Analysis

  • max time kernel
    138s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2024, 00:00

General

  • Target

    6e2ee4f2fb68cc5169594dc840eaa398.exe

  • Size

    387KB

  • MD5

    6e2ee4f2fb68cc5169594dc840eaa398

  • SHA1

    46ca1fa3d3305a71f45ab9811c333d7da804beb8

  • SHA256

    121a71d2d2e648797d46e361bc5c6d9a791f768ae9296d7152f055373f318742

  • SHA512

    84ae5e753c0f6f334d388547e916b87653f34763cda9c6c3614d66b9bc8efc536d0fac745ff1c11a092fbccc22b6a717e933c7327ac720a416ab109a583811d5

  • SSDEEP

    12288:9X20TpWzHwqTfxZs0BFB7/gjQNIEDlFvtt+stn:9X20VWzwKfxe2FG/WlNtbn

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Modifies security service 2 TTPs 20 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs .reg file with regedit 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e2ee4f2fb68cc5169594dc840eaa398.exe
    "C:\Users\Admin\AppData\Local\Temp\6e2ee4f2fb68cc5169594dc840eaa398.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3236
    • C:\Users\Admin\AppData\Local\Temp\Decrypted.exe
      "C:\Users\Admin\AppData\Local\Temp\Decrypted.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4372
      • C:\Users\Admin\AppData\Local\Temp\tmpfile678.exe
        C:\Users\Admin\AppData\Local\Temp\tmpfile678.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:1864
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c c:\a.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1404
          • C:\Windows\SysWOW64\regedit.exe
            REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
            5⤵
            • Modifies security service
            • Runs .reg file with regedit
            PID:1592
        • C:\Windows\SysWOW64\logs.exe
          C:\Windows\system32\logs.exe 1016 "C:\Users\Admin\AppData\Local\Temp\tmpfile678.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:1368
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c c:\a.bat
            5⤵
              PID:968
            • C:\Windows\SysWOW64\logs.exe
              C:\Windows\system32\logs.exe 1168 "C:\Windows\SysWOW64\logs.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:1672
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c c:\a.bat
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2664
                • C:\Windows\SysWOW64\regedit.exe
                  REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                  7⤵
                  • Modifies security service
                  • Runs .reg file with regedit
                  PID:2692
              • C:\Windows\SysWOW64\logs.exe
                C:\Windows\system32\logs.exe 1148 "C:\Windows\SysWOW64\logs.exe"
                6⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:1404
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c c:\a.bat
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3120
                  • C:\Windows\SysWOW64\regedit.exe
                    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                    8⤵
                    • Modifies security service
                    • Runs .reg file with regedit
                    PID:2236
                • C:\Windows\SysWOW64\logs.exe
                  C:\Windows\system32\logs.exe 1144 "C:\Windows\SysWOW64\logs.exe"
                  7⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:3612
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c c:\a.bat
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4940
                    • C:\Windows\SysWOW64\regedit.exe
                      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                      9⤵
                      • Modifies security service
                      • Runs .reg file with regedit
                      PID:1880
                  • C:\Windows\SysWOW64\logs.exe
                    C:\Windows\system32\logs.exe 1152 "C:\Windows\SysWOW64\logs.exe"
                    8⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:644
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c c:\a.bat
                      9⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1128
                      • C:\Windows\SysWOW64\regedit.exe
                        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                        10⤵
                        • Modifies security service
                        • Runs .reg file with regedit
                        PID:3504
                    • C:\Windows\SysWOW64\logs.exe
                      C:\Windows\system32\logs.exe 1156 "C:\Windows\SysWOW64\logs.exe"
                      9⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Suspicious use of WriteProcessMemory
                      PID:4716
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c c:\a.bat
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3780
                        • C:\Windows\SysWOW64\regedit.exe
                          REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                          11⤵
                          • Modifies security service
                          • Runs .reg file with regedit
                          PID:2248
                      • C:\Windows\SysWOW64\logs.exe
                        C:\Windows\system32\logs.exe 1160 "C:\Windows\SysWOW64\logs.exe"
                        10⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        PID:2856
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c c:\a.bat
                          11⤵
                            PID:3268
                            • C:\Windows\SysWOW64\regedit.exe
                              REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                              12⤵
                              • Modifies security service
                              • Runs .reg file with regedit
                              PID:4604
                          • C:\Windows\SysWOW64\logs.exe
                            C:\Windows\system32\logs.exe 1164 "C:\Windows\SysWOW64\logs.exe"
                            11⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:1228
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c c:\a.bat
                              12⤵
                                PID:3560
                                • C:\Windows\SysWOW64\regedit.exe
                                  REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                  13⤵
                                  • Modifies security service
                                  • Runs .reg file with regedit
                                  PID:4600
                              • C:\Windows\SysWOW64\logs.exe
                                C:\Windows\system32\logs.exe 1172 "C:\Windows\SysWOW64\logs.exe"
                                12⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                PID:776
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c c:\a.bat
                                  13⤵
                                    PID:2036
                                    • C:\Windows\SysWOW64\regedit.exe
                                      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                      14⤵
                                      • Modifies security service
                                      • Runs .reg file with regedit
                                      PID:2920
                                  • C:\Windows\SysWOW64\logs.exe
                                    C:\Windows\system32\logs.exe 1176 "C:\Windows\SysWOW64\logs.exe"
                                    13⤵
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    PID:3740
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c c:\a.bat
                                      14⤵
                                        PID:4180
                                        • C:\Windows\SysWOW64\regedit.exe
                                          REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                          15⤵
                                          • Modifies security service
                                          • Runs .reg file with regedit
                                          PID:4332
                • C:\Users\Admin\AppData\Local\Temp\tmpfile679.exe
                  C:\Users\Admin\AppData\Local\Temp\tmpfile679.exe
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3736

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    2KB

                    MD5

                    d8be0d42e512d922804552250f01eb90

                    SHA1

                    cda2fd8fc9c4cdf15d5e2f07a4c633e21d11c9d3

                    SHA256

                    901619f668fe541b53d809cd550460f579985c3d2f3d899a557997e778eb1d82

                    SHA512

                    f53619e1ec3c9abc833f9fca1174529fb4a4723b64f7560059cd3147d74ea8fe945a7bd0034f6fb68c0e61b6782a26908d30a749a256e019031b5a6ac088eb97

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    815B

                    MD5

                    fadf3805f68986d2ee9c82f560a564e4

                    SHA1

                    87bcab6ab1fb66ace98eb1d36e54eb9c11628aa6

                    SHA256

                    d6e4760c4554b061363e89648dc4144f8a9ba8a300dde1a1621f22ecc62ab759

                    SHA512

                    e3e495385da6d181a2411554a61b27c480ff31fa49225e8b2dc46b9ec4f618343475a8d189786b956c91efc65bfb05be19065bfdf3288eb011c5ec427e764cb9

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    1KB

                    MD5

                    5b77620cb52220f4a82e3551ee0a53a6

                    SHA1

                    07d122b8e70ec5887bad4ef8f4d6209df18912d0

                    SHA256

                    93ee7aaab4bb8bb1a11aede226bdb7c2ad85197ef5054eb58531c4df35599579

                    SHA512

                    9dc2b10a03c87d294903ff3514ca38ce1e85dec66213a7042d31f70fb20d36fed645150c5a6cb6f08c31bdc9f61e7dee2f1737c98aab263c289b09ffa663371c

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    206B

                    MD5

                    2d9f1ff716273d19e3f0d10a3cd8736f

                    SHA1

                    b4ca02834dd3f3489c5088d2157279d2be90f5ff

                    SHA256

                    9acf0b6f653d189bcf02fa9941a2a1a6b6f60c6fa1f62ad38f314014ec188623

                    SHA512

                    1d08e079d12a58115ced67c002d383a4ff5aca81fde9ac81bb14d8c5dcdfe07839c7b895130b746d4691cd38dc74fbfc0bdc8605b520ac85bc137fd5fa922025

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    1KB

                    MD5

                    2299014e9ce921b7045e958d39d83e74

                    SHA1

                    26ed64f84417eb05d1d9d48441342ca1363084da

                    SHA256

                    ee2b1a70a028c6d66757d68a847b4631fc722c1e9bfc2ce714b5202f43ec6b57

                    SHA512

                    0a1922752065a6ab7614ca8a12d5d235dfb088d3759b831de51124894adae79637713d7dee2eb87668fa85e37f3ba00d85a727a7ba3a6301fbf1d47f80c6a08f

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    2KB

                    MD5

                    8c6aa92ac8ffdfb7a0fb3dafd14d65f1

                    SHA1

                    cac3992d696a99a5dec2ab1c824c816117414b16

                    SHA256

                    dc98a84d679d0ba1e36e3142000fa9fd7c5cd4606e07cbcb33f12c98bc1510fa

                    SHA512

                    f17a7cbfc11ce2a258aee2857720dcc72ddcfd17ebe9c9b1b04bedb52835c2b35ca4bb649fd5ef3d7ef3f9585f87ef321efec52cb7524be3b83a919999c4900c

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    1024B

                    MD5

                    159bb1d34a927f58fc851798c7c09b58

                    SHA1

                    c3a26565004531f3a93e29eabb0f9a196b4c1ba2

                    SHA256

                    53b81439ff38712958d57d158f1402a299c3a131d521c3a7a4a30c56542db7bd

                    SHA512

                    b6f9a3d1cb628b79ca97a65645618190b20bfbddee0ceecea710c802d3d92cee3d1e3e675b5fb9ac994a0abb3f0681ed28abbab2fe61f4b54a0fb5d7a7f0034b

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    701B

                    MD5

                    e427a32326a6a806e7b7b4fdbbe0ed4c

                    SHA1

                    b10626953332aeb7c524f2a29f47ca8b0bee38b1

                    SHA256

                    b5cfd1100679c495202229aede417b8a385405cb9d467d2d89b936fc99245839

                    SHA512

                    6bd679341bec6b224962f3d0d229cff2d400e568e10b7764eb4e0903c66819a8fa99927249ab9b4c447b2d09ea0d98eb9823fb2c5f7462112036049795a5d8bd

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    2KB

                    MD5

                    b79d7c7385eb2936ecd5681762227a9b

                    SHA1

                    c2a21fb49bd3cc8be9baac1bf6f6389453ad785d

                    SHA256

                    fd1be29f1f4b9fc4a8d9b583c4d2114f17c062998c833b2085960ac02ef82019

                    SHA512

                    7ea049afca363ff483f57b9fff1e213006d689eb4406cefe7f1e096c46b41e7908f1e4d69e1411ae56eb1c4e19489c9322176ffdd8ea2f1c37213eb51f03ef5b

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    3KB

                    MD5

                    1c6131354c6987300ea512b765475b82

                    SHA1

                    2ad74e27ee9080f65d1b2b2e537f73d8f6b59f53

                    SHA256

                    3a16ce0b62d9b7bc6832082d30e37163bbde0eddcffe9b09f20fc118b1e0d640

                    SHA512

                    b1274a40e10dea26834d3839a4c64a593252640a8a55bcbf642b661f1711451ea81ca712cc98d0c0b9132b4aaf5c8aaac6cc974fc8cbe0eed6ffc13d1b01db68

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    3KB

                    MD5

                    9e5db93bd3302c217b15561d8f1e299d

                    SHA1

                    95a5579b336d16213909beda75589fd0a2091f30

                    SHA256

                    f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

                    SHA512

                    b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    978B

                    MD5

                    2e2266221550edce9a27c9060d5c2361

                    SHA1

                    f39f2d8f02f8b3a877d5969a81c4cb12679609f3

                    SHA256

                    e19af90814641d2c6cd15a7a53d676a4a7f63b4a80a14126824d1e63fdccdcdb

                    SHA512

                    e962cc55d1f9537159c34349a2fa5ffffc910de3e52cafa8347c43eded78b8e986ecb8e2e9ada5e2381b034151f17e6b984c279460e8e114e50ea58a64648864

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    1KB

                    MD5

                    c1e5f93e2bee9ca33872764d8889de23

                    SHA1

                    167f65adfc34a0e47cb7de92cc5958ee8905796a

                    SHA256

                    8f5276e847b1c6beb572b1eeae20f98784aae11ea2d8f8860adcdb78fd9dca3a

                    SHA512

                    482741b0df7bf6e94ba9667892fe12125df30812e21de40fd60dee540922da70ffb6db4a0c0e17346e714d4bb6e49e2d4eca53c0d5194cd888903071c82b8859

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    3KB

                    MD5

                    5e073629d751540b3512a229a7c56baf

                    SHA1

                    8d384f06bf3fe00d178514990ae39fc54d4e3941

                    SHA256

                    2039732d26af5a0d4db7bda4a781967a0e0e4543dea9838690219e3cb688449e

                    SHA512

                    84fc0d818ecd5706904b5918170436820ffc78c894cbe549a4f5b04b5c9832e3d709c98d56c8522b55a98cd9db8ec04aeaa020e9162e8a35503597ca580126fd

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    2KB

                    MD5

                    f708dcfd087b5b3763678cfb8d63735e

                    SHA1

                    a38fa7fa516c1402762425176ff1b607db36c752

                    SHA256

                    abf4c5f7dbed40d58dc982256535a56128f86d5eaf163d634037ae2b61027a10

                    SHA512

                    fa0e84032b88e19fc67c5be846983cf89c8ba021351a0aa9cab0162ea27a3933dade0b78146b2230b0c57f218b18da52a5ce1d04b6f9746b21e4285e2540049c

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    2KB

                    MD5

                    6dd7ad95427e77ae09861afd77104775

                    SHA1

                    81c2ffe8c63e71f013a07e5794473b60f50c0716

                    SHA256

                    8eb7ba2c4ca558bb764f1db1ea0da16c08791a79e995704e5c1b9f3e855008c2

                    SHA512

                    171d8a96006ea9ff2655af49bd3bfc4702ba8573b3e6f93237ee52e0be68dd09e123495f9fbda9ff69d03fe843d9306798cae6c156202d48b8d021722eedc7cb

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    478B

                    MD5

                    1a00c84e2e8a76c3caa6c0b89f9f0d6d

                    SHA1

                    2650e962d49c5800edb569ee1b989edc8868d9b9

                    SHA256

                    f477217e9368c8114de7621c41a01818957dae31140ffd7df2b39705c72543e6

                    SHA512

                    a5f2f271184ff3bad04dd2135e7d32ca32c2ad24400832ec8a143dcbc20449ede4e06b48479ba93609cb1caf0b41a9143698eafb07b032ebdd609e399d62288c

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    1KB

                    MD5

                    584f47a0068747b3295751a0d591f4ee

                    SHA1

                    7886a90e507c56d3a6105ecdfd9ff77939afa56f

                    SHA256

                    927fd19c24f20ac1dff028de9d73094b2591842248c95a20a8264abf1333aea5

                    SHA512

                    ca945aad3c2d9ecadff2bc30cf23902b1254cffdf572ff9d4e7c94659255fc3467899053e4a45d3b155900c7b5b91abedf03d31af7e39870015c85e424d04257

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    1KB

                    MD5

                    5bf31d7ea99b678c867ccdec344298aa

                    SHA1

                    2e548f54bf50d13993105c4f59bbeaeb87b17a68

                    SHA256

                    52be521b5509b444c0369ea7e69fc06b2d0b770cf600386c9a0178225ccdd281

                    SHA512

                    1bc82b65efe8c2be419748c8534210e7ad8cc8332ef87fb5df828eaebfdf630066ab3ad8d3ceeb82dee5ec4e680daff2748fcd4beaad8c71f1477b2ec7fe3564

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    2KB

                    MD5

                    5855edf3afa67e11de78af0389880d18

                    SHA1

                    c43fcd36d70a6ffcd41fbb48c1d0c406fd00286f

                    SHA256

                    c7798759a159989611cdf47f702c8813ad0f029b52f18af573f383859a8bfaaa

                    SHA512

                    5be99a55f86486c04bda0a089571c296d041dae337321578c0f8d19d7bd2e51802aafbc8716753b6191b8e5ced782a5bc7d44bdd4995ab8e6ac1f7cd4b0f91ee

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    3KB

                    MD5

                    752fd85212d47da8f0adc29004a573b2

                    SHA1

                    fa8fe3ff766601db46412879dc13dbec8d055965

                    SHA256

                    9faa69e9dabfb4beb40790bf12d0ae2ac0a879fb045e38c03b9e4d0ab569636e

                    SHA512

                    d7bbadb2ed764717dc01b012832e5c1debd6615bbdc121b5954e61d6364a03b2dd03718bdea26c5c2a6dbb6e33c5a7657c76862f6d8c0a916f7a0f9f8dd3b209

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    3KB

                    MD5

                    d085cde42c14e8ee2a5e8870d08aee42

                    SHA1

                    c8e967f1d301f97dbcf252d7e1677e590126f994

                    SHA256

                    a15d5dfd655de1214e0aae2292ead17eef1f1b211d39fac03276bbd6325b0d9f

                    SHA512

                    de2cebd45d3cf053df17ae43466db6a8b2d816bf4b9a8deb5b577cfedf765b5dcdc5904145809ad3ca03ccff308f8893ec1faa309dd34afcab7cc1836d698d7b

                  • C:\Users\Admin\AppData\Local\Temp\1.reg

                    Filesize

                    3KB

                    MD5

                    872656500ddac1ddd91d10aba3a8df96

                    SHA1

                    ddf655aea7e8eae37b0a2dd4c8cabaf21cf681fc

                    SHA256

                    d6f58d2fbf733d278281af0b9e7732a591cdd752e18a430f76cb7afa806c75f8

                    SHA512

                    e7fab32f6f38bde67c8ce7af483216c9965ab62a70aee5c9a9e17aa693c33c67953f817406c1687406977b234d89e62d7feb44757527de5db34e5a61462a0be9

                  • C:\Users\Admin\AppData\Local\Temp\Decrypted.exe

                    Filesize

                    367KB

                    MD5

                    0e246fd1dd8235f942b32e8dac657676

                    SHA1

                    e4c39e659db089023912e77b1b60c8a9ab162266

                    SHA256

                    75c1c8a97b399166ad4c8a30d62907730a271400e9e0b5e626f9f5efb049fed7

                    SHA512

                    58af1131ef7f95e9d19adedbf37e108f3047e03b35733be561adbb18a055ae114e6eb1cd7ad2acce8c1a6138d1ec96c9b2b6af093e03d6bfa4d9c70da9828c7b

                  • C:\Users\Admin\AppData\Local\Temp\tmpfile678.exe

                    Filesize

                    310KB

                    MD5

                    70cf71444e9d625943bb92f2229d1a3b

                    SHA1

                    ba1e719ae5f659b2e20ef9e855456eecd677d051

                    SHA256

                    0cdd4095dd78bfbf009d553190e5b46274cd63d4b7d333106c810134d90abcea

                    SHA512

                    372be4f83eb5ae17152004131ce7ec6e71b0c6ffbf2221162c86c5cee2753f02b5882617ed75ba87af70eed93f2a7dda0700ecbeafd30ab1cacb286f479ae1ee

                  • C:\Users\Admin\AppData\Local\Temp\tmpfile679.exe

                    Filesize

                    47KB

                    MD5

                    49808f66424aec571b9d5025f36409dd

                    SHA1

                    38db0a611bd7d7d8aceb116fbca88768e15551d7

                    SHA256

                    8dc78feef0cb0f76d179ddb6ab0eb9ed8f9267df4c0d6d0ea74dc27fc2ccf821

                    SHA512

                    da67632a16ca5354dcc4e63c8884109513a4e4d6b4b7d57e376443ed5a93fa574226c80a5738f76b4884a88cf822bfa74433e0fbea9dc3833ddf9a5ad687a099

                  • \??\c:\a.bat

                    Filesize

                    5KB

                    MD5

                    0019a0451cc6b9659762c3e274bc04fb

                    SHA1

                    5259e256cc0908f2846e532161b989f1295f479b

                    SHA256

                    ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

                    SHA512

                    314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

                  • memory/3236-0-0x0000000000400000-0x0000000000405000-memory.dmp

                    Filesize

                    20KB

                  • memory/3236-16-0x0000000000400000-0x0000000000405000-memory.dmp

                    Filesize

                    20KB

                  • memory/3736-144-0x0000000000400000-0x0000000000405000-memory.dmp

                    Filesize

                    20KB

                  • memory/3736-148-0x0000000000400000-0x0000000000405000-memory.dmp

                    Filesize

                    20KB

                  • memory/4372-13-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/4372-147-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB