Overview
overview
10Static
static
3New Text D...od.exe
windows7-x64
10New Text D...od.exe
windows10-1703-x64
10New Text D...od.exe
windows10-2004-x64
10New Text D...od.exe
windows11-21h2-x64
10New Text D...od.exe
windows7-x64
10New Text D...od.exe
windows10-1703-x64
10New Text D...od.exe
windows10-2004-x64
10New Text D...od.exe
windows11-21h2-x64
10Resubmissions
09-04-2024 07:01
240409-htps3scd2w 1009-04-2024 07:01
240409-htf6yacc9x 1009-04-2024 07:00
240409-hs6p7scc81 1009-04-2024 07:00
240409-hss44scc7z 1007-03-2024 22:29
240307-2eh7jagg41 10Analysis
-
max time kernel
600s -
max time network
602s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
09-04-2024 07:00
Static task
static1
Behavioral task
behavioral1
Sample
New Text Document mod.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
New Text Document mod.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
New Text Document mod.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
New Text Document mod.exe
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
New Text Document mod.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
New Text Document mod.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
New Text Document mod.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
New Text Document mod.exe
Resource
win11-20240221-en
General
-
Target
New Text Document mod.exe
-
Size
8KB
-
MD5
69994ff2f00eeca9335ccd502198e05b
-
SHA1
b13a15a5bea65b711b835ce8eccd2a699a99cead
-
SHA256
2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
-
SHA512
ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
-
SSDEEP
96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
Malware Config
Extracted
redline
6077866846
https://pastebin.com/raw/KE5Mft0T
Extracted
metasploit
metasploit_stager
91.92.247.21:8405
Extracted
xworm
94.156.8.213:58002
-
Install_directory
%Public%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\svchost.exe family_xworm behavioral4/memory/2972-488-0x00000000001F0000-0x0000000000206000-memory.dmp family_xworm -
Detect ZGRat V1 32 IoCs
Processes:
resource yara_rule behavioral4/memory/1920-142-0x00000233F30A0000-0x00000233F3316000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-143-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-144-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-146-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-148-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-150-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-154-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-159-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-167-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-170-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-175-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-188-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-190-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-192-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-197-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-199-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-201-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-203-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-205-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-209-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-219-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-223-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-226-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-229-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-233-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-238-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-243-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-248-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-252-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-256-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-258-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 behavioral4/memory/1920-260-0x00000233F30A0000-0x00000233F3311000-memory.dmp family_zgrat_v1 -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/3396-43-0x0000000001150000-0x0000000001172000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
mQxBvlTA.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ mQxBvlTA.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mQxBvlTA.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mQxBvlTA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion mQxBvlTA.exe -
Executes dropped EXE 30 IoCs
Processes:
mQxBvlTA.exexIPJVPDq.exeXMHHPYeR.execrypted6077866846MVYQY.exei1gcbW1E.exedisable-defender.exepclient.exeresponsibilitylead.exeMStore.exeProps.exewininit.exe1234.exeISetup8.exetest2.exeTemp.exeu2z4.0.exe1111.exeISetup2.exeu2z4.1.exeTester.exesvchost.exeu2o0.0.exe555.exeu2o0.1.exeDocument.exeresponsiibilitylead.exeDocument.exesvchost.exemsdtc.exemsdtc.exepid process 3724 mQxBvlTA.exe 3760 xIPJVPDq.exe 3828 XMHHPYeR.exe 3396 crypted6077866846MVYQY.exe 1148 i1gcbW1E.exe 4052 disable-defender.exe 2968 pclient.exe 1920 responsibilitylead.exe 2264 MStore.exe 3148 Props.exe 4456 wininit.exe 3412 1234.exe 3856 ISetup8.exe 1092 test2.exe 3540 Temp.exe 3068 u2z4.0.exe 3140 1111.exe 3456 ISetup2.exe 1004 u2z4.1.exe 2236 Tester.exe 2972 svchost.exe 2004 u2o0.0.exe 2892 555.exe 3176 u2o0.1.exe 1704 Document.exe 3732 responsiibilitylead.exe 696 Document.exe 1768 svchost.exe 960 msdtc.exe 2692 msdtc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe themida behavioral4/memory/3724-59-0x0000000000F80000-0x000000000209C000-memory.dmp themida behavioral4/memory/3724-61-0x0000000000F80000-0x000000000209C000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
pclient.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" pclient.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
mQxBvlTA.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mQxBvlTA.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
Processes:
flow ioc 3 raw.githubusercontent.com 3 pastebin.com 6 raw.githubusercontent.com 10 pastebin.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\wininit.exe autoit_exe -
Drops file in System32 directory 1 IoCs
Processes:
MStore.exedescription ioc process File created C:\Windows\SysWOW64\MService.exe MStore.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
mQxBvlTA.exepid process 3724 mQxBvlTA.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Document.exemsdtc.exedescription pid process target process PID 1704 set thread context of 696 1704 Document.exe Document.exe PID 960 set thread context of 2692 960 msdtc.exe msdtc.exe -
Drops file in Windows directory 2 IoCs
Processes:
Tester.exedescription ioc process File opened for modification C:\Windows\svchost.exe Tester.exe File created C:\Windows\svchost.exe Tester.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4676 3856 WerFault.exe ISetup8.exe 3076 3456 WerFault.exe ISetup2.exe 4536 2004 WerFault.exe u2o0.0.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
u2o0.1.exeu2z4.1.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2o0.1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2o0.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2z4.1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2z4.1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2z4.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u2o0.1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
u2z4.0.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 u2z4.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString u2z4.0.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4920 schtasks.exe 2020 schtasks.exe 1036 schtasks.exe 784 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2128 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
xIPJVPDq.exeXMHHPYeR.execrypted6077866846MVYQY.exedisable-defender.exepowershell.exeTemp.exeu2z4.0.exeTester.exesvchost.exepowershell.exepowershell.exeDocument.exepowershell.exepowershell.exepid process 3760 xIPJVPDq.exe 3760 xIPJVPDq.exe 3760 xIPJVPDq.exe 3760 xIPJVPDq.exe 3828 XMHHPYeR.exe 3828 XMHHPYeR.exe 3828 XMHHPYeR.exe 3828 XMHHPYeR.exe 3396 crypted6077866846MVYQY.exe 4052 disable-defender.exe 4052 disable-defender.exe 848 powershell.exe 848 powershell.exe 3396 crypted6077866846MVYQY.exe 3396 crypted6077866846MVYQY.exe 3396 crypted6077866846MVYQY.exe 3396 crypted6077866846MVYQY.exe 3396 crypted6077866846MVYQY.exe 3396 crypted6077866846MVYQY.exe 3396 crypted6077866846MVYQY.exe 3396 crypted6077866846MVYQY.exe 3396 crypted6077866846MVYQY.exe 3396 crypted6077866846MVYQY.exe 3396 crypted6077866846MVYQY.exe 3396 crypted6077866846MVYQY.exe 3540 Temp.exe 3540 Temp.exe 3068 u2z4.0.exe 3068 u2z4.0.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2972 svchost.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 2236 Tester.exe 3176 powershell.exe 3176 powershell.exe 3000 powershell.exe 3000 powershell.exe 1704 Document.exe 1704 Document.exe 1704 Document.exe 1704 Document.exe 1704 Document.exe 1704 Document.exe 1832 powershell.exe 2388 powershell.exe 1704 Document.exe 1832 powershell.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
New Text Document mod.exexIPJVPDq.exeXMHHPYeR.execrypted6077866846MVYQY.exedisable-defender.exeresponsibilitylead.exemQxBvlTA.exepowershell.exeTemp.exeTester.exesvchost.exeresponsiibilitylead.exevssvc.exepowershell.exepowershell.exeDocument.exepowershell.exepowershell.exeDocument.exemsdtc.exepowershell.exepowershell.exemsdtc.exesvchost.exedescription pid process Token: SeDebugPrivilege 5024 New Text Document mod.exe Token: SeDebugPrivilege 3760 xIPJVPDq.exe Token: SeDebugPrivilege 3828 XMHHPYeR.exe Token: SeDebugPrivilege 3396 crypted6077866846MVYQY.exe Token: SeDebugPrivilege 4052 disable-defender.exe Token: SeImpersonatePrivilege 4052 disable-defender.exe Token: SeDebugPrivilege 1920 responsibilitylead.exe Token: SeDebugPrivilege 3724 mQxBvlTA.exe Token: SeDebugPrivilege 848 powershell.exe Token: SeDebugPrivilege 3540 Temp.exe Token: SeImpersonatePrivilege 3540 Temp.exe Token: SeDebugPrivilege 2236 Tester.exe Token: SeDebugPrivilege 2972 svchost.exe Token: SeDebugPrivilege 2972 svchost.exe Token: SeDebugPrivilege 3732 responsiibilitylead.exe Token: SeBackupPrivilege 2896 vssvc.exe Token: SeRestorePrivilege 2896 vssvc.exe Token: SeAuditPrivilege 2896 vssvc.exe Token: SeDebugPrivilege 3176 powershell.exe Token: SeDebugPrivilege 3000 powershell.exe Token: SeDebugPrivilege 1704 Document.exe Token: SeDebugPrivilege 1832 powershell.exe Token: SeDebugPrivilege 2388 powershell.exe Token: SeDebugPrivilege 696 Document.exe Token: SeDebugPrivilege 960 msdtc.exe Token: SeDebugPrivilege 444 powershell.exe Token: SeDebugPrivilege 1696 powershell.exe Token: SeDebugPrivilege 2692 msdtc.exe Token: SeDebugPrivilege 1768 svchost.exe Token: SeDebugPrivilege 1768 svchost.exe Token: SeDebugPrivilege 1768 svchost.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
wininit.exeu2z4.1.exepid process 4456 wininit.exe 4456 wininit.exe 1004 u2z4.1.exe 1004 u2z4.1.exe 1004 u2z4.1.exe 1004 u2z4.1.exe 1004 u2z4.1.exe 1004 u2z4.1.exe 1004 u2z4.1.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
wininit.exeu2z4.1.exepid process 4456 wininit.exe 4456 wininit.exe 1004 u2z4.1.exe 1004 u2z4.1.exe 1004 u2z4.1.exe 1004 u2z4.1.exe 1004 u2z4.1.exe 1004 u2z4.1.exe 1004 u2z4.1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
svchost.exesvchost.exepid process 2972 svchost.exe 1768 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
New Text Document mod.exexIPJVPDq.exepclient.exeMStore.execmd.exeISetup8.exeISetup2.exedescription pid process target process PID 5024 wrote to memory of 3724 5024 New Text Document mod.exe mQxBvlTA.exe PID 5024 wrote to memory of 3724 5024 New Text Document mod.exe mQxBvlTA.exe PID 5024 wrote to memory of 3724 5024 New Text Document mod.exe mQxBvlTA.exe PID 5024 wrote to memory of 3760 5024 New Text Document mod.exe xIPJVPDq.exe PID 5024 wrote to memory of 3760 5024 New Text Document mod.exe xIPJVPDq.exe PID 5024 wrote to memory of 3760 5024 New Text Document mod.exe xIPJVPDq.exe PID 3760 wrote to memory of 3828 3760 xIPJVPDq.exe XMHHPYeR.exe PID 3760 wrote to memory of 3828 3760 xIPJVPDq.exe XMHHPYeR.exe PID 5024 wrote to memory of 3396 5024 New Text Document mod.exe crypted6077866846MVYQY.exe PID 5024 wrote to memory of 3396 5024 New Text Document mod.exe crypted6077866846MVYQY.exe PID 5024 wrote to memory of 3396 5024 New Text Document mod.exe crypted6077866846MVYQY.exe PID 5024 wrote to memory of 1148 5024 New Text Document mod.exe i1gcbW1E.exe PID 5024 wrote to memory of 1148 5024 New Text Document mod.exe i1gcbW1E.exe PID 5024 wrote to memory of 4052 5024 New Text Document mod.exe disable-defender.exe PID 5024 wrote to memory of 4052 5024 New Text Document mod.exe disable-defender.exe PID 5024 wrote to memory of 2968 5024 New Text Document mod.exe pclient.exe PID 5024 wrote to memory of 2968 5024 New Text Document mod.exe pclient.exe PID 2968 wrote to memory of 1920 2968 pclient.exe responsibilitylead.exe PID 2968 wrote to memory of 1920 2968 pclient.exe responsibilitylead.exe PID 5024 wrote to memory of 2264 5024 New Text Document mod.exe MStore.exe PID 5024 wrote to memory of 2264 5024 New Text Document mod.exe MStore.exe PID 5024 wrote to memory of 3148 5024 New Text Document mod.exe Props.exe PID 5024 wrote to memory of 3148 5024 New Text Document mod.exe Props.exe PID 2264 wrote to memory of 3092 2264 MStore.exe cmd.exe PID 2264 wrote to memory of 3092 2264 MStore.exe cmd.exe PID 3092 wrote to memory of 848 3092 cmd.exe powershell.exe PID 3092 wrote to memory of 848 3092 cmd.exe powershell.exe PID 5024 wrote to memory of 4456 5024 New Text Document mod.exe wininit.exe PID 5024 wrote to memory of 4456 5024 New Text Document mod.exe wininit.exe PID 5024 wrote to memory of 4456 5024 New Text Document mod.exe wininit.exe PID 5024 wrote to memory of 3412 5024 New Text Document mod.exe 1234.exe PID 5024 wrote to memory of 3412 5024 New Text Document mod.exe 1234.exe PID 5024 wrote to memory of 3412 5024 New Text Document mod.exe 1234.exe PID 5024 wrote to memory of 3856 5024 New Text Document mod.exe ISetup8.exe PID 5024 wrote to memory of 3856 5024 New Text Document mod.exe ISetup8.exe PID 5024 wrote to memory of 3856 5024 New Text Document mod.exe ISetup8.exe PID 5024 wrote to memory of 1092 5024 New Text Document mod.exe test2.exe PID 5024 wrote to memory of 1092 5024 New Text Document mod.exe test2.exe PID 2264 wrote to memory of 3540 2264 MStore.exe Temp.exe PID 2264 wrote to memory of 3540 2264 MStore.exe Temp.exe PID 3856 wrote to memory of 3068 3856 ISetup8.exe u2z4.0.exe PID 3856 wrote to memory of 3068 3856 ISetup8.exe u2z4.0.exe PID 3856 wrote to memory of 3068 3856 ISetup8.exe u2z4.0.exe PID 5024 wrote to memory of 3140 5024 New Text Document mod.exe 1111.exe PID 5024 wrote to memory of 3140 5024 New Text Document mod.exe 1111.exe PID 5024 wrote to memory of 3456 5024 New Text Document mod.exe ISetup2.exe PID 5024 wrote to memory of 3456 5024 New Text Document mod.exe ISetup2.exe PID 5024 wrote to memory of 3456 5024 New Text Document mod.exe ISetup2.exe PID 3856 wrote to memory of 1004 3856 ISetup8.exe u2z4.1.exe PID 3856 wrote to memory of 1004 3856 ISetup8.exe u2z4.1.exe PID 3856 wrote to memory of 1004 3856 ISetup8.exe u2z4.1.exe PID 5024 wrote to memory of 2236 5024 New Text Document mod.exe Tester.exe PID 5024 wrote to memory of 2236 5024 New Text Document mod.exe Tester.exe PID 5024 wrote to memory of 2972 5024 New Text Document mod.exe svchost.exe PID 5024 wrote to memory of 2972 5024 New Text Document mod.exe svchost.exe PID 3456 wrote to memory of 2004 3456 ISetup2.exe u2o0.0.exe PID 3456 wrote to memory of 2004 3456 ISetup2.exe u2o0.0.exe PID 3456 wrote to memory of 2004 3456 ISetup2.exe u2o0.0.exe PID 5024 wrote to memory of 2892 5024 New Text Document mod.exe 555.exe PID 5024 wrote to memory of 2892 5024 New Text Document mod.exe 555.exe PID 3456 wrote to memory of 3176 3456 ISetup2.exe powershell.exe PID 3456 wrote to memory of 3176 3456 ISetup2.exe powershell.exe PID 3456 wrote to memory of 3176 3456 ISetup2.exe powershell.exe PID 5024 wrote to memory of 1704 5024 New Text Document mod.exe Document.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\XMHHPYeR.exe"C:\Users\Admin\AppData\Local\Temp\XMHHPYeR.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"2⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe3⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionExtension .exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:848 -
C:\Windows\Temp\Temp.exe"C:\Windows\Temp\Temp.exe" -s3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\a\Props.exe"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"2⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\a\1234.exe"C:\Users\Admin\AppData\Local\Temp\a\1234.exe"2⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\u2z4.0.exe"C:\Users\Admin\AppData\Local\Temp\u2z4.0.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\u2z4.1.exe"C:\Users\Admin\AppData\Local\Temp\u2z4.1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 10483⤵
- Program crash
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\a\test2.exe"C:\Users\Admin\AppData\Local\Temp\a\test2.exe"2⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\a\1111.exe"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"2⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\u2o0.0.exe"C:\Users\Admin\AppData\Local\Temp\u2o0.0.exe"3⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 13764⤵
- Program crash
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\u2o0.1.exe"C:\Users\Admin\AppData\Local\Temp\u2o0.1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3176 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 14363⤵
- Program crash
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3176 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2972 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"3⤵
- Creates scheduled task(s)
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\a\555.exe"C:\Users\Admin\AppData\Local\Temp\a\555.exe"2⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB.tmp"3⤵
- Creates scheduled task(s)
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:696 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit4⤵PID:388
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'5⤵
- Creates scheduled task(s)
PID:1036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1671.tmp.bat""4⤵PID:292
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
PID:2128 -
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:960 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:444 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7896.tmp"6⤵
- Creates scheduled task(s)
PID:784 -
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3856 -ip 38561⤵PID:2132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3456 -ip 34561⤵PID:2820
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2004 -ip 20041⤵PID:4824
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1768
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Document.exe.logFilesize
1KB
MD57e1ed0055c3eaa0bbc4a29ec1ef15a6a
SHA1765b954c1adbb6a6ecc4fe912fdaa6d0fba0ae7d
SHA2564c17576f64dea465c45a50573ee41771f7be9962ab2d07f961af4df5589bdcce
SHA512de7c784c37d18c43820908add88f08ab4864c0ef3f9d158cc2c9d1bab120613cb093dd4bfc5d7ed0c289414956cfe0b213c386f8e6b5753847dec915566297c8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5c0b99945a392821400ce632c8ad35699
SHA1786610bdf649cb2bd6ec76c26453e1d83d1357e3
SHA25668f8371f7488ae60e9a27bdea1f575359cf66c189e0b5a7d48584b3e7722a53d
SHA512644519b27dea9ba43ecdccdcfee957940ef5c27624862261b8b691fcdc2dba93299ec1159086fe3652687bd04e234c401c231b5297b464970d85872346952867
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD521c46061e7e47d53f28382d3b9da372d
SHA15a9d1113fc1743de2a7fc639d60535235c6a27ee
SHA2567809dde39b23825216fc16adc08a47369b44876417d8c0550d3b68eb5d4ce4a0
SHA512e4bed852b5cb2b5a3f73dc3ca95057bd3dcb01a13356dc8644e241e9266d527dffbefeeb102cb45fbccc4fa882981b90345f151b8e78ca1a453737dbde716b2a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeFilesize
6KB
MD5f7930c4859ccd34bd2b80a9995f49926
SHA18b5b95fb51619e20246f90d60f2137da7654fc5e
SHA256163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a
SHA5128f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exeFilesize
6KB
MD5a0c8b99e0780c3e8f8319f5ec3abf9f4
SHA1561a59a4d6af134797b2e2907590efee9e519ca3
SHA2564588ad64c432d7a20ba41949327be873c25f7eaa0cbba71b3435463739510035
SHA51230bd51b731ab989188ae3597f37ba74d56d78287afcb2c2243f657a131618ba6e83d34b82253b6d42efab7a01da0397fb496478628393b4cffca4c907d39f961
-
C:\Users\Admin\AppData\Local\Temp\XMHHPYeR.exeFilesize
5KB
MD56a2c09749219d577535d0338c6cffe06
SHA1576b00c03455a518664308c976097097f691bca4
SHA25675b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c
SHA512cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4uixa4nv.qpr.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exeFilesize
2.8MB
MD5e670bdc7c82eee75a6d3ada6a7c9134e
SHA1b0f0bab6f6e92bc86e86fd7bff93c257a4235859
SHA256a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb
SHA5127384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exeFilesize
1.3MB
MD55e13199a94cf8664e5bfbe2f68d4738e
SHA18cfaa21f68226ae775615f033507b5756f5ccacc
SHA25671b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5
SHA512b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5
-
C:\Users\Admin\AppData\Local\Temp\a\555.exeFilesize
2.7MB
MD57162024dc024bb3311ee1cf81f37a791
SHA1be03705f33a8205f90330814f525e2e53dfb5871
SHA2563e39efae22fcda501f858229af27be129f178c85723d4477ef9be2f80b61a8fd
SHA51294652b8b770fcdd70ee5059b56ce84aee50c46901b6311e2a602cdb4d97b15abd0148ba4e55f225f722d125bf9c3969185bcefaf07f3911a4347d9a0ca8d2d38
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exeFilesize
492KB
MD50eec3b50636ae6d37613e6a2c7617191
SHA1630d5e3b88215d88432db42d2bd295c6d4b55ee8
SHA25632dc8827ff96982401777cd7feb77798660450a3e8960855577e8ace837f8b05
SHA5129a2088cce7ed6da8e2f13f2486925e7565b50a6c527363f0da19ff28910314fb9723496dfe3ddf0a977d1b0c8ff1661f0ae6bc3789332534ad0bea3cbafbdc12
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exeFilesize
413KB
MD5d388d6918f1e8a6a3b34ad993d8159eb
SHA1cf3cd31a4dd6571cc78016c7b0f97f621b1f253d
SHA25627d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645
SHA51254cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exeFilesize
413KB
MD594e9960a45131af61e599acee54d21d6
SHA139b03e050337d4eb127ae5ff5f0868e986bec7ad
SHA2567add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172
SHA512179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exeFilesize
12KB
MD5282c1ebb16ad0edc41389d1e73a74607
SHA1fbcdda121484ea6125827ed4e7b1b00f6a88835d
SHA2567712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc
SHA51294be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exeFilesize
7KB
MD59c938f91a0530150a2b1c4546334570c
SHA1f4ae9acba920744457739fef0205f86443dbdf65
SHA25635a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a
SHA512f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exeFilesize
267KB
MD50803c1aec008e75859877844cfa81492
SHA116924d5802ddf76a2096fcfade0ce06d4c0670bd
SHA256d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3
SHA5129001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exeFilesize
524KB
MD5c8edf453ed433cefb2696bb859e0f782
SHA1e34cf939d6c5a34c7bedfd885249bb7fb15336e5
SHA2560c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0
SHA51261d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exeFilesize
294KB
MD510fc8b2915c43aa16b6a2e2b4529adc5
SHA10c15286457963eb86d61d83642870a3473ef38fe
SHA256feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5
SHA512421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exeFilesize
2.3MB
MD5262a7eb58a01d1aab21b24292c181cd3
SHA1535312b7048fb90be981e04ea759c5ad8aaf6eda
SHA256107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6
SHA512358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exeFilesize
7.7MB
MD57aca152e7040f43dae201cfe01ce37b4
SHA183eb2fa2d400f96b241e61f81e4d80317eea0200
SHA256ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50
SHA51284415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exeFilesize
157KB
MD55790d1417f8f00bd7ec6fb7011c79d9c
SHA136076ed9457c45d94e664ea291eb01e5c70d084b
SHA256ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82
SHA512b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeFilesize
66KB
MD500135a86ab829fc2d4678179d7a6e70f
SHA1ef75c259865d7685d566b6e25b7a20d134952555
SHA2560b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89
SHA512011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exeFilesize
2.7MB
MD55347852b24409aed42423f0118637f03
SHA16c7947428231ab857ee8c9dab7a7e62fdeed024b
SHA256a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131
SHA5120a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exeFilesize
1.3MB
MD5ddee86f4db0d3b8010110445b0545526
SHA1b41380b50d17dd679f85a224771398b81966bb9e
SHA2560d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5
SHA5124271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exeFilesize
13KB
MD50c550ce9bb3efa8c3ce80a507cadfffa
SHA16559cb9db9c13147da5139cc3b8d9c60b914b667
SHA2560dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912
SHA512c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
931B
MD5b2ffcf8d257ecf3afa7e6e8b69fa6b38
SHA1678163d841198ee010b59bd309a50d6aea1dd72e
SHA2562ce91b8b20b5d3dd49aa9dcd480ff8001e94de6c7412e1cab1d792d31d9aa7ef
SHA51286102ab44d57384fbb8cbc4e00bec4be3b9df9b53fa1c392a10d6f4af2b217bc10e1c573a78dcd47ad5a4ccd41018d9e71115a438000ea338dd0028ea2b499d1
-
C:\Users\Admin\AppData\Local\Temp\tmp1671.tmp.batFilesize
149B
MD568c80e40266c6871c9f060d10ef7a4f6
SHA1b191357f82751ab54020f7769402a32e5f4cde81
SHA2561d7e1545d9ba22f9c3765b8302c0dedc167d1f7ebca0116acaa8be67a146c37b
SHA51263af220201d2522712807f0a90a5676096af15bb3030af902a52c8702e00aae18278cc810c9626d4a5d5b2c7439c8cf23d0aada4c47d7e394c4e45f58dbdfdd7
-
C:\Users\Admin\AppData\Local\Temp\tmpB.tmpFilesize
1KB
MD56f560c85ba390db4b53ea79a0ae53e5c
SHA197990f5b33a8bb094774aa63fe33f0efcbae227d
SHA25658e726f0eb6d70cbf592f677736c9c54b8ad3aa8e83ff328c8e7a4e78821d9ed
SHA512c0dfd27dd73bb19af59c58b668cdc3ee79176d21f9aeebd627fbc5b348527f2323aa2b4f47c7a9c8716373b5e5d8ee4508624e56353130caa30c5af3cc25bbcf
-
C:\Users\Admin\AppData\Local\Temp\u2z4.0.exeFilesize
271KB
MD5b95747cad90e982d44da8fd74f50b9a6
SHA1d7f267d2042f6b67f63542395ff6a5a1b3ba1250
SHA2567b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153
SHA512615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c
-
C:\Users\Admin\AppData\Local\Temp\u2z4.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
memory/848-119-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmpFilesize
10.8MB
-
memory/848-130-0x00000234B7F30000-0x00000234B7F40000-memory.dmpFilesize
64KB
-
memory/848-129-0x00000234B7F30000-0x00000234B7F40000-memory.dmpFilesize
64KB
-
memory/848-128-0x000002349F970000-0x000002349F992000-memory.dmpFilesize
136KB
-
memory/848-133-0x00000234B7F30000-0x00000234B7F40000-memory.dmpFilesize
64KB
-
memory/848-139-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmpFilesize
10.8MB
-
memory/1004-466-0x0000000002520000-0x0000000002521000-memory.dmpFilesize
4KB
-
memory/1920-256-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-167-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-238-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-233-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-111-0x00000233F2F40000-0x00000233F2F50000-memory.dmpFilesize
64KB
-
memory/1920-94-0x00000233F09E0000-0x00000233F09E6000-memory.dmpFilesize
24KB
-
memory/1920-229-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-226-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-105-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmpFilesize
10.8MB
-
memory/1920-421-0x00000233F2F40000-0x00000233F2F50000-memory.dmpFilesize
64KB
-
memory/1920-223-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-260-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-258-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-219-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-142-0x00000233F30A0000-0x00000233F3316000-memory.dmpFilesize
2.5MB
-
memory/1920-143-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-144-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-146-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-148-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-150-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-154-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-209-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-159-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-381-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmpFilesize
10.8MB
-
memory/1920-243-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-170-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-252-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-175-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-188-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-190-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-248-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-192-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-197-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-199-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-201-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-203-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/1920-205-0x00000233F30A0000-0x00000233F3311000-memory.dmpFilesize
2.4MB
-
memory/2236-463-0x000000001B0D0000-0x000000001B0E0000-memory.dmpFilesize
64KB
-
memory/2236-455-0x00000000002A0000-0x00000000002EA000-memory.dmpFilesize
296KB
-
memory/2236-460-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmpFilesize
10.8MB
-
memory/2972-488-0x00000000001F0000-0x0000000000206000-memory.dmpFilesize
88KB
-
memory/2972-491-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmpFilesize
10.8MB
-
memory/3068-376-0x0000000002F90000-0x0000000002FB7000-memory.dmpFilesize
156KB
-
memory/3068-374-0x0000000002FC0000-0x00000000030C0000-memory.dmpFilesize
1024KB
-
memory/3068-396-0x0000000000400000-0x0000000002D21000-memory.dmpFilesize
41.1MB
-
memory/3148-115-0x0000000140000000-0x0000000140004278-memory.dmpFilesize
16KB
-
memory/3396-166-0x0000000007370000-0x00000000073E6000-memory.dmpFilesize
472KB
-
memory/3396-264-0x0000000007650000-0x00000000076A0000-memory.dmpFilesize
320KB
-
memory/3396-173-0x0000000007330000-0x000000000734E000-memory.dmpFilesize
120KB
-
memory/3396-43-0x0000000001150000-0x0000000001172000-memory.dmpFilesize
136KB
-
memory/3396-251-0x0000000074620000-0x0000000074DD1000-memory.dmpFilesize
7.7MB
-
memory/3396-55-0x0000000074620000-0x0000000074DD1000-memory.dmpFilesize
7.7MB
-
memory/3396-56-0x0000000005730000-0x0000000005796000-memory.dmpFilesize
408KB
-
memory/3396-60-0x0000000006210000-0x0000000006828000-memory.dmpFilesize
6.1MB
-
memory/3396-141-0x0000000007780000-0x0000000007CAC000-memory.dmpFilesize
5.2MB
-
memory/3396-116-0x0000000006D30000-0x0000000006D6C000-memory.dmpFilesize
240KB
-
memory/3396-62-0x0000000005C90000-0x0000000005CA2000-memory.dmpFilesize
72KB
-
memory/3396-64-0x0000000005DC0000-0x0000000005ECA000-memory.dmpFilesize
1.0MB
-
memory/3396-317-0x0000000074620000-0x0000000074DD1000-memory.dmpFilesize
7.7MB
-
memory/3396-134-0x0000000007080000-0x0000000007242000-memory.dmpFilesize
1.8MB
-
memory/3396-75-0x00000000057E0000-0x00000000057F0000-memory.dmpFilesize
64KB
-
memory/3396-117-0x00000000061C0000-0x000000000620C000-memory.dmpFilesize
304KB
-
memory/3456-422-0x0000000002F80000-0x0000000003080000-memory.dmpFilesize
1024KB
-
memory/3456-448-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/3724-138-0x0000000006BA0000-0x0000000006BB0000-memory.dmpFilesize
64KB
-
memory/3724-61-0x0000000000F80000-0x000000000209C000-memory.dmpFilesize
17.1MB
-
memory/3724-97-0x00000000069E0000-0x00000000069F4000-memory.dmpFilesize
80KB
-
memory/3724-14-0x0000000000F80000-0x000000000209C000-memory.dmpFilesize
17.1MB
-
memory/3724-77-0x0000000000400000-0x000000000054E000-memory.dmpFilesize
1.3MB
-
memory/3724-74-0x0000000006B90000-0x0000000006B9A000-memory.dmpFilesize
40KB
-
memory/3724-131-0x0000000000F80000-0x000000000209C000-memory.dmpFilesize
17.1MB
-
memory/3724-132-0x0000000076470000-0x0000000076560000-memory.dmpFilesize
960KB
-
memory/3724-65-0x0000000006A00000-0x0000000006A92000-memory.dmpFilesize
584KB
-
memory/3724-24-0x0000000077284000-0x0000000077285000-memory.dmpFilesize
4KB
-
memory/3724-28-0x0000000076470000-0x0000000076560000-memory.dmpFilesize
960KB
-
memory/3724-63-0x0000000006FB0000-0x0000000007556000-memory.dmpFilesize
5.6MB
-
memory/3724-140-0x0000000076470000-0x0000000076560000-memory.dmpFilesize
960KB
-
memory/3724-29-0x0000000076470000-0x0000000076560000-memory.dmpFilesize
960KB
-
memory/3724-59-0x0000000000F80000-0x000000000209C000-memory.dmpFilesize
17.1MB
-
memory/3724-34-0x0000000077286000-0x0000000077288000-memory.dmpFilesize
8KB
-
memory/3856-255-0x0000000004A60000-0x0000000004ACC000-memory.dmpFilesize
432KB
-
memory/3856-253-0x0000000002DE0000-0x0000000002EE0000-memory.dmpFilesize
1024KB
-
memory/3856-263-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/4456-187-0x0000000003DE0000-0x0000000003DE4000-memory.dmpFilesize
16KB
-
memory/5024-0-0x0000000000020000-0x0000000000028000-memory.dmpFilesize
32KB
-
memory/5024-109-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmpFilesize
10.8MB
-
memory/5024-118-0x000000001AC30000-0x000000001AC40000-memory.dmpFilesize
64KB
-
memory/5024-2-0x000000001AC30000-0x000000001AC40000-memory.dmpFilesize
64KB
-
memory/5024-1-0x00007FFF5A320000-0x00007FFF5ADE2000-memory.dmpFilesize
10.8MB