Analysis
-
max time kernel
57s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2024 06:03
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20231215-en
General
-
Target
tmp.exe
-
Size
791KB
-
MD5
dafba6b93e117bf5477c56a3a30a1a2d
-
SHA1
9f5b1c990ec15ba2a90377dbc1da6e046d083050
-
SHA256
594817ca4710a984d7c4720f9a40284233b72da88167263de9bbe3bd3bdd7278
-
SHA512
eaad64b17f84bbd731c558db139f11c78097070194606b4cc9993538cd73a6b3e00af9a403ba8d61be9287b6945264e0043df34de4d0e81b646ee052c0cd0fcc
-
SSDEEP
24576:0CusCnjwQrBaWnBCqHjooSQU2kLExTSee:0CanjlrBaWntHjoTQrkgxuee
Malware Config
Extracted
amadey
4.15
http://185.215.113.68
-
install_dir
d887ceb89d
-
install_file
explorhe.exe
-
strings_key
7cadc181267fafff9df8503e730d60e1
-
url_paths
/theme/index.php
Extracted
amadey
http://185.215.113.68
-
strings_key
7cadc181267fafff9df8503e730d60e1
-
url_paths
/theme/index.php
Extracted
risepro
65.109.90.47:50500
Extracted
redline
@RLREBORN Cloud (TG: @FATHEROFCARDERS)
141.95.211.148:46011
Extracted
redline
@PixelsCloud
94.156.67.230:13781
Extracted
redline
LiveTraffic
20.79.30.95:33223
Extracted
redline
2024
195.20.16.103:20440
Extracted
redline
@oleh_ps
185.172.128.33:8924
Signatures
-
Detect ZGRat V1 8 IoCs
Processes:
resource yara_rule behavioral2/memory/4404-44-0x0000000000400000-0x000000000045A000-memory.dmp family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\1000758001\fsdfsfsfs.exe family_zgrat_v1 behavioral2/memory/812-305-0x0000000000580000-0x0000000000602000-memory.dmp family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\1000758001\fsdfsfsfs.exe family_zgrat_v1 C:\Users\Admin\AppData\Local\Temp\1000758001\fsdfsfsfs.exe family_zgrat_v1 C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe family_zgrat_v1 C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe family_zgrat_v1 C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 14 IoCs
Processes:
resource yara_rule behavioral2/memory/4404-44-0x0000000000400000-0x000000000045A000-memory.dmp family_redline behavioral2/memory/4820-238-0x0000000000400000-0x0000000000452000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000759001\sadsadsadsa.exe family_redline C:\Users\Admin\AppData\Local\Temp\1000759001\sadsadsadsa.exe family_redline C:\Users\Admin\AppData\Local\Temp\1000759001\sadsadsadsa.exe family_redline behavioral2/memory/1888-343-0x0000000000400000-0x0000000000454000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000760001\2024.exe family_redline C:\Users\Admin\AppData\Local\Temp\1000760001\2024.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe family_redline -
XMRig Miner payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4540-234-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4540-237-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4540-255-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4540-256-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4540-265-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4540-266-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4540-269-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 57 1752 rundll32.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4836 netsh.exe -
Stops running service(s) 3 TTPs
-
.NET Reactor proctector 25 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral2/memory/2476-135-0x0000000004BF0000-0x0000000004C88000-memory.dmp net_reactor behavioral2/memory/2476-139-0x0000000004B50000-0x0000000004BE8000-memory.dmp net_reactor behavioral2/memory/1712-226-0x00000000049B0000-0x0000000004A12000-memory.dmp net_reactor behavioral2/memory/1712-228-0x0000000005000000-0x0000000005060000-memory.dmp net_reactor behavioral2/memory/1084-272-0x00000000051B0000-0x000000000535C000-memory.dmp net_reactor behavioral2/memory/1084-276-0x0000000005000000-0x00000000051AC000-memory.dmp net_reactor behavioral2/memory/1084-288-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-287-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-298-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-307-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-311-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-301-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-313-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-324-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-334-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-341-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-345-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-358-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-361-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-374-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-389-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-400-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-407-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-410-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor behavioral2/memory/1084-414-0x0000000005000000-0x00000000051A5000-memory.dmp net_reactor -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exeexplorhe.exeRegAsm.exeworkforroc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation explorhe.exe Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation workforroc.exe -
Executes dropped EXE 26 IoCs
Processes:
explorhe.execrypted.exeWerFault.exeredline1234.exeWerFault.exemrk1234.exeqemu-ga.exe1234pixxxx.exeuwgxswmtctao.exeWerFault.exealex.exefsdfsfsfs.exesadsadsadsa.exe2024.execrypted.exeleg221.exe55555.exeWerFault.exeLogs.exeworkforroc.exeInstallSetup9.exeWerFault.exeBroomSetup.exeschtasks.exerty25.exeWerFault.exepid process 3640 explorhe.exe 3780 crypted.exe 2660 WerFault.exe 632 redline1234.exe 1816 WerFault.exe 2476 mrk1234.exe 5068 qemu-ga.exe 364 1234pixxxx.exe 1788 uwgxswmtctao.exe 1712 WerFault.exe 1084 alex.exe 812 fsdfsfsfs.exe 2140 sadsadsadsa.exe 4004 2024.exe 960 crypted.exe 2704 leg221.exe 1072 55555.exe 4828 WerFault.exe 3336 Logs.exe 888 workforroc.exe 4724 InstallSetup9.exe 4496 WerFault.exe 4908 BroomSetup.exe 964 schtasks.exe 404 rty25.exe 1432 WerFault.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exeInstallSetup9.exepid process 1752 rundll32.exe 4724 InstallSetup9.exe 4724 InstallSetup9.exe 4724 InstallSetup9.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4540-223-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4540-225-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4540-227-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4540-229-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4540-230-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4540-234-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4540-237-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4540-255-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4540-256-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4540-265-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4540-266-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4540-269-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
Processes:
description ioc process Key opened \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Key opened \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Key opened \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Key opened \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Key opened \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 api.ipify.org 21 api.ipify.org -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
explorhe.exepid process 3640 explorhe.exe 3640 explorhe.exe 3640 explorhe.exe 3640 explorhe.exe 3640 explorhe.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
crypted.exemrk1234.exeuwgxswmtctao.exeWerFault.exefsdfsfsfs.execrypted.exealex.exedescription pid process target process PID 3780 set thread context of 4404 3780 crypted.exe RegAsm.exe PID 2476 set thread context of 4572 2476 mrk1234.exe RegAsm.exe PID 1788 set thread context of 4540 1788 uwgxswmtctao.exe explorer.exe PID 1712 set thread context of 4820 1712 WerFault.exe RegAsm.exe PID 812 set thread context of 1888 812 fsdfsfsfs.exe RegAsm.exe PID 960 set thread context of 4796 960 crypted.exe RegAsm.exe PID 1084 set thread context of 4824 1084 alex.exe WerFault.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 848 sc.exe 4740 sc.exe 3292 sc.exe 4732 sc.exe 400 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 51 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1816 4572 WerFault.exe RegAsm.exe 4208 1072 WerFault.exe 55555.exe 848 1072 WerFault.exe 55555.exe 2500 4496 WerFault.exe toolspub1.exe 3168 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 1716 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 936 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 5072 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 1716 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 5036 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 3416 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 1636 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 2216 1432 WerFault.exe nsa1356.tmp 2916 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 3552 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 2864 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 3168 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 4448 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 4164 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 4244 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 2660 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 664 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 1432 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 5100 964 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 4752 536 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 5016 536 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 4824 536 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 4728 536 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 2424 536 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 3724 536 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 1952 536 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 1564 536 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 4428 536 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 2536 536 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe 3688 3312 WerFault.exe csrss.exe 3172 3312 WerFault.exe csrss.exe 3888 3312 WerFault.exe csrss.exe 1088 3312 WerFault.exe csrss.exe 2144 3312 WerFault.exe csrss.exe 5036 3312 WerFault.exe csrss.exe 4604 3312 WerFault.exe csrss.exe 4972 3312 WerFault.exe csrss.exe 4792 3312 WerFault.exe csrss.exe 1712 3312 WerFault.exe csrss.exe 8 3312 WerFault.exe csrss.exe 1512 3312 WerFault.exe csrss.exe 3836 3312 WerFault.exe csrss.exe 3976 3312 WerFault.exe csrss.exe 1096 3312 WerFault.exe csrss.exe 4432 3312 WerFault.exe csrss.exe 2500 3312 WerFault.exe csrss.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI WerFault.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI WerFault.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI WerFault.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1636 schtasks.exe 2312 schtasks.exe 964 schtasks.exe 2312 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 41 IoCs
Processes:
WerFault.exeRegAsm.exeredline1234.exeuwgxswmtctao.exeRegAsm.exeRegAsm.exeLogs.exeleg221.exeWerFault.exeRegAsm.exeWerFault.exe2024.exeWerFault.exepid process 2660 WerFault.exe 4404 RegAsm.exe 3352 3352 632 redline1234.exe 632 redline1234.exe 632 redline1234.exe 632 redline1234.exe 1788 uwgxswmtctao.exe 4820 RegAsm.exe 4820 RegAsm.exe 4796 RegAsm.exe 4796 RegAsm.exe 3336 Logs.exe 3336 Logs.exe 2704 leg221.exe 2704 leg221.exe 4496 WerFault.exe 4496 WerFault.exe 4820 RegAsm.exe 1888 RegAsm.exe 1888 RegAsm.exe 1432 WerFault.exe 1432 WerFault.exe 4004 2024.exe 4004 2024.exe 4828 WerFault.exe 4828 WerFault.exe 4004 2024.exe 4004 2024.exe 4004 2024.exe 4004 2024.exe 4004 2024.exe 1888 RegAsm.exe 1888 RegAsm.exe 1888 RegAsm.exe 1888 RegAsm.exe 4828 WerFault.exe 4828 WerFault.exe 4828 WerFault.exe 4828 WerFault.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 668 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
WerFault.exepid process 2660 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
RegAsm.exeexplorer.exealex.exeRegAsm.exeRegAsm.exeLogs.exeleg221.exedescription pid process Token: SeDebugPrivilege 4404 RegAsm.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeLockMemoryPrivilege 4540 explorer.exe Token: SeDebugPrivilege 1084 alex.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeDebugPrivilege 4820 RegAsm.exe Token: SeDebugPrivilege 4796 RegAsm.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeDebugPrivilege 3336 Logs.exe Token: SeDebugPrivilege 2704 leg221.exe Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 Token: SeCreatePagefilePrivilege 3352 Token: SeShutdownPrivilege 3352 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
tmp.exepid process 4264 tmp.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
tmp.exeexplorhe.exeWerFault.exeBroomSetup.exepid process 4264 tmp.exe 3640 explorhe.exe 1816 WerFault.exe 4908 BroomSetup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
tmp.exeexplorhe.execrypted.exemrk1234.exeRegAsm.exeuwgxswmtctao.exeWerFault.exefsdfsfsfs.exedescription pid process target process PID 4264 wrote to memory of 3640 4264 tmp.exe explorhe.exe PID 4264 wrote to memory of 3640 4264 tmp.exe explorhe.exe PID 4264 wrote to memory of 3640 4264 tmp.exe explorhe.exe PID 3640 wrote to memory of 1636 3640 explorhe.exe WerFault.exe PID 3640 wrote to memory of 1636 3640 explorhe.exe WerFault.exe PID 3640 wrote to memory of 1636 3640 explorhe.exe WerFault.exe PID 3640 wrote to memory of 3780 3640 explorhe.exe crypted.exe PID 3640 wrote to memory of 3780 3640 explorhe.exe crypted.exe PID 3640 wrote to memory of 3780 3640 explorhe.exe crypted.exe PID 3780 wrote to memory of 4404 3780 crypted.exe RegAsm.exe PID 3780 wrote to memory of 4404 3780 crypted.exe RegAsm.exe PID 3780 wrote to memory of 4404 3780 crypted.exe RegAsm.exe PID 3780 wrote to memory of 4404 3780 crypted.exe RegAsm.exe PID 3780 wrote to memory of 4404 3780 crypted.exe RegAsm.exe PID 3780 wrote to memory of 4404 3780 crypted.exe RegAsm.exe PID 3780 wrote to memory of 4404 3780 crypted.exe RegAsm.exe PID 3780 wrote to memory of 4404 3780 crypted.exe RegAsm.exe PID 3640 wrote to memory of 2660 3640 explorhe.exe WerFault.exe PID 3640 wrote to memory of 2660 3640 explorhe.exe WerFault.exe PID 3640 wrote to memory of 632 3640 explorhe.exe redline1234.exe PID 3640 wrote to memory of 632 3640 explorhe.exe redline1234.exe PID 3640 wrote to memory of 2476 3640 explorhe.exe mrk1234.exe PID 3640 wrote to memory of 2476 3640 explorhe.exe mrk1234.exe PID 3640 wrote to memory of 2476 3640 explorhe.exe mrk1234.exe PID 2476 wrote to memory of 4572 2476 mrk1234.exe RegAsm.exe PID 2476 wrote to memory of 4572 2476 mrk1234.exe RegAsm.exe PID 2476 wrote to memory of 4572 2476 mrk1234.exe RegAsm.exe PID 2476 wrote to memory of 4572 2476 mrk1234.exe RegAsm.exe PID 2476 wrote to memory of 4572 2476 mrk1234.exe RegAsm.exe PID 2476 wrote to memory of 4572 2476 mrk1234.exe RegAsm.exe PID 2476 wrote to memory of 4572 2476 mrk1234.exe RegAsm.exe PID 2476 wrote to memory of 4572 2476 mrk1234.exe RegAsm.exe PID 2476 wrote to memory of 4572 2476 mrk1234.exe RegAsm.exe PID 4404 wrote to memory of 5068 4404 RegAsm.exe qemu-ga.exe PID 4404 wrote to memory of 5068 4404 RegAsm.exe qemu-ga.exe PID 3640 wrote to memory of 364 3640 explorhe.exe 1234pixxxx.exe PID 3640 wrote to memory of 364 3640 explorhe.exe 1234pixxxx.exe PID 3640 wrote to memory of 364 3640 explorhe.exe 1234pixxxx.exe PID 3640 wrote to memory of 1712 3640 explorhe.exe WerFault.exe PID 3640 wrote to memory of 1712 3640 explorhe.exe WerFault.exe PID 3640 wrote to memory of 1712 3640 explorhe.exe WerFault.exe PID 1788 wrote to memory of 4540 1788 uwgxswmtctao.exe explorer.exe PID 1788 wrote to memory of 4540 1788 uwgxswmtctao.exe explorer.exe PID 1788 wrote to memory of 4540 1788 uwgxswmtctao.exe explorer.exe PID 1788 wrote to memory of 4540 1788 uwgxswmtctao.exe explorer.exe PID 1788 wrote to memory of 4540 1788 uwgxswmtctao.exe explorer.exe PID 1712 wrote to memory of 4820 1712 WerFault.exe RegAsm.exe PID 1712 wrote to memory of 4820 1712 WerFault.exe RegAsm.exe PID 1712 wrote to memory of 4820 1712 WerFault.exe RegAsm.exe PID 1712 wrote to memory of 4820 1712 WerFault.exe RegAsm.exe PID 1712 wrote to memory of 4820 1712 WerFault.exe RegAsm.exe PID 1712 wrote to memory of 4820 1712 WerFault.exe RegAsm.exe PID 1712 wrote to memory of 4820 1712 WerFault.exe RegAsm.exe PID 1712 wrote to memory of 4820 1712 WerFault.exe RegAsm.exe PID 3640 wrote to memory of 1084 3640 explorhe.exe alex.exe PID 3640 wrote to memory of 1084 3640 explorhe.exe alex.exe PID 3640 wrote to memory of 1084 3640 explorhe.exe alex.exe PID 3640 wrote to memory of 812 3640 explorhe.exe fsdfsfsfs.exe PID 3640 wrote to memory of 812 3640 explorhe.exe fsdfsfsfs.exe PID 3640 wrote to memory of 812 3640 explorhe.exe fsdfsfsfs.exe PID 3640 wrote to memory of 2140 3640 explorhe.exe sadsadsadsa.exe PID 3640 wrote to memory of 2140 3640 explorhe.exe sadsadsadsa.exe PID 3640 wrote to memory of 2140 3640 explorhe.exe sadsadsadsa.exe PID 812 wrote to memory of 1888 812 fsdfsfsfs.exe RegAsm.exe -
outlook_office_path 1 IoCs
Processes:
description ioc process Key opened \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 -
outlook_win_path 1 IoCs
Processes:
description ioc process Key opened \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe"C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000751001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000751001\crypted.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\qemu-ga.exe"C:\Users\Admin\AppData\Local\Temp\d887ceb89d\qemu-ga.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000752001\1233213123213.exe"C:\Users\Admin\AppData\Local\Temp\1000752001\1233213123213.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000753001\redline1234.exe"C:\Users\Admin\AppData\Local\Temp\1000753001\redline1234.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "ACULXOBT"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "ACULXOBT" binpath= "C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe" start= "auto"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "ACULXOBT"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000754001\mrk1234.exe"C:\Users\Admin\AppData\Local\Temp\1000754001\mrk1234.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 12565⤵
- Executes dropped EXE
- Program crash
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\1000755001\1234pixxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000755001\1234pixxxx.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000756001\rdxx1.exe"C:\Users\Admin\AppData\Local\Temp\1000756001\rdxx1.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000757001\alex.exe"C:\Users\Admin\AppData\Local\Temp\1000757001\alex.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe"C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"5⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 36⤵
-
C:\Users\Admin\AppData\Local\Temp\1000758001\fsdfsfsfs.exe"C:\Users\Admin\AppData\Local\Temp\1000758001\fsdfsfsfs.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000759001\sadsadsadsa.exe"C:\Users\Admin\AppData\Local\Temp\1000759001\sadsadsadsa.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000760001\2024.exe"C:\Users\Admin\AppData\Local\Temp\1000760001\2024.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000761001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000761001\crypted.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000762001\leg221.exe"C:\Users\Admin\AppData\Local\Temp\1000762001\leg221.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000763001\55555.exe"C:\Users\Admin\AppData\Local\Temp\1000763001\55555.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 11044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 10644⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000765001\workforroc.exe"C:\Users\Admin\AppData\Local\Temp\1000765001\workforroc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12517⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\nsa1356.tmpC:\Users\Admin\AppData\Local\Temp\nsa1356.tmp5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 13286⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 3525⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 3765⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 2605⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 3765⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 6885⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 4365⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 7405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 7725⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 7805⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 7565⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 6325⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 8645⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 8645⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 6285⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 7245⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 6285⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 7165⤵
- Executes dropped EXE
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 9365⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 8245⤵
- Executes dropped EXE
- Program crash
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 8885⤵
- Program crash
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 3406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 3566⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 3606⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 6526⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 6646⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 6646⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 6646⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 7446⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 7766⤵
- Program crash
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 5886⤵
- Program crash
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 3727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 3927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 4047⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 6807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 6927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 6927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 7527⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 7607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 7527⤵
- Program crash
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Executes dropped EXE
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 8207⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Program crash
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 8927⤵
- Program crash
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 9647⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 9807⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 9407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 9527⤵
- Program crash
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"7⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 11527⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 11687⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\rty25.exe"C:\Users\Admin\AppData\Local\Temp\rty25.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exeC:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe1⤵
-
C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exeC:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4572 -ip 45721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1072 -ip 10721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1072 -ip 10721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1432 -ip 14321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 964 -ip 9641⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 964 -ip 9641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 536 -ip 5361⤵
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exeC:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 536 -ip 5361⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 536 -ip 5361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3312 -ip 33121⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exeC:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3312 -ip 33121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3312 -ip 33121⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exeFilesize
440KB
MD564a48e48fc058204464f5ecdef31e2af
SHA1cbbf1fbf923fa8c1cad2b6f749bbc2023b42a859
SHA2566e2573c49c6af020201d9f797552bf72c1c77ead8699ccb335025d99b1a587eb
SHA51202e4ec86a520e3241ab02a766f8a3d45180e477047b53e56c6fabca2e29243dd12a3e3220aad3b4c50b71805d9ac18e1dad7760a4d72068555b5c4b6b392207b
-
C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exeFilesize
673KB
MD5e593f9f9987473036d1791b3162563aa
SHA1ebc39c3639c2804f1c5e9b937ff22a69bf10d249
SHA256aab3fd1ead51c67792ef40e1bab04bbf3abd1b3bb9e742883778c3b5d6bd31bb
SHA5127d3781978db904e0953f504ef3e91289685fa686c5d97ecea051ab2472bff16ef1301b9510be441be61fae585bd07f29e9decaf2982ba1855d4b28caee28b5d5
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.logFilesize
2KB
MD51305705ab4eb7a8ff5a73874670d91f4
SHA1a118cf0ba2d4ac47473b9140c0aa7745efc6aac7
SHA256d6af172e36aa43249144b77b3fb2dfe65f511baf3b2e7747851e47eaceb8f99b
SHA51227ecc05e3c91ae669799ead19ef0d89397cd51f3221c1e35d30a8fe229b80a7efdc1e9b6c10bb544442c47a263c077cd912727b5a2388ad1f71af45a17ef4b64
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\crypted.exe.logFilesize
42B
MD584cfdb4b995b1dbf543b26b86c863adc
SHA1d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA256d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
SHA512485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce
-
C:\Users\Admin\AppData\Local\Temp\1000751001\crypted.exeFilesize
412KB
MD53c9da20ad78d24df53b661b7129959e0
SHA1e7956e819cc1d2abafb2228a10cf22b9391fb611
SHA2562fd37ed834b6cd3747f1017ee09b3f97170245f59f9f2ed37c15b62580623319
SHA5121a02da1652a2c00df33eceda0706adebb5a5f1c3c05e30a09857c94d2fbb93e570f768af5d6648d3a5d11eea3b5c4b1ceb9393fc05248f1eefd96e17f3bbe1b4
-
C:\Users\Admin\AppData\Local\Temp\1000752001\1233213123213.exeFilesize
1.3MB
MD521b3cdb66660fadba45736665a0ff154
SHA13b23ee37190aad70e9010fa08c5fcb394f020a9a
SHA2568c582dc3a0be35110a53c40dd83fa69f31302a458fe8a3da513ae7a2e4515352
SHA512a8d15c75ae291af96cac9dafa35ce36b7e7a9618b3078f1d5e0ed32ac5a2f385268a92f6f9e411f511c8ebd7af19629eb6bac45a156e7c0702d3ddad90cb252f
-
C:\Users\Admin\AppData\Local\Temp\1000752001\1233213123213.exeFilesize
657KB
MD58240b06252f50573a3ae42e8dbc7dbbc
SHA1ad5669c34897063f2e13491f67d9976026de467e
SHA25656dad02abd308d5d8a7b894773d38aa61b687fa9c84165fe18d377a82cfac256
SHA51225977c6dc2048a5d786be9608b999dc263095b95cd20a599b2f121c7859ea72984f499fa71e4aeb0b1d50ba3d89edde17a6c89992a1027c77e03088f985c0e59
-
C:\Users\Admin\AppData\Local\Temp\1000752001\1233213123213.exeFilesize
865KB
MD5782bd79a7233083a0dafdf6d832b2f4e
SHA1ac6455a1b1e3d57bff0df9bf6b6f715d9c7db530
SHA25604091af6d56ac3bd3b8d704c1b0231e265d77b437caaa115d33ff479d814b602
SHA5128f1426a46e564777ab9b55801d9222aad43e44b9bef7d1d0de7948651a08f80865f5c0a0c1d052bc2a13444810b4118e047b74914584fb82db25abcd8396f4d7
-
C:\Users\Admin\AppData\Local\Temp\1000753001\redline1234.exeFilesize
710KB
MD51756062967375c5e57de7c7cbceb1def
SHA13e092dca1c558b2c0b5e43065a7da744e543ec2d
SHA2561075c329f6e324dcc573e5afe11f771fc7ea50bd72cfa031b81d3fd0c0af8280
SHA512e1d246835172f00c2e64a55d0389d6b5e441614fdd15bf723ec82cf931dc507cd41d05b80a419f45b2bc8fcd03632371b646c4ca1e5d8af21da330d28646f43c
-
C:\Users\Admin\AppData\Local\Temp\1000753001\redline1234.exeFilesize
675KB
MD511c0ee9bbb98d3e4b72e545f1d12d37e
SHA1d7894a42ca6e95f4d7c516a9c675d27c9bdb6f72
SHA25666147d8610339fac3335a1d04f71ff679e912c07c0b2f179c51671266478891b
SHA5128c6a629ca33170d6620e1d8ee7b4c37f60074ffaa152d3ea7f8d0dbfd8584c205aee7cca4cdad768c5bf0a8e8f95301e9bb18108a9930046c24c4caca1230755
-
C:\Users\Admin\AppData\Local\Temp\1000753001\redline1234.exeFilesize
572KB
MD54feeb9741d58f2aaab11d6788e637e0e
SHA18fd5ffe0f34c0209fdca2a0edf2643cd61dad9bd
SHA256961a18f14f1175d3ffb55d986f86619aad60c6d8827efb7a405dc2db40a5e345
SHA512c24f0d3db52fe65bc18a2b18046afac48983bc6ba8f6038e87ecc3d01b8b11e0decb969da348eb5caab590d23f864133556af2f7c0e066590895419844ba19a5
-
C:\Users\Admin\AppData\Local\Temp\1000754001\mrk1234.exeFilesize
254KB
MD548f6447bfc32b84fe9b3bcbbe5a72922
SHA1618c2f541fd9b79004303556686b7139ce8cdff3
SHA25603de9d2ce591a18948bd6f45b3c7d527dff03f5897f49e1ff3cfb189e910ba1c
SHA5128fab4e98dfe1c5ee58341b634d763f6d54d097ecb29623efde49a220eb608a2a9d06a08eb01fe844949911cc176c6882103cd10dd9555d9456a6cb8fc3ca3fbe
-
C:\Users\Admin\AppData\Local\Temp\1000754001\mrk1234.exeFilesize
151KB
MD592fcf86b51e867d825fb7f2b641dd496
SHA1d902278a9581be8d05a256ca406564c4c1d8162f
SHA256fc50eecf117651f2ed01b45f05060873c4659a7bfef44ae64c9e11588b462c74
SHA512a274a4dae459e3fe5e2d14fd097675120edfb88e5553309ac42d53f130e69eb81c6938d3bc9753d0c4a8c375947dd041f5f2cf8595a83b02e6fa7b887352225c
-
C:\Users\Admin\AppData\Local\Temp\1000754001\mrk1234.exeFilesize
155KB
MD5cc5f64ef514b2c1e2eb625bcd90d862e
SHA1e43c5f1e8f5a90b276ca4f006096b4b6ba50d2af
SHA25610b1bb81fc55c680fc4d26762d6280bc4365d190844502458ab392002784488c
SHA5122b62b88a03cd788d80b5d504815c591e5ec565b2d85c17067674a1fc4d38f1d1c5c09bc14306fa52293db1fceae9e5ef60478c1e213b4a9023827596f7b0cfa8
-
C:\Users\Admin\AppData\Local\Temp\1000755001\1234pixxxx.exeFilesize
160KB
MD5ce7e7642cfc6aa2cfed843b615ad6053
SHA11e7483ea2c68063b0a088a03e29dd2231443394b
SHA256d4508b74c36711a4cb2f60f7e835217c7f82a1f50a97cf5ac3241b9259e9c43e
SHA512e7479f08a1997f92c0d49367356e1d8b5a4181c4da4277c93bf55b33d27db8634d4551f1df99b2db0b739889ef5b3ac78cbb77d9c707b4424244f34ce97b8e78
-
C:\Users\Admin\AppData\Local\Temp\1000755001\1234pixxxx.exeFilesize
253KB
MD55d0128c066c20f4d6bde23e12365b0d6
SHA144657ac3f24e4b243e4c14fe07f100256702dfe3
SHA256fd795614970e7cff0ae2c2733963c0d9689511bf79461341a07f31ac02754dc0
SHA512b43dac4a615d90e64b740b4165cc6c1be00705cf5a3e210df67f45e7df0a394d9cbe96116b8e118930ec0a0ce2084e420df812815f6406be7379793a0ad78138
-
C:\Users\Admin\AppData\Local\Temp\1000755001\1234pixxxx.exeFilesize
441KB
MD546107703f19a352a0ff8c8f5243b4389
SHA1a9b36a2e614a422346668018852e608f02dac9f3
SHA256beb2903dc42fa9120cd3f082ab7112c2fd0a54d04c555c778ac5a2e95c733bef
SHA51228deda1315a53fcdf7288bc5c7eb965f9bac0ef30f1ffee32bd042e658e1ed632ff0236ed1b133827068f5375e219d0b5f9d8bb1fc233767771c7fb6b6bd2782
-
C:\Users\Admin\AppData\Local\Temp\1000756001\rdxx1.exeFilesize
25KB
MD5be7d728e4c054a32cb8df2df0b89b372
SHA19ed79e08d5979c1c8af823d2e90d596284f1730c
SHA256a40235a6455d5d423f673c0a442c712241d55e78321d5e52c65f9d23303a7673
SHA512d35cc47350044d38fa07141e7af7f55ffc4d7f7303f7efb1944b5eb4f9930d6a4ec1d471428d14764b509c32adcdfb7c042d91cb389cb11b8d4b8eb52686bceb
-
C:\Users\Admin\AppData\Local\Temp\1000756001\rdxx1.exeFilesize
471KB
MD5810da00c69d55e89dca3bfe9a6f6a420
SHA1ca02bdce48ac20f7b40ab720079009894f369990
SHA25664a21d074850a4e8dd28a846e8f9e5d72d5549dc68d9ded2e9bff99f730f4d80
SHA512453f25595db97195c6211a07c821977e1db5015906865fcbb535172c5fc1733a131eafc512dc896f4c8726c9d58cf2aa6b354d7e33ae3afd9371a0c5432b3034
-
C:\Users\Admin\AppData\Local\Temp\1000757001\alex.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\1000757001\alex.exeFilesize
340KB
MD51bc668e7b4a0125a1e47b542f8e76d91
SHA129351bf900ccd0f048da907358a3febaa64c8fe0
SHA2562aa267a8bacfe85ea74c7d19756ea8d6e096f75eab21e6ace12dbe60c8ce371f
SHA5129170225a7988d576837711ef02aaa25135d748c6e6d75c18984b22bcc0fa5363170b209abb82c9611226b7424e78fd3558486cde115d3b62290d612f145a6d7d
-
C:\Users\Admin\AppData\Local\Temp\1000757001\alex.exeFilesize
194KB
MD5f7784dc12d69a586a6dda5c8579cddc3
SHA1b8652830113acbfef679da8e35f6abc62c45ed49
SHA256bdbad6ca84ed3de37d5eeaf173f7ead6013338f4a07af42b2167aec0467a40c7
SHA51269bd4e94bcbdc3e6851822eb61d16bf9c472700b6f382f1232e08c356a655f2f097db5e6b765903539b252b57a36d8549d3d85a0b44d060e692e2883aac00ad4
-
C:\Users\Admin\AppData\Local\Temp\1000758001\fsdfsfsfs.exeFilesize
61KB
MD584773bb9bd7e1306b965928fba6455dd
SHA16a6dec2ab38262374b68faa0bf35ddacc6180dae
SHA256bfadbc4525b44560fa291135344e14279fc18f2b1e5aade05e86174a788103fd
SHA512c387383ede84fc814920a3d9b3219f4b38f97f4ec9d657a17a70a28773c62292208e7aa5b2a00861a9bcc0a9a809dfbf4a87b03e0fd9062704700a0a2c781646
-
C:\Users\Admin\AppData\Local\Temp\1000758001\fsdfsfsfs.exeFilesize
173KB
MD50f72d96741104aafe69e16df5297156e
SHA1aa907d828f9cce95ca785177b90aac673134d401
SHA256913e3d085a0f83ec0a848d3c6662679de6b36c0562bfbe9149d2fde0d661abd9
SHA5123a4d70467c01f708a39651dac048647a8750e85638298fd2d241567bd0fb81f1b1bdb8d0ef6b7d1a3a6e323db456a4944118de5b26973ba098c75587e66f03db
-
C:\Users\Admin\AppData\Local\Temp\1000758001\fsdfsfsfs.exeFilesize
157KB
MD54b2ef4a7e1405871d4b949bc931fe3d3
SHA1a4d89294551c5bf709a1f78094b810d83ee3d76f
SHA2567bed0d2c23c8b62c9d5d8e464abcbf6ad605e2fb63e812bcdf03c098b5659d3d
SHA512eab8a794f14371c5da53e69dc870f3c5b785fbacdd724d036c85134c800b993daba9fe96fcea95b3da60703d9de605e8422c3a82d101b29a54afbe7724e7d6b5
-
C:\Users\Admin\AppData\Local\Temp\1000759001\sadsadsadsa.exeFilesize
24KB
MD5533d3519e44987c0d817571da9e2dbd6
SHA1b08d928be38431aa3e2b49f5049054b92e25c15e
SHA256b4d0c3c2c3c44aae42d6b70af00ba91259336a83685db65c7da3e3801cc971e2
SHA5125b5b0fc8f5c508574e6be2480eccd5158cff475ee8aa917d43340ee0b19883294bd5f103b7c47ceb36efa3904386551d80ddb1eee068ad42a95b5dc1f867a9d4
-
C:\Users\Admin\AppData\Local\Temp\1000759001\sadsadsadsa.exeFilesize
163KB
MD54ca7cfff3f4626013ed0f1c4a6a2f7b0
SHA1eb8b9a9d56babae1a7c2c85c68046f346f950248
SHA25629d35ed0664e368510ffe9b2ed769fc6345110fdf2e20cc731ff9bd694adbe66
SHA5124e2214927f3acd7fa6916eb336eae04787d9fa89dc2235e026685ebd54e0294c82540193898b54e8cd725a9b2d7557edc410f8df0bb82de007a3713f8dbb2646
-
C:\Users\Admin\AppData\Local\Temp\1000759001\sadsadsadsa.exeFilesize
283KB
MD59a2eca3a996358b1a94b2a124675d9a1
SHA176e524a27da50b4481b5f7bd0a0e84f7ec8c49bd
SHA256669ec335427c969b7554f7e8ce23ee2755e53946c80407cd00afc54c68b28ba1
SHA5128522429d903ceed44cf069c43b24ac6163ff5b391deebefe3923825528735103bab64ea9c9ff577b19d511474740c366bfd1d965ee87ffacffda73886e55a4a2
-
C:\Users\Admin\AppData\Local\Temp\1000760001\2024.exeFilesize
300KB
MD52c470494b6dc68b2346e42542d80a0fd
SHA187ce1483571bf04d67be4c8cb12fb7dfef4ba299
SHA2561ca8f444f95c2cd9817ce6ab789513e55629c0e0ac0d2b7b552d402517e7cfe9
SHA512c07332228810928b01aba94119e0f93339c08e55ad656d2eaff5c7647e42bbf5ab529232163fb1bbd14af3331a49d0fb537cfb5eb83565f674155e53d4ae41b5
-
C:\Users\Admin\AppData\Local\Temp\1000760001\2024.exeFilesize
192KB
MD593b99d7cb16108da01740ce7ba4c7e7d
SHA13fd8da9cef8bea3b9247f289be2f2fdde2894cf7
SHA256e9b5e6cf61c6752d41b81ce892e129af840e4d1b4cfbc4f3999185b407748eb9
SHA51204c0657d2f12134c4b7cb184f4e73c0aac2986825babe1ad4bb0efb262014a201265429f62a983c423e31f760bbca65d7850f851492540b29345a8a3e4082ac7
-
C:\Users\Admin\AppData\Local\Temp\1000761001\crypted.exeFilesize
191KB
MD5318da36d542117eae6ea120fa8c41e48
SHA15e47b5fc97c181eb9e141da7223cce9011730ab6
SHA256fcca43777c193e75099357933c4bea850cd81a202bf3b9914799f9a431212a86
SHA5125854b2838cffeacc8f439801bf76eb2d06dd3544eff0d2a6835712e9cdbf1510de674cc7475580ab9be69b79c6aa67f3ab8bc59657c262916c0de0b48ea6e5ce
-
C:\Users\Admin\AppData\Local\Temp\1000761001\crypted.exeFilesize
352KB
MD514838158250b616353f821ee351eef2d
SHA14f95a81a47cebefbe5b61435eccddf6541d19536
SHA256ea621488bc8834b1cd59ac1d333092ce511b2c5f561d09f0713dcf42f212b615
SHA512fcc348c29776da6d4f5573f19a33b3a92c1156b2356b54ea609939379a598ce4db834d7acc7db0561fa0111f5c3f2d50c17a7f4e8e98a9ceaab373ce3efe123b
-
C:\Users\Admin\AppData\Local\Temp\1000762001\leg221.exeFilesize
41KB
MD56dc8a46d8bf8b88649b73f55e3eca7b7
SHA1198dbcece164dec90bb14248a311d4d261dfc009
SHA25647b1e535822bc9ce9fa94e2c758a927162381720132b942b645e9bc8de3d695f
SHA5125802b33c9a2885dc39ea3aadb758f92d4f468a6f82b88eb7e16eba5a75776cd6c45a3a6c8183f9c4356dd048d5e0de6ad9b162bb6e9c738716f7752e960ef05e
-
C:\Users\Admin\AppData\Local\Temp\1000762001\leg221.exeFilesize
140KB
MD547cc6395af087812be10774baaab90f0
SHA14fa7ea7b1843b3c4d8c742b25f86fd66ec7a10e3
SHA256fb3eaff4b0e3727c3e9b1fbdef587e785b556ef093f5fabd602a882759c908b1
SHA51288d098e14025296ee995505ab9be457a5b2311d34ab7b65b5e067f1bb69bf203c3b38909bfde78afc68da08edb55f49aeb331e434149c7ccf588689743bc4e55
-
C:\Users\Admin\AppData\Local\Temp\1000762001\leg221.exeFilesize
211KB
MD52f199b2d3b35d52e1910ffe65fe55cf7
SHA17eb7e965842cce28c5045725aaecdd9f10fa4f85
SHA256b8b9f562eaa9c64b2f7d141e655027fcaba3fb8d2e3aabac4d0dde0a1161a062
SHA5125217aa85ded85cbf16d0a5f8cf332e0204777fb0877bc4156f43c57b3d6d4088baa473c291b563f8326b39c593aa1ac17ae16440d51ac6d1f9c2449e84e7916c
-
C:\Users\Admin\AppData\Local\Temp\1000763001\55555.exeFilesize
115KB
MD54c69c60b347e5a861e4ba4b57af40b5f
SHA165fdae417d4ab98d745bd5cb6af8bf2c177f5e0a
SHA25697ecd71283f795e56f75f9d4df69fe267915cfcfda77f0ee69a219b8bd42bf5d
SHA5122a212ce31646d3e37dea9825369f260324fde43278624ac5bac4a60667f64e7739efc35050b271d2883be1f634b2c5b82e7128dd5eef9678da59514d4f728a82
-
C:\Users\Admin\AppData\Local\Temp\1000763001\55555.exeFilesize
17KB
MD5332dc2c8681255db1d421b2e1dc1316c
SHA19b92ac4d76590febf20e85c5deac0fd426a88917
SHA2569d1067569b52e6a72093bb517bbcccc1d6964451c2a24c60d5beab4743d1eacf
SHA512cb4ea9fa44aa923511910894c806bcc0488f84bf6cd8d756f7711e0c4dcc8ae1981010dc09c8f4188667a92e9c58f3f65b105615a6880b97e11a7cba0fbd063b
-
C:\Users\Admin\AppData\Local\Temp\1000763001\55555.exeFilesize
156KB
MD5bb148ae4daa2331b15689a4197344217
SHA12aad9650bbd7b6a4ca57162cefe2d69a3a0c23dc
SHA256c741d8f3345a64dcd50aac9896125a264d5fb6fe265de4e70e64bc80d70e1598
SHA512f40d4cdb7dd250ca2f6dd8bb92a2dfd3f5b5af031c303491f0039f7516e2a2602ded6402df557754adaeefac9999351891cf2e0b486f0093f0046618ded07d13
-
C:\Users\Admin\AppData\Local\Temp\1000764001\moto.exeFilesize
390KB
MD59b76168059e86c2c05ced61d6b2f5895
SHA1c567e510b758c3475f70a5916c14d8162160129d
SHA256122316a895eb278f69276374b0e3a20186dc996033c898c3852af6e0bd26d482
SHA512bdaaf370d4f76c87e5517a7ca9d788be8a57108af5a18bf819b1dce90af8334d85858dab0c704f813f27e1c5da7463373bf1a275a14da673e200a5e515721190
-
C:\Users\Admin\AppData\Local\Temp\1000765001\workforroc.exeFilesize
498KB
MD5406773681ddaf37c14aa7f2a743ab626
SHA1a0186da6dfb9a8f3c2a98092705db8d9a0fb647c
SHA2562cdbd99cfb1f63807aae89d43c8dbfd283b0e67cfa7020d29bff937167becdf4
SHA51258d1caff1a84bcc39d8a4100f2593f5b863a0ce3add96e2b1991b928860702f6be17c21791e66467209c2fef3b5d44ea219c828f34e4ea31abe0bd805e7291a1
-
C:\Users\Admin\AppData\Local\Temp\1000765001\workforroc.exeFilesize
222KB
MD5a5f696f7347ad8affb60e6bf7705b38d
SHA1854b2df5a766a94321753b9efbbf7c900c296a96
SHA256fcf542a68cad00eb4816c66f161baee7f7189961255d30012c36fea3c3ee2673
SHA5128f510ca7da1ee5b59f810360f2aac93806b4c10b52baf1a02fe106e51301f097200cc8cb2428893f3ddaf52e449d2d37a4ce410fa2c4f5eeadef9b8e15eed874
-
C:\Users\Admin\AppData\Local\Temp\1000765001\workforroc.exeFilesize
144KB
MD5d56381ea0f2e4f38e6e86de163897d9e
SHA1d65075048802324f2bb75008c56fcd2b6ebf5dcc
SHA25679be6077a86ab039eb5d6b97c9660084ae072b8cd5b1cd97211d03a6afa951f2
SHA5128144b3f28b75c3e0ebc364ba54392b5d311867e1fd759086342b1f52b7c885706a763b799f8eaee9868258114e9516ad97b7142978a661540fb0f3486aaa0224
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
326KB
MD5cc48a6eba2c0ed0002ab92d5c93fbc08
SHA1df8bcfb71ec1ee3a48c6e6ff9b522d81a5390b4c
SHA2564ba7fbee4cb981b8b6c621314bdd822484817c72f8266ed9ec240a09449b02f5
SHA51299c229faa952cd474f8658fa1b45c3c11e1a7a7d41a0f9f37417b8a72cc50d33bd79fd50eae9b3e922cb3cf4ecccb6c91795fdf5fdecaa201e36f506ce6617fa
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
267KB
MD5b6b18dfb2eea7955e77319e8888ae296
SHA1a069ffac5cc49f99656ec2654cc7359f9edb5ea1
SHA25666c247dfb7da266647c8544baa274070d91b50e4aef6f85916030ef67b980675
SHA512fbed0a0be1ba13202d56b70827653465c6b4ed13ea66044336ad8c933b25a3b31654c8a284669bb1991415dcfe4f0bc791243b0c45e495dc318eac5308d8ca14
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
187KB
MD53086775360ce33afb7ac97271b975751
SHA15cde3365a925d625ae557876748020e156d7e01a
SHA2560abe7997f8c971b7e64150258b143e15e2956c8cbf871c3828c041338785e36e
SHA512b23b9fabafb078b0d877e7c542808dd95870af7987044ecbe3a2cea3d578076280bdbaebbdfc401f184447c5faccf769a065be2cc4e78fc8954201d0ddacdd1e
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
1.5MB
MD5b9fd85bc156db52c72a9c4583761d028
SHA1c544a7926dc7639dd30ab5b687c886a7a22b736f
SHA25670f44c49eaee6e8bc17570fdda58e9819e6615390753b07dd36c7f75f893ac53
SHA512e443dc95fcaa01fc825161bcf48963836072350d0b7ed61f3c2ea87d5ecbc44f40de5ad8da45e1c88d2af34f8110563176be5a9ebd06b13c00c7e102a027d2af
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeFilesize
365KB
MD57ce61f14584011ca6e799b88e3c7c65f
SHA1a2174044738768cab128597deccefca62832ded8
SHA2568054549b7f9650a44d781581a4ddc4ea8d195918902dcf904a5858a245b29c8d
SHA51254db7c046f849800cf47d5a68446e1e2c0fa610b5a7acfc992e6a33199e61b626af838a985a14e4021ea80edf3e045e53e2ec7856611207951864daadc2d89cf
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exeFilesize
182KB
MD516dadb34182cf37ff26b7c9a3acf755f
SHA1f22558c610bdad9411fdaa6981e2de1feb197801
SHA2561ba9280d440c54bb8469dddd6ede6755203348ea539342151fce225357fc146f
SHA51264ed7da22e1ba873ae1094210d7923d928ef0baabf8330ea9c2ae286a7c1ef2ac9d62806359bd0c2a38134043364656767c7fe3a8b3e7c0044b48869fa53b1fa
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exeFilesize
221KB
MD53e1032fee91199ec67322a59ceca9d80
SHA1e29797b426190364adca88b05435ffd2394bd503
SHA2562c066488dc75a5429a9328ffc099aa3017e6b473c314a53005c0f6dc3b238afa
SHA5127c396259844b336fb406104afd9670f4b77b775719b2ff3c20ac56818bedb8327432d916650edbb6a4cba90b4ab98987036f9db469919227536a5827e2618256
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exeFilesize
541KB
MD5d6fae01454cb734aed85ff8ee62e098e
SHA12de1d99906151d35e7a953b3e72800d030697bca
SHA2562250b981416e1077f42664fa6bbf2d082bb8b6a7c7e5175d8455ddf72b6207ff
SHA512cf0fda17af2c714ea8e183ac4bab673a2dbdc53fb675bc49156c5b70d0f0a20bd3b346532572d0483c285a40f1f5b390181d58859962ca318053250b02f1a887
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wtqcwle1.zhm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exeFilesize
791KB
MD5dafba6b93e117bf5477c56a3a30a1a2d
SHA19f5b1c990ec15ba2a90377dbc1da6e046d083050
SHA256594817ca4710a984d7c4720f9a40284233b72da88167263de9bbe3bd3bdd7278
SHA512eaad64b17f84bbd731c558db139f11c78097070194606b4cc9993538cd73a6b3e00af9a403ba8d61be9287b6945264e0043df34de4d0e81b646ee052c0cd0fcc
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exeFilesize
230KB
MD52ab9d92e16694f0f626cdd866fee7627
SHA109ced5a8452da7476f066324b1fc19a7d0d1f4b7
SHA2568bf7d914747e3144121f48c4cbc9b9f0958103542618cb772ccb5aee4b358084
SHA5126dfe227412ae474254100f4cae9f00da135f262c74feb2ec3d05c07d06ed46ed8290bc263fed4cd865ed04b5ddd88fc2b9e78e94e5496b7720e0329225a93201
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\qemu-ga.exeFilesize
4KB
MD5a5ce3aba68bdb438e98b1d0c70a3d95c
SHA1013f5aa9057bf0b3c0c24824de9d075434501354
SHA2569b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a
SHA5127446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79
-
C:\Users\Admin\AppData\Local\Temp\nsa1356.tmpFilesize
136KB
MD5abcf7804c518938c705350fb4f7c93e2
SHA1957958826c15b71f99995cdd1d599706e9c86897
SHA256f79b7e675422dfe8e52c36f9efdd5f21fc337a3836e5e4bc626b28ec53bf4dfd
SHA512fd7c3cb085f7a5a9d263c9dbfbe2742edb3e6df1584c2ae109327a355216224f02772590897e40f59dd8fb2d4d03d32656bcbfce8d9682664adf34abb89683b1
-
C:\Users\Admin\AppData\Local\Temp\nsa1356.tmpFilesize
51KB
MD56fc891fa64027819ad3625d5b2ccb25a
SHA1c81c8d355cb7a3083e868197532fb85be0633793
SHA256cbfbee6920c03d82a2e13f3a5e3f33f7457f875afce90e651d791cd56f8f8f7b
SHA51248e16cc6663b4080574b6beba6a2893402c6fd2aaacfb6b4c6aa9869486011d9ec0e4861649e019e664f7b1ccfc838f2982d0804f6997146b855a8b4ab128c1b
-
C:\Users\Admin\AppData\Local\Temp\nsb914.tmp\INetC.dllFilesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
C:\Users\Admin\AppData\Local\Temp\nsb914.tmp\INetC.dllFilesize
24KB
MD582fef98c93873c84201d7c470ab7a5a8
SHA10bd913811db221efc9b1b5391e3eb45949b6fa4e
SHA256906fa5e581bb91307be26ce99ca9fe2d96da4f82146f61dca6f596b8e1144819
SHA512c78f75ed69c263d3812b3cd30156163cc133d2751200771d4a4c2baa0948354ee7e14d9202565cc66e3399921b212237d638b0d295dbe1d0f2bfbe03e1023dbc
-
C:\Users\Admin\AppData\Local\Temp\rty25.exeFilesize
306KB
MD59ee899895acbfd9e0c34d5a5b46b6205
SHA10e7be92b824f98ccbd37fab7affb8c9efdb1ef5d
SHA256e85361387ac726f8636ac24e9027a92cafad3a8d039a7a8809f76e0dbee2c7a1
SHA5121e10169b60d623c0acf43a2196ce1e75dbc72f8a8458cd4c205aab01b1437764bc0cde0e53cc6140c03934ebc717ea54e55de13df423986074ba1b68220fee8f
-
C:\Users\Admin\AppData\Local\Temp\rty25.exeFilesize
232KB
MD584d7c3f3863cda5065fd83d35842280a
SHA13d1f69135752845b8fdab448d44f4d5e06fd8ddc
SHA256684539de7ac46e0aeb57d7bfe372b55933222d1b52cbe16b2d1650c16cd5e79d
SHA512f3a282e1bf14f6e67e3e3635f923bf5e827ea60b4ad8818a87818d06a5f23246b8e9a5a31c117d38d124300c617d496e62a295ea57a1eeaf3067b61f73b97a9f
-
C:\Users\Admin\AppData\Local\Temp\rty25.exeFilesize
154KB
MD53a7936f508992db4c82bbbcd0554897e
SHA19a9aa0d4a4af4eb16339c43218ee83386c71ca03
SHA2569a8283e40a20037f14c4b8f1885ce653e70790efa7ce2f4b420b8d15d4add252
SHA5129e0250ab4ef52f7f9f788be8ad542c4276c30f893ddea5b6b8cc6d5d308ede8e9da0e45ced24dd5faa016cb62edf28e0b0a6113d9bf5e7ea73d164b9c489fefb
-
C:\Users\Admin\AppData\Local\Temp\toolspub1.exeFilesize
169KB
MD51d3976879d2a98ddbb49151ef652c3d7
SHA13b17be2f1a63eafe589911b7e6461b9b94e9f424
SHA256f7cd23f9e6b47e319b2dd8d96acd8b57a6989051367065f973f463d70bca9c50
SHA512b9f77d933f6dde3457cca2c6e5ce7da9d8b0dfb3d68bc8b977dd5df485ad52cd487d52cd838e9d6f37701ccf67bdc873bc0bd02c918061ec9229f414f67457e3
-
C:\Users\Admin\AppData\Local\Temp\toolspub1.exeFilesize
332KB
MD5a1470335c14e84fd1f158878a5776ae1
SHA198ff4297b83233ce26c0a116abe76312af645398
SHA2568da2cb8ea28028e84ead59e8d7e4f97325351ddab33df6704d3cf8894d5ce7a5
SHA512cb43793944d547f6d91a546619848f02605e42ed6160954fa89e5297b0d252a1ddf3747d5fd96912fabcad6ec90901a15da5e755838916fe80396742c79008ec
-
C:\Users\Admin\AppData\Local\Temp\toolspub1.exeFilesize
40KB
MD50857eb718ec9afa477d59a64bd5efb34
SHA13ba85e7d9d15404b73768dadcd0640a8154863d4
SHA256cc0e18045e21b6b00059083c630f090bda1b3e71abfb45677d7d1ab44f76bc2a
SHA512a6f2e5f07645e3bd7f6748ca1a097d298eb2d9adf6b07c060a6b6ef17eb3d25c3f75cdca2ac63d0239ab8b45ff14715b567206324b64a5b42c990317b3a5d439
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
102KB
MD585af6c99d918757171d2d280e5ac61ef
SHA1ba1426d0ecf89825f690adad0a9f3c8c528ed48e
SHA256150fb1285c252e2b79dea84efb28722cc22d370328ceb46fb9553de1479e001e
SHA51212c061d8ff87cdd3b1f26b84748396e4f56fc1429152e418988e042bc5362df96a2f2c17bcf826d17a8bae9045ee3ba0c063fb565d75c604e47009ff442e8c8e
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
C:\Users\Admin\AppData\Roaming\Temp\Task.batFilesize
128B
MD511bb3db51f701d4e42d3287f71a6a43e
SHA163a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA2566be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
SHA512907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2
-
C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exeFilesize
325KB
MD53058f10b2fe431d9f8a487a35cd89ba3
SHA1adf31cfada940e96a02305177bea754d4ee41861
SHA25673e5d1b5c0d2134f08a76a09b913efa9076bd492e509cd0346794db436c54d30
SHA5124f59602a4f557a9947d15a1ed13d8e1b09d0ba3660130fa7e029219b21062a3dba55f7da6db0efa9f2f5ac5053dda51ed4e183ae171789374e239c4d7609eae5
-
C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exeFilesize
166KB
MD5484dd41c0ac2b855a786ce79ea15e4f2
SHA11c57b7737ea40859655c65447bb137fed257f239
SHA25648fe7600b68bb298be12565e9085913fab1448bf45ebc99bb3e3552bb36ce62d
SHA51284cc87b7ada36713ef5e8ccf2fc65b125aa68f4de087b137bc78c800fd444d0b3630e68066ea2f3cbdaec1475d739028db629ea7fcfe53bae0f1d70f9a66fd6b
-
C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exeFilesize
189KB
MD5794cec9e8db825915673ea52be715a17
SHA11967650874fa347cfd1c5e762db8a85013694729
SHA256686eabd2374cf5d68ce415aa960e0f2ad2a1ebdfe7c47fca5011ff2609d2d27f
SHA5127fc6275effab7f1f1b50283175e8fe9c498bc6ee5d6a67f1c98c978f4ff6370cc9842d779d96d14d09c5afd576a9f4bf2fb4f9c61ce0026d342d66fc9a4a79ab
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exeFilesize
147KB
MD512c75eb915a110e10722cdc66e709c64
SHA1ccc7133274bf68e8df8ba3f3b3e1110e50661c4d
SHA25618126c1f6c048a13038f94624c831489d73e499c384ea232df503c2b372c617e
SHA512b0ee066d413bdb35824753bea7ba0b3accd6ac5cc46056ea6e0df98a784e4422ae18dcb0636cc0365ff903daad5044b207f48af86715725f863a668e14badef0
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exeFilesize
176KB
MD57c67997e1ab6c59d1a55fd548dc5dd2b
SHA1a74e25e6b35a482331391125f97b509cd7d7da90
SHA256629c6af26f47c12b30d3f08e9d902d7727aabc46a3daadf3132b5e9e79e0c1bb
SHA512da8c57d5a24c1dd390c1436997ce8432d62630ee49c1ea8beaeb33472e99e511a1f9a1faeda51631f8699609862dbb3075fff22b9f5a3ac79ed9efbc36b02df6
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exeFilesize
313KB
MD55ea776e43112b097b024104d6319b6dc
SHA1abd48a2ec2163a85fc71be96914b73f3abef994c
SHA256cf650d13eea100a691f7f8f64674189a9c13d7948e31468963e10a23726dc341
SHA51283667045b7da8596fad90320880d8d7c83f71a1f043d73f7b68a0ad948ae2e530a753d5c7943a096a307e696f8d9fa433025b30078af6d4530d1a2f2a4b12ed2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a8184b1cacdf7b45acf203cdca1f8350
SHA170dbd34716bbcc3c39ae2e66e94585f4c9dcc3a8
SHA256e435cb7a53481a934ef04124528065b2787c6e4b14746b4396ed3dfc12c61b7a
SHA51226c4ee726a7ac14337c9f774d2e386b8609c5d417e9115886dcd068eeae70a0a5d6ae62dffe134c1c3ff63bb82886a390aff50b1309ebbd2b472605acbf736a5
-
\??\c:\users\admin\appdata\local\temp\F59E91F8Filesize
14B
MD53853abb35ab617a117144f119cdc9808
SHA103d8fb3499ba7e77d9aa75cdd118b4e7a74fc4ae
SHA256f4a22e11f7d4a6ea0c60654edc821df260b093ce1ccb911f16b42bcfc96278ef
SHA5120c79095134ef83f1eed98cdaff749fb557e6543789879fc09650726cc8c575ba18757975bb67e245846fad304ea3dd0abc0f489c810b8ef1b5f08d72e711e1b8
-
memory/812-305-0x0000000000580000-0x0000000000602000-memory.dmpFilesize
520KB
-
memory/1084-301-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-274-0x0000000004FF0000-0x0000000005000000-memory.dmpFilesize
64KB
-
memory/1084-273-0x0000000004FF0000-0x0000000005000000-memory.dmpFilesize
64KB
-
memory/1084-324-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-400-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-313-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-361-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-311-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-389-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-307-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-341-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-345-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-358-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-334-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-298-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-289-0x0000000073480000-0x0000000073C30000-memory.dmpFilesize
7.7MB
-
memory/1084-287-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-407-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-288-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-414-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-277-0x0000000004FF0000-0x0000000005000000-memory.dmpFilesize
64KB
-
memory/1084-374-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-410-0x0000000005000000-0x00000000051A5000-memory.dmpFilesize
1.6MB
-
memory/1084-276-0x0000000005000000-0x00000000051AC000-memory.dmpFilesize
1.7MB
-
memory/1084-272-0x00000000051B0000-0x000000000535C000-memory.dmpFilesize
1.7MB
-
memory/1712-235-0x0000000073480000-0x0000000073C30000-memory.dmpFilesize
7.7MB
-
memory/1712-241-0x0000000002320000-0x0000000002330000-memory.dmpFilesize
64KB
-
memory/1712-270-0x0000000073480000-0x0000000073C30000-memory.dmpFilesize
7.7MB
-
memory/1712-228-0x0000000005000000-0x0000000005060000-memory.dmpFilesize
384KB
-
memory/1712-257-0x0000000002570000-0x0000000004570000-memory.dmpFilesize
32.0MB
-
memory/1712-236-0x0000000002320000-0x0000000002330000-memory.dmpFilesize
64KB
-
memory/1712-226-0x00000000049B0000-0x0000000004A12000-memory.dmpFilesize
392KB
-
memory/1712-239-0x0000000002320000-0x0000000002330000-memory.dmpFilesize
64KB
-
memory/1816-102-0x0000000000BF0000-0x0000000000FF8000-memory.dmpFilesize
4.0MB
-
memory/1816-100-0x0000000000BF0000-0x0000000000FF8000-memory.dmpFilesize
4.0MB
-
memory/1816-105-0x0000000000BF0000-0x0000000000FF8000-memory.dmpFilesize
4.0MB
-
memory/1888-343-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/2476-141-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2476-152-0x0000000002590000-0x0000000004590000-memory.dmpFilesize
32.0MB
-
memory/2476-138-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2476-137-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2476-136-0x00000000735F0000-0x0000000073DA0000-memory.dmpFilesize
7.7MB
-
memory/2476-135-0x0000000004BF0000-0x0000000004C88000-memory.dmpFilesize
608KB
-
memory/2476-142-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2476-139-0x0000000004B50000-0x0000000004BE8000-memory.dmpFilesize
608KB
-
memory/2476-151-0x00000000735F0000-0x0000000073DA0000-memory.dmpFilesize
7.7MB
-
memory/3352-75-0x0000000002CF0000-0x0000000002D4E000-memory.dmpFilesize
376KB
-
memory/3640-224-0x0000000000BF0000-0x0000000000FF8000-memory.dmpFilesize
4.0MB
-
memory/3640-140-0x0000000000BF0000-0x0000000000FF8000-memory.dmpFilesize
4.0MB
-
memory/3640-17-0x0000000000BF0000-0x0000000000FF8000-memory.dmpFilesize
4.0MB
-
memory/3640-16-0x0000000000BF0000-0x0000000000FF8000-memory.dmpFilesize
4.0MB
-
memory/3640-392-0x0000000000BF0000-0x0000000000FF8000-memory.dmpFilesize
4.0MB
-
memory/3780-47-0x00000000735F0000-0x0000000073DA0000-memory.dmpFilesize
7.7MB
-
memory/3780-48-0x0000000002920000-0x0000000004920000-memory.dmpFilesize
32.0MB
-
memory/3780-41-0x0000000004DE0000-0x0000000004DF0000-memory.dmpFilesize
64KB
-
memory/3780-40-0x00000000735F0000-0x0000000073DA0000-memory.dmpFilesize
7.7MB
-
memory/3780-39-0x0000000000330000-0x000000000039C000-memory.dmpFilesize
432KB
-
memory/3780-231-0x0000000002920000-0x0000000004920000-memory.dmpFilesize
32.0MB
-
memory/4264-0-0x0000000000580000-0x0000000000988000-memory.dmpFilesize
4.0MB
-
memory/4264-14-0x0000000000580000-0x0000000000988000-memory.dmpFilesize
4.0MB
-
memory/4264-2-0x0000000000580000-0x0000000000988000-memory.dmpFilesize
4.0MB
-
memory/4264-1-0x0000000000580000-0x0000000000988000-memory.dmpFilesize
4.0MB
-
memory/4404-87-0x0000000006290000-0x0000000006322000-memory.dmpFilesize
584KB
-
memory/4404-50-0x0000000005910000-0x0000000005F28000-memory.dmpFilesize
6.1MB
-
memory/4404-44-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/4404-49-0x00000000051E0000-0x00000000051F0000-memory.dmpFilesize
64KB
-
memory/4404-51-0x00000000735F0000-0x0000000073DA0000-memory.dmpFilesize
7.7MB
-
memory/4404-52-0x0000000005330000-0x0000000005342000-memory.dmpFilesize
72KB
-
memory/4404-53-0x0000000005460000-0x000000000556A000-memory.dmpFilesize
1.0MB
-
memory/4404-54-0x0000000005390000-0x00000000053CC000-memory.dmpFilesize
240KB
-
memory/4404-179-0x00000000735F0000-0x0000000073DA0000-memory.dmpFilesize
7.7MB
-
memory/4404-55-0x00000000053F0000-0x000000000543C000-memory.dmpFilesize
304KB
-
memory/4404-76-0x0000000005760000-0x00000000057C6000-memory.dmpFilesize
408KB
-
memory/4404-88-0x00000000063B0000-0x0000000006426000-memory.dmpFilesize
472KB
-
memory/4404-77-0x0000000006730000-0x0000000006CD4000-memory.dmpFilesize
5.6MB
-
memory/4404-92-0x0000000006570000-0x000000000658E000-memory.dmpFilesize
120KB
-
memory/4404-106-0x0000000008110000-0x000000000863C000-memory.dmpFilesize
5.2MB
-
memory/4404-97-0x00000000075C0000-0x0000000007610000-memory.dmpFilesize
320KB
-
memory/4404-99-0x0000000007A10000-0x0000000007BD2000-memory.dmpFilesize
1.8MB
-
memory/4540-234-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4540-229-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4540-227-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4540-225-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4540-223-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4540-266-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4540-265-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4540-256-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4540-230-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4540-255-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4540-251-0x0000000000990000-0x00000000009B0000-memory.dmpFilesize
128KB
-
memory/4540-269-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4540-237-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4572-166-0x00000000014B0000-0x00000000014E2000-memory.dmpFilesize
200KB
-
memory/4572-156-0x0000000001390000-0x00000000013D0000-memory.dmpFilesize
256KB
-
memory/4572-183-0x0000000000400000-0x000000000048A000-memory.dmpFilesize
552KB
-
memory/4572-169-0x00000000014B0000-0x00000000014E2000-memory.dmpFilesize
200KB
-
memory/4572-163-0x00000000014B0000-0x00000000014E2000-memory.dmpFilesize
200KB
-
memory/4572-148-0x0000000000400000-0x000000000048A000-memory.dmpFilesize
552KB
-
memory/4572-145-0x0000000000400000-0x000000000048A000-memory.dmpFilesize
552KB
-
memory/4572-153-0x0000000001390000-0x00000000013D0000-memory.dmpFilesize
256KB
-
memory/4820-303-0x0000000008010000-0x000000000805C000-memory.dmpFilesize
304KB
-
memory/4820-238-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4820-275-0x00000000051C0000-0x00000000051CA000-memory.dmpFilesize
40KB
-
memory/4820-271-0x0000000073480000-0x0000000073C30000-memory.dmpFilesize
7.7MB
-
memory/5068-180-0x00007FF813D70000-0x00007FF814831000-memory.dmpFilesize
10.8MB
-
memory/5068-167-0x0000000000410000-0x0000000000418000-memory.dmpFilesize
32KB