Overview

overview

10

Static

static

3

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-1703-x64

10

New Text D...od.exe

windows10-2004-x64

10

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

09-04-2024 07:01

240409-htps3scd2w 10

09-04-2024 07:01

240409-htf6yacc9x 10

09-04-2024 07:00

240409-hs6p7scc81 10

09-04-2024 07:00

240409-hss44scc7z 10

07-03-2024 22:29

240307-2eh7jagg41 10

Analysis

  • max time kernel
    300s
  • max time network
    305s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-04-2024 07:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
asyncratmetasploitredlineremcosstealcxwormzgrat6077866846remotehostbackdoordiscoveryevasioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

6077866846

C2

https://pastebin.com/raw/KE5Mft0T

Extracted

Family

metasploit

Version

metasploit_stager

C2

91.92.247.21:8405

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Extracted

Family

remcos

Botnet

RemoteHost

C2

shgoini.com:30902

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7XHN5V

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

xworm

C2

94.156.8.213:58002

127.0.0.1:18356

t-brave.gl.at.ply.gg:18356
Attributes
  • Install_directory

    %Public%

  • install_file

    svchost.exe

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Detect Xworm Payload 4 IoCs
  • Detect ZGRat V1 35 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Modifies security service 2 TTPs 2 IoCs
    evasion
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 5 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
      "C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3300
    • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
      "C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"
      2⤵
      • Executes dropped EXE
      PID:2588
    • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
      "C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:536
    • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
      "C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3616
    • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
      "C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3012
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell Add-MpPreference -ExclusionExtension .exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5080
      • C:\Windows\Temp\Temp.exe
        "C:\Windows\Temp\Temp.exe" -s
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6036
        • C:\Windows\Temp\Temp.exe
          C:\Windows\Temp\Temp.exe -s
          4⤵
          • Modifies security service
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          PID:1752
      • C:\Windows\SysWOW64\MService.exe
        "C:\Windows\SysWOW64\MService.exe"
        3⤵
        • Executes dropped EXE
        PID:6032
    • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
      "C:\Users\Admin\AppData\Local\Temp\a\Props.exe"
      2⤵
      • Executes dropped EXE
      PID:1080
    • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
      "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3760
      • C:\Users\Admin\AppData\Local\directory\word.exe
        "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4128
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
          4⤵
            PID:5156
      • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
        "C:\Users\Admin\AppData\Local\Temp\a\1234.exe"
        2⤵
        • Executes dropped EXE
        PID:5340
      • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
        "C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5464
        • C:\Users\Admin\AppData\Local\Temp\u47s.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u47s.0.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:5160
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HDGCAAFBFB.exe"
            4⤵
              PID:4744
              • C:\Users\Admin\AppData\Local\Temp\HDGCAAFBFB.exe
                "C:\Users\Admin\AppData\Local\Temp\HDGCAAFBFB.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:5576
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\HDGCAAFBFB.exe
                  6⤵
                    PID:3228
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 2.2.2.2 -n 1 -w 3000
                      7⤵
                      • Runs ping.exe
                      PID:5628
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 2372
                4⤵
                • Program crash
                PID:5840
            • C:\Users\Admin\AppData\Local\Temp\u47s.1.exe
              "C:\Users\Admin\AppData\Local\Temp\u47s.1.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2940
              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1732
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 1628
              3⤵
              • Program crash
              PID:5420
          • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
            "C:\Users\Admin\AppData\Local\Temp\a\test2.exe"
            2⤵
            • Blocklisted process makes network request
            • Executes dropped EXE
            PID:6124
          • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
            "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
            2⤵
            • Executes dropped EXE
            PID:624
          • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
            "C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4328
            • C:\Users\Admin\AppData\Local\Temp\u3c8.0.exe
              "C:\Users\Admin\AppData\Local\Temp\u3c8.0.exe"
              3⤵
              • Executes dropped EXE
              PID:4148
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 812
                4⤵
                • Program crash
                PID:3496
            • C:\Users\Admin\AppData\Local\Temp\u3c8.1.exe
              "C:\Users\Admin\AppData\Local\Temp\u3c8.1.exe"
              3⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:5268
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 1424
              3⤵
              • Program crash
              PID:5288
          • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
            "C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2480
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4832
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:6124
          • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5380
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"
              3⤵
              • Creates scheduled task(s)
              PID:5864
          • C:\Users\Admin\AppData\Local\Temp\a\555.exe
            "C:\Users\Admin\AppData\Local\Temp\a\555.exe"
            2⤵
            • Executes dropped EXE
            PID:3988
          • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
            "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:3524
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:5800
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4184
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp86A0.tmp"
              3⤵
              • Creates scheduled task(s)
              PID:836
            • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
              "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
              3⤵
              • Executes dropped EXE
              PID:4452
            • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
              "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:5352
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit
                4⤵
                  PID:3968
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'
                    5⤵
                    • Creates scheduled task(s)
                    PID:2844
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9E10.tmp.bat""
                  4⤵
                    PID:180
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout 3
                      5⤵
                      • Delays execution with timeout.exe
                      PID:3596
                    • C:\Users\Admin\AppData\Roaming\msdtc.exe
                      "C:\Users\Admin\AppData\Roaming\msdtc.exe"
                      5⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4692
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"
                        6⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5984
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"
                        6⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5776
                      • C:\Windows\SysWOW64\schtasks.exe
                        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFF3B.tmp"
                        6⤵
                        • Creates scheduled task(s)
                        PID:5480
                      • C:\Users\Admin\AppData\Roaming\msdtc.exe
                        "C:\Users\Admin\AppData\Roaming\msdtc.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5424
              • C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe
                "C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe"
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1384
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe'
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3332
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BrawlB0t.exe'
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3780
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5608
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3992
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
                  3⤵
                  • Creates scheduled task(s)
                  PID:2892
              • C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
                "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:1040
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                  "C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5592
              • C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
                "C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"
                2⤵
                • Executes dropped EXE
                PID:1888
              • C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
                "C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"
                2⤵
                • Executes dropped EXE
                PID:3560
              • C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
                "C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:5308
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  3⤵
                  • Modifies system certificate store
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5336
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 792
                  3⤵
                  • Program crash
                  PID:3872
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5464 -ip 5464
              1⤵
                PID:5288
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4328 -ip 4328
                1⤵
                  PID:4548
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5160 -ip 5160
                  1⤵
                    PID:6060
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4148 -ip 4148
                    1⤵
                      PID:5840
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5308 -ip 5308
                      1⤵
                        PID:3732
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4312
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k swprv
                        1⤵
                          PID:4328
                        • C:\Users\Public\svchost.exe
                          C:\Users\Public\svchost.exe
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5340
                        • C:\Windows\System32\RuntimeBroker.exe
                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                          1⤵
                            PID:3524
                          • C:\Users\Admin\AppData\Roaming\OneDrive.exe
                            C:\Users\Admin\AppData\Roaming\OneDrive.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3276
                          • C:\Windows\svchost.exe
                            C:\Windows\svchost.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of SetWindowsHookEx
                            PID:2840
                          • C:\Users\Admin\AppData\Roaming\OneDrive.exe
                            C:\Users\Admin\AppData\Roaming\OneDrive.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5360
                          • C:\Users\Admin\AppData\Roaming\OneDrive.exe
                            C:\Users\Admin\AppData\Roaming\OneDrive.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1132

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Scheduled Task/Job

                          1
                          T1053

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Scheduled Task/Job

                          1
                          T1053

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Scheduled Task/Job

                          1
                          T1053

                          Defense Evasion

                          Impair Defenses

                          1
                          T1562

                          Disable or Modify Tools

                          1
                          T1562.001

                          Modify Registry

                          4
                          T1112

                          Subvert Trust Controls

                          1
                          T1553

                          Install Root Certificate

                          1
                          T1553.004

                          Credential Access

                          Unsecured Credentials

                          3
                          T1552

                          Credentials In Files

                          3
                          T1552.001

                          Discovery

                          Peripheral Device Discovery

                          1
                          T1120

                          Query Registry

                          5
                          T1012

                          Remote System Discovery

                          1
                          T1018

                          System Information Discovery

                          4
                          T1082

                          Lateral Movement

                          Collection

                          Data from Local System

                          3
                          T1005

                          Command and Control

                          Web Service

                          1
                          T1102

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\ProgramData\Are.docx
                            Filesize

                            11KB

                            MD5

                            a33e5b189842c5867f46566bdbf7a095

                            SHA1

                            e1c06359f6a76da90d19e8fd95e79c832edb3196

                            SHA256

                            5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                            SHA512

                            f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                            Download Submit

                          • C:\ProgramData\mozglue.dll
                            Filesize

                            593KB

                            MD5

                            c8fd9be83bc728cc04beffafc2907fe9

                            SHA1

                            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                            SHA256

                            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                            SHA512

                            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                            Download Submit

                          • C:\ProgramData\nss3.dll
                            Filesize

                            2.0MB

                            MD5

                            1cc453cdf74f31e4d913ff9c10acdde2

                            SHA1

                            6e85eae544d6e965f15fa5c39700fa7202f3aafe

                            SHA256

                            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                            SHA512

                            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                            Filesize

                            2KB

                            MD5

                            d85ba6ff808d9e5444a4b369f5bc2730

                            SHA1

                            31aa9d96590fff6981b315e0b391b575e4c0804a

                            SHA256

                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                            SHA512

                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            944B

                            MD5

                            cadef9abd087803c630df65264a6c81c

                            SHA1

                            babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                            SHA256

                            cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                            SHA512

                            7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\HDGCAAFBFB.exe
                            Filesize

                            106KB

                            MD5

                            fe380780b5c35bd6d54541791151c2be

                            SHA1

                            7fe3a583cf91474c733f85cebf3c857682e269e1

                            SHA256

                            b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

                            SHA512

                            ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe
                            Filesize

                            6KB

                            MD5

                            f7930c4859ccd34bd2b80a9995f49926

                            SHA1

                            8b5b95fb51619e20246f90d60f2137da7654fc5e

                            SHA256

                            163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a

                            SHA512

                            8f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\Maianthemum
                            Filesize

                            29KB

                            MD5

                            1680954b249062aa27483ac80d9d2016

                            SHA1

                            acb196e38638fa7332a450b8ed9c127f1d56acff

                            SHA256

                            3614592179f15f4bc0cba05bac8e9dd7e545e6f623bd71b841aaa665f82b16cb

                            SHA512

                            9c94ec10f0577953a6bbc994b1339d9e414622efd07e4a61f31c5213f588d7327bd772c225a7a127736b721ec026ff836cf4167f9467dbf6df819bdec6e2ed93

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\Tmp604B.tmp
                            Filesize

                            2KB

                            MD5

                            1420d30f964eac2c85b2ccfe968eebce

                            SHA1

                            bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                            SHA256

                            f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                            SHA512

                            6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_duay5ppl.5gz.psm1
                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\1111.exe
                            Filesize

                            2.8MB

                            MD5

                            e670bdc7c82eee75a6d3ada6a7c9134e

                            SHA1

                            b0f0bab6f6e92bc86e86fd7bff93c257a4235859

                            SHA256

                            a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb

                            SHA512

                            7384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\1234.exe
                            Filesize

                            1.3MB

                            MD5

                            5e13199a94cf8664e5bfbe2f68d4738e

                            SHA1

                            8cfaa21f68226ae775615f033507b5756f5ccacc

                            SHA256

                            71b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5

                            SHA512

                            b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\555.exe
                            Filesize

                            2.7MB

                            MD5

                            7162024dc024bb3311ee1cf81f37a791

                            SHA1

                            be03705f33a8205f90330814f525e2e53dfb5871

                            SHA256

                            3e39efae22fcda501f858229af27be129f178c85723d4477ef9be2f80b61a8fd

                            SHA512

                            94652b8b770fcdd70ee5059b56ce84aee50c46901b6311e2a602cdb4d97b15abd0148ba4e55f225f722d125bf9c3969185bcefaf07f3911a4347d9a0ca8d2d38

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe
                            Filesize

                            334KB

                            MD5

                            cd77e00b04bc4ad0ccb96a7819c9dda8

                            SHA1

                            f41f6ccb7a4117f8b646940caf501c2d8904e336

                            SHA256

                            3a14bf440814f53b7260a37dcc2a422f6a3859cfada26a143496be81e41f0706

                            SHA512

                            9f06c96fa6c8cd4b7adc50b7915b4cbb4e171f1180ecf0e56d31890dade54983bf1c014badb6f26ffd708dfd2a566659a2deefa0bc05280b2914c521575281a1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\BrawlB0t.exe
                            Filesize

                            65KB

                            MD5

                            3a71554c4a1b0665bbe63c19e85b5182

                            SHA1

                            9d90887ff8b7b160ffc7b764de8ee813db880a89

                            SHA256

                            9340551164eb763cd63db1f251b535dea497edfcf1eb46febcb642b1369f8595

                            SHA512

                            49c869db9a74c8054a477396c205685f41d4fe79ed1bb9088c1d528d7df8dfd1e251ec016939a0207484e6fd2f3338afad06b4f242c7fcb5d16d2293db16e772

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\Document.exe
                            Filesize

                            492KB

                            MD5

                            0eec3b50636ae6d37613e6a2c7617191

                            SHA1

                            630d5e3b88215d88432db42d2bd295c6d4b55ee8

                            SHA256

                            32dc8827ff96982401777cd7feb77798660450a3e8960855577e8ace837f8b05

                            SHA512

                            9a2088cce7ed6da8e2f13f2486925e7565b50a6c527363f0da19ff28910314fb9723496dfe3ddf0a977d1b0c8ff1661f0ae6bc3789332534ad0bea3cbafbdc12

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe
                            Filesize

                            413KB

                            MD5

                            d388d6918f1e8a6a3b34ad993d8159eb

                            SHA1

                            cf3cd31a4dd6571cc78016c7b0f97f621b1f253d

                            SHA256

                            27d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645

                            SHA512

                            54cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe
                            Filesize

                            413KB

                            MD5

                            94e9960a45131af61e599acee54d21d6

                            SHA1

                            39b03e050337d4eb127ae5ff5f0868e986bec7ad

                            SHA256

                            7add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172

                            SHA512

                            179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\MStore.exe
                            Filesize

                            12KB

                            MD5

                            282c1ebb16ad0edc41389d1e73a74607

                            SHA1

                            fbcdda121484ea6125827ed4e7b1b00f6a88835d

                            SHA256

                            7712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc

                            SHA512

                            94be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe
                            Filesize

                            611KB

                            MD5

                            dbdcbacbc74b139d914747690ebe0e1c

                            SHA1

                            a43a5232d84e4f40e2103aa43ab4a98ce2495369

                            SHA256

                            54fbd0b6c760f3f0892bd7fabeb6bbad9444a013a024e8a22813c0c0a77d6c18

                            SHA512

                            74cfc6270d88c13ba030dfd5c3312920cd1bf0f3fa61ceb27d6a9ec64c1855f72a0f9f5eb14ab781eb7a1dab31effc5c49c1ac1cab395da143ba883e6d46a2d1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\Props.exe
                            Filesize

                            7KB

                            MD5

                            9c938f91a0530150a2b1c4546334570c

                            SHA1

                            f4ae9acba920744457739fef0205f86443dbdf65

                            SHA256

                            35a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a

                            SHA512

                            f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\Tester.exe
                            Filesize

                            267KB

                            MD5

                            0803c1aec008e75859877844cfa81492

                            SHA1

                            16924d5802ddf76a2096fcfade0ce06d4c0670bd

                            SHA256

                            d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3

                            SHA512

                            9001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe
                            Filesize

                            524KB

                            MD5

                            c8edf453ed433cefb2696bb859e0f782

                            SHA1

                            e34cf939d6c5a34c7bedfd885249bb7fb15336e5

                            SHA256

                            0c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0

                            SHA512

                            61d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe
                            Filesize

                            294KB

                            MD5

                            10fc8b2915c43aa16b6a2e2b4529adc5

                            SHA1

                            0c15286457963eb86d61d83642870a3473ef38fe

                            SHA256

                            feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5

                            SHA512

                            421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe
                            Filesize

                            2.3MB

                            MD5

                            262a7eb58a01d1aab21b24292c181cd3

                            SHA1

                            535312b7048fb90be981e04ea759c5ad8aaf6eda

                            SHA256

                            107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6

                            SHA512

                            358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe
                            Filesize

                            1.1MB

                            MD5

                            b915133065e8c357f8b37e28015088fe

                            SHA1

                            61286d2adea00cab97ade25d5221d7cfc36a580b

                            SHA256

                            3d79bf5d780b6770babf2f2cba5549a01992d4e77f797292e2f4a3ecd668379c

                            SHA512

                            69e6b492e3b36e55fd64608067d3b7329adb8890fd712e64b845943c5902ef1c983a388bfbfdeff646bc4ddab94c308b26de3b7c04ceea2bed52fc11acf759fc

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\pclient.exe
                            Filesize

                            157KB

                            MD5

                            5790d1417f8f00bd7ec6fb7011c79d9c

                            SHA1

                            36076ed9457c45d94e664ea291eb01e5c70d084b

                            SHA256

                            ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82

                            SHA512

                            b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe
                            Filesize

                            1.1MB

                            MD5

                            cb4c21ab082d4acc4712089f4cd517b8

                            SHA1

                            7d46bc7ad10c7fba5c9fa982eb19b96f9278d5d5

                            SHA256

                            e72f17d6111a1a7b814f0b10a708b7e5edadb990f19b6dc95014b65a8dd2d144

                            SHA512

                            52fb1180b986342705f36d81901887f1f05dabd058cd37e056044e6a5334551aaa5607599fe56952f86fb30696ed2b227ba94df081b7583848dd6946660709a2

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
                            Filesize

                            66KB

                            MD5

                            00135a86ab829fc2d4678179d7a6e70f

                            SHA1

                            ef75c259865d7685d566b6e25b7a20d134952555

                            SHA256

                            0b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89

                            SHA512

                            011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\test2.exe
                            Filesize

                            2.7MB

                            MD5

                            5347852b24409aed42423f0118637f03

                            SHA1

                            6c7947428231ab857ee8c9dab7a7e62fdeed024b

                            SHA256

                            a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131

                            SHA512

                            0a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
                            Filesize

                            1.3MB

                            MD5

                            ddee86f4db0d3b8010110445b0545526

                            SHA1

                            b41380b50d17dd679f85a224771398b81966bb9e

                            SHA256

                            0d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5

                            SHA512

                            4271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\croc
                            Filesize

                            483KB

                            MD5

                            ceea497fc0601e397a9b0dba479b6ad3

                            SHA1

                            b791fd1115d9517d7e9cb9a987db2307aa900f67

                            SHA256

                            a17f87f849572c5977fa38198d6697a248424f2559aed98136834e188ac2d3f2

                            SHA512

                            702cff5d69b609e25d75545f58352aecf7ed28730c012f3a4ce6113842ebcda3308bc05e7658c27a260dec0bebaf25cad2bda1bff476aa79b2bb0ed4ad561858

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                            Filesize

                            2KB

                            MD5

                            50a625755849d0cc7bdc151bc38c25c0

                            SHA1

                            468f092c4188df277e222733f40d56b658311f71

                            SHA256

                            b615f921ef72d3c54e3b3d75e1567711537f4bde897de1458059cd90a851b1ee

                            SHA512

                            8ca0ad6b150821236ba2fb24b9488d0c692a90045d9cd4df033a94dcd3b01f2480b48403c6d6fd1ea3538f755408b257733ea815d00aeae0139b3f1cbff59237

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                            Filesize

                            3KB

                            MD5

                            dc5e6e17c1260a944ec934dd93375e9b

                            SHA1

                            3911d14e295d9705d1820d06fe72f0407f12beaa

                            SHA256

                            fb5127bc6980e2d1376452eff6b139b216d27e13f7e00ea7fff71a788806bf00

                            SHA512

                            f7ff2b39663590330d40abe5e8a6dfac513864a4a6c29c61c9a8e8b71599405b8ac392fa1416a2a05eb434ec97114979b79b101592459ee280a4703a98d311ee

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                            Filesize

                            3KB

                            MD5

                            a2a28c6474a8b3db22cc884825ff14c9

                            SHA1

                            0f36342aac73c87f0bf2f3146dbe80da21411e37

                            SHA256

                            496a3e540ef5708ffff24036802e01018585bf3d24fb044e30f5ccf7cde797a7

                            SHA512

                            cafa623bf6cfaa3c47dc76ab696fc391288f0139b66c006931aaf579b3f92237ba8d474dc1d072bcfa83368d7a85979401dd1d01764b320b60373ed40dee773d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\u47s.0.exe
                            Filesize

                            271KB

                            MD5

                            b95747cad90e982d44da8fd74f50b9a6

                            SHA1

                            d7f267d2042f6b67f63542395ff6a5a1b3ba1250

                            SHA256

                            7b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153

                            SHA512

                            615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\u47s.1.exe
                            Filesize

                            4.6MB

                            MD5

                            397926927bca55be4a77839b1c44de6e

                            SHA1

                            e10f3434ef3021c399dbba047832f02b3c898dbd

                            SHA256

                            4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                            SHA512

                            cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                            Download Submit

                          • C:\Users\Admin\AppData\Local\directory\word.exe
                            Filesize

                            5.9MB

                            MD5

                            b8d15843845eb1191115a7b3225f2647

                            SHA1

                            b1f993e00691d4fa70d5b99ad6ec2896e09e13fd

                            SHA256

                            1125f32807386e933c432a8e3d3e960c2b2e800b290662d5cceeb27e362ff529

                            SHA512

                            20113d5f462b56dc075825fd28165327f69ac49612fc3cc577ab5f6983aadb9c61b1ab6a14f0f5912db3946af8b4c73a38fb55b2830bd3690d29af837ea1d3c5

                            Download Submit

                          • C:\Users\Admin\AppData\Local\directory\word.exe
                            Filesize

                            6.3MB

                            MD5

                            f185eede3c382d8a81751d64c0928ed5

                            SHA1

                            d56229b00eabb3ee28be724a45333cdee52ccf12

                            SHA256

                            3aaf47a40d8a3b7e67a4024b5ba941e3aab9b00b64a5c923656810b9150a0dcf

                            SHA512

                            97aababaeddca26fa442774ab6401c68d135e477c6aa98a6f3b8f7683f5c06c4e459df5a9d697cd31e8219a049738003ac8e9d3a0879edd26bd231072247649b

                            Download Submit

                          • memory/1080-74-0x0000000140000000-0x0000000140004278-memory.dmp

                            Filesize

                            16KB

                            Download

                          • memory/1384-1634-0x0000000000AC0000-0x0000000000AD6000-memory.dmp

                            Filesize

                            88KB

                            Download

                          • memory/1732-1541-0x000001ACDA3E0000-0x000001ACDA404000-memory.dmp

                            Filesize

                            144KB

                            Download

                          • memory/1732-1538-0x000001ACBF650000-0x000001ACBF664000-memory.dmp

                            Filesize

                            80KB

                            Download

                          • memory/1732-1535-0x000001ACC10D0000-0x000001ACC10DC000-memory.dmp

                            Filesize

                            48KB

                            Download

                          • memory/1732-1531-0x000001ACDA2C0000-0x000001ACDA3D0000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/1732-1533-0x000001ACBF630000-0x000001ACBF640000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1732-1508-0x000001ACBB930000-0x000001ACBF228000-memory.dmp

                            Filesize

                            57.0MB

                            Download

                          • memory/2480-1308-0x00007FFC76060000-0x00007FFC76B21000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/2480-1300-0x0000000001530000-0x0000000001540000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/2480-1280-0x0000000000CB0000-0x0000000000CFA000-memory.dmp

                            Filesize

                            296KB

                            Download

                          • memory/2940-581-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/3300-27-0x00000000059C0000-0x0000000005ACA000-memory.dmp

                            Filesize

                            1.0MB

                            Download

                          • memory/3300-186-0x0000000074CB0000-0x0000000075460000-memory.dmp

                            Filesize

                            7.7MB

                            Download

                          • memory/3300-102-0x0000000006F90000-0x0000000007022000-memory.dmp

                            Filesize

                            584KB

                            Download

                          • memory/3300-11-0x0000000000BB0000-0x0000000000BD2000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/3300-1301-0x0000000074CB0000-0x0000000075460000-memory.dmp

                            Filesize

                            7.7MB

                            Download

                          • memory/3300-120-0x0000000007140000-0x00000000071B6000-memory.dmp

                            Filesize

                            472KB

                            Download

                          • memory/3300-90-0x00000000074C0000-0x00000000079EC000-memory.dmp

                            Filesize

                            5.2MB

                            Download

                          • memory/3300-15-0x0000000074CB0000-0x0000000075460000-memory.dmp

                            Filesize

                            7.7MB

                            Download

                          • memory/3300-24-0x0000000005350000-0x00000000053B6000-memory.dmp

                            Filesize

                            408KB

                            Download

                          • memory/3300-87-0x0000000006DC0000-0x0000000006F82000-memory.dmp

                            Filesize

                            1.8MB

                            Download

                          • memory/3300-38-0x0000000006A80000-0x0000000006ACC000-memory.dmp

                            Filesize

                            304KB

                            Download

                          • memory/3300-106-0x0000000007FA0000-0x0000000008544000-memory.dmp

                            Filesize

                            5.6MB

                            Download

                          • memory/3300-37-0x0000000006A40000-0x0000000006A7C000-memory.dmp

                            Filesize

                            240KB

                            Download

                          • memory/3300-36-0x0000000005340000-0x0000000005350000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3300-118-0x0000000007030000-0x0000000007080000-memory.dmp

                            Filesize

                            320KB

                            Download

                          • memory/3300-135-0x00000000070A0000-0x00000000070BE000-memory.dmp

                            Filesize

                            120KB

                            Download

                          • memory/3300-26-0x0000000005890000-0x00000000058A2000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/3300-25-0x0000000005E20000-0x0000000006438000-memory.dmp

                            Filesize

                            6.1MB

                            Download

                          • memory/3524-1612-0x00000000003B0000-0x000000000042C000-memory.dmp

                            Filesize

                            496KB

                            Download

                          • memory/3524-1648-0x00000000050E0000-0x00000000050FA000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/3524-1628-0x0000000004CE0000-0x0000000004CEA000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/3616-193-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-166-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-56-0x000001BB1BC60000-0x000001BB1BC66000-memory.dmp

                            Filesize

                            24KB

                            Download

                          • memory/3616-210-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-212-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-215-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-203-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-201-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-57-0x00007FFC76060000-0x00007FFC76B21000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/3616-58-0x000001BB1C040000-0x000001BB1C050000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3616-134-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-199-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-119-0x000001BB362B0000-0x000001BB36526000-memory.dmp

                            Filesize

                            2.5MB

                            Download

                          • memory/3616-197-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-121-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-122-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-394-0x000001BB1C040000-0x000001BB1C050000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3616-124-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-184-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-126-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-192-0x00007FFC76060000-0x00007FFC76B21000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/3616-187-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-182-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-180-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-172-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-177-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-128-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-130-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-137-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-162-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-132-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-158-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-206-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-139-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-141-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-154-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3616-145-0x000001BB362B0000-0x000001BB36521000-memory.dmp

                            Filesize

                            2.4MB

                            Download

                          • memory/3760-117-0x0000000002000000-0x0000000002004000-memory.dmp

                            Filesize

                            16KB

                            Download

                          • memory/4148-1390-0x0000000000400000-0x0000000002D21000-memory.dmp

                            Filesize

                            41.1MB

                            Download

                          • memory/4148-1375-0x0000000002D80000-0x0000000002E80000-memory.dmp

                            Filesize

                            1024KB

                            Download

                          • memory/4328-1272-0x0000000003000000-0x0000000003100000-memory.dmp

                            Filesize

                            1024KB

                            Download

                          • memory/4328-1298-0x0000000000400000-0x0000000002D44000-memory.dmp

                            Filesize

                            41.3MB

                            Download

                          • memory/4328-1543-0x0000000000400000-0x0000000002D44000-memory.dmp

                            Filesize

                            41.3MB

                            Download

                          • memory/4356-89-0x0000000002610000-0x0000000002620000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4356-1-0x00007FFC76060000-0x00007FFC76B21000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/4356-2-0x0000000002610000-0x0000000002620000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4356-0-0x0000000000530000-0x0000000000538000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/4356-88-0x00007FFC76060000-0x00007FFC76B21000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/5080-93-0x00007FFC76060000-0x00007FFC76B21000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/5080-85-0x00007FFC76060000-0x00007FFC76B21000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/5080-86-0x000001BD787F0000-0x000001BD78800000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/5080-84-0x000001BD7B260000-0x000001BD7B282000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/5156-392-0x0000000000400000-0x0000000000482000-memory.dmp

                            Filesize

                            520KB

                            Download

                          • memory/5160-311-0x0000000002EB0000-0x0000000002FB0000-memory.dmp

                            Filesize

                            1024KB

                            Download

                          • memory/5160-324-0x0000000000400000-0x0000000002D21000-memory.dmp

                            Filesize

                            41.1MB

                            Download

                          • memory/5160-314-0x0000000004950000-0x0000000004977000-memory.dmp

                            Filesize

                            156KB

                            Download

                          • memory/5380-1302-0x00007FFC76060000-0x00007FFC76B21000-memory.dmp

                            Filesize

                            10.8MB

                            Download

                          • memory/5380-1294-0x0000000000450000-0x0000000000466000-memory.dmp

                            Filesize

                            88KB

                            Download

                          • memory/5464-196-0x00000000049E0000-0x0000000004A4C000-memory.dmp

                            Filesize

                            432KB

                            Download

                          • memory/5464-205-0x0000000000400000-0x0000000002D44000-memory.dmp

                            Filesize

                            41.3MB

                            Download

                          • memory/5464-642-0x0000000000400000-0x0000000002D44000-memory.dmp

                            Filesize

                            41.3MB

                            Download

                          • memory/5464-194-0x0000000003040000-0x0000000003140000-memory.dmp

                            Filesize

                            1024KB

                            Download

                          • memory/5576-1658-0x0000000000040000-0x0000000000060000-memory.dmp

                            Filesize

                            128KB

                            Download