Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 13:18

General

  • Target

    80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21.exe

  • Size

    7.7MB

  • MD5

    41ab78eba18f74db196c3876f49179a8

  • SHA1

    d0b573aafe0ae84468027929ca77f3013e8edeee

  • SHA256

    80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21

  • SHA512

    d37d91027df02cd3cd9799f183ffb21955933b27abd7810593bc33df18ac321c166d5a378ba9f50a34c907a1f3071b5b8370c6329f3d7ec223a240e8992dc68c

  • SSDEEP

    98304:vXYJ3MN/dOFAjqbqLSRlFNjZUlzCCgOU4dcRTzJ1dX/jC7PYxg5N0arG2sD0+9h0:AJcbvq+SrVXCJUs+TzJLLpILrXs

Malware Config

Extracted

Family

xworm

Version

3.1

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    SecurityHealthSystray.exe

  • telegram

    https://api.telegram.org/bot5370417334:AAEZrEauqhTNZInhZ9_-SaapQJIi0hIvjJU

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect Xworm Payload 8 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Async RAT payload 13 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21.exe
    "C:\Users\Admin\AppData\Local\Temp\80c91ecaab6a6a6a7a8cb3df47b111f031ea41beab9f8b8386f4c1bc8d18ff21.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:876
    • C:\ProgramData\tab.exe
      "C:\ProgramData\tab.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3544
      • C:\Users\Admin\AppData\Roaming\Protected.exe
        "C:\Users\Admin\AppData\Roaming\Protected.exe"
        3⤵
          PID:2628
          • C:\Users\Admin\AppData\Roaming\splwow64.exe
            "C:\Users\Admin\AppData\Roaming\splwow64.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1780
        • C:\Users\Admin\AppData\Roaming\Seting.exe
          "C:\Users\Admin\AppData\Roaming\Seting.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:3708
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • Checks computer location settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:868
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Seting" /tr '"C:\Users\Admin\AppData\Local\Temp\%Windows%\Seting.exe"' & exit
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4764
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
                PID:4640
            • C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe
              "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe"
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              PID:2748
            • C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe
              "C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"
              3⤵
              • Checks computer location settings
              • Drops startup file
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2808
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe'
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2864
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsSecurity.exe'
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2348
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:2628
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSecurity.exe'
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3188
              • C:\Windows\System32\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsSecurity" /tr "C:\ProgramData\WindowsSecurity.exe"
                4⤵
                • Creates scheduled task(s)
                PID:1444
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAcQBzACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAZgBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAegBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AawBpACMAPgA="
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4552
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "Seting" /tr '"C:\Users\Admin\AppData\Local\Temp\%Windows%\Seting.exe"'
          1⤵
          • Creates scheduled task(s)
          PID:2724
        • C:\ProgramData\WindowsSecurity.exe
          C:\ProgramData\WindowsSecurity.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1960
        • C:\ProgramData\WindowsSecurity.exe
          C:\ProgramData\WindowsSecurity.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4928
        • C:\Windows\system32\BackgroundTransferHost.exe
          "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
          1⤵
            PID:2724
          • C:\ProgramData\WindowsSecurity.exe
            C:\ProgramData\WindowsSecurity.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3820

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\WindowsSecurity.exe

            Filesize

            141KB

            MD5

            cd193387c79bf8deeb078dee3b6fb2f6

            SHA1

            81b2d17246b98180449e6be9903b838e124fb5c9

            SHA256

            d7cbdd7320d65ec1217ed6b8cc2de778feb39ad82ad5f38931d7c3c16094172f

            SHA512

            76db72d78e1dd7e10820250bdaa9128f886c0d195a3f34793802399c06867d7c83518dd185827cd8e420f8e3520b030c0bea5056809cf4ca897c2e37188f0d7e

          • C:\ProgramData\WindowsSecurity.exe

            Filesize

            85KB

            MD5

            cb6593071f94e78ee7c5a7ee36440391

            SHA1

            98ca912b5e456bb0136e0c17be95f23c9d13dc87

            SHA256

            50a1bd93d768a8f809230428eb5f6560874b295297ce6746408252ded76ee336

            SHA512

            76a35e0d0b5ed712e4ca9e18c4402ed90e501a17d878baaf13c4960fbb51a34a2f90a16e29fafefa11050d2ac99e01587c51b60a516356d4d4ad1b60833dfdd9

          • C:\ProgramData\WindowsSecurity.exe

            Filesize

            28KB

            MD5

            228d315982fc8af6695da9ad00ce7dde

            SHA1

            86bc93492708e5aa780ccc7f8192a581e0a6c536

            SHA256

            6e6944ce03db7a435f6256e47cd09da7b80e135a8dd0c185e2ac1557ec23cfb7

            SHA512

            a45071ce5ec9962dab40f72801a98a974635ce242df077b4851b15b9b28b68464de163783bc3bb8aeb7d3b2ca7404e335033be74b11359c46a7d62eab3b9fd6e

          • C:\ProgramData\WindowsSecurity.exe

            Filesize

            375KB

            MD5

            216ef921adac2bbb51ff6331f61b19e7

            SHA1

            90c3cfc3b78daa2bfa12d26dbd765fbfd4bc510d

            SHA256

            5d717d35b913ff6d13c408f294d899ca58bb321598426eca2bea71b9e6edd9ce

            SHA512

            33b817fe0b8bcca66173dd293de6a4926b5195a990ee575a378eb4c71610dc68bb3e36b70f4498bd8a2fc9d12283b05a8fd296d2108554105f0e49fdb9e89f0c

          • C:\ProgramData\tab.exe

            Filesize

            29KB

            MD5

            3f841406667490efebdadae20598dd43

            SHA1

            3686db18fc8123a42beeed2c5a597ccd6cb4aa6a

            SHA256

            af910e4908438646bce44fff74b7f69ae07780a97d20603416ffc945f010ff41

            SHA512

            b31acc0e11c0fe940811c116a1c9b9c93a4b42781f8f6a0450b398761967c7bd769b1f1e52e43d4bec30b7f389e1c60af744a63c012ba744a7e0f88cb716da5c

          • C:\ProgramData\tab.exe

            Filesize

            62KB

            MD5

            09a70251ab02692503ab46c25649cc1c

            SHA1

            5df2f41621e4424784e5323ed70ee3cdcc0d182b

            SHA256

            5571870e1a7803bf5ba3acef36d72a8950d7ffcb03e7022ae111d1e9acdd1927

            SHA512

            333bf3186e3303a871e435161b7b382541ccca82da82a62f37c8bb6952bab566d93f1ac80f0dcee20d06b5a76ce90cdaede82c785b6ed6f0bc2e7326f8ab7813

          • C:\ProgramData\tab.exe

            Filesize

            54KB

            MD5

            a94d4bf3bd969f56cb88b11a5f4901a3

            SHA1

            c975df920fb5e2a1b9fc6b6ae7cc2019b6c994ae

            SHA256

            10d8dc40eb44705fe4ad9b8391f435c7e91de8a7d8f176a2f8f109f2f393d01c

            SHA512

            afa218629e538eb55e87c77f53668d7c745a62d369597ee7d6f302b0da6d80ff91abb1016aba1c90e0daa23c9506e9375fc81704c8bd181337d050243a91d1a4

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WindowsSecurity.exe.log

            Filesize

            654B

            MD5

            2ff39f6c7249774be85fd60a8f9a245e

            SHA1

            684ff36b31aedc1e587c8496c02722c6698c1c4e

            SHA256

            e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

            SHA512

            1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            d85ba6ff808d9e5444a4b369f5bc2730

            SHA1

            31aa9d96590fff6981b315e0b391b575e4c0804a

            SHA256

            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

            SHA512

            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            18KB

            MD5

            8b4d40199663876a753aca1ad667f5da

            SHA1

            d72aa1d451c2837d15db1cb4ddb3b6d51c175042

            SHA256

            50362ac2ef6272fccf45e3aed489f5f2eba41678a68a2fdd50edd53a4c958bf5

            SHA512

            e2b3aeb1f8637e6531774ca319da5458beb476159c75541ce8d3aa9499bf49e375607e0df4a893984b12d9933caf11f9faab4f95d5283085a0d891edabb614ed

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            41ac47e52d901688f4c46823eb12c6ae

            SHA1

            c80f6ae3584d3ebd94b753dd7ef1039ed541f078

            SHA256

            ab4a7be7634267aaf9c5db321924ee34f6e8c97267bf0844138bde233c409c8f

            SHA512

            1ccb1c694c6d61027b223cf7c79ce5fdc6046a4a32dc15f22b722d6f063c127f4b5f5f3740f2c8b2447504f54d6e0d9afa47d202a61946e29bbcbac41d83c5b4

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            944B

            MD5

            dd9ccfa032ff7bac4e38bc9f25bbc4e1

            SHA1

            75210a2cca407cf3d1dffeda5f5f756fee48685e

            SHA256

            568e5bc3255d8769d6019913ac4d0ec1db63a147d42be0c73f46280da7a1a8d3

            SHA512

            6ddb9a7b0645c4c46babee9697cbb35ea9733a7984582369c5d31f182bdffb33be68671b1183fbf6c5456bc4a23f441587857e09289f5a9e8b20f20f44cc028d

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fn4uawpu.kzx.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Roaming\Protected.exe

            Filesize

            174KB

            MD5

            9a91cd652fe6da66e436af7111a8a128

            SHA1

            20626cf2a579e414dd6398e14ec35046d2c199b4

            SHA256

            141c2c776843ceef46b040b6e82d5d5302707841098288fb36841fd3dc705b57

            SHA512

            96a39e2bdd81753cb1c756745439a83a6d816acaeb6c9e1161f22323140ade0bbd1b1156662736f242ba81816de7b3d338a7e60b4cc37d29b5e0fe0fdb2125fd

          • C:\Users\Admin\AppData\Roaming\Protected.exe

            Filesize

            104KB

            MD5

            2393b55f8f032f44eee394514601b608

            SHA1

            7c68d7addb48d1068e201cbf9c0e13dcb17116c7

            SHA256

            892d5f498b60d2b1a46ef6494228b7759acc1855d191f462b6689ab6c09100b4

            SHA512

            e409b850afc3aad9c3c204fdec0ccb5babaa782187bc8fd76bf2e7af35b851997ae5d406926479346d37f92858101f35aa50c887e81017dced5a64a1e5bb89c9

          • C:\Users\Admin\AppData\Roaming\Protected.exe

            Filesize

            1KB

            MD5

            ada2bcdfb14d0b5ba5441949c1404e21

            SHA1

            7a503dcbbc80d71fdcb4e687f5665480d569378a

            SHA256

            6cab421de4ede68a8e486004cdd8b1f8cad2a55d32dd506d4712f0b88d9c2357

            SHA512

            3cf3a72a3232d8c00ae1e8c4e1e3bda6050be9a4b7e0cc771d02313ebfe93877ff38ece3215983aafb9176b49ee081f3567a971f370ed1789cb68215d69707d5

          • C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe

            Filesize

            42KB

            MD5

            de55572818656124fc5c2d31d37957a6

            SHA1

            17d5c7c264bcfd34f39f1fef9a2676ad4ee19c79

            SHA256

            ae3a4f51cdc9d14f7cabfb247650631493fcaab705fb1afe09a1f3d3f3d3f07d

            SHA512

            665253ed9aeb02b43004aff3ecf09bd17a59b6702f0f066d4c663470506cfb5ae8e53e7674be216f666487a3ec04600a5d8ca7f5e45c6eb37fbe2a2ba9f54f10

          • C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe

            Filesize

            67KB

            MD5

            bcbd10ef5b923c01945bb00b18378721

            SHA1

            b7413ec6c691f98b6573e29535d6e9a8db501e2c

            SHA256

            6aca1eb7a8a55688865179cd935fc0d2c59f6bc622761151d66cc22b5673f856

            SHA512

            77bf75b7b57835a050c5f47085c435f1f18e4fc801522ca83c22b5dd1fdbde266ce9a36ad079570c32464976e39eb5c6363368e7acb8505c354130fbd1a9d203

          • C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe

            Filesize

            35KB

            MD5

            0642b88c542cec91f853306c4cf88db3

            SHA1

            84f9c3e4c1f2a952429fb504176a240b6de50f8e

            SHA256

            aca06b59dca8cba7a482fd285c539176e6bf36cc142b4970b0ac535a83c70c1d

            SHA512

            0362a464637cc960fd0e91455f27bdde080d5e285056209b9195a574630ea7f247b5386f5c93ff0a58a35f372fca74545f1c48446e6190f8fbd6a6b5fdf796f0

          • C:\Users\Admin\AppData\Roaming\Seting.exe

            Filesize

            101KB

            MD5

            3364dc51d4d4655c7c11a8e1e8f02c40

            SHA1

            7430fb266e0b4a59d1d1625761b7c3e01b7171e8

            SHA256

            86a103e639f2fd089f19e5881624a11afaf899eff57a3fa030548a7eb2c075d8

            SHA512

            15e488d260565f80336936513f022248b7180ad69c0103347373c6a3d2074c773b3ba475975240f51b5d846808f16137b980c3b2e43124788335bc6b4c86d8a2

          • C:\Users\Admin\AppData\Roaming\Seting.exe

            Filesize

            57KB

            MD5

            2abdd57ed6feab13dc79fd492be4df87

            SHA1

            5d5239e10f9a07a60117b9607cab709caa770da5

            SHA256

            037d419e4d164e7e37c44dd6736ef9782dd0e722eb3129a065675e4dab9f1b2e

            SHA512

            57a4ce1b89bbdd3e0ddff52c3aa9f4d2c1caa6c4f95d3f7c993dd0dda4a7158563fb086ca93f27f206b494a3fe73b8119cabf9e91a9940b53ca62e1eefe0a7bf

          • C:\Users\Admin\AppData\Roaming\Seting.exe

            Filesize

            87KB

            MD5

            aa53b76a20115749d2fa81bc1c44f518

            SHA1

            34f80ec5a8f8a0ccd53eb6b02ebc12247ec864ef

            SHA256

            fa285c97bb2de40f6c88a99ae466487533f125a4aec072656d6cb91828be29dd

            SHA512

            3b5093b0f5f94f04f47524d399d9394ffe766b0f0c1d77914c1f4641f1d67dd9a328f2a17cdc5dfc39d9e3a57d07ef85af2b491ee9024dea26d255264fd1f6af

          • C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe

            Filesize

            40KB

            MD5

            b98204fd217d2404cf1cf4a550c7c82d

            SHA1

            5edb7774f1555b116155b51bf99b7bd84d6bdcfd

            SHA256

            07ee7148ec38323772372de405270631f44b23f000579ca224ba0fe82775f860

            SHA512

            b83b050bf2423a5594cdb3c64f6c93cdaa2b226d777228200bbbe6d40f9dc26917ea491240b8d8eb4d9bbdb4f3b9f896ebdc30eee4c5dfadb30adaa1b2974962

          • C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe

            Filesize

            16KB

            MD5

            be36f83c49c91b493c1992aa795b4368

            SHA1

            5b5f180cc4b069da04aaa4ff43f70802e8b57b0b

            SHA256

            a1032c56a7b74171b9715b97ff96a682db9879b6be17f301261fc7b94187bf31

            SHA512

            93d8fb08b1a87f981e564bb971d881ead7c0acae64567d78e2f1d6a9c401f1926e24fdf4c23ad10e30b60a0f3dc30731a4d270efa836e1fc12c07a36c673254c

          • C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe

            Filesize

            13KB

            MD5

            91445a36cff3857c09de696e0ea08b5b

            SHA1

            0b181186e5e73f7dd84ea6ce1d74759541d8d0f6

            SHA256

            03caba84f836f9897fa1f5f9597fc844789f9ee233f2e3bd8f9853a7a5327e04

            SHA512

            93ca62fe2ed1ddf566cfe67e20ebd6a83b6fdbda3aea5da0ccd8724125df1e50187cc108444063573b5d560232ef4efe50a8938b79d6dbd765b798be5d45ee1f

          • C:\Users\Admin\AppData\Roaming\splwow64.exe

            Filesize

            55KB

            MD5

            f038f6510e5a60b98ffe79aacef83e55

            SHA1

            b52407f42a8a73bc332d03cb0c3af7c357788c2f

            SHA256

            f8ab8a461900f885ffdcfa4b1300467e8e355687b52f53f2f5f27f1d9e6d0fcb

            SHA512

            06d768600b4873cb48728a0c382da58205760630d616d0fd025741271445220523676c4674583d2c15c2aae481354dce42079e6e24f24f23f33e3c36b65f4123

          • C:\Users\Admin\AppData\Roaming\splwow64.exe

            Filesize

            27KB

            MD5

            bb0606893c03dddc3aacffb7d208bfbe

            SHA1

            cd124865170421287578a295cdd652d024686afd

            SHA256

            3d254f3e701742d7d48b6e47a59b730252b8e438a248dbe83e4d186298a65bb7

            SHA512

            f70f2d43157d9dc6cef23627379eafb8b12ca839ee4fa0aca997b8a8b8a9d15e99c8c0f4c3f58b7145ceaa1855ace0f50000211b6238a229e759180816fe6324

          • C:\Users\Admin\AppData\Roaming\splwow64.exe

            Filesize

            21KB

            MD5

            b49f4dd052dc7623f0cd19d61e80e537

            SHA1

            779d270f71af930a58d9505ef8e03f2b2d207f30

            SHA256

            91896586af122f87331bbb37a3fee4a7c269f6a2ef0419ddd55911613ed02d53

            SHA512

            7a624a159c5643ed2d28f60b891c834e8c53bc00a34200986d3e89bab337d029521c3b89d8172dd5c95bc27f7345ab63e4c19b15610f57c902da911c38523c00

          • memory/868-204-0x00000000731A0000-0x0000000073950000-memory.dmp

            Filesize

            7.7MB

          • memory/868-144-0x0000000000400000-0x0000000000692000-memory.dmp

            Filesize

            2.6MB

          • memory/868-137-0x0000000000400000-0x0000000000692000-memory.dmp

            Filesize

            2.6MB

          • memory/868-141-0x0000000000400000-0x0000000000692000-memory.dmp

            Filesize

            2.6MB

          • memory/868-143-0x0000000000400000-0x0000000000692000-memory.dmp

            Filesize

            2.6MB

          • memory/868-142-0x0000000000400000-0x0000000000692000-memory.dmp

            Filesize

            2.6MB

          • memory/868-140-0x0000000000400000-0x0000000000692000-memory.dmp

            Filesize

            2.6MB

          • memory/868-139-0x0000000000400000-0x0000000000692000-memory.dmp

            Filesize

            2.6MB

          • memory/868-138-0x0000000000400000-0x0000000000692000-memory.dmp

            Filesize

            2.6MB

          • memory/868-129-0x0000000000400000-0x0000000000692000-memory.dmp

            Filesize

            2.6MB

          • memory/868-136-0x00000000731A0000-0x0000000073950000-memory.dmp

            Filesize

            7.7MB

          • memory/876-14-0x00007FF931760000-0x00007FF932221000-memory.dmp

            Filesize

            10.8MB

          • memory/876-0-0x0000000000E40000-0x00000000015FA000-memory.dmp

            Filesize

            7.7MB

          • memory/876-1-0x00007FF931760000-0x00007FF932221000-memory.dmp

            Filesize

            10.8MB

          • memory/1364-84-0x0000000005020000-0x0000000005030000-memory.dmp

            Filesize

            64KB

          • memory/1364-127-0x0000000000F30000-0x0000000000F40000-memory.dmp

            Filesize

            64KB

          • memory/1364-65-0x0000000000580000-0x00000000006DE000-memory.dmp

            Filesize

            1.4MB

          • memory/1364-135-0x00000000731A0000-0x0000000073950000-memory.dmp

            Filesize

            7.7MB

          • memory/1364-128-0x0000000005130000-0x00000000051CC000-memory.dmp

            Filesize

            624KB

          • memory/1364-71-0x00000000731A0000-0x0000000073950000-memory.dmp

            Filesize

            7.7MB

          • memory/1780-99-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/1780-97-0x0000000000610000-0x000000000085A000-memory.dmp

            Filesize

            2.3MB

          • memory/1780-168-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/1780-208-0x0000000001070000-0x0000000001080000-memory.dmp

            Filesize

            64KB

          • memory/1960-209-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/2348-165-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/2348-167-0x0000026758F50000-0x0000026758F60000-memory.dmp

            Filesize

            64KB

          • memory/2348-166-0x0000026758F50000-0x0000026758F60000-memory.dmp

            Filesize

            64KB

          • memory/2348-180-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/2628-47-0x0000000000CD0000-0x0000000001244000-memory.dmp

            Filesize

            5.5MB

          • memory/2628-96-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/2628-64-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/2748-66-0x0000000000400000-0x000000000044F000-memory.dmp

            Filesize

            316KB

          • memory/2808-145-0x00000000029E0000-0x00000000029F0000-memory.dmp

            Filesize

            64KB

          • memory/2808-68-0x0000000000A00000-0x0000000000A64000-memory.dmp

            Filesize

            400KB

          • memory/2808-81-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/2808-160-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/2808-205-0x00000000029E0000-0x00000000029F0000-memory.dmp

            Filesize

            64KB

          • memory/2864-159-0x000001737F7F0000-0x000001737F800000-memory.dmp

            Filesize

            64KB

          • memory/2864-163-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/2864-151-0x000001737F780000-0x000001737F7A2000-memory.dmp

            Filesize

            136KB

          • memory/2864-157-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/2864-158-0x000001737F7F0000-0x000001737F800000-memory.dmp

            Filesize

            64KB

          • memory/3188-191-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/3188-195-0x00007FF9315B0000-0x00007FF932071000-memory.dmp

            Filesize

            10.8MB

          • memory/3188-192-0x0000019467780000-0x0000019467790000-memory.dmp

            Filesize

            64KB

          • memory/3188-193-0x0000019467780000-0x0000019467790000-memory.dmp

            Filesize

            64KB

          • memory/4552-101-0x0000000005F10000-0x0000000005F2E000-memory.dmp

            Filesize

            120KB

          • memory/4552-46-0x00000000731A0000-0x0000000073950000-memory.dmp

            Filesize

            7.7MB

          • memory/4552-133-0x00000000731A0000-0x0000000073950000-memory.dmp

            Filesize

            7.7MB

          • memory/4552-126-0x0000000007560000-0x0000000007568000-memory.dmp

            Filesize

            32KB

          • memory/4552-125-0x0000000007580000-0x000000000759A000-memory.dmp

            Filesize

            104KB

          • memory/4552-123-0x0000000007480000-0x000000000748E000-memory.dmp

            Filesize

            56KB

          • memory/4552-124-0x0000000007490000-0x00000000074A4000-memory.dmp

            Filesize

            80KB

          • memory/4552-45-0x0000000002930000-0x0000000002966000-memory.dmp

            Filesize

            216KB

          • memory/4552-122-0x0000000007440000-0x0000000007451000-memory.dmp

            Filesize

            68KB

          • memory/4552-103-0x000000007F550000-0x000000007F560000-memory.dmp

            Filesize

            64KB

          • memory/4552-121-0x00000000074C0000-0x0000000007556000-memory.dmp

            Filesize

            600KB

          • memory/4552-104-0x0000000006EF0000-0x0000000006F22000-memory.dmp

            Filesize

            200KB

          • memory/4552-115-0x00000000064A0000-0x00000000064BE000-memory.dmp

            Filesize

            120KB

          • memory/4552-120-0x00000000072C0000-0x00000000072CA000-memory.dmp

            Filesize

            40KB

          • memory/4552-119-0x0000000007240000-0x000000000725A000-memory.dmp

            Filesize

            104KB

          • memory/4552-118-0x0000000007880000-0x0000000007EFA000-memory.dmp

            Filesize

            6.5MB

          • memory/4552-116-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

            Filesize

            64KB

          • memory/4552-117-0x0000000006F30000-0x0000000006FD3000-memory.dmp

            Filesize

            652KB

          • memory/4552-105-0x0000000070200000-0x000000007024C000-memory.dmp

            Filesize

            304KB

          • memory/4552-62-0x0000000005200000-0x0000000005828000-memory.dmp

            Filesize

            6.2MB

          • memory/4552-67-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

            Filesize

            64KB

          • memory/4552-90-0x0000000005830000-0x0000000005896000-memory.dmp

            Filesize

            408KB

          • memory/4552-102-0x0000000005F30000-0x0000000005F7C000-memory.dmp

            Filesize

            304KB

          • memory/4552-98-0x0000000005A10000-0x0000000005A76000-memory.dmp

            Filesize

            408KB

          • memory/4552-100-0x0000000005A80000-0x0000000005DD4000-memory.dmp

            Filesize

            3.3MB

          • memory/4552-73-0x0000000004F90000-0x0000000004FB2000-memory.dmp

            Filesize

            136KB

          • memory/4552-69-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

            Filesize

            64KB