Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/03/2024, 04:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    333a556b9edba0a849275d9f35e85c00e40b258d29036d0d7394f44d7eb569fd.exe

  • Size

    1.8MB

  • MD5

    cfcbb4018389095db69c51e845896db0

  • SHA1

    1d97084a177a55094cb0350c8feffc69abf3a388

  • SHA256

    333a556b9edba0a849275d9f35e85c00e40b258d29036d0d7394f44d7eb569fd

  • SHA512

    50ecacc4fb32fa42b79306b970b3eb061fd630e74c5de1025b17441b974de361a932c45b0305e49b1af94741977f7c6906745df31557993fc24d50f7274f42ec

  • SSDEEP

    24576:bdXdaxjLQx7cxYGjZH5Ks/mywACjJDzjAUc+C5rtFCjjqOn3hz4yOzRd8xJOGtEi:bB8IH8ZKvywh1zErtaDn6dsbXFJ

Score
10/10
amadeygluptebariseprostealcxmrigdiscoverydropperevasionloaderminerpersistencerootkitspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

risepro

C2

193.233.132.62

Extracted

Family

stealc

C2

http://185.172.128.145

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 6 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    evasion
  • XMRig Miner payload 4 IoCs
    miner
  • Blocklisted process makes network request 2 IoCs
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 10 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 15 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 1 IoCs
    installer
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\333a556b9edba0a849275d9f35e85c00e40b258d29036d0d7394f44d7eb569fd.exe
    "C:\Users\Admin\AppData\Local\Temp\333a556b9edba0a849275d9f35e85c00e40b258d29036d0d7394f44d7eb569fd.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:212
      • C:\Users\Admin\AppData\Local\Temp\1000010001\lenin.exe
        "C:\Users\Admin\AppData\Local\Temp\1000010001\lenin.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:4672
      • C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
        "C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2892
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN InstallSetup8.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4648
        • C:\Users\Admin\AppData\Local\Temp\1000151001\InstallSetup8.exe
          "C:\Users\Admin\AppData\Local\Temp\1000151001\InstallSetup8.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1596
          • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
            C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:3500
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CAFHIJDHDG.exe"
              6⤵
                PID:3620
                • C:\Users\Admin\AppData\Local\Temp\CAFHIJDHDG.exe
                  "C:\Users\Admin\AppData\Local\Temp\CAFHIJDHDG.exe"
                  7⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:4928
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\CAFHIJDHDG.exe
                    8⤵
                      PID:4168
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 2.2.2.2 -n 1 -w 3000
                        9⤵
                        • Runs ping.exe
                        PID:4964
              • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2576
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4360
                  • C:\Windows\SysWOW64\chcp.com
                    chcp 1251
                    7⤵
                      PID:2492
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                      7⤵
                      • Creates scheduled task(s)
                      PID:1048
              • C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe
                "C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4896
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1076
                • C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe"
                  5⤵
                  • Windows security bypass
                  • Executes dropped EXE
                  • Windows security modification
                  • Adds Run key to start application
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4008
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4080
                  • C:\Windows\System32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4540
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      7⤵
                      • Modifies Windows Firewall
                      PID:1876
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1320
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:316
                  • C:\Windows\rss\csrss.exe
                    C:\Windows\rss\csrss.exe
                    6⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Manipulates WinMonFS driver.
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4232
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      7⤵
                      • Modifies data under HKEY_USERS
                      PID:2464
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      7⤵
                      • Creates scheduled task(s)
                      PID:2912
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /delete /tn ScheduledUpdate /f
                      7⤵
                        PID:2308
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        7⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3008
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        7⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4248
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                        7⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5012
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        7⤵
                        • Creates scheduled task(s)
                        PID:2184
                      • C:\Windows\windefender.exe
                        "C:\Windows\windefender.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:1860
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          8⤵
                            PID:3284
                            • C:\Windows\SysWOW64\sc.exe
                              sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              9⤵
                              • Launches sc.exe
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4508
                  • C:\Users\Admin\AppData\Local\Temp\1000153001\FirstZ.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000153001\FirstZ.exe"
                    4⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    PID:5020
                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                      5⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3284
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                      5⤵
                        PID:4892
                        • C:\Windows\system32\wusa.exe
                          wusa /uninstall /kb:890830 /quiet /norestart
                          6⤵
                            PID:4352
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe stop UsoSvc
                          5⤵
                          • Launches sc.exe
                          PID:2172
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe stop WaaSMedicSvc
                          5⤵
                          • Launches sc.exe
                          PID:4304
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe stop wuauserv
                          5⤵
                          • Launches sc.exe
                          PID:2124
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe stop bits
                          5⤵
                          • Launches sc.exe
                          PID:1692
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe stop dosvc
                          5⤵
                          • Launches sc.exe
                          PID:3120
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                          5⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1320
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                          5⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5116
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                          5⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4768
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                          5⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3100
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe delete "WSNKISKT"
                          5⤵
                          • Launches sc.exe
                          PID:2376
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
                          5⤵
                          • Launches sc.exe
                          PID:4112
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe stop eventlog
                          5⤵
                          • Launches sc.exe
                          PID:4280
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe start "WSNKISKT"
                          5⤵
                          • Launches sc.exe
                          PID:3476
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                      3⤵
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:660
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                        4⤵
                        • Blocklisted process makes network request
                        • Loads dropped DLL
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4212
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profiles
                          5⤵
                            PID:376
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\104443672357_Desktop.zip' -CompressionLevel Optimal
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2296
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                        3⤵
                        • Blocklisted process makes network request
                        • Loads dropped DLL
                        PID:4472
                  • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                    C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                    1⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3252
                  • C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
                    C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4632
                  • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                    C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                    1⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    PID:4084
                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                      2⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1048
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                      2⤵
                        PID:1300
                        • C:\Windows\system32\wusa.exe
                          wusa /uninstall /kb:890830 /quiet /norestart
                          3⤵
                            PID:4872
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe stop UsoSvc
                          2⤵
                          • Launches sc.exe
                          PID:4352
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe stop WaaSMedicSvc
                          2⤵
                          • Launches sc.exe
                          PID:2520
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe stop wuauserv
                          2⤵
                          • Launches sc.exe
                          PID:2828
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe stop bits
                          2⤵
                          • Launches sc.exe
                          PID:3972
                        • C:\Windows\system32\sc.exe
                          C:\Windows\system32\sc.exe stop dosvc
                          2⤵
                          • Launches sc.exe
                          PID:4632
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                          2⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2336
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                          2⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4112
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                          2⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:656
                        • C:\Windows\system32\powercfg.exe
                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                          2⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5064
                        • C:\Windows\system32\conhost.exe
                          C:\Windows\system32\conhost.exe
                          2⤵
                            PID:1560
                          • C:\Windows\explorer.exe
                            explorer.exe
                            2⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4952
                        • C:\Windows\windefender.exe
                          C:\Windows\windefender.exe
                          1⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          PID:396
                        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                          C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:2504
                        • C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
                          C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
                          1⤵
                          • Executes dropped EXE
                          PID:656
                        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                          C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:4076
                        • C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
                          C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
                          1⤵
                          • Executes dropped EXE
                          PID:2328
                        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                          C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:4312
                        • C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
                          C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
                          1⤵
                          • Executes dropped EXE
                          PID:684
                        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                          C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                          1⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:4852
                        • C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
                          C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
                          1⤵
                          • Executes dropped EXE
                          PID:2848

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Scheduled Task/Job

                        1
                        T1053

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        3
                        T1543

                        Windows Service

                        3
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        3
                        T1543

                        Windows Service

                        3
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Defense Evasion

                        Impair Defenses

                        4
                        T1562

                        Disable or Modify System Firewall

                        1
                        T1562.004

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        3
                        T1112

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Unsecured Credentials

                        5
                        T1552

                        Credentials In Files

                        4
                        T1552.001

                        Credentials in Registry

                        1
                        T1552.002

                        Discovery

                        Query Registry

                        6
                        T1012

                        Remote System Discovery

                        1
                        T1018

                        System Information Discovery

                        4
                        T1082

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        5
                        T1005

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Service Stop

                        1
                        T1489

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\Are.docx
                          Filesize

                          11KB

                          MD5

                          a33e5b189842c5867f46566bdbf7a095

                          SHA1

                          e1c06359f6a76da90d19e8fd95e79c832edb3196

                          SHA256

                          5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                          SHA512

                          f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                          Download Submit

                        • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                          Filesize

                          1.0MB

                          MD5

                          832bfec21b8f3a5ad5bc1a97b8725368

                          SHA1

                          328ea519dd4c5aba4cfcc29f970c3984738e285c

                          SHA256

                          062aca9198b5737aa4678c5093cea6de98d5fe3992946ecbeb41461cb10ac464

                          SHA512

                          079fafc7431ed6a96514d3c0f88afe432c456750af3dcd1a43804a30c81aae5756f4b18c5318dc0e8880241ff9094d208fd925e1479fb7bda25a8e7d3da3389f

                          Download Submit

                        • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
                          Filesize

                          989KB

                          MD5

                          553b862ad072abd944ac1f8a083e16c2

                          SHA1

                          a8ee85efa812ac7069ed4119359df38403748e03

                          SHA256

                          d26754d25af8449e30f561b9ba4fa7a7a7fefcf0d0946ba5ad0ac8e687f911e7

                          SHA512

                          ecb8aedbdca32c68667dc30ca72bbb39e4e933335fcdf874d101079ba8a39c299a87d0a5e522240d2d9450f3f0662e61be13d0d8b86f90d0b059508bbbd3a003

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                          Filesize

                          3KB

                          MD5

                          7ce47df53c8f0ba7ccf885c309afc484

                          SHA1

                          b25ad9723b06d3861498caa32ffb1b7b38701a95

                          SHA256

                          7031b6b7bc43cf4ee90d4ec4860b78a442352243ea28f5d959b56222b13de2e4

                          SHA512

                          78585fbfcfe2e7a27f0ee168075958923184e67da1668850d0e66e31f0fd0a5516c04a17693ad197da7ffffb179265cd54fe0629fa30e00a6f269c6d68277efd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          Filesize

                          1KB

                          MD5

                          59178dc1c897fe387eb743a42edbe440

                          SHA1

                          fb2fd6dc1b5de306e79e15eb83bbbc7854fb9f11

                          SHA256

                          b1831615adc9632912312b3c23136ea1520250556538ed2c5d2808b72a382ade

                          SHA512

                          8fdec4a1d4699c274660817c0c8384f42470e6f532c473869ccdef62418612bd9e602a5c3a2c58878fa5b7f31c6906ed6f391876b9797c6ef26eb7d7017b86fc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                          Filesize

                          1.8MB

                          MD5

                          cfcbb4018389095db69c51e845896db0

                          SHA1

                          1d97084a177a55094cb0350c8feffc69abf3a388

                          SHA256

                          333a556b9edba0a849275d9f35e85c00e40b258d29036d0d7394f44d7eb569fd

                          SHA512

                          50ecacc4fb32fa42b79306b970b3eb061fd630e74c5de1025b17441b974de361a932c45b0305e49b1af94741977f7c6906745df31557993fc24d50f7274f42ec

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                          Filesize

                          448KB

                          MD5

                          1820bd5b68ef9db380aee233734c3372

                          SHA1

                          b21c55e93a0be08c32ab8947f1c97f22398b685b

                          SHA256

                          62e119004ffb048008fd49cc32e886faf1b69b6ecd268889fdf5db042f631746

                          SHA512

                          939ee4d8211eb2a6c32bda42bd16d8afdc3e2aa64acf5d0c98b1b31dececacf9e7c2a2cba8e6bee67bd12c71d57406d1ff779a894adf4ca0437ac00b3762ea83

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000010001\lenin.exe
                          Filesize

                          3.0MB

                          MD5

                          1a02813cf7cb1c939af82ee6a7670575

                          SHA1

                          2845e7214874b6dce95e9edb30ddfba426d26533

                          SHA256

                          78fad881cf61ed2d13bb532c13e4e4bb761acdcbac4ddc7ccdf65dc7b5b87c37

                          SHA512

                          5f69cd15549cc6b7942273c20d3bcf95ff4121174da5df4ae1ca5c4d34afcf009e2328f074b37aee710e56cc429cd522547702ad2d17e9d3e4165e2a942e79fc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000018001\InstallSetup8.exe
                          Filesize

                          418KB

                          MD5

                          0099a99f5ffb3c3ae78af0084136fab3

                          SHA1

                          0205a065728a9ec1133e8a372b1e3864df776e8c

                          SHA256

                          919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                          SHA512

                          5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000151001\InstallSetup8.exe
                          Filesize

                          2.1MB

                          MD5

                          07771f905f956e2e9311f88d2fb61a41

                          SHA1

                          43714c72081b102de5def978db8b0eb1d3f1a85f

                          SHA256

                          869173bf6d4a8ad18a72e2b61a2c68d87a09450e42076e6336b1f46a033df12a

                          SHA512

                          ff049073fe00dc6b18b0ddf455bed814ac6b6bc3b52c23fe027bb5bee70a7e212a091d460a7c948019ddd02f52358092429e98988c885ecdbf46b341fd6ba05d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000152001\4767d2e713f2021e8fe856e3ea638b58.exe
                          Filesize

                          4.1MB

                          MD5

                          67d436770679af41b4a59a1c76f55b3b

                          SHA1

                          21ea415c326d5a5857ebb90e577a8f8782528a01

                          SHA256

                          0c8d359c46b7cc7224245f59c5213e53da9f4098cb166fa0b78b9ba17be2c070

                          SHA512

                          060a13ed802a74cb22c43a22cd3ab13db46857b2919552d6afdd7e4954fd66e18262abec59b1e514e6016d8f62f16191d34a4b3ac663276fa5c6493f596de2d6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000153001\FirstZ.exe
                          Filesize

                          2.5MB

                          MD5

                          ffada57f998ed6a72b6ba2f072d2690a

                          SHA1

                          6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

                          SHA256

                          677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

                          SHA512

                          1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                          Filesize

                          1.7MB

                          MD5

                          eee5ddcffbed16222cac0a1b4e2e466e

                          SHA1

                          28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

                          SHA256

                          2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

                          SHA512

                          8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\CAFHIJDHDG.exe
                          Filesize

                          24KB

                          MD5

                          82ba0fa29450a66b0626bc81db9665d7

                          SHA1

                          0f6db9b832d1353172838c2644623abce7018de0

                          SHA256

                          eeb68876ca89772506c0d46e8ecf556fb98ae7026668456b498310c9c34b4efe

                          SHA512

                          b14886ddb057c11a10a8499987d77918d82ea7238e28c1e9cd04876774f3adc01408015408d73d643add8146f04f6b1628d985b8e4fd73d42a45cc2e72d2ecbd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\CAFHIJDHDG.exe
                          Filesize

                          101KB

                          MD5

                          42b838cf8bdf67400525e128d917f6e0

                          SHA1

                          a578f6faec738912dba8c41e7abe1502c46d0cae

                          SHA256

                          0e4ffba62ce9a464aa1b7ff9f1e55ace8f51ff1e15102d856f801a81f8b4607d

                          SHA512

                          f64b39d885375251ab7db72c57dc5b5095f0c6412169f1035d1f6a25b8415a2a01004d06bfa0267cf683ef7dea7a9f969ad43fde5a4376f1fcb65a57403433c0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oudi2dqu.xhb.ps1
                          Filesize

                          1B

                          MD5

                          c4ca4238a0b923820dcc509a6f75849b

                          SHA1

                          356a192b7913b04c54574d18c28d46e6395428ab

                          SHA256

                          6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                          SHA512

                          4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                          Filesize

                          281KB

                          MD5

                          d98e33b66343e7c96158444127a117f6

                          SHA1

                          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                          SHA256

                          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                          SHA512

                          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                          Filesize

                          253KB

                          MD5

                          5033fc63b03bed10b7d5a9dca0592e93

                          SHA1

                          4b5be6516e45d75d4662332134e72320d1bb962e

                          SHA256

                          4411c6a053b00fbcf08b03a67added99061b7d7ba0070b6e5e1d24586d856c5c

                          SHA512

                          be0f1805855a42bc37d79d30ebc40cf1ef73dd5233a06fb3c6f74ae5ce52c75ec499a32b4d6ff82524d99f9bc9ef7a96bec43cbe1499427d3002ada58bbaf5cd

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                          Filesize

                          128B

                          MD5

                          11bb3db51f701d4e42d3287f71a6a43e

                          SHA1

                          63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                          SHA256

                          6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                          SHA512

                          907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                          Filesize

                          109KB

                          MD5

                          726cd06231883a159ec1ce28dd538699

                          SHA1

                          404897e6a133d255ad5a9c26ac6414d7134285a2

                          SHA256

                          12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                          SHA512

                          9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                          Filesize

                          1.2MB

                          MD5

                          15a42d3e4579da615a384c717ab2109b

                          SHA1

                          22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                          SHA256

                          3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                          SHA512

                          1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                          Download Submit

                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                          Filesize

                          2KB

                          MD5

                          1c19c16e21c97ed42d5beabc93391fc5

                          SHA1

                          8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                          SHA256

                          1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                          SHA512

                          7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                          Download Submit

                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                          Filesize

                          18KB

                          MD5

                          ce1717b4eeddda44a76ded02674c8c8d

                          SHA1

                          cb5169aa19bb6a885257e634a62185bf9c1ee235

                          SHA256

                          7c915a47a6053544fe37130d9e2b777f616349a74ca19d04cde3240230b8b65d

                          SHA512

                          5bec8671355e2fc771ec0a8599169c7bdce821f91c19c13dc1d45d14da2dc487710e2bf69ff08036c6839796a60979d6a549d370915127c65ad21297120d1336

                          Download Submit

                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                          Filesize

                          18KB

                          MD5

                          ec14c91a96c40bd809501ee0d154ea4e

                          SHA1

                          8f18ab0423022fee8f17ec6a4654d86a7601349e

                          SHA256

                          cdda1b082a16e4b0949224ba7e133ceb4b56b457ebc118f27979e5d667c9c3e2

                          SHA512

                          58115540b7c99287f23181aabac750577580c73d9d42ff2b3a4c5747bc814d2e5b0b50f329cea112107e3ec84565868551b45a6c8d40988c9479bad0a34b172c

                          Download Submit

                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                          Filesize

                          18KB

                          MD5

                          5fe72e092f9b2d13e0ac47bbd285a03d

                          SHA1

                          99e03bfbdd9097d386ab955885a162e65758151e

                          SHA256

                          aea4350de5053a275e610e0e210b8ec2c5ebf9bda90a5318e37e76d83708dc7b

                          SHA512

                          8eeffbea02d0487c725398b421e75828268dbaa9823ed81a27ac46b35c1a416ffa6370d0a2e22fb92f831f4ce1d9313337e206f4c4764aed7935f1ba4197439c

                          Download Submit

                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                          Filesize

                          18KB

                          MD5

                          8c5d91d6db8307d4c0d3eef0f6b13c2c

                          SHA1

                          67efda145d084b61725393131a66023c503b1505

                          SHA256

                          fcf9198a1155c1eed341a8df683c47a268455bd89a7f168bb2158a16140c0e75

                          SHA512

                          4b3d55d7f330994c7593665890b7bbc8dde78cb8a8d01ffa955a73b3daa6bd4810c643d2b960bb5d45b23daa68bc5a4658ad25b70d42a1e3146c9b45218752c6

                          Download Submit

                        • C:\Windows\windefender.exe
                          Filesize

                          382KB

                          MD5

                          ea5795a574c0bf894211641643488f26

                          SHA1

                          53c78daab38eed420df3f94b304557bc41a31540

                          SHA256

                          89bcdc0c5572c067502ca64c4359f7330238e7711a2691f866f15f6aceb9cbf4

                          SHA512

                          0ccc797eaf7af35186bd3020b5bcb88ac2d4e401a7cf80d341b7e1b1a616b4748051e41adab85b187886d905fcb3a285240a0da879ae3974a4715dcceca5258e

                          Download Submit

                        • C:\Windows\windefender.exe
                          Filesize

                          312KB

                          MD5

                          98e49a59dd055b25bf7fa53bee69cfd9

                          SHA1

                          c18f47e1e32ffc7d2b1a845ea6e7379077324478

                          SHA256

                          fb08c24c46488ca098ea093cc0fd5ae22ecad5bdbe378c7dba88a7547ade9588

                          SHA512

                          7ec4c4bcd59acd83d411f97e4bec79a76ef547ad5da16d704f6ea0db9c3f58dd44401d8f5e81135481e7e73708213c5f6db8f9c6637cfce6ffce422c6697ef37

                          Download Submit

                        • C:\Windows\windefender.exe
                          Filesize

                          555KB

                          MD5

                          8bbe4ab9a5d3ba140c56ae674d14ef1a

                          SHA1

                          1377ee5c18387bd04ef76ebee6f65efbc021c81c

                          SHA256

                          6309fbc605857fb32bdca2f50e43c4beea4ec7e95dcb8496c4c355e8ddaa79ad

                          SHA512

                          73df9bc131c04e1c3b676f6f5d4b5c9c0ec9e06ba56d9adca8fb7255c945bfa924026ba225f912fd73fc7915b2b49697546b50fe725310d38966b665dd24591b

                          Download Submit

                        • \ProgramData\mozglue.dll
                          Filesize

                          593KB

                          MD5

                          c8fd9be83bc728cc04beffafc2907fe9

                          SHA1

                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                          SHA256

                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                          SHA512

                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                          Download Submit

                        • \ProgramData\nss3.dll
                          Filesize

                          2.0MB

                          MD5

                          1cc453cdf74f31e4d913ff9c10acdde2

                          SHA1

                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                          SHA256

                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                          SHA512

                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\nsbD64E.tmp\INetC.dll
                          Filesize

                          21KB

                          MD5

                          2b342079303895c50af8040a91f30f71

                          SHA1

                          b11335e1cb8356d9c337cb89fe81d669a69de17e

                          SHA256

                          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

                          SHA512

                          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

                          Download Submit

                        • memory/212-28-0x00000000051A0000-0x00000000051A1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/212-25-0x00000000051C0000-0x00000000051C1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/212-27-0x0000000005170000-0x0000000005171000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/212-615-0x0000000001210000-0x00000000016CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/212-29-0x00000000051B0000-0x00000000051B1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/212-58-0x0000000001210000-0x00000000016CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/212-31-0x00000000051D0000-0x00000000051D1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/212-1861-0x0000000001210000-0x00000000016CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/212-26-0x0000000005160000-0x0000000005161000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/212-30-0x00000000051E0000-0x00000000051E1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/212-140-0x0000000001210000-0x00000000016CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/212-24-0x0000000005180000-0x0000000005181000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/212-22-0x0000000001210000-0x00000000016CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/212-78-0x0000000001210000-0x00000000016CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/212-23-0x0000000005190000-0x0000000005191000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/212-230-0x0000000001210000-0x00000000016CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/212-1359-0x0000000001210000-0x00000000016CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/212-21-0x0000000001210000-0x00000000016CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/1076-237-0x0000000007240000-0x0000000007276000-memory.dmp

                          Filesize

                          216KB

                          Download

                        • memory/1076-304-0x000000000A640000-0x000000000A673000-memory.dmp

                          Filesize

                          204KB

                          Download

                        • memory/1076-306-0x000000006DB20000-0x000000006DB6B000-memory.dmp

                          Filesize

                          300KB

                          Download

                        • memory/1076-296-0x0000000009810000-0x0000000009886000-memory.dmp

                          Filesize

                          472KB

                          Download

                        • memory/1076-265-0x0000000008C80000-0x0000000008CBC000-memory.dmp

                          Filesize

                          240KB

                          Download

                        • memory/1076-246-0x00000000088B0000-0x00000000088FB000-memory.dmp

                          Filesize

                          300KB

                          Download

                        • memory/1076-245-0x00000000086A0000-0x00000000086BC000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/1076-313-0x000000000A680000-0x000000000A725000-memory.dmp

                          Filesize

                          660KB

                          Download

                        • memory/1076-244-0x00000000082D0000-0x0000000008620000-memory.dmp

                          Filesize

                          3.3MB

                          Download

                        • memory/1076-243-0x0000000008260000-0x00000000082C6000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/1076-308-0x000000000A620000-0x000000000A63E000-memory.dmp

                          Filesize

                          120KB

                          Download

                        • memory/1076-307-0x000000006DB70000-0x000000006DEC0000-memory.dmp

                          Filesize

                          3.3MB

                          Download

                        • memory/1076-305-0x000000007F390000-0x000000007F3A0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/1076-242-0x00000000079B0000-0x0000000007A16000-memory.dmp

                          Filesize

                          408KB

                          Download

                        • memory/1076-236-0x0000000070D80000-0x000000007146E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/1076-238-0x0000000007410000-0x0000000007420000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/1076-239-0x0000000007410000-0x0000000007420000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/1076-240-0x0000000007A50000-0x0000000008078000-memory.dmp

                          Filesize

                          6.2MB

                          Download

                        • memory/1076-241-0x0000000007910000-0x0000000007932000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/1560-2117-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/1560-2111-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/1560-2112-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/1560-2113-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/1560-2110-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/1560-2114-0x0000000140000000-0x000000014000E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/1596-209-0x0000000000400000-0x000000000043D000-memory.dmp

                          Filesize

                          244KB

                          Download

                        • memory/1860-1970-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2296-79-0x00000200894C0000-0x00000200894D0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/2296-76-0x00007FFF43C40000-0x00007FFF4462C000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/2296-81-0x00000200894C0000-0x00000200894D0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/2296-74-0x0000020089440000-0x0000020089462000-memory.dmp

                          Filesize

                          136KB

                          Download

                        • memory/2296-80-0x00000200A1780000-0x00000200A17F6000-memory.dmp

                          Filesize

                          472KB

                          Download

                        • memory/2296-102-0x00000200894C0000-0x00000200894D0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/2296-116-0x0000020089510000-0x0000020089522000-memory.dmp

                          Filesize

                          72KB

                          Download

                        • memory/2296-129-0x00000200894A0000-0x00000200894AA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/2296-138-0x00007FFF43C40000-0x00007FFF4462C000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/2464-1353-0x0000000002E00000-0x0000000002EAE000-memory.dmp

                          Filesize

                          696KB

                          Download

                        • memory/2576-211-0x0000000000A20000-0x0000000000A21000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2576-210-0x0000000000400000-0x0000000000930000-memory.dmp

                          Filesize

                          5.2MB

                          Download

                        • memory/3252-608-0x0000000001210000-0x00000000016CD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3500-303-0x0000000000400000-0x000000000063B000-memory.dmp

                          Filesize

                          2.2MB

                          Download

                        • memory/3500-1602-0x0000000000400000-0x000000000063B000-memory.dmp

                          Filesize

                          2.2MB

                          Download

                        • memory/3500-200-0x0000000000920000-0x0000000000A20000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/3500-1882-0x0000000000400000-0x000000000063B000-memory.dmp

                          Filesize

                          2.2MB

                          Download

                        • memory/3500-574-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                          Filesize

                          972KB

                          Download

                        • memory/3500-201-0x0000000000880000-0x00000000008A7000-memory.dmp

                          Filesize

                          156KB

                          Download

                        • memory/3500-872-0x0000000000400000-0x000000000063B000-memory.dmp

                          Filesize

                          2.2MB

                          Download

                        • memory/3500-202-0x0000000000400000-0x000000000063B000-memory.dmp

                          Filesize

                          2.2MB

                          Download

                        • memory/3856-4-0x0000000004D10000-0x0000000004D11000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3856-11-0x0000000004D70000-0x0000000004D71000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3856-9-0x0000000000DF0000-0x00000000012AD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3856-12-0x0000000004D60000-0x0000000004D61000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3856-19-0x0000000000DF0000-0x00000000012AD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3856-0-0x0000000000DF0000-0x00000000012AD000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3856-6-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3856-7-0x0000000004D00000-0x0000000004D01000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3856-5-0x0000000004D50000-0x0000000004D51000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3856-8-0x0000000004D40000-0x0000000004D41000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3856-3-0x0000000004D30000-0x0000000004D31000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3856-2-0x0000000004D20000-0x0000000004D21000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3856-1-0x0000000077154000-0x0000000077155000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4008-1345-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/4232-1860-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/4232-1934-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/4672-141-0x0000000000980000-0x0000000000D28000-memory.dmp

                          Filesize

                          3.7MB

                          Download

                        • memory/4672-44-0x0000000000980000-0x0000000000D28000-memory.dmp

                          Filesize

                          3.7MB

                          Download

                        • memory/4672-45-0x0000000000980000-0x0000000000D28000-memory.dmp

                          Filesize

                          3.7MB

                          Download

                        • memory/4672-1859-0x0000000000980000-0x0000000000D28000-memory.dmp

                          Filesize

                          3.7MB

                          Download

                        • memory/4672-139-0x0000000000980000-0x0000000000D28000-memory.dmp

                          Filesize

                          3.7MB

                          Download

                        • memory/4672-193-0x0000000000980000-0x0000000000D28000-memory.dmp

                          Filesize

                          3.7MB

                          Download

                        • memory/4672-1890-0x0000000000980000-0x0000000000D28000-memory.dmp

                          Filesize

                          3.7MB

                          Download

                        • memory/4672-1120-0x0000000000980000-0x0000000000D28000-memory.dmp

                          Filesize

                          3.7MB

                          Download

                        • memory/4672-215-0x0000000000980000-0x0000000000D28000-memory.dmp

                          Filesize

                          3.7MB

                          Download

                        • memory/4672-545-0x0000000000980000-0x0000000000D28000-memory.dmp

                          Filesize

                          3.7MB

                          Download

                        • memory/4896-231-0x0000000002AC0000-0x0000000002EC2000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/4896-232-0x0000000002ED0000-0x00000000037BB000-memory.dmp

                          Filesize

                          8.9MB

                          Download

                        • memory/4896-550-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/4896-233-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/4952-2118-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/4952-2127-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/4952-2124-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/4952-2126-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/4952-2125-0x0000000000600000-0x0000000000620000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/4952-2120-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/4952-2122-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/4952-2121-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/4952-2123-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download

                        • memory/4952-2119-0x0000000140000000-0x0000000140848000-memory.dmp

                          Filesize

                          8.3MB

                          Download