Overview
overview
10Static
static
3New Text D...od.exe
windows7-x64
10New Text D...od.exe
windows10-1703-x64
10New Text D...od.exe
windows10-2004-x64
10New Text D...od.exe
windows11-21h2-x64
10New Text D...od.exe
windows7-x64
10New Text D...od.exe
windows10-1703-x64
10New Text D...od.exe
windows10-2004-x64
10New Text D...od.exe
windows11-21h2-x64
10Resubmissions
09-04-2024 07:01
240409-htps3scd2w 1009-04-2024 07:01
240409-htf6yacc9x 1009-04-2024 07:00
240409-hs6p7scc81 1009-04-2024 07:00
240409-hss44scc7z 1007-03-2024 22:29
240307-2eh7jagg41 10Analysis
-
max time kernel
600s -
max time network
610s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
09-04-2024 07:00
Static task
static1
Behavioral task
behavioral1
Sample
New Text Document mod.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
New Text Document mod.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
New Text Document mod.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
New Text Document mod.exe
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
New Text Document mod.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
New Text Document mod.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
New Text Document mod.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
New Text Document mod.exe
Resource
win11-20240221-en
General
-
Target
New Text Document mod.exe
-
Size
8KB
-
MD5
69994ff2f00eeca9335ccd502198e05b
-
SHA1
b13a15a5bea65b711b835ce8eccd2a699a99cead
-
SHA256
2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
-
SHA512
ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
-
SSDEEP
96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
Malware Config
Extracted
redline
6077866846
https://pastebin.com/raw/KE5Mft0T
Extracted
metasploit
metasploit_stager
91.92.247.21:8405
Extracted
xworm
94.156.8.213:58002
-
Install_directory
%Public%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\svchost.exe family_xworm behavioral8/memory/2352-324-0x0000000000ED0000-0x0000000000EE6000-memory.dmp family_xworm -
Detect ZGRat V1 21 IoCs
Processes:
resource yara_rule behavioral8/memory/4164-263-0x0000022327C70000-0x0000022327EE6000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-276-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-280-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-307-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-313-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-297-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-290-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-326-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-331-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-336-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-343-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-348-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-360-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-366-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-375-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-395-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-405-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-410-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-418-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-429-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 behavioral8/memory/4164-387-0x0000022327C70000-0x0000022327EE1000-memory.dmp family_zgrat_v1 -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral8/memory/3748-43-0x00000000013A0000-0x00000000013C2000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
mQxBvlTA.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ mQxBvlTA.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mQxBvlTA.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mQxBvlTA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion mQxBvlTA.exe -
Executes dropped EXE 31 IoCs
Processes:
mQxBvlTA.exexIPJVPDq.exeeuZSbvzg.execrypted6077866846MVYQY.exei1gcbW1E.exedisable-defender.exepclient.exeresponsibilitylead.exeMStore.exeProps.exewininit.exe1234.exeISetup8.exeTemp.exetest2.exeu39g.0.exe1111.exeISetup2.exeu39g.1.exeTester.exesvchost.exeMService.exe555.exeu264.0.exeDocument.exesvchost.exeDocument.exeDocument.exemsdtc.exemsdtc.exemsdtc.exepid process 2344 mQxBvlTA.exe 4776 xIPJVPDq.exe 1676 euZSbvzg.exe 3748 crypted6077866846MVYQY.exe 3448 i1gcbW1E.exe 1388 disable-defender.exe 3476 pclient.exe 4164 responsibilitylead.exe 4836 MStore.exe 2800 Props.exe 1904 wininit.exe 2476 1234.exe 4228 ISetup8.exe 1540 Temp.exe 1880 test2.exe 3320 u39g.0.exe 4824 1111.exe 2812 ISetup2.exe 2204 u39g.1.exe 1264 Tester.exe 2352 svchost.exe 964 MService.exe 792 555.exe 3084 u264.0.exe 4240 Document.exe 580 svchost.exe 2304 Document.exe 1896 Document.exe 3600 msdtc.exe 5032 msdtc.exe 2372 msdtc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe themida behavioral8/memory/2344-59-0x0000000000730000-0x000000000184C000-memory.dmp themida behavioral8/memory/2344-60-0x0000000000730000-0x000000000184C000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
pclient.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" pclient.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
mQxBvlTA.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mQxBvlTA.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
Processes:
flow ioc 1 raw.githubusercontent.com 1 pastebin.com 6 raw.githubusercontent.com 12 pastebin.com -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\wininit.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe autoit_exe -
Drops file in System32 directory 1 IoCs
Processes:
MStore.exedescription ioc process File created C:\Windows\SysWOW64\MService.exe MStore.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
mQxBvlTA.exepid process 2344 mQxBvlTA.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Document.exemsdtc.exedescription pid process target process PID 4240 set thread context of 1896 4240 Document.exe Document.exe PID 3600 set thread context of 2372 3600 msdtc.exe msdtc.exe -
Drops file in Windows directory 2 IoCs
Processes:
Tester.exedescription ioc process File created C:\Windows\svchost.exe Tester.exe File opened for modification C:\Windows\svchost.exe Tester.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2768 4228 WerFault.exe ISetup8.exe 3012 3084 WerFault.exe u264.0.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
u39g.1.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u39g.1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u39g.1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u39g.1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
u39g.0.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 u39g.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString u39g.0.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 5032 schtasks.exe 1668 schtasks.exe 1388 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3688 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
xIPJVPDq.exeeuZSbvzg.execrypted6077866846MVYQY.exedisable-defender.exepowershell.exeTemp.exeu39g.0.exeTester.exepowershell.exepowershell.exeDocument.exesvchost.exepid process 4776 xIPJVPDq.exe 4776 xIPJVPDq.exe 4776 xIPJVPDq.exe 4776 xIPJVPDq.exe 1676 euZSbvzg.exe 1676 euZSbvzg.exe 1676 euZSbvzg.exe 1676 euZSbvzg.exe 3748 crypted6077866846MVYQY.exe 1388 disable-defender.exe 1388 disable-defender.exe 3180 powershell.exe 3180 powershell.exe 3748 crypted6077866846MVYQY.exe 3748 crypted6077866846MVYQY.exe 1540 Temp.exe 1540 Temp.exe 3748 crypted6077866846MVYQY.exe 3748 crypted6077866846MVYQY.exe 3748 crypted6077866846MVYQY.exe 3748 crypted6077866846MVYQY.exe 3748 crypted6077866846MVYQY.exe 3748 crypted6077866846MVYQY.exe 3748 crypted6077866846MVYQY.exe 3748 crypted6077866846MVYQY.exe 3748 crypted6077866846MVYQY.exe 3748 crypted6077866846MVYQY.exe 3320 u39g.0.exe 3320 u39g.0.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 1264 Tester.exe 2440 powershell.exe 2440 powershell.exe 4248 powershell.exe 4248 powershell.exe 4240 Document.exe 580 svchost.exe 4240 Document.exe 4240 Document.exe 4240 Document.exe 4240 Document.exe 4240 Document.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
New Text Document mod.exexIPJVPDq.exeeuZSbvzg.execrypted6077866846MVYQY.exedisable-defender.exeresponsibilitylead.exemQxBvlTA.exepowershell.exeTemp.exeTester.exesvchost.exevssvc.exepowershell.exepowershell.exesvchost.exeDocument.exepowershell.exepowershell.exeDocument.exemsdtc.exepowershell.exepowershell.exemsdtc.exedescription pid process Token: SeDebugPrivilege 2644 New Text Document mod.exe Token: SeDebugPrivilege 4776 xIPJVPDq.exe Token: SeDebugPrivilege 1676 euZSbvzg.exe Token: SeDebugPrivilege 3748 crypted6077866846MVYQY.exe Token: SeDebugPrivilege 1388 disable-defender.exe Token: SeImpersonatePrivilege 1388 disable-defender.exe Token: SeDebugPrivilege 4164 responsibilitylead.exe Token: SeDebugPrivilege 2344 mQxBvlTA.exe Token: SeDebugPrivilege 3180 powershell.exe Token: SeDebugPrivilege 1540 Temp.exe Token: SeImpersonatePrivilege 1540 Temp.exe Token: SeDebugPrivilege 1264 Tester.exe Token: SeDebugPrivilege 2352 svchost.exe Token: SeBackupPrivilege 3804 vssvc.exe Token: SeRestorePrivilege 3804 vssvc.exe Token: SeAuditPrivilege 3804 vssvc.exe Token: SeDebugPrivilege 2440 powershell.exe Token: SeDebugPrivilege 4248 powershell.exe Token: SeDebugPrivilege 580 svchost.exe Token: SeDebugPrivilege 580 svchost.exe Token: SeDebugPrivilege 4240 Document.exe Token: SeDebugPrivilege 580 svchost.exe Token: SeDebugPrivilege 4564 powershell.exe Token: SeDebugPrivilege 2424 powershell.exe Token: SeDebugPrivilege 1896 Document.exe Token: SeDebugPrivilege 3600 msdtc.exe Token: SeDebugPrivilege 3092 powershell.exe Token: SeDebugPrivilege 3728 powershell.exe Token: SeDebugPrivilege 2372 msdtc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
wininit.exeu39g.1.exepid process 1904 wininit.exe 1904 wininit.exe 2204 u39g.1.exe 2204 u39g.1.exe 2204 u39g.1.exe 2204 u39g.1.exe 2204 u39g.1.exe 2204 u39g.1.exe 2204 u39g.1.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
wininit.exeu39g.1.exepid process 1904 wininit.exe 1904 wininit.exe 2204 u39g.1.exe 2204 u39g.1.exe 2204 u39g.1.exe 2204 u39g.1.exe 2204 u39g.1.exe 2204 u39g.1.exe 2204 u39g.1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 580 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
New Text Document mod.exexIPJVPDq.exepclient.exeMStore.execmd.exeISetup8.exeISetup2.exedescription pid process target process PID 2644 wrote to memory of 2344 2644 New Text Document mod.exe mQxBvlTA.exe PID 2644 wrote to memory of 2344 2644 New Text Document mod.exe mQxBvlTA.exe PID 2644 wrote to memory of 2344 2644 New Text Document mod.exe mQxBvlTA.exe PID 2644 wrote to memory of 4776 2644 New Text Document mod.exe xIPJVPDq.exe PID 2644 wrote to memory of 4776 2644 New Text Document mod.exe xIPJVPDq.exe PID 2644 wrote to memory of 4776 2644 New Text Document mod.exe xIPJVPDq.exe PID 4776 wrote to memory of 1676 4776 xIPJVPDq.exe euZSbvzg.exe PID 4776 wrote to memory of 1676 4776 xIPJVPDq.exe euZSbvzg.exe PID 2644 wrote to memory of 3748 2644 New Text Document mod.exe crypted6077866846MVYQY.exe PID 2644 wrote to memory of 3748 2644 New Text Document mod.exe crypted6077866846MVYQY.exe PID 2644 wrote to memory of 3748 2644 New Text Document mod.exe crypted6077866846MVYQY.exe PID 2644 wrote to memory of 3448 2644 New Text Document mod.exe i1gcbW1E.exe PID 2644 wrote to memory of 3448 2644 New Text Document mod.exe i1gcbW1E.exe PID 2644 wrote to memory of 1388 2644 New Text Document mod.exe disable-defender.exe PID 2644 wrote to memory of 1388 2644 New Text Document mod.exe disable-defender.exe PID 2644 wrote to memory of 3476 2644 New Text Document mod.exe pclient.exe PID 2644 wrote to memory of 3476 2644 New Text Document mod.exe pclient.exe PID 3476 wrote to memory of 4164 3476 pclient.exe responsibilitylead.exe PID 3476 wrote to memory of 4164 3476 pclient.exe responsibilitylead.exe PID 2644 wrote to memory of 4836 2644 New Text Document mod.exe MStore.exe PID 2644 wrote to memory of 4836 2644 New Text Document mod.exe MStore.exe PID 2644 wrote to memory of 2800 2644 New Text Document mod.exe Props.exe PID 2644 wrote to memory of 2800 2644 New Text Document mod.exe Props.exe PID 4836 wrote to memory of 2444 4836 MStore.exe cmd.exe PID 4836 wrote to memory of 2444 4836 MStore.exe cmd.exe PID 2444 wrote to memory of 3180 2444 cmd.exe powershell.exe PID 2444 wrote to memory of 3180 2444 cmd.exe powershell.exe PID 2644 wrote to memory of 1904 2644 New Text Document mod.exe wininit.exe PID 2644 wrote to memory of 1904 2644 New Text Document mod.exe wininit.exe PID 2644 wrote to memory of 1904 2644 New Text Document mod.exe wininit.exe PID 2644 wrote to memory of 2476 2644 New Text Document mod.exe 1234.exe PID 2644 wrote to memory of 2476 2644 New Text Document mod.exe 1234.exe PID 2644 wrote to memory of 2476 2644 New Text Document mod.exe 1234.exe PID 2644 wrote to memory of 4228 2644 New Text Document mod.exe ISetup8.exe PID 2644 wrote to memory of 4228 2644 New Text Document mod.exe ISetup8.exe PID 2644 wrote to memory of 4228 2644 New Text Document mod.exe ISetup8.exe PID 4836 wrote to memory of 1540 4836 MStore.exe Temp.exe PID 4836 wrote to memory of 1540 4836 MStore.exe Temp.exe PID 2644 wrote to memory of 1880 2644 New Text Document mod.exe test2.exe PID 2644 wrote to memory of 1880 2644 New Text Document mod.exe test2.exe PID 4228 wrote to memory of 3320 4228 ISetup8.exe u39g.0.exe PID 4228 wrote to memory of 3320 4228 ISetup8.exe u39g.0.exe PID 4228 wrote to memory of 3320 4228 ISetup8.exe u39g.0.exe PID 2644 wrote to memory of 4824 2644 New Text Document mod.exe 1111.exe PID 2644 wrote to memory of 4824 2644 New Text Document mod.exe 1111.exe PID 2644 wrote to memory of 2812 2644 New Text Document mod.exe ISetup2.exe PID 2644 wrote to memory of 2812 2644 New Text Document mod.exe ISetup2.exe PID 2644 wrote to memory of 2812 2644 New Text Document mod.exe ISetup2.exe PID 4228 wrote to memory of 2204 4228 ISetup8.exe u39g.1.exe PID 4228 wrote to memory of 2204 4228 ISetup8.exe u39g.1.exe PID 4228 wrote to memory of 2204 4228 ISetup8.exe u39g.1.exe PID 2644 wrote to memory of 1264 2644 New Text Document mod.exe Tester.exe PID 2644 wrote to memory of 1264 2644 New Text Document mod.exe Tester.exe PID 2644 wrote to memory of 2352 2644 New Text Document mod.exe svchost.exe PID 2644 wrote to memory of 2352 2644 New Text Document mod.exe svchost.exe PID 4836 wrote to memory of 964 4836 MStore.exe MService.exe PID 4836 wrote to memory of 964 4836 MStore.exe MService.exe PID 2644 wrote to memory of 792 2644 New Text Document mod.exe 555.exe PID 2644 wrote to memory of 792 2644 New Text Document mod.exe 555.exe PID 2812 wrote to memory of 3084 2812 ISetup2.exe u264.0.exe PID 2812 wrote to memory of 3084 2812 ISetup2.exe u264.0.exe PID 2812 wrote to memory of 3084 2812 ISetup2.exe u264.0.exe PID 2644 wrote to memory of 4240 2644 New Text Document mod.exe Document.exe PID 2644 wrote to memory of 4240 2644 New Text Document mod.exe Document.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\euZSbvzg.exe"C:\Users\Admin\AppData\Local\Temp\euZSbvzg.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"2⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe3⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionExtension .exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180 -
C:\Windows\Temp\Temp.exe"C:\Windows\Temp\Temp.exe" -s3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540 -
C:\Windows\SysWOW64\MService.exe"C:\Windows\SysWOW64\MService.exe"3⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\a\Props.exe"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"2⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\a\1234.exe"C:\Users\Admin\AppData\Local\Temp\a\1234.exe"2⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\u39g.0.exe"C:\Users\Admin\AppData\Local\Temp\u39g.0.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\u39g.1.exe"C:\Users\Admin\AppData\Local\Temp\u39g.1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 15323⤵
- Program crash
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\a\test2.exe"C:\Users\Admin\AppData\Local\Temp\a\test2.exe"2⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\a\1111.exe"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"2⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\u264.0.exe"C:\Users\Admin\AppData\Local\Temp\u264.0.exe"3⤵
- Executes dropped EXE
PID:3084 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 10964⤵
- Program crash
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\u264.1.exe"C:\Users\Admin\AppData\Local\Temp\u264.1.exe"3⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1264 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\a\555.exe"C:\Users\Admin\AppData\Local\Temp\a\555.exe"2⤵
- Executes dropped EXE
PID:792 -
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2424 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4564 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4726.tmp"3⤵
- Creates scheduled task(s)
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1896 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit4⤵PID:2580
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'5⤵
- Creates scheduled task(s)
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5E48.tmp.bat""4⤵PID:2640
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
PID:3688 -
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3600 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3092 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3728 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBD5F.tmp"6⤵
- Creates scheduled task(s)
PID:1388 -
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4228 -ip 42281⤵PID:4580
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3084 -ip 30841⤵PID:1444
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:580
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD55ba388a6597d5e09191c2c88d2fdf598
SHA113516f8ec5a99298f6952438055c39330feae5d8
SHA256e6b6223094e8fc598ad12b3849e49f03a141ccd21e0eaa336f81791ad8443eca
SHA512ead2a2b5a1c2fad70c1cf570b2c9bfcb7364dd9f257a834eb819e55b8fee78e3f191f93044f07d51c259ca77a90ee8530f9204cbae080fba1d5705e1209f5b19
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Document.exe.logFilesize
1KB
MD57e1ed0055c3eaa0bbc4a29ec1ef15a6a
SHA1765b954c1adbb6a6ecc4fe912fdaa6d0fba0ae7d
SHA2564c17576f64dea465c45a50573ee41771f7be9962ab2d07f961af4df5589bdcce
SHA512de7c784c37d18c43820908add88f08ab4864c0ef3f9d158cc2c9d1bab120613cb093dd4bfc5d7ed0c289414956cfe0b213c386f8e6b5753847dec915566297c8
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD569aca5dc454c082db5b4f30fb213cd08
SHA101d76948bd976da2c2c5a5b0eda9b7cd9a2052b9
SHA256c19bc386c353a1b20d2072144c6c4a076b04371dabe8968d23e826fe1a3af786
SHA512c54b401d759bb9cc2b93d8977c727f1cae618f0bd685ccf59711556150bfb862b15d9348e11c22147ddf907ba4caf8b7ad75c03091af8dbbe2be969cfed25aa7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD54a7f03a7ad1cae046d8ceac04256e5ae
SHA1ef0bf767c91cba32b33c0b48f74f5eb153ae43d3
SHA256e8aa3162f519e3670b0fc79dfbeeca68ea2b65a17900cf3aafc6a48de3296d60
SHA512382a91848be121734bce9f533bcb4747e5f21db5b1ea5dfc8cc567005f5be0f1dcc73a55516b83feb931cdc90601ed4d36fb890687f08e1056ff98da2365f01d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD553baceafe29eabe8b3af161873ec4af4
SHA10aa7a23375ea68302e8cdc0ca8fa020a56b4e74c
SHA256cd12c5808bd48708772c5cc0b53c07941b643c8115bb8042b30ab96a1ceb61c8
SHA5124166d67c20f6e7ad2843af73735a42391c2651dd8379cac74b4c09963e592dc475613dcd90280735b55ecdda6a2086c5d5d50b07616d9111a609de48b7fad296
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5f79ee2ef846666759f16d748e1b5c652
SHA1638e87213c2571d83002a6cafae2a73d60247b84
SHA256b86b415de2882d3f09d78ea80ae7c7c9de66100240d294e15b8fb2915d7c8dbe
SHA512bfaa21a4a653dde0815fa6ce97b145aa0785a591b25c5db84b95cf678b52ba2c8bb5d3eda597d5722ee91f4db79ec3241d40016a39efdf18965ea7a554c34522
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeFilesize
6KB
MD5f7930c4859ccd34bd2b80a9995f49926
SHA18b5b95fb51619e20246f90d60f2137da7654fc5e
SHA256163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a
SHA5128f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oi2vffn1.553.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exeFilesize
2.8MB
MD5e670bdc7c82eee75a6d3ada6a7c9134e
SHA1b0f0bab6f6e92bc86e86fd7bff93c257a4235859
SHA256a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb
SHA5127384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exeFilesize
1.3MB
MD55e13199a94cf8664e5bfbe2f68d4738e
SHA18cfaa21f68226ae775615f033507b5756f5ccacc
SHA25671b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5
SHA512b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5
-
C:\Users\Admin\AppData\Local\Temp\a\555.exeFilesize
2.7MB
MD57162024dc024bb3311ee1cf81f37a791
SHA1be03705f33a8205f90330814f525e2e53dfb5871
SHA2563e39efae22fcda501f858229af27be129f178c85723d4477ef9be2f80b61a8fd
SHA51294652b8b770fcdd70ee5059b56ce84aee50c46901b6311e2a602cdb4d97b15abd0148ba4e55f225f722d125bf9c3969185bcefaf07f3911a4347d9a0ca8d2d38
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exeFilesize
492KB
MD50eec3b50636ae6d37613e6a2c7617191
SHA1630d5e3b88215d88432db42d2bd295c6d4b55ee8
SHA25632dc8827ff96982401777cd7feb77798660450a3e8960855577e8ace837f8b05
SHA5129a2088cce7ed6da8e2f13f2486925e7565b50a6c527363f0da19ff28910314fb9723496dfe3ddf0a977d1b0c8ff1661f0ae6bc3789332534ad0bea3cbafbdc12
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exeFilesize
413KB
MD5d388d6918f1e8a6a3b34ad993d8159eb
SHA1cf3cd31a4dd6571cc78016c7b0f97f621b1f253d
SHA25627d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645
SHA51254cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exeFilesize
413KB
MD594e9960a45131af61e599acee54d21d6
SHA139b03e050337d4eb127ae5ff5f0868e986bec7ad
SHA2567add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172
SHA512179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exeFilesize
12KB
MD5282c1ebb16ad0edc41389d1e73a74607
SHA1fbcdda121484ea6125827ed4e7b1b00f6a88835d
SHA2567712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc
SHA51294be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exeFilesize
7KB
MD59c938f91a0530150a2b1c4546334570c
SHA1f4ae9acba920744457739fef0205f86443dbdf65
SHA25635a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a
SHA512f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exeFilesize
267KB
MD50803c1aec008e75859877844cfa81492
SHA116924d5802ddf76a2096fcfade0ce06d4c0670bd
SHA256d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3
SHA5129001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exeFilesize
524KB
MD5c8edf453ed433cefb2696bb859e0f782
SHA1e34cf939d6c5a34c7bedfd885249bb7fb15336e5
SHA2560c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0
SHA51261d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exeFilesize
294KB
MD510fc8b2915c43aa16b6a2e2b4529adc5
SHA10c15286457963eb86d61d83642870a3473ef38fe
SHA256feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5
SHA512421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exeFilesize
2.3MB
MD5262a7eb58a01d1aab21b24292c181cd3
SHA1535312b7048fb90be981e04ea759c5ad8aaf6eda
SHA256107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6
SHA512358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exeFilesize
7.7MB
MD57aca152e7040f43dae201cfe01ce37b4
SHA183eb2fa2d400f96b241e61f81e4d80317eea0200
SHA256ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50
SHA51284415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4
-
C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exeFilesize
1.1MB
MD5b915133065e8c357f8b37e28015088fe
SHA161286d2adea00cab97ade25d5221d7cfc36a580b
SHA2563d79bf5d780b6770babf2f2cba5549a01992d4e77f797292e2f4a3ecd668379c
SHA51269e6b492e3b36e55fd64608067d3b7329adb8890fd712e64b845943c5902ef1c983a388bfbfdeff646bc4ddab94c308b26de3b7c04ceea2bed52fc11acf759fc
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exeFilesize
157KB
MD55790d1417f8f00bd7ec6fb7011c79d9c
SHA136076ed9457c45d94e664ea291eb01e5c70d084b
SHA256ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82
SHA512b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeFilesize
66KB
MD500135a86ab829fc2d4678179d7a6e70f
SHA1ef75c259865d7685d566b6e25b7a20d134952555
SHA2560b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89
SHA512011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exeFilesize
2.7MB
MD55347852b24409aed42423f0118637f03
SHA16c7947428231ab857ee8c9dab7a7e62fdeed024b
SHA256a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131
SHA5120a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exeFilesize
1.3MB
MD5ddee86f4db0d3b8010110445b0545526
SHA1b41380b50d17dd679f85a224771398b81966bb9e
SHA2560d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5
SHA5124271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exeFilesize
13KB
MD50c550ce9bb3efa8c3ce80a507cadfffa
SHA16559cb9db9c13147da5139cc3b8d9c60b914b667
SHA2560dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912
SHA512c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf
-
C:\Users\Admin\AppData\Local\Temp\euZSbvzg.exeFilesize
5KB
MD56a2c09749219d577535d0338c6cffe06
SHA1576b00c03455a518664308c976097097f691bca4
SHA25675b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c
SHA512cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c
-
C:\Users\Admin\AppData\Local\Temp\tmp4726.tmpFilesize
1KB
MD56fa6528b981d175a86d56c51cca56978
SHA1ea7ed8fedd55c7b768487fe17fe1eaaeb5b60933
SHA2567a389628bda9f38977350ab01484b5008f003686c8f3fb7351367dd27bc18a2a
SHA51228bbdc7fd577024ea2b2397b6ceeba4c500f05ff8830da170d38c2bb44cecf720920f3fc4c727bcf1aefeb8eb07b4a1d06dd90c8880d542ff80185dd819e1ef0
-
C:\Users\Admin\AppData\Local\Temp\tmp5E48.tmp.batFilesize
149B
MD53284b2538183d9457c6314847d209e20
SHA1f16a9e49c7d7f042b7d23ae95018f7e2467ee0a4
SHA256a1c3286612f3481687d1b780a56239b12c98b8bb04b8960e4b76a54f3c9fa4b3
SHA512e40c0ad1fa26372d8fff4c6c11daef3c82503a066d3a6405581aaa20171e097f17c56774ffb97096f42af89f1d2664efe116c2a9b3472d8c57131707fc32e47b
-
C:\Users\Admin\AppData\Local\Temp\u39g.0.exeFilesize
271KB
MD5b95747cad90e982d44da8fd74f50b9a6
SHA1d7f267d2042f6b67f63542395ff6a5a1b3ba1250
SHA2567b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153
SHA512615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c
-
C:\Users\Admin\AppData\Local\Temp\u39g.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
memory/1264-312-0x0000000000280000-0x00000000002CA000-memory.dmpFilesize
296KB
-
memory/1264-404-0x000000001B0E0000-0x000000001B0F0000-memory.dmpFilesize
64KB
-
memory/1904-167-0x00000000023D0000-0x00000000023D4000-memory.dmpFilesize
16KB
-
memory/2344-62-0x0000000006A30000-0x0000000006FD6000-memory.dmpFilesize
5.6MB
-
memory/2344-24-0x0000000075980000-0x0000000075A70000-memory.dmpFilesize
960KB
-
memory/2344-59-0x0000000000730000-0x000000000184C000-memory.dmpFilesize
17.1MB
-
memory/2344-104-0x00000000066E0000-0x00000000066F0000-memory.dmpFilesize
64KB
-
memory/2344-60-0x0000000000730000-0x000000000184C000-memory.dmpFilesize
17.1MB
-
memory/2344-127-0x0000000000730000-0x000000000184C000-memory.dmpFilesize
17.1MB
-
memory/2344-129-0x0000000007C70000-0x0000000007CAC000-memory.dmpFilesize
240KB
-
memory/2344-29-0x0000000075980000-0x0000000075A70000-memory.dmpFilesize
960KB
-
memory/2344-64-0x0000000006560000-0x00000000065F2000-memory.dmpFilesize
584KB
-
memory/2344-34-0x00000000772A6000-0x00000000772A8000-memory.dmpFilesize
8KB
-
memory/2344-73-0x0000000006610000-0x000000000661A000-memory.dmpFilesize
40KB
-
memory/2344-134-0x0000000075980000-0x0000000075A70000-memory.dmpFilesize
960KB
-
memory/2344-135-0x0000000075980000-0x0000000075A70000-memory.dmpFilesize
960KB
-
memory/2344-23-0x00000000772A4000-0x00000000772A5000-memory.dmpFilesize
4KB
-
memory/2344-76-0x0000000000400000-0x000000000054E000-memory.dmpFilesize
1.3MB
-
memory/2344-22-0x0000000000730000-0x000000000184C000-memory.dmpFilesize
17.1MB
-
memory/2344-78-0x0000000006600000-0x0000000006614000-memory.dmpFilesize
80KB
-
memory/2344-407-0x00000000066E0000-0x00000000066F0000-memory.dmpFilesize
64KB
-
memory/2352-350-0x00007FF9BECB0000-0x00007FF9BF772000-memory.dmpFilesize
10.8MB
-
memory/2352-324-0x0000000000ED0000-0x0000000000EE6000-memory.dmpFilesize
88KB
-
memory/2644-2-0x000000001B200000-0x000000001B210000-memory.dmpFilesize
64KB
-
memory/2644-0-0x0000000000580000-0x0000000000588000-memory.dmpFilesize
32KB
-
memory/2644-1-0x00007FF9BECB0000-0x00007FF9BF772000-memory.dmpFilesize
10.8MB
-
memory/2644-97-0x00007FF9BECB0000-0x00007FF9BF772000-memory.dmpFilesize
10.8MB
-
memory/2644-115-0x000000001B200000-0x000000001B210000-memory.dmpFilesize
64KB
-
memory/2800-117-0x0000000140000000-0x0000000140004278-memory.dmpFilesize
16KB
-
memory/2812-292-0x0000000002E70000-0x0000000002F70000-memory.dmpFilesize
1024KB
-
memory/2812-337-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/3180-133-0x00000148829B0000-0x00000148829C0000-memory.dmpFilesize
64KB
-
memory/3180-131-0x00000148829B0000-0x00000148829C0000-memory.dmpFilesize
64KB
-
memory/3180-132-0x00000148829B0000-0x00000148829C0000-memory.dmpFilesize
64KB
-
memory/3180-130-0x00007FF9BECB0000-0x00007FF9BF772000-memory.dmpFilesize
10.8MB
-
memory/3180-126-0x000001489AED0000-0x000001489AEF2000-memory.dmpFilesize
136KB
-
memory/3180-139-0x00007FF9BECB0000-0x00007FF9BF772000-memory.dmpFilesize
10.8MB
-
memory/3320-244-0x0000000002FA0000-0x00000000030A0000-memory.dmpFilesize
1024KB
-
memory/3320-245-0x0000000004A40000-0x0000000004A67000-memory.dmpFilesize
156KB
-
memory/3320-311-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/3320-254-0x0000000000400000-0x0000000002D21000-memory.dmpFilesize
41.1MB
-
memory/3448-223-0x00007FF78B370000-0x00007FF78B5C4000-memory.dmpFilesize
2.3MB
-
memory/3748-72-0x0000000005EC0000-0x0000000005FCA000-memory.dmpFilesize
1.0MB
-
memory/3748-55-0x0000000074640000-0x0000000074DF1000-memory.dmpFilesize
7.7MB
-
memory/3748-43-0x00000000013A0000-0x00000000013C2000-memory.dmpFilesize
136KB
-
memory/3748-58-0x00000000058C0000-0x0000000005926000-memory.dmpFilesize
408KB
-
memory/3748-61-0x0000000006350000-0x0000000006968000-memory.dmpFilesize
6.1MB
-
memory/3748-63-0x0000000005D90000-0x0000000005DA2000-memory.dmpFilesize
72KB
-
memory/3748-221-0x00000000058B0000-0x00000000058C0000-memory.dmpFilesize
64KB
-
memory/3748-75-0x00000000058B0000-0x00000000058C0000-memory.dmpFilesize
64KB
-
memory/3748-376-0x0000000074640000-0x0000000074DF1000-memory.dmpFilesize
7.7MB
-
memory/3748-212-0x0000000074640000-0x0000000074DF1000-memory.dmpFilesize
7.7MB
-
memory/3748-208-0x00000000076D0000-0x0000000007720000-memory.dmpFilesize
320KB
-
memory/3748-190-0x0000000007490000-0x00000000074AE000-memory.dmpFilesize
120KB
-
memory/3748-178-0x0000000007510000-0x0000000007586000-memory.dmpFilesize
472KB
-
memory/3748-168-0x00000000079C0000-0x0000000007EEC000-memory.dmpFilesize
5.2MB
-
memory/3748-153-0x00000000072C0000-0x0000000007482000-memory.dmpFilesize
1.8MB
-
memory/3748-136-0x0000000006FB0000-0x0000000006FFC000-memory.dmpFilesize
304KB
-
memory/4164-95-0x000002230D4E0000-0x000002230D4E6000-memory.dmpFilesize
24KB
-
memory/4164-418-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-343-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-348-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-360-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-366-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-331-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-326-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-375-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-96-0x00007FF9BECB0000-0x00007FF9BF772000-memory.dmpFilesize
10.8MB
-
memory/4164-395-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-291-0x0000022327B60000-0x0000022327B70000-memory.dmpFilesize
64KB
-
memory/4164-290-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-405-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-410-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-336-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-297-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-429-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-387-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-313-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-307-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-280-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-276-0x0000022327C70000-0x0000022327EE1000-memory.dmpFilesize
2.4MB
-
memory/4164-263-0x0000022327C70000-0x0000022327EE6000-memory.dmpFilesize
2.5MB
-
memory/4164-222-0x00007FF9BECB0000-0x00007FF9BF772000-memory.dmpFilesize
10.8MB
-
memory/4164-98-0x0000022327B60000-0x0000022327B70000-memory.dmpFilesize
64KB
-
memory/4228-214-0x0000000004A60000-0x0000000004ACC000-memory.dmpFilesize
432KB
-
memory/4228-213-0x0000000002F00000-0x0000000003000000-memory.dmpFilesize
1024KB
-
memory/4228-220-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/4228-361-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB