0x0000000002870000-0x00000000028F0000-memory.dmp

    Filesize

    512KB

  • memory/2736-29-0x000000001B330000-0x000000001B612000-memory.dmp

    Filesize

    2.9MB

  • memory/2736-32-0x000007FEEDA30000-0x000007FEEE3CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2736-33-0x0000000002870000-0x00000000028F0000-memory.dmp

    Filesize

    512KB

  • memory/2736-34-0x000007FEEDA30000-0x000007FEEE3CD000-memory.dmp

    Filesize

    9.6MB

  • memory/2736-35-0x0000000002870000-0x00000000028F0000-memory.dmp

    Filesize

    512KB

  • memory/2880-51-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

    Filesize

    2.9MB

  • memory/2880-56-0x000007FEEE3D0000-0x000007FEEED6D000-memory.dmp

    Filesize

    9.6MB

  • memory/2880-57-0x0000000002500000-0x0000000002580000-memory.dmp

    Filesize

    512KB

  • memory/2880-52-0x000007FEEE3D0000-0x000007FEEED6D000-memory.dmp

    Filesize

    9.6MB

  • memory/2880-53-0x0000000002500000-0x0000000002580000-memory.dmp

    Filesize

    512KB

  • memory/2880-59-0x000007FEEE3D0000-0x000007FEEED6D000-memory.dmp

    Filesize

    9.6MB

  • memory/2880-55-0x0000000002500000-0x0000000002580000-memory.dmp

    Filesize

    512KB

  • memory/2880-54-0x0000000001E50000-0x0000000001E58000-memory.dmp

    Filesize

    32KB

  • memory/2880-58-0x0000000002500000-0x0000000002580000-memory.dmp

    Filesize

    512KB

  • memory/2952-45-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

    Filesize

    9.9MB

  • memory/2952-0-0x0000000000A90000-0x0000000000AA6000-memory.dmp

    Filesize

    88KB

  • memory/2952-2-0x000000001BCC0000-0x000000001BD40000-memory.dmp

    Filesize

    512KB

  • memory/2952-1-0x000007FEF5950000-0x000007FEF633C000-memory.dmp

    Filesize

    9.9MB