Overview
overview
10Static
static
3New Text D...od.exe
windows7-x64
10New Text D...od.exe
windows10-1703-x64
10New Text D...od.exe
windows10-2004-x64
10New Text D...od.exe
windows11-21h2-x64
10New Text D...od.exe
windows7-x64
10New Text D...od.exe
windows10-1703-x64
10New Text D...od.exe
windows10-2004-x64
10New Text D...od.exe
windows11-21h2-x64
10Resubmissions
09-04-2024 07:01
240409-htps3scd2w 1009-04-2024 07:01
240409-htf6yacc9x 1009-04-2024 07:00
240409-hs6p7scc81 1009-04-2024 07:00
240409-hss44scc7z 1007-03-2024 22:29
240307-2eh7jagg41 10Analysis
-
max time kernel
599s -
max time network
583s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
09-04-2024 07:00
Static task
static1
Behavioral task
behavioral1
Sample
New Text Document mod.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
New Text Document mod.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
New Text Document mod.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
New Text Document mod.exe
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
New Text Document mod.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
New Text Document mod.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
New Text Document mod.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
New Text Document mod.exe
Resource
win11-20240221-en
General
-
Target
New Text Document mod.exe
-
Size
8KB
-
MD5
69994ff2f00eeca9335ccd502198e05b
-
SHA1
b13a15a5bea65b711b835ce8eccd2a699a99cead
-
SHA256
2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
-
SHA512
ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
-
SSDEEP
96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
Malware Config
Extracted
redline
6077866846
https://pastebin.com/raw/KE5Mft0T
Extracted
metasploit
metasploit_stager
91.92.247.21:8405
Extracted
xworm
94.156.8.213:58002
-
Install_directory
%Public%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\svchost.exe family_xworm -
Detect ZGRat V1 32 IoCs
Processes:
resource yara_rule behavioral6/memory/4268-140-0x0000020358360000-0x00000203585D6000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-148-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-152-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-161-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-168-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-171-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-173-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-179-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-183-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-185-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-187-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-190-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-192-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-194-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-196-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-198-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-200-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-202-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-207-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-209-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-211-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-213-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-218-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-224-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-222-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-226-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-230-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-232-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-235-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-237-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-242-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 behavioral6/memory/4268-245-0x0000020358360000-0x00000203585D1000-memory.dmp family_zgrat_v1 -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral6/memory/4680-35-0x0000000000B30000-0x0000000000B52000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
mQxBvlTA.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ mQxBvlTA.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mQxBvlTA.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mQxBvlTA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion mQxBvlTA.exe -
Executes dropped EXE 24 IoCs
Processes:
mQxBvlTA.exexIPJVPDq.exehBZGJWkp.execrypted6077866846MVYQY.exei1gcbW1E.exedisable-defender.exepclient.exeresponsibilitylead.exeMStore.exeProps.exewininit.exe1234.exeISetup8.exetest2.exeu360.0.exeTemp.exe1111.exeISetup2.exeu360.1.exeTester.exesvchost.exeDBFHCGCGDA.exeresponsiibilitylead.exesvchost.exepid process 3648 mQxBvlTA.exe 4392 xIPJVPDq.exe 204 hBZGJWkp.exe 4680 crypted6077866846MVYQY.exe 200 i1gcbW1E.exe 3332 disable-defender.exe 4428 pclient.exe 4268 responsibilitylead.exe 4620 MStore.exe 860 Props.exe 3888 wininit.exe 1496 1234.exe 4104 ISetup8.exe 1108 test2.exe 1276 u360.0.exe 4748 Temp.exe 3632 1111.exe 1856 ISetup2.exe 64 u360.1.exe 1568 Tester.exe 428 svchost.exe 1720 DBFHCGCGDA.exe 1056 responsiibilitylead.exe 1768 svchost.exe -
Loads dropped DLL 2 IoCs
Processes:
u360.0.exepid process 1276 u360.0.exe 1276 u360.0.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe themida behavioral6/memory/3648-34-0x00000000009C0000-0x0000000001ADC000-memory.dmp themida behavioral6/memory/3648-38-0x00000000009C0000-0x0000000001ADC000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
pclient.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" pclient.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
mQxBvlTA.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mQxBvlTA.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
Processes:
flow ioc 9 raw.githubusercontent.com 10 raw.githubusercontent.com 16 pastebin.com 17 pastebin.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\wininit.exe autoit_exe -
Drops file in System32 directory 1 IoCs
Processes:
MStore.exedescription ioc process File created C:\Windows\SysWOW64\MService.exe MStore.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
mQxBvlTA.exepid process 3648 mQxBvlTA.exe -
Drops file in Windows directory 2 IoCs
Processes:
Tester.exedescription ioc process File opened for modification C:\Windows\svchost.exe Tester.exe File created C:\Windows\svchost.exe Tester.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
u360.1.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u360.1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u360.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u360.1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
u360.0.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 u360.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString u360.0.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
xIPJVPDq.exehBZGJWkp.execrypted6077866846MVYQY.exedisable-defender.exepowershell.exeTemp.exeu360.0.exeTester.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exei1gcbW1E.exepid process 4392 xIPJVPDq.exe 4392 xIPJVPDq.exe 4392 xIPJVPDq.exe 4392 xIPJVPDq.exe 204 hBZGJWkp.exe 204 hBZGJWkp.exe 204 hBZGJWkp.exe 204 hBZGJWkp.exe 4680 crypted6077866846MVYQY.exe 3332 disable-defender.exe 3332 disable-defender.exe 4656 powershell.exe 4656 powershell.exe 4656 powershell.exe 4680 crypted6077866846MVYQY.exe 4680 crypted6077866846MVYQY.exe 4680 crypted6077866846MVYQY.exe 4680 crypted6077866846MVYQY.exe 4680 crypted6077866846MVYQY.exe 4680 crypted6077866846MVYQY.exe 4680 crypted6077866846MVYQY.exe 4680 crypted6077866846MVYQY.exe 4748 Temp.exe 4748 Temp.exe 1276 u360.0.exe 1276 u360.0.exe 1568 Tester.exe 1568 Tester.exe 1568 Tester.exe 1568 Tester.exe 1568 Tester.exe 1568 Tester.exe 1568 Tester.exe 1568 Tester.exe 1568 Tester.exe 1568 Tester.exe 1276 u360.0.exe 1276 u360.0.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1568 Tester.exe 1568 Tester.exe 200 i1gcbW1E.exe 200 i1gcbW1E.exe 200 i1gcbW1E.exe 200 i1gcbW1E.exe 200 i1gcbW1E.exe 200 i1gcbW1E.exe 200 i1gcbW1E.exe 200 i1gcbW1E.exe 200 i1gcbW1E.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
New Text Document mod.exexIPJVPDq.exehBZGJWkp.execrypted6077866846MVYQY.exemQxBvlTA.exedisable-defender.exeresponsibilitylead.exepowershell.exeTemp.exeTester.exesvchost.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeresponsiibilitylead.exevssvc.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1572 New Text Document mod.exe Token: SeDebugPrivilege 4392 xIPJVPDq.exe Token: SeDebugPrivilege 204 hBZGJWkp.exe Token: SeDebugPrivilege 4680 crypted6077866846MVYQY.exe Token: SeDebugPrivilege 3648 mQxBvlTA.exe Token: SeDebugPrivilege 3332 disable-defender.exe Token: SeImpersonatePrivilege 3332 disable-defender.exe Token: SeDebugPrivilege 4268 responsibilitylead.exe Token: SeDebugPrivilege 4656 powershell.exe Token: SeIncreaseQuotaPrivilege 4656 powershell.exe Token: SeSecurityPrivilege 4656 powershell.exe Token: SeTakeOwnershipPrivilege 4656 powershell.exe Token: SeLoadDriverPrivilege 4656 powershell.exe Token: SeSystemProfilePrivilege 4656 powershell.exe Token: SeSystemtimePrivilege 4656 powershell.exe Token: SeProfSingleProcessPrivilege 4656 powershell.exe Token: SeIncBasePriorityPrivilege 4656 powershell.exe Token: SeCreatePagefilePrivilege 4656 powershell.exe Token: SeBackupPrivilege 4656 powershell.exe Token: SeRestorePrivilege 4656 powershell.exe Token: SeShutdownPrivilege 4656 powershell.exe Token: SeDebugPrivilege 4656 powershell.exe Token: SeSystemEnvironmentPrivilege 4656 powershell.exe Token: SeRemoteShutdownPrivilege 4656 powershell.exe Token: SeUndockPrivilege 4656 powershell.exe Token: SeManageVolumePrivilege 4656 powershell.exe Token: 33 4656 powershell.exe Token: 34 4656 powershell.exe Token: 35 4656 powershell.exe Token: 36 4656 powershell.exe Token: SeDebugPrivilege 4748 Temp.exe Token: SeImpersonatePrivilege 4748 Temp.exe Token: SeDebugPrivilege 1568 Tester.exe Token: SeDebugPrivilege 428 svchost.exe Token: SeDebugPrivilege 1580 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Token: SeDebugPrivilege 1056 responsiibilitylead.exe Token: SeBackupPrivilege 1368 vssvc.exe Token: SeRestorePrivilege 1368 vssvc.exe Token: SeAuditPrivilege 1368 vssvc.exe Token: SeDebugPrivilege 4748 powershell.exe Token: SeIncreaseQuotaPrivilege 4748 powershell.exe Token: SeSecurityPrivilege 4748 powershell.exe Token: SeTakeOwnershipPrivilege 4748 powershell.exe Token: SeLoadDriverPrivilege 4748 powershell.exe Token: SeSystemProfilePrivilege 4748 powershell.exe Token: SeSystemtimePrivilege 4748 powershell.exe Token: SeProfSingleProcessPrivilege 4748 powershell.exe Token: SeIncBasePriorityPrivilege 4748 powershell.exe Token: SeCreatePagefilePrivilege 4748 powershell.exe Token: SeBackupPrivilege 4748 powershell.exe Token: SeRestorePrivilege 4748 powershell.exe Token: SeShutdownPrivilege 4748 powershell.exe Token: SeDebugPrivilege 4748 powershell.exe Token: SeSystemEnvironmentPrivilege 4748 powershell.exe Token: SeRemoteShutdownPrivilege 4748 powershell.exe Token: SeUndockPrivilege 4748 powershell.exe Token: SeManageVolumePrivilege 4748 powershell.exe Token: 33 4748 powershell.exe Token: 34 4748 powershell.exe Token: 35 4748 powershell.exe Token: 36 4748 powershell.exe Token: SeDebugPrivilege 2796 powershell.exe Token: SeIncreaseQuotaPrivilege 2796 powershell.exe Token: SeSecurityPrivilege 2796 powershell.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
wininit.exeu360.1.exepid process 3888 wininit.exe 3888 wininit.exe 64 u360.1.exe 64 u360.1.exe 64 u360.1.exe 64 u360.1.exe 64 u360.1.exe 64 u360.1.exe 64 u360.1.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
wininit.exeu360.1.exepid process 3888 wininit.exe 3888 wininit.exe 64 u360.1.exe 64 u360.1.exe 64 u360.1.exe 64 u360.1.exe 64 u360.1.exe 64 u360.1.exe 64 u360.1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 1768 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
New Text Document mod.exexIPJVPDq.exepclient.exeMStore.execmd.exeISetup8.exeu360.1.exeu360.0.execmd.exeDBFHCGCGDA.exedescription pid process target process PID 1572 wrote to memory of 3648 1572 New Text Document mod.exe mQxBvlTA.exe PID 1572 wrote to memory of 3648 1572 New Text Document mod.exe mQxBvlTA.exe PID 1572 wrote to memory of 3648 1572 New Text Document mod.exe mQxBvlTA.exe PID 1572 wrote to memory of 4392 1572 New Text Document mod.exe xIPJVPDq.exe PID 1572 wrote to memory of 4392 1572 New Text Document mod.exe xIPJVPDq.exe PID 1572 wrote to memory of 4392 1572 New Text Document mod.exe xIPJVPDq.exe PID 4392 wrote to memory of 204 4392 xIPJVPDq.exe hBZGJWkp.exe PID 4392 wrote to memory of 204 4392 xIPJVPDq.exe hBZGJWkp.exe PID 1572 wrote to memory of 4680 1572 New Text Document mod.exe crypted6077866846MVYQY.exe PID 1572 wrote to memory of 4680 1572 New Text Document mod.exe crypted6077866846MVYQY.exe PID 1572 wrote to memory of 4680 1572 New Text Document mod.exe crypted6077866846MVYQY.exe PID 1572 wrote to memory of 200 1572 New Text Document mod.exe i1gcbW1E.exe PID 1572 wrote to memory of 200 1572 New Text Document mod.exe i1gcbW1E.exe PID 1572 wrote to memory of 3332 1572 New Text Document mod.exe disable-defender.exe PID 1572 wrote to memory of 3332 1572 New Text Document mod.exe disable-defender.exe PID 1572 wrote to memory of 4428 1572 New Text Document mod.exe pclient.exe PID 1572 wrote to memory of 4428 1572 New Text Document mod.exe pclient.exe PID 4428 wrote to memory of 4268 4428 pclient.exe responsibilitylead.exe PID 4428 wrote to memory of 4268 4428 pclient.exe responsibilitylead.exe PID 1572 wrote to memory of 4620 1572 New Text Document mod.exe MStore.exe PID 1572 wrote to memory of 4620 1572 New Text Document mod.exe MStore.exe PID 1572 wrote to memory of 860 1572 New Text Document mod.exe Props.exe PID 1572 wrote to memory of 860 1572 New Text Document mod.exe Props.exe PID 4620 wrote to memory of 5008 4620 MStore.exe cmd.exe PID 4620 wrote to memory of 5008 4620 MStore.exe cmd.exe PID 5008 wrote to memory of 4656 5008 cmd.exe powershell.exe PID 5008 wrote to memory of 4656 5008 cmd.exe powershell.exe PID 1572 wrote to memory of 3888 1572 New Text Document mod.exe wininit.exe PID 1572 wrote to memory of 3888 1572 New Text Document mod.exe wininit.exe PID 1572 wrote to memory of 3888 1572 New Text Document mod.exe wininit.exe PID 1572 wrote to memory of 1496 1572 New Text Document mod.exe 1234.exe PID 1572 wrote to memory of 1496 1572 New Text Document mod.exe 1234.exe PID 1572 wrote to memory of 1496 1572 New Text Document mod.exe 1234.exe PID 1572 wrote to memory of 4104 1572 New Text Document mod.exe ISetup8.exe PID 1572 wrote to memory of 4104 1572 New Text Document mod.exe ISetup8.exe PID 1572 wrote to memory of 4104 1572 New Text Document mod.exe ISetup8.exe PID 1572 wrote to memory of 1108 1572 New Text Document mod.exe test2.exe PID 1572 wrote to memory of 1108 1572 New Text Document mod.exe test2.exe PID 4104 wrote to memory of 1276 4104 ISetup8.exe u360.0.exe PID 4104 wrote to memory of 1276 4104 ISetup8.exe u360.0.exe PID 4104 wrote to memory of 1276 4104 ISetup8.exe u360.0.exe PID 4620 wrote to memory of 4748 4620 MStore.exe powershell.exe PID 4620 wrote to memory of 4748 4620 MStore.exe powershell.exe PID 1572 wrote to memory of 3632 1572 New Text Document mod.exe 1111.exe PID 1572 wrote to memory of 3632 1572 New Text Document mod.exe 1111.exe PID 1572 wrote to memory of 1856 1572 New Text Document mod.exe ISetup2.exe PID 1572 wrote to memory of 1856 1572 New Text Document mod.exe ISetup2.exe PID 1572 wrote to memory of 1856 1572 New Text Document mod.exe ISetup2.exe PID 4104 wrote to memory of 64 4104 ISetup8.exe u360.1.exe PID 4104 wrote to memory of 64 4104 ISetup8.exe u360.1.exe PID 4104 wrote to memory of 64 4104 ISetup8.exe u360.1.exe PID 1572 wrote to memory of 1568 1572 New Text Document mod.exe Tester.exe PID 1572 wrote to memory of 1568 1572 New Text Document mod.exe Tester.exe PID 1572 wrote to memory of 428 1572 New Text Document mod.exe svchost.exe PID 1572 wrote to memory of 428 1572 New Text Document mod.exe svchost.exe PID 64 wrote to memory of 1580 64 u360.1.exe SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe PID 64 wrote to memory of 1580 64 u360.1.exe SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe PID 1276 wrote to memory of 2716 1276 u360.0.exe cmd.exe PID 1276 wrote to memory of 2716 1276 u360.0.exe cmd.exe PID 1276 wrote to memory of 2716 1276 u360.0.exe cmd.exe PID 2716 wrote to memory of 1720 2716 cmd.exe DBFHCGCGDA.exe PID 2716 wrote to memory of 1720 2716 cmd.exe DBFHCGCGDA.exe PID 2716 wrote to memory of 1720 2716 cmd.exe DBFHCGCGDA.exe PID 1720 wrote to memory of 4924 1720 DBFHCGCGDA.exe cmd.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hBZGJWkp.exe"C:\Users\Admin\AppData\Local\Temp\hBZGJWkp.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionExtension .exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Temp\Temp.exe"C:\Windows\Temp\Temp.exe" -s3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exe"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exe"C:\Users\Admin\AppData\Local\Temp\a\1234.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u360.0.exe"C:\Users\Admin\AppData\Local\Temp\u360.0.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DBFHCGCGDA.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DBFHCGCGDA.exe"C:\Users\Admin\AppData\Local\Temp\DBFHCGCGDA.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\DBFHCGCGDA.exe6⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30007⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\u360.1.exe"C:\Users\Admin\AppData\Local\Temp\u360.1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD14⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exe"C:\Users\Admin\AppData\Local\Temp\a\test2.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exe"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Are.docxFilesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5441ed63e1f97ad2542a7591236512ab5
SHA1d3d1317de1926addf7a14a0b20b525cf43c47b0c
SHA25668252ecaafd66cbe1f406a50bf03e95835ff2923fc81f784a5eea5400e9e90be
SHA51263bed5d0110ff68e90b38b72855a9d2c4e13a025b85566c5e12f59b702f5a3ccbfb92631acb94950f25fed0b6e4ef0e5eb7dea537605099b8bd75da809b0b1c9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD55f27ef66bc7560eddc41af50e0636762
SHA1f4ae9692ca20c0366d427a8d2abe59b64ad9d784
SHA256dfe13bad068fe5eebce4260cb3467166c723fdc73ea688b54986b091d3a90638
SHA512deb0c862cb4447a11923d722ef33082ae36007cd2d51e5c1b9bd1e9aa1954c49de9cd9e06de0be41dff338d2f1e345b147ec64b53e2807b7f105e51f14a622ee
-
C:\Users\Admin\AppData\Local\Temp\DBFHCGCGDA.exeFilesize
106KB
MD5fe380780b5c35bd6d54541791151c2be
SHA17fe3a583cf91474c733f85cebf3c857682e269e1
SHA256b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53
SHA512ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeFilesize
6KB
MD5f7930c4859ccd34bd2b80a9995f49926
SHA18b5b95fb51619e20246f90d60f2137da7654fc5e
SHA256163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a
SHA5128f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsiibilitylead.exeFilesize
6KB
MD5a0c8b99e0780c3e8f8319f5ec3abf9f4
SHA1561a59a4d6af134797b2e2907590efee9e519ca3
SHA2564588ad64c432d7a20ba41949327be873c25f7eaa0cbba71b3435463739510035
SHA51230bd51b731ab989188ae3597f37ba74d56d78287afcb2c2243f657a131618ba6e83d34b82253b6d42efab7a01da0397fb496478628393b4cffca4c907d39f961
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rjr2lltp.tcf.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exeFilesize
2.8MB
MD5e670bdc7c82eee75a6d3ada6a7c9134e
SHA1b0f0bab6f6e92bc86e86fd7bff93c257a4235859
SHA256a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb
SHA5127384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exeFilesize
1.3MB
MD55e13199a94cf8664e5bfbe2f68d4738e
SHA18cfaa21f68226ae775615f033507b5756f5ccacc
SHA25671b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5
SHA512b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exeFilesize
413KB
MD5d388d6918f1e8a6a3b34ad993d8159eb
SHA1cf3cd31a4dd6571cc78016c7b0f97f621b1f253d
SHA25627d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645
SHA51254cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exeFilesize
413KB
MD594e9960a45131af61e599acee54d21d6
SHA139b03e050337d4eb127ae5ff5f0868e986bec7ad
SHA2567add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172
SHA512179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exeFilesize
12KB
MD5282c1ebb16ad0edc41389d1e73a74607
SHA1fbcdda121484ea6125827ed4e7b1b00f6a88835d
SHA2567712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc
SHA51294be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exeFilesize
7KB
MD59c938f91a0530150a2b1c4546334570c
SHA1f4ae9acba920744457739fef0205f86443dbdf65
SHA25635a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a
SHA512f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exeFilesize
267KB
MD50803c1aec008e75859877844cfa81492
SHA116924d5802ddf76a2096fcfade0ce06d4c0670bd
SHA256d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3
SHA5129001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exeFilesize
524KB
MD5c8edf453ed433cefb2696bb859e0f782
SHA1e34cf939d6c5a34c7bedfd885249bb7fb15336e5
SHA2560c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0
SHA51261d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exeFilesize
294KB
MD510fc8b2915c43aa16b6a2e2b4529adc5
SHA10c15286457963eb86d61d83642870a3473ef38fe
SHA256feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5
SHA512421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exeFilesize
2.3MB
MD5262a7eb58a01d1aab21b24292c181cd3
SHA1535312b7048fb90be981e04ea759c5ad8aaf6eda
SHA256107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6
SHA512358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exeFilesize
7.7MB
MD57aca152e7040f43dae201cfe01ce37b4
SHA183eb2fa2d400f96b241e61f81e4d80317eea0200
SHA256ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50
SHA51284415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exeFilesize
157KB
MD55790d1417f8f00bd7ec6fb7011c79d9c
SHA136076ed9457c45d94e664ea291eb01e5c70d084b
SHA256ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82
SHA512b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeFilesize
66KB
MD500135a86ab829fc2d4678179d7a6e70f
SHA1ef75c259865d7685d566b6e25b7a20d134952555
SHA2560b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89
SHA512011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exeFilesize
2.7MB
MD55347852b24409aed42423f0118637f03
SHA16c7947428231ab857ee8c9dab7a7e62fdeed024b
SHA256a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131
SHA5120a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exeFilesize
1.3MB
MD5ddee86f4db0d3b8010110445b0545526
SHA1b41380b50d17dd679f85a224771398b81966bb9e
SHA2560d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5
SHA5124271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exeFilesize
13KB
MD50c550ce9bb3efa8c3ce80a507cadfffa
SHA16559cb9db9c13147da5139cc3b8d9c60b914b667
SHA2560dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912
SHA512c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf
-
C:\Users\Admin\AppData\Local\Temp\hBZGJWkp.exeFilesize
5KB
MD56a2c09749219d577535d0338c6cffe06
SHA1576b00c03455a518664308c976097097f691bca4
SHA25675b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c
SHA512cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD520b5f0e98ffc42c9ae0bb6b3c48c0ebe
SHA1308c25fd7f4fea26419dd85937b63c8a89b96334
SHA2566d697ca60ac9df74589c3e8ae5a1dd7e7025addc875bc44172e2d9e3ef82fcd8
SHA5129b9cebf46925684ff8d18d7ce9b163b3a78a7cc71cc3daadd471f7cbee80a7bbd7c96cd1dbc2f6930c7908ffdf70443ffb71b1cc510424d779990ab0fba26060
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
3KB
MD5e140977dff2dc226316b225ed9582f1b
SHA136b3cb130f115c24feb9329bb125688d025c7469
SHA2568f4f08b142c361a08be8fd279d10a9f1440ad97d7390d556c95f990ee372fa4a
SHA512f4b96bfb353870fd008ecf5702e886d97826fafb53e11e3a31647b7267a61d90e0288a118d7dc37f26b53cee063d1edb622189a59aece59bff230c3d347bedc9
-
C:\Users\Admin\AppData\Local\Temp\u360.0.exeFilesize
271KB
MD5b95747cad90e982d44da8fd74f50b9a6
SHA1d7f267d2042f6b67f63542395ff6a5a1b3ba1250
SHA2567b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153
SHA512615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c
-
C:\Users\Admin\AppData\Local\Temp\u360.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
memory/860-89-0x0000000140000000-0x0000000140004278-memory.dmpFilesize
16KB
-
memory/1276-336-0x0000000003000000-0x0000000003100000-memory.dmpFilesize
1024KB
-
memory/1276-361-0x0000000000400000-0x0000000002D21000-memory.dmpFilesize
41.1MB
-
memory/1276-347-0x0000000002F90000-0x0000000002FB7000-memory.dmpFilesize
156KB
-
memory/1572-2-0x000000001ACB0000-0x000000001ACC0000-memory.dmpFilesize
64KB
-
memory/1572-1-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmpFilesize
9.9MB
-
memory/1572-0-0x0000000000010000-0x0000000000018000-memory.dmpFilesize
32KB
-
memory/1572-91-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmpFilesize
9.9MB
-
memory/1572-117-0x000000001ACB0000-0x000000001ACC0000-memory.dmpFilesize
64KB
-
memory/1856-391-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/1856-369-0x00000000030D0000-0x00000000031D0000-memory.dmpFilesize
1024KB
-
memory/3648-166-0x00000000771C0000-0x0000000077290000-memory.dmpFilesize
832KB
-
memory/3648-43-0x00000000068A0000-0x0000000006932000-memory.dmpFilesize
584KB
-
memory/3648-8-0x00000000009C0000-0x0000000001ADC000-memory.dmpFilesize
17.1MB
-
memory/3648-18-0x0000000077470000-0x0000000077632000-memory.dmpFilesize
1.8MB
-
memory/3648-19-0x00000000771C0000-0x0000000077290000-memory.dmpFilesize
832KB
-
memory/3648-20-0x00000000771C0000-0x0000000077290000-memory.dmpFilesize
832KB
-
memory/3648-23-0x0000000077470000-0x0000000077632000-memory.dmpFilesize
1.8MB
-
memory/3648-25-0x00000000771C0000-0x0000000077290000-memory.dmpFilesize
832KB
-
memory/3648-34-0x00000000009C0000-0x0000000001ADC000-memory.dmpFilesize
17.1MB
-
memory/3648-38-0x00000000009C0000-0x0000000001ADC000-memory.dmpFilesize
17.1MB
-
memory/3648-40-0x0000000006D00000-0x00000000071FE000-memory.dmpFilesize
5.0MB
-
memory/3648-79-0x0000000006A00000-0x0000000006A10000-memory.dmpFilesize
64KB
-
memory/3648-143-0x00000000009C0000-0x0000000001ADC000-memory.dmpFilesize
17.1MB
-
memory/3648-49-0x0000000006820000-0x000000000682A000-memory.dmpFilesize
40KB
-
memory/3648-149-0x00000000771C0000-0x0000000077290000-memory.dmpFilesize
832KB
-
memory/3648-50-0x0000000000400000-0x000000000054E000-memory.dmpFilesize
1.3MB
-
memory/3648-51-0x0000000006850000-0x0000000006864000-memory.dmpFilesize
80KB
-
memory/3648-330-0x0000000006A00000-0x0000000006A10000-memory.dmpFilesize
64KB
-
memory/3648-250-0x00000000771C0000-0x0000000077290000-memory.dmpFilesize
832KB
-
memory/3648-146-0x0000000077470000-0x0000000077632000-memory.dmpFilesize
1.8MB
-
memory/3888-169-0x0000000000EB0000-0x0000000000EB4000-memory.dmpFilesize
16KB
-
memory/4104-254-0x00000000049C0000-0x0000000004A2C000-memory.dmpFilesize
432KB
-
memory/4104-252-0x0000000003020000-0x0000000003120000-memory.dmpFilesize
1024KB
-
memory/4104-263-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/4268-218-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-168-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-179-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-183-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-185-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-187-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-140-0x0000020358360000-0x00000203585D6000-memory.dmpFilesize
2.5MB
-
memory/4268-190-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-192-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-194-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-196-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-198-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-200-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-202-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-207-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-209-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-211-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-213-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-148-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-173-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-224-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-222-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-226-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-230-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-232-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-235-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-237-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-242-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-75-0x000002033DDA0000-0x000002033DDA6000-memory.dmpFilesize
24KB
-
memory/4268-245-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-171-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-88-0x000002033F990000-0x000002033F9A0000-memory.dmpFilesize
64KB
-
memory/4268-86-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmpFilesize
9.9MB
-
memory/4268-161-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-152-0x0000020358360000-0x00000203585D1000-memory.dmpFilesize
2.4MB
-
memory/4268-334-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmpFilesize
9.9MB
-
memory/4656-177-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmpFilesize
9.9MB
-
memory/4656-98-0x00000149E2430000-0x00000149E2440000-memory.dmpFilesize
64KB
-
memory/4656-151-0x00000149E2430000-0x00000149E2440000-memory.dmpFilesize
64KB
-
memory/4656-99-0x00000149FC310000-0x00000149FC332000-memory.dmpFilesize
136KB
-
memory/4656-103-0x00000149FC4C0000-0x00000149FC536000-memory.dmpFilesize
472KB
-
memory/4656-94-0x00007FFB35280000-0x00007FFB35C6C000-memory.dmpFilesize
9.9MB
-
memory/4656-119-0x00000149E2430000-0x00000149E2440000-memory.dmpFilesize
64KB
-
memory/4656-97-0x00000149E2430000-0x00000149E2440000-memory.dmpFilesize
64KB
-
memory/4680-188-0x00000000078F0000-0x0000000007940000-memory.dmpFilesize
320KB
-
memory/4680-53-0x0000000005940000-0x0000000005952000-memory.dmpFilesize
72KB
-
memory/4680-52-0x0000000005F10000-0x0000000006516000-memory.dmpFilesize
6.0MB
-
memory/4680-379-0x0000000073ED0000-0x00000000745BE000-memory.dmpFilesize
6.9MB
-
memory/4680-61-0x0000000006860000-0x000000000689E000-memory.dmpFilesize
248KB
-
memory/4680-48-0x00000000053B0000-0x0000000005416000-memory.dmpFilesize
408KB
-
memory/4680-45-0x0000000073ED0000-0x00000000745BE000-memory.dmpFilesize
6.9MB
-
memory/4680-139-0x0000000006E80000-0x0000000006E9E000-memory.dmpFilesize
120KB
-
memory/4680-134-0x0000000006EC0000-0x0000000006F36000-memory.dmpFilesize
472KB
-
memory/4680-266-0x0000000073ED0000-0x00000000745BE000-memory.dmpFilesize
6.9MB
-
memory/4680-35-0x0000000000B30000-0x0000000000B52000-memory.dmpFilesize
136KB
-
memory/4680-54-0x0000000005A70000-0x0000000005B7A000-memory.dmpFilesize
1.0MB
-
memory/4680-96-0x0000000006C70000-0x0000000006E32000-memory.dmpFilesize
1.8MB
-
memory/4680-55-0x00000000054F0000-0x0000000005500000-memory.dmpFilesize
64KB
-
memory/4680-101-0x0000000007370000-0x000000000789C000-memory.dmpFilesize
5.2MB
-
memory/4680-62-0x00000000069A0000-0x00000000069EB000-memory.dmpFilesize
300KB
-
memory/4680-328-0x00000000054F0000-0x0000000005500000-memory.dmpFilesize
64KB