Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 13:15
Static task
static1
Behavioral task
behavioral1
Sample
e1c0ffe29210812f126d7d326a73cf48.exe
Resource
win7-20240221-en
General
-
Target
e1c0ffe29210812f126d7d326a73cf48.exe
-
Size
920KB
-
MD5
e1c0ffe29210812f126d7d326a73cf48
-
SHA1
190bf0423fd2855120e55ecb49faa071a86554c2
-
SHA256
a110fed848ba8216817e1524a20487a9cb0879b4d78104843642196f36fe5f75
-
SHA512
4884e5dd9434c311d55d59613a17e270e2dbe4c2560e122eac91b899d3c4815cf410e2277b013d784655e2eb1c0590707e7ca44651ff6ba500bd10d689420327
-
SSDEEP
24576:zJXWAayET+QuawV+XTUknfiuG7weke8juowZKMnunK:ATzuaxjnsywKMnY
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\e2caafb3\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
MDdyAsuPL1.exegoepah.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" MDdyAsuPL1.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" goepah.exe -
Disables taskbar notifications via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
5eaj.exedescription ioc process File created C:\Windows\system32\drivers\etc\hosts 5eaj.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2176 cmd.exe -
Executes dropped EXE 16 IoCs
Processes:
MDdyAsuPL1.exegoepah.exe2eaj.exe2eaj.exe2eaj.exe2eaj.exe2eaj.exe2eaj.exe3eaj.exe4eaj.execsrss.exeX3eaj.exe3eaj.exe5eaj.exeCA80.tmppid process 1616 MDdyAsuPL1.exe 2796 goepah.exe 2808 2eaj.exe 2476 2eaj.exe 2688 2eaj.exe 2868 2eaj.exe 2740 2eaj.exe 500 2eaj.exe 1452 3eaj.exe 1836 4eaj.exe 336 csrss.exe 1600 X 2276 3eaj.exe 1652 3eaj.exe 2464 5eaj.exe 2472 CA80.tmp -
Loads dropped DLL 23 IoCs
Processes:
e1c0ffe29210812f126d7d326a73cf48.exeMDdyAsuPL1.exeWerFault.exe4eaj.exe3eaj.exepid process 832 e1c0ffe29210812f126d7d326a73cf48.exe 832 e1c0ffe29210812f126d7d326a73cf48.exe 1616 MDdyAsuPL1.exe 1616 MDdyAsuPL1.exe 832 e1c0ffe29210812f126d7d326a73cf48.exe 832 e1c0ffe29210812f126d7d326a73cf48.exe 1548 WerFault.exe 1548 WerFault.exe 1548 WerFault.exe 1548 WerFault.exe 1548 WerFault.exe 1548 WerFault.exe 1548 WerFault.exe 832 e1c0ffe29210812f126d7d326a73cf48.exe 832 e1c0ffe29210812f126d7d326a73cf48.exe 832 e1c0ffe29210812f126d7d326a73cf48.exe 832 e1c0ffe29210812f126d7d326a73cf48.exe 1836 4eaj.exe 1836 4eaj.exe 832 e1c0ffe29210812f126d7d326a73cf48.exe 832 e1c0ffe29210812f126d7d326a73cf48.exe 1452 3eaj.exe 1452 3eaj.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2476-41-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2476-43-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2476-53-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2476-56-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2476-57-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2688-52-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2476-47-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2688-58-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2688-63-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2688-69-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2688-71-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2868-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-73-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2740-92-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2740-94-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2740-98-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2740-102-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2740-107-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2740-106-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2476-120-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1452-123-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1208-172-0x0000000000C30000-0x0000000000C3B000-memory.dmp upx behavioral1/memory/2276-247-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2740-246-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1452-361-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1652-367-0x0000000000400000-0x000000000046B000-memory.dmp upx \Users\Admin\5eaj.exe upx behavioral1/memory/2464-450-0x0000000000400000-0x0000000000B19000-memory.dmp upx behavioral1/memory/2464-571-0x0000000000400000-0x0000000000B19000-memory.dmp upx -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 53 IoCs
Processes:
goepah.exeMDdyAsuPL1.exe3eaj.exe5eaj.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /A" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /G" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /Z" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /y" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /W" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /f" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /g" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /j" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /v" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /k" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /i" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /B" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /L" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /K" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /t" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /Y" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /V" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /h" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /p" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /N" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /x" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /M" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /S" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /O" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /X" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /T" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /d" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /b" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /Q" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /w" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /c" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /C" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /U" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /C" MDdyAsuPL1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /m" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /q" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /P" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /l" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /J" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /s" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /z" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /R" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /e" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /u" goepah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\378.exe = "C:\\Program Files (x86)\\LP\\C4A7\\378.exe" 3eaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /o" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /n" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /I" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /E" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /F" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Init = "\"C:\\Users\\Admin\\AppData\\Roaming\\xiajorobvup23z3e3isvdcbzy2zsz2yb2\\svcnost.exe\"" 5eaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /H" goepah.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\goepah = "C:\\Users\\Admin\\goepah.exe /D" goepah.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2eaj.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2eaj.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 2eaj.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
2eaj.exe4eaj.exedescription pid process target process PID 2808 set thread context of 2476 2808 2eaj.exe 2eaj.exe PID 2808 set thread context of 2688 2808 2eaj.exe 2eaj.exe PID 2808 set thread context of 2868 2808 2eaj.exe 2eaj.exe PID 2808 set thread context of 2740 2808 2eaj.exe 2eaj.exe PID 2808 set thread context of 500 2808 2eaj.exe 2eaj.exe PID 1836 set thread context of 1620 1836 4eaj.exe cmd.exe -
Drops file in Program Files directory 3 IoCs
Processes:
3eaj.exedescription ioc process File created C:\Program Files (x86)\LP\C4A7\378.exe 3eaj.exe File opened for modification C:\Program Files (x86)\LP\C4A7\378.exe 3eaj.exe File opened for modification C:\Program Files (x86)\LP\C4A7\CA80.tmp 3eaj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1548 2688 WerFault.exe 2eaj.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 2576 tasklist.exe 2352 tasklist.exe -
Modifies registry class 8 IoCs
Processes:
explorer.exe4eaj.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \registry\machine\Software\Classes\Interface\{1e7ba21f-f92a-02a3-0350-4ca985f11bff} 4eaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1e7ba21f-f92a-02a3-0350-4ca985f11bff}\u = "188" 4eaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1e7ba21f-f92a-02a3-0350-4ca985f11bff}\cid = "4465854178128173385" 4eaj.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MDdyAsuPL1.exegoepah.exe2eaj.exe3eaj.exe4eaj.exeXpid process 1616 MDdyAsuPL1.exe 1616 MDdyAsuPL1.exe 2796 goepah.exe 2796 goepah.exe 2868 2eaj.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2868 2eaj.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 1452 3eaj.exe 1452 3eaj.exe 1452 3eaj.exe 1452 3eaj.exe 1452 3eaj.exe 1452 3eaj.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 1836 4eaj.exe 1836 4eaj.exe 1836 4eaj.exe 2796 goepah.exe 1836 4eaj.exe 1600 X 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 2796 goepah.exe 1452 3eaj.exe 1452 3eaj.exe 1452 3eaj.exe 1452 3eaj.exe 1452 3eaj.exe 1452 3eaj.exe 1452 3eaj.exe 1452 3eaj.exe 2796 goepah.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
tasklist.exemsiexec.exe4eaj.exeexplorer.exetasklist.exedescription pid process Token: SeDebugPrivilege 2576 tasklist.exe Token: SeRestorePrivilege 684 msiexec.exe Token: SeTakeOwnershipPrivilege 684 msiexec.exe Token: SeSecurityPrivilege 684 msiexec.exe Token: SeDebugPrivilege 1836 4eaj.exe Token: SeDebugPrivilege 1836 4eaj.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeShutdownPrivilege 312 explorer.exe Token: SeDebugPrivilege 2352 tasklist.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
explorer.exepid process 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
explorer.exepid process 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe 312 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
e1c0ffe29210812f126d7d326a73cf48.exeMDdyAsuPL1.exegoepah.exe2eaj.exe2eaj.exe2eaj.exepid process 832 e1c0ffe29210812f126d7d326a73cf48.exe 1616 MDdyAsuPL1.exe 2796 goepah.exe 2808 2eaj.exe 2476 2eaj.exe 2740 2eaj.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
csrss.exepid process 336 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e1c0ffe29210812f126d7d326a73cf48.exeMDdyAsuPL1.execmd.exe2eaj.exegoepah.exe2eaj.exedescription pid process target process PID 832 wrote to memory of 1616 832 e1c0ffe29210812f126d7d326a73cf48.exe MDdyAsuPL1.exe PID 832 wrote to memory of 1616 832 e1c0ffe29210812f126d7d326a73cf48.exe MDdyAsuPL1.exe PID 832 wrote to memory of 1616 832 e1c0ffe29210812f126d7d326a73cf48.exe MDdyAsuPL1.exe PID 832 wrote to memory of 1616 832 e1c0ffe29210812f126d7d326a73cf48.exe MDdyAsuPL1.exe PID 1616 wrote to memory of 2796 1616 MDdyAsuPL1.exe goepah.exe PID 1616 wrote to memory of 2796 1616 MDdyAsuPL1.exe goepah.exe PID 1616 wrote to memory of 2796 1616 MDdyAsuPL1.exe goepah.exe PID 1616 wrote to memory of 2796 1616 MDdyAsuPL1.exe goepah.exe PID 1616 wrote to memory of 2648 1616 MDdyAsuPL1.exe cmd.exe PID 1616 wrote to memory of 2648 1616 MDdyAsuPL1.exe cmd.exe PID 1616 wrote to memory of 2648 1616 MDdyAsuPL1.exe cmd.exe PID 1616 wrote to memory of 2648 1616 MDdyAsuPL1.exe cmd.exe PID 832 wrote to memory of 2808 832 e1c0ffe29210812f126d7d326a73cf48.exe 2eaj.exe PID 832 wrote to memory of 2808 832 e1c0ffe29210812f126d7d326a73cf48.exe 2eaj.exe PID 832 wrote to memory of 2808 832 e1c0ffe29210812f126d7d326a73cf48.exe 2eaj.exe PID 832 wrote to memory of 2808 832 e1c0ffe29210812f126d7d326a73cf48.exe 2eaj.exe PID 2648 wrote to memory of 2576 2648 cmd.exe tasklist.exe PID 2648 wrote to memory of 2576 2648 cmd.exe tasklist.exe PID 2648 wrote to memory of 2576 2648 cmd.exe tasklist.exe PID 2648 wrote to memory of 2576 2648 cmd.exe tasklist.exe PID 2808 wrote to memory of 2476 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2476 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2476 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2476 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2476 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2476 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2476 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2476 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2688 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2688 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2688 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2688 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2688 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2688 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2688 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2688 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2868 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2868 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2868 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2868 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2868 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2868 2808 2eaj.exe 2eaj.exe PID 2796 wrote to memory of 2576 2796 goepah.exe tasklist.exe PID 2796 wrote to memory of 2576 2796 goepah.exe tasklist.exe PID 2808 wrote to memory of 2868 2808 2eaj.exe 2eaj.exe PID 2688 wrote to memory of 1548 2688 2eaj.exe WerFault.exe PID 2688 wrote to memory of 1548 2688 2eaj.exe WerFault.exe PID 2688 wrote to memory of 1548 2688 2eaj.exe WerFault.exe PID 2688 wrote to memory of 1548 2688 2eaj.exe WerFault.exe PID 2808 wrote to memory of 2868 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2740 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2740 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2740 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2740 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2740 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2740 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2740 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 2740 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 500 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 500 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 500 2808 2eaj.exe 2eaj.exe PID 2808 wrote to memory of 500 2808 2eaj.exe 2eaj.exe PID 2796 wrote to memory of 2576 2796 goepah.exe tasklist.exe PID 2796 wrote to memory of 2576 2796 goepah.exe tasklist.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
3eaj.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 3eaj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 3eaj.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
-
C:\Users\Admin\AppData\Local\Temp\e1c0ffe29210812f126d7d326a73cf48.exe"C:\Users\Admin\AppData\Local\Temp\e1c0ffe29210812f126d7d326a73cf48.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\MDdyAsuPL1.exeC:\Users\Admin\MDdyAsuPL1.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\goepah.exe"C:\Users\Admin\goepah.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del MDdyAsuPL1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\2eaj.exeC:\Users\Admin\2eaj.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\2eaj.exe"C:\Users\Admin\2eaj.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\2eaj.exe"C:\Users\Admin\2eaj.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 885⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\2eaj.exe"C:\Users\Admin\2eaj.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\2eaj.exe"C:\Users\Admin\2eaj.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\2eaj.exe"C:\Users\Admin\2eaj.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\3eaj.exeC:\Users\Admin\3eaj.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Users\Admin\3eaj.exeC:\Users\Admin\3eaj.exe startC:\Users\Admin\AppData\Roaming\765AC\BF1C4.exe%C:\Users\Admin\AppData\Roaming\765AC4⤵
- Executes dropped EXE
-
C:\Users\Admin\3eaj.exeC:\Users\Admin\3eaj.exe startC:\Program Files (x86)\AC4EB\lvvm.exe%C:\Program Files (x86)\AC4EB4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\LP\C4A7\CA80.tmp"C:\Program Files (x86)\LP\C4A7\CA80.tmp"4⤵
- Executes dropped EXE
-
C:\Users\Admin\4eaj.exeC:\Users\Admin\4eaj.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\e2caafb3\X*0*bc*c2061949*31.193.3.240:534⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
-
C:\Users\Admin\5eaj.exeC:\Users\Admin\5eaj.exe3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del e1c0ffe29210812f126d7d326a73cf48.exe3⤵
- Deletes itself
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Modify Registry
5Hide Artifacts
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\2eaj.exeFilesize
64KB
MD5104e08c2342acbfa309ae161c6316d04
SHA1bd5f77809e446be016e4cf02fed679f7161d2e40
SHA256cfc5ee87c91649f31d23a747b60c15982eb1278625b79252b1fde27fbdc5c836
SHA51262bcbb89e8bfff7027b623aab79fb0a66eeb58304c762ab51db05a3fc6f382c617d236036a654dd48f3163010afb199d34f53d46d4852831b25743586c5cc284
-
C:\Users\Admin\AppData\Roaming\765AC\C4EB.65AFilesize
300B
MD589e868f4db8ab80ce08261fec99e705d
SHA196360f4a481332e82e695f94eb6c92b703f020a1
SHA25610bba48b78929bb7c0d40d8f7e64b0e8e7485202ecfbee71fccfb3f64f46523c
SHA512511ae5e1c1239c328fe349dfd72e1480dbe9ad6e5f7df4c740f49b244b5235310b36b7fff1e062b285220a815818ecbbc2b0083f383cda6fd4e10a0bbc88419c
-
C:\Users\Admin\AppData\Roaming\765AC\C4EB.65AFilesize
600B
MD59b0d13a8eca6b235826d3be1b779f596
SHA1d7c71f1501555309a647f0314617ea1e1a34c3a0
SHA2568f9701781c5c2d1e5b09d612e875577318db685721f87a4becc4588eba201615
SHA51221677614a974964915ed6bb63808a4054d34dfaf2a69c2221c3ac8dba0d6b48e96d339d13754e8c17ab6ca81bdae4458a3f9354e02c15844bdda31c79469abfe
-
C:\Users\Admin\AppData\Roaming\765AC\C4EB.65AFilesize
996B
MD51507a06f16bdd4fbaf1238b453dd416a
SHA19782916b088dca4175c2ff3ad99be5c3e8f6c0f9
SHA256575ffc35bbdbbaa11435eb7f1f36e3d08a83269895e17573d273ea51f2b13d2a
SHA51211eb942f7ce6589e5867419704b9aeafbceac9077daa40733250c53e827a17c28a163135dcf599ea90d0de4640f20f7e022b66bfe1949d433a58921bad394def
-
C:\Users\Admin\AppData\Roaming\765AC\C4EB.65AFilesize
1KB
MD5ae8b36f3d9f18aaa94a8e80fea05760a
SHA11400c8f3a5439f99179b224469f369b1fce16b69
SHA25620afb77ec49817176f45014d8cfc9cebeb32d42e99eeac2e92c3cb1ae046a755
SHA5128a307599d49b24d854c78f3c3f9292a301ff014bb1b735cb49b3714826b54b3c67da49925bd74e814ff59017983c5248ce3b9efed5441fb1d1db3e8136e44d04
-
C:\Windows\system32\consrv.dllFilesize
29KB
MD51149c1bd71248a9d170e4568fb08df30
SHA16f77f183d65709901f476c5d6eebaed060a495f9
SHA256c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1
SHA5129e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459
-
\Program Files (x86)\LP\C4A7\CA80.tmpFilesize
100KB
MD58659e2fdb286421874e997e5b1d56ae4
SHA1e3b46183011a317dd80baf92ff9ef1b2da53cc05
SHA25680ceedded02c13a9c4ade2d2242b2bb295bc122b5c7c0f6b3332b0f4fceae2b8
SHA512ae12fd737c0a6f765ebe7a6e312230220e5fb79d42c1478a6f00edf5e67b6dec201aee90d3082b7817726c6501c7c94ce4a8eab72b2a00547bfdc382bbf2a8dc
-
\Users\Admin\2eaj.exeFilesize
132KB
MD5afaca64214594290a9e01c2ab012f00c
SHA1eb1183a49d6da506072d34673f60a623687d2f82
SHA256ca9e0ce2d0cf500ddbad4e9ad42e6e4136e3fa351839ccc654f393e624528f7a
SHA5129f91e78c3a1de2e877e16b3cc862bc512051ccd011868c333dc66487bf1979c5f52406fa3498996e397705050b9c41a65a318d1f72e1e611dd9e2674a794a8b7
-
\Users\Admin\3eaj.exeFilesize
283KB
MD5ab0bbc81ff15b6d295989e4076711c04
SHA199372e440fceb26128534ae44ba6649f4d6f5354
SHA256b936e7056270188775662177402c86da4028950320a772f3d56763e2f935b4e5
SHA512f1fa46e0fc9480766b68f7b3aba23bf41bb66e22d529d1006f5dbbfe467ec0bf490b50067184b38fa76639a76c15e88ca654544ea045bcbfce8c12d3d8347077
-
\Users\Admin\4eaj.exeFilesize
273KB
MD590cfd3294a276c3bc20a9fddf574a8d1
SHA1fc294843a290d0bc223e67f3370009e0bd63e3b8
SHA2565b076d47b571824cd668c26e7fc0a53b54a58547b7cb6a70eccdf44b4ccbda14
SHA512a1ffc3e46490c74e7cd45b919b4668e0f38cbf28b3c3b81a25c68233cd68b72a5d9444306b9e8ef03fa1739d441c7f6504a36aabc2c53a7025b3c6260adc1aeb
-
\Users\Admin\5eaj.exeFilesize
121KB
MD56735cacc68031001bcf6459daa770b42
SHA178fc873eee60454534d7f39279d53d9bd9780c77
SHA256b1a7250c0fc8caa1a26ca2ebf18507ba4dcc564149ccfa81ed07e4fe2fbed026
SHA512ef092414d0b7f51ec8ec697148dba5656ba13987f2b7f746bda77267320dbbfdc0504e51699becbe30162ee0dd102cea80ab689f74221a2c6a50e1912ab82f08
-
\Users\Admin\AppData\Local\e2caafb3\XFilesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
\Users\Admin\MDdyAsuPL1.exeFilesize
256KB
MD5601683a024c1e27dd62d33de59536641
SHA14584d66af41c4f77a6e1b7df3dcd3e78217ad270
SHA25611ba7731f1b9b48116167234553254116e86f06091b0bbd7eaf0cbea4c2df049
SHA512b6ee2b371198d5a70124444596fb28831ec6b2f06910e0f772852f7d80ad2974373aead6f9597c61a89bd99496ca33a838030e458265f6ddea4920ffb0472008
-
\Users\Admin\goepah.exeFilesize
256KB
MD563b3b261615cef6ad4a4e2e1b6a792b3
SHA12bbefc48eec8f30004c301d353d28943b8708624
SHA256e0879373fd54664bbd08db8fc54d429dfb036297382b8ca8ca42742cee68f76c
SHA512e7e54b17bcc14118666fcfc1a21ffd51024c63d60b2fc4b603e55a0d49f7447ab6fa9146c24abc55063ad6eb434eaab068299a67f34d981470a87fdcbc2ad92c
-
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}Filesize
2KB
MD5a5d7eac6c01a44b6a6256612f4b57ca3
SHA134197d3d33960563f01cd4fbc860af205e891de4
SHA256b205656391dba5728e73ba32074253a1da407794ebd3c192aacf22d73764e637
SHA512bd31f51eb92f9a08e0e5b96f2a28979115630a2776040f22c9cf46c1477bc92845a236b1e8a244a959c03a8f092da9be451f697ad892c8bf48a73a87410da582
-
memory/312-551-0x0000000004460000-0x0000000004461000-memory.dmpFilesize
4KB
-
memory/312-585-0x0000000004460000-0x0000000004461000-memory.dmpFilesize
4KB
-
memory/336-368-0x00000000025E0000-0x00000000025E2000-memory.dmpFilesize
8KB
-
memory/336-160-0x00000000025E0000-0x00000000025E2000-memory.dmpFilesize
8KB
-
memory/336-171-0x0000000000C30000-0x0000000000C3B000-memory.dmpFilesize
44KB
-
memory/832-449-0x0000000002980000-0x0000000003099000-memory.dmpFilesize
7.1MB
-
memory/832-448-0x0000000002980000-0x0000000003099000-memory.dmpFilesize
7.1MB
-
memory/1208-173-0x0000000002D60000-0x0000000002D6B000-memory.dmpFilesize
44KB
-
memory/1208-172-0x0000000000C30000-0x0000000000C3B000-memory.dmpFilesize
44KB
-
memory/1208-371-0x0000000002D60000-0x0000000002D6B000-memory.dmpFilesize
44KB
-
memory/1208-145-0x00000000025E0000-0x00000000025E2000-memory.dmpFilesize
8KB
-
memory/1208-141-0x00000000025F0000-0x00000000025F6000-memory.dmpFilesize
24KB
-
memory/1208-137-0x00000000025F0000-0x00000000025F6000-memory.dmpFilesize
24KB
-
memory/1452-361-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1452-362-0x00000000002D0000-0x00000000003D0000-memory.dmpFilesize
1024KB
-
memory/1452-124-0x00000000002D0000-0x00000000003D0000-memory.dmpFilesize
1024KB
-
memory/1452-123-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1616-28-0x0000000003830000-0x00000000042EA000-memory.dmpFilesize
10.7MB
-
memory/1652-367-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1836-363-0x0000000030670000-0x00000000306BF000-memory.dmpFilesize
316KB
-
memory/1836-364-0x0000000000370000-0x0000000000470000-memory.dmpFilesize
1024KB
-
memory/1836-438-0x0000000030670000-0x00000000306BF000-memory.dmpFilesize
316KB
-
memory/1836-135-0x0000000030670000-0x00000000306BF000-memory.dmpFilesize
316KB
-
memory/1836-136-0x0000000000370000-0x0000000000470000-memory.dmpFilesize
1024KB
-
memory/2276-247-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2464-450-0x0000000000400000-0x0000000000B19000-memory.dmpFilesize
7.1MB
-
memory/2464-571-0x0000000000400000-0x0000000000B19000-memory.dmpFilesize
7.1MB
-
memory/2464-451-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2472-580-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2472-577-0x0000000000590000-0x0000000000690000-memory.dmpFilesize
1024KB
-
memory/2472-576-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2476-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2476-56-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2476-53-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2476-120-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2476-57-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2476-43-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2476-41-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2476-47-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2476-39-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2688-69-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2688-50-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2688-71-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2688-63-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2688-58-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2688-73-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2688-52-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2740-92-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2740-94-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2740-106-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2740-107-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2740-102-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2740-98-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2740-246-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2868-87-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/2868-68-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/2868-66-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/2868-77-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/2868-86-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/2868-74-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/2868-88-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/2868-90-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB