Resubmissions
09-04-2024 07:01
240409-htps3scd2w 1009-04-2024 07:01
240409-htf6yacc9x 1009-04-2024 07:00
240409-hs6p7scc81 1009-04-2024 07:00
240409-hss44scc7z 1007-03-2024 22:29
240307-2eh7jagg41 10Analysis
-
max time kernel
1799s -
max time network
1801s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
09-04-2024 07:01
General
-
Target
New Text Document mod.exe
-
Size
8KB
-
MD5
69994ff2f00eeca9335ccd502198e05b
-
SHA1
b13a15a5bea65b711b835ce8eccd2a699a99cead
-
SHA256
2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
-
SHA512
ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
-
SSDEEP
96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
Malware Config
Extracted
redline
6077866846
https://pastebin.com/raw/KE5Mft0T
Extracted
metasploit
metasploit_stager
91.92.247.21:8405
Extracted
xworm
94.156.8.213:58002
-
Install_directory
%Public%
-
install_file
svchost.exe
Extracted
socks5systemz
http://bobzrji.com/search/?q=67e28dd8645fa72f495daa1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ffd17c4e6959d3c
http://bobzrji.com/search/?q=67e28dd8645fa72f495daa1c7c27d78406abdd88be4b12eab517aa5c96bd86ee928e4b815a8bbc896c58e713bc90c91836b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be510b866db52bee348ee4c2b14a82966836f23d7f210c7ee979c3fc46f9111
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Detect Xworm Payload 2 IoCs
-
Detect ZGRat V1 32 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Stealc
Stealc is an infostealer written in C++.
-
Xworm
Xworm is a remote access trojan written in C#.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 59 IoCs
-
Loads dropped DLL 7 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 8 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Modifies data under HKEY_USERS 5 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 11 IoCs
-
Suspicious use of SendNotifyMessage 11 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zMsQmlSM.exe"C:\Users\Admin\AppData\Local\Temp\zMsQmlSM.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionExtension .exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exe"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exe"C:\Users\Admin\AppData\Local\Temp\a\1234.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u1s0.0.exe"C:\Users\Admin\AppData\Local\Temp\u1s0.0.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exe"C:\Users\Admin\AppData\Local\Temp\a\test2.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exe"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uvk.0.exe"C:\Users\Admin\AppData\Local\Temp\uvk.0.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe"C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\DAAECAFHDB.exe6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30007⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\uvk.1.exe"C:\Users\Admin\AppData\Local\Temp\uvk.1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD14⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\555.exe"C:\Users\Admin\AppData\Local\Temp\a\555.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp297C.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"' & exit4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "msdtc" /tr '"C:\Users\Admin\AppData\Roaming\msdtc.exe"'5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp65CA.tmp.bat""4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYVTyaODtj.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYVTyaODtj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF22B.tmp"6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\msdtc.exe"C:\Users\Admin\AppData\Roaming\msdtc.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 7643⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe"C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe"C:\Users\Admin\AppData\Local\Temp\a\BroomSetup.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe"C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exe3⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30004⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\a\new1.exe"C:\Users\Admin\AppData\Local\Temp\a\new1.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\a\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\a\razdva.exe"C:\Users\Admin\AppData\Local\Temp\a\razdva.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 7643⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup5.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u46s.0.exe"C:\Users\Admin\AppData\Local\Temp\u46s.0.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u46s.1.exe"C:\Users\Admin\AppData\Local\Temp\u46s.1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe"C:\Users\Admin\AppData\Local\Temp\a\mstsc.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted_097f1784.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 7643⤵
- Program crash
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\june.exe"C:\Users\Admin\AppData\Local\Temp\a\june.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-PVKLK.tmp\june.tmp"C:\Users\Admin\AppData\Local\Temp\is-PVKLK.tmp\june.tmp" /SL5="$302D6,3525916,54272,C:\Users\Admin\AppData\Local\Temp\a\june.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe"C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe" -i4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe"C:\Users\Admin\AppData\Local\Sun Vox\sunvox.exe" -s4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted_33cb9091.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 7643⤵
- Program crash
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
-
C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Virtualization/Sandbox Evasion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exeFilesize
444KB
MD52d2ca48b8c09de0645b7fd0223c922f0
SHA1de1f948065d612cd649564e466e362198f8ce3e6
SHA25672e63f73ced48b29f196e48030215273a17f7827c310f2747321cbc1f388c206
SHA512452f545f1f4d834a2cd92910fe5caa8c0f2ffdbaf2b3a0370c17f953422d37c13e10212219cae04fad93d07e81f370010a1951b29f2e83f78694ed68637d27bb
-
C:\ProgramData\Are.docxFilesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
C:\ProgramData\BAECFCAAFilesize
92KB
MD5cae9079afcb4c379869afa5d34181d8a
SHA1188e2435c533dd9633f5fcc09f245ddc1a78db2c
SHA2562be0a96da90da69fbc34b8e7747e89ce57dfc4fb58ed6c79e0fc21cb7c6791b7
SHA512ff7d863ebd1090219f07eaf2ac493f20b6ed11606e7f2c19536d764e730a8bb426fff26dc3890f0503c12329ea4a6c5d8812a0d1b69c19a29fbb8cb8366bd4fd
-
C:\ProgramData\MediaDevicePicker 3.0.194.66\MediaDevicePicker 3.0.194.66.exeFilesize
2.7MB
MD5c5bfeddc9eca9cb53ed7fe60814fd1b1
SHA1938470d19961f85e4cdac7541411a08b264d29ae
SHA256ce38cf464433dd7c4ea1d6823d3d6561552ce07996ef8da0b295447871504767
SHA5124a8001a6ba0e8874d787c8816b7a38f0c1b4a988294398e1e4e291cca1cb79168c04bf12174ce553e56d62fbe0901d982875229bef4e70b960b66d0178791192
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeFilesize
6KB
MD5f7930c4859ccd34bd2b80a9995f49926
SHA18b5b95fb51619e20246f90d60f2137da7654fc5e
SHA256163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a
SHA5128f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43
-
C:\Users\Admin\AppData\Local\Temp\TmpF656.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xjyntqow.2p3.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exeFilesize
2.8MB
MD5e670bdc7c82eee75a6d3ada6a7c9134e
SHA1b0f0bab6f6e92bc86e86fd7bff93c257a4235859
SHA256a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb
SHA5127384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exeFilesize
1.3MB
MD55e13199a94cf8664e5bfbe2f68d4738e
SHA18cfaa21f68226ae775615f033507b5756f5ccacc
SHA25671b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5
SHA512b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5
-
C:\Users\Admin\AppData\Local\Temp\a\555.exeFilesize
2.7MB
MD57162024dc024bb3311ee1cf81f37a791
SHA1be03705f33a8205f90330814f525e2e53dfb5871
SHA2563e39efae22fcda501f858229af27be129f178c85723d4477ef9be2f80b61a8fd
SHA51294652b8b770fcdd70ee5059b56ce84aee50c46901b6311e2a602cdb4d97b15abd0148ba4e55f225f722d125bf9c3969185bcefaf07f3911a4347d9a0ca8d2d38
-
C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exeFilesize
334KB
MD5cd77e00b04bc4ad0ccb96a7819c9dda8
SHA1f41f6ccb7a4117f8b646940caf501c2d8904e336
SHA2563a14bf440814f53b7260a37dcc2a422f6a3859cfada26a143496be81e41f0706
SHA5129f06c96fa6c8cd4b7adc50b7915b4cbb4e171f1180ecf0e56d31890dade54983bf1c014badb6f26ffd708dfd2a566659a2deefa0bc05280b2914c521575281a1
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exeFilesize
492KB
MD50eec3b50636ae6d37613e6a2c7617191
SHA1630d5e3b88215d88432db42d2bd295c6d4b55ee8
SHA25632dc8827ff96982401777cd7feb77798660450a3e8960855577e8ace837f8b05
SHA5129a2088cce7ed6da8e2f13f2486925e7565b50a6c527363f0da19ff28910314fb9723496dfe3ddf0a977d1b0c8ff1661f0ae6bc3789332534ad0bea3cbafbdc12
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exeFilesize
413KB
MD5d388d6918f1e8a6a3b34ad993d8159eb
SHA1cf3cd31a4dd6571cc78016c7b0f97f621b1f253d
SHA25627d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645
SHA51254cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exeFilesize
413KB
MD594e9960a45131af61e599acee54d21d6
SHA139b03e050337d4eb127ae5ff5f0868e986bec7ad
SHA2567add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172
SHA512179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a
-
C:\Users\Admin\AppData\Local\Temp\a\Ledger-Live.exeFilesize
106KB
MD5fe380780b5c35bd6d54541791151c2be
SHA17fe3a583cf91474c733f85cebf3c857682e269e1
SHA256b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53
SHA512ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exeFilesize
12KB
MD5282c1ebb16ad0edc41389d1e73a74607
SHA1fbcdda121484ea6125827ed4e7b1b00f6a88835d
SHA2567712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc
SHA51294be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292
-
C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exeFilesize
611KB
MD5dbdcbacbc74b139d914747690ebe0e1c
SHA1a43a5232d84e4f40e2103aa43ab4a98ce2495369
SHA25654fbd0b6c760f3f0892bd7fabeb6bbad9444a013a024e8a22813c0c0a77d6c18
SHA51274cfc6270d88c13ba030dfd5c3312920cd1bf0f3fa61ceb27d6a9ec64c1855f72a0f9f5eb14ab781eb7a1dab31effc5c49c1ac1cab395da143ba883e6d46a2d1
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exeFilesize
7KB
MD59c938f91a0530150a2b1c4546334570c
SHA1f4ae9acba920744457739fef0205f86443dbdf65
SHA25635a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a
SHA512f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b
-
C:\Users\Admin\AppData\Local\Temp\a\Retailer_prog.exeFilesize
5.5MB
MD53841b1904cbd678b426fe81a60c27f92
SHA1ad052c09da16ebee48a97ca57417d49856a0743a
SHA256e7d0715cf26299410027ceb06f4825efc011acc32897bb59a1b8b94f3fd7645a
SHA51276e34b825e0c5727a8033f4b04592dd0f21980915b23e83efdd0a8e4fdbef16d6bcbfabf99cdbd09233822e276b94dfe7a87242d3579fe89a5ce51a0985cc01f
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exeFilesize
267KB
MD50803c1aec008e75859877844cfa81492
SHA116924d5802ddf76a2096fcfade0ce06d4c0670bd
SHA256d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3
SHA5129001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9
-
C:\Users\Admin\AppData\Local\Temp\a\alexxxxxxxx.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exeFilesize
524KB
MD5c8edf453ed433cefb2696bb859e0f782
SHA1e34cf939d6c5a34c7bedfd885249bb7fb15336e5
SHA2560c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0
SHA51261d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exeFilesize
294KB
MD510fc8b2915c43aa16b6a2e2b4529adc5
SHA10c15286457963eb86d61d83642870a3473ef38fe
SHA256feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5
SHA512421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exeFilesize
2.3MB
MD5262a7eb58a01d1aab21b24292c181cd3
SHA1535312b7048fb90be981e04ea759c5ad8aaf6eda
SHA256107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6
SHA512358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exeFilesize
7.7MB
MD57aca152e7040f43dae201cfe01ce37b4
SHA183eb2fa2d400f96b241e61f81e4d80317eea0200
SHA256ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50
SHA51284415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4
-
C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exeFilesize
1.1MB
MD5b915133065e8c357f8b37e28015088fe
SHA161286d2adea00cab97ade25d5221d7cfc36a580b
SHA2563d79bf5d780b6770babf2f2cba5549a01992d4e77f797292e2f4a3ecd668379c
SHA51269e6b492e3b36e55fd64608067d3b7329adb8890fd712e64b845943c5902ef1c983a388bfbfdeff646bc4ddab94c308b26de3b7c04ceea2bed52fc11acf759fc
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exeFilesize
157KB
MD55790d1417f8f00bd7ec6fb7011c79d9c
SHA136076ed9457c45d94e664ea291eb01e5c70d084b
SHA256ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82
SHA512b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0
-
C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exeFilesize
1.1MB
MD5cb4c21ab082d4acc4712089f4cd517b8
SHA17d46bc7ad10c7fba5c9fa982eb19b96f9278d5d5
SHA256e72f17d6111a1a7b814f0b10a708b7e5edadb990f19b6dc95014b65a8dd2d144
SHA51252fb1180b986342705f36d81901887f1f05dabd058cd37e056044e6a5334551aaa5607599fe56952f86fb30696ed2b227ba94df081b7583848dd6946660709a2
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeFilesize
66KB
MD500135a86ab829fc2d4678179d7a6e70f
SHA1ef75c259865d7685d566b6e25b7a20d134952555
SHA2560b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89
SHA512011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exeFilesize
2.7MB
MD55347852b24409aed42423f0118637f03
SHA16c7947428231ab857ee8c9dab7a7e62fdeed024b
SHA256a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131
SHA5120a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exeFilesize
1.3MB
MD5ddee86f4db0d3b8010110445b0545526
SHA1b41380b50d17dd679f85a224771398b81966bb9e
SHA2560d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5
SHA5124271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exeFilesize
13KB
MD50c550ce9bb3efa8c3ce80a507cadfffa
SHA16559cb9db9c13147da5139cc3b8d9c60b914b667
SHA2560dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912
SHA512c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
3KB
MD567fa4e376e71c3995af225697e85dba3
SHA16b21f05dc9aeaf044ff120fdf787e9f832a80aef
SHA256b0317a573cb8d1bae4ba7304f80bd06a5da58276358ef02124ee2232578cfff5
SHA51285ed36acf69c836da70613eeb34b73992a00cd78553c84e0b303293f2f7c68a2d63fc76f7bf6fc82b8843fb845174a089d6691164d35c2f6d648c18d237fa758
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD50bedc93523a80c8772f2bdbc1fc6a65b
SHA179d3498e1711884acce546c3a894c96a3f31be77
SHA256b6ad22d0fe6447fe42207241516841ac26c9a8be755baac4267f4d0c4480b2ee
SHA51259d52cc478016e07e603c9b99210a357b72df0af223206f06b06b32fb163d0344c6be17198ac6820f6ae0a782d5fe95601f72acda21b9e5452a0ffcf36f4f8c2
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD5c6d843c694e8b162efc4647ba98f5943
SHA1579c3790f6047db5e978713e8ae8a7b7c03870fe
SHA256580ac539163dd7b1e33ecb20ed3f686735974b2690a4ba23f3dc5224cc033021
SHA512abf8ec6927aeb4be368200fa2911c2ea19e85cd0f1d53dc5cad300c38d59d425b34ea2bf0c7f7a3ac168c064cbdbed2b920666be1ff275ce023a4c480c91597b
-
C:\Users\Admin\AppData\Local\Temp\u1s0.0.exeFilesize
271KB
MD5b95747cad90e982d44da8fd74f50b9a6
SHA1d7f267d2042f6b67f63542395ff6a5a1b3ba1250
SHA2567b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153
SHA512615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c
-
C:\Users\Admin\AppData\Local\Temp\uvk.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Local\Temp\zMsQmlSM.exeFilesize
5KB
MD56a2c09749219d577535d0338c6cffe06
SHA1576b00c03455a518664308c976097097f691bca4
SHA25675b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c
SHA512cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-873560699-1074803302-2326074425-1000\685ee829b687ded4bbb145a391a94ee5_9251837d-e9a5-4229-9a78-b1085d98b1bbFilesize
2KB
MD50158fe9cead91d1b027b795984737614
SHA1b41a11f909a7bdf1115088790a5680ac4e23031b
SHA256513257326e783a862909a2a0f0941d6ff899c403e104fbd1dbc10443c41d9f9a
SHA512c48a55cc7a92cefcefe5fb2382ccd8ef651fc8e0885e88a256cd2f5d83b824b7d910f755180b29eccb54d9361d6af82f9cc741bd7e6752122949b657da973676
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-873560699-1074803302-2326074425-1000\76b53b3ec448f7ccdda2063b15d2bfc3_9251837d-e9a5-4229-9a78-b1085d98b1bbFilesize
2KB
MD5cb31d5c3dd7a8dda5731b399d09c7425
SHA18b0592aaba741040604d401125b014f383f6c709
SHA25625d15f9474e99306096fce00f106e23cee54fcca93d803aead7163875b7e0ab8
SHA51267cd928722e0ded099ced2f65c8b9019097083dd6a1061264dde53169809adb07ed6c537a74c2b4ab7576cf0eccc5cf5ad9a5d13b7baafdad30cbef92f66704b
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5bc66475ee3b9ba37ec6828944dadd734
SHA19b82600ed9625cd85c114473a66b2160aea60b0a
SHA2564c14b7589cf62d4a93c2e2e3f6b74c3b2424973df96e12dfbfb988cc6d29d409
SHA512e45e908918f2c08cc2a1fe85f268c858a6bfa082c792ce893ef649aeffe7d570b791236f70f6f9e1ac2388173a6e5b76fe53a340685d0f1880bb2f28a440cbdf
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
memory/352-90-0x0000000006FA0000-0x00000000074CC000-memory.dmpFilesize
5.2MB
-
memory/352-71-0x00000000056A0000-0x00000000057AA000-memory.dmpFilesize
1.0MB
-
memory/352-265-0x0000000073B90000-0x000000007427E000-memory.dmpFilesize
6.9MB
-
memory/352-89-0x00000000068A0000-0x0000000006A62000-memory.dmpFilesize
1.8MB
-
memory/352-50-0x0000000005000000-0x0000000005066000-memory.dmpFilesize
408KB
-
memory/352-85-0x0000000005130000-0x0000000005140000-memory.dmpFilesize
64KB
-
memory/352-48-0x0000000073B90000-0x000000007427E000-memory.dmpFilesize
6.9MB
-
memory/352-87-0x00000000065E0000-0x000000000662B000-memory.dmpFilesize
300KB
-
memory/352-84-0x00000000065A0000-0x00000000065DE000-memory.dmpFilesize
248KB
-
memory/352-64-0x0000000005570000-0x0000000005582000-memory.dmpFilesize
72KB
-
memory/352-58-0x0000000005B50000-0x0000000006156000-memory.dmpFilesize
6.0MB
-
memory/352-124-0x0000000006B60000-0x0000000006BB0000-memory.dmpFilesize
320KB
-
memory/352-126-0x0000000006CD0000-0x0000000006D46000-memory.dmpFilesize
472KB
-
memory/352-38-0x00000000007D0000-0x00000000007F2000-memory.dmpFilesize
136KB
-
memory/1136-246-0x0000000002DF0000-0x0000000002EF0000-memory.dmpFilesize
1024KB
-
memory/1136-257-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/2228-157-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-183-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-140-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-134-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-143-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-81-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmpFilesize
9.9MB
-
memory/2228-146-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-148-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-130-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-70-0x000001FFA2100000-0x000001FFA2106000-memory.dmpFilesize
24KB
-
memory/2228-159-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-162-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-86-0x000001FFBC5F0000-0x000001FFBC600000-memory.dmpFilesize
64KB
-
memory/2228-243-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-132-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-172-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-166-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-97-0x000001FFBC730000-0x000001FFBC9A6000-memory.dmpFilesize
2.5MB
-
memory/2228-121-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-178-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-181-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-247-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-219-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-185-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-187-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-189-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-192-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-204-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-208-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-128-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-125-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-108-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-278-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmpFilesize
9.9MB
-
memory/2228-229-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2228-107-0x000001FFBC730000-0x000001FFBC9A1000-memory.dmpFilesize
2.4MB
-
memory/2240-264-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmpFilesize
9.9MB
-
memory/2240-233-0x0000000000CD0000-0x0000000000D1A000-memory.dmpFilesize
296KB
-
memory/2240-269-0x000000001BA80000-0x000000001BA90000-memory.dmpFilesize
64KB
-
memory/2304-297-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/2304-180-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/2304-167-0x00000000049F0000-0x0000000004A5C000-memory.dmpFilesize
432KB
-
memory/2304-165-0x0000000002F50000-0x0000000003050000-memory.dmpFilesize
1024KB
-
memory/2660-106-0x0000000000970000-0x0000000000980000-memory.dmpFilesize
64KB
-
memory/2660-1-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmpFilesize
9.9MB
-
memory/2660-2-0x0000000000970000-0x0000000000980000-memory.dmpFilesize
64KB
-
memory/2660-0-0x00000000002A0000-0x00000000002A8000-memory.dmpFilesize
32KB
-
memory/2660-93-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmpFilesize
9.9MB
-
memory/2808-122-0x0000000000AE0000-0x0000000000AE4000-memory.dmpFilesize
16KB
-
memory/2904-310-0x0000000073B90000-0x000000007427E000-memory.dmpFilesize
6.9MB
-
memory/2904-313-0x00000000003D0000-0x000000000044C000-memory.dmpFilesize
496KB
-
memory/2992-82-0x0000000140000000-0x0000000140004278-memory.dmpFilesize
16KB
-
memory/3656-49-0x0000000000BC0000-0x0000000001CDC000-memory.dmpFilesize
17.1MB
-
memory/3656-24-0x0000000076C10000-0x0000000076CE0000-memory.dmpFilesize
832KB
-
memory/3656-13-0x0000000000BC0000-0x0000000001CDC000-memory.dmpFilesize
17.1MB
-
memory/3656-161-0x0000000000BC0000-0x0000000001CDC000-memory.dmpFilesize
17.1MB
-
memory/3656-18-0x0000000074AB0000-0x0000000074C72000-memory.dmpFilesize
1.8MB
-
memory/3656-20-0x0000000076C10000-0x0000000076CE0000-memory.dmpFilesize
832KB
-
memory/3656-22-0x0000000076C10000-0x0000000076CE0000-memory.dmpFilesize
832KB
-
memory/3656-230-0x0000000076C10000-0x0000000076CE0000-memory.dmpFilesize
832KB
-
memory/3656-26-0x0000000074AB0000-0x0000000074C72000-memory.dmpFilesize
1.8MB
-
memory/3656-163-0x0000000074AB0000-0x0000000074C72000-memory.dmpFilesize
1.8MB
-
memory/3656-94-0x0000000006B80000-0x0000000006B90000-memory.dmpFilesize
64KB
-
memory/3656-27-0x0000000074AB0000-0x0000000074C72000-memory.dmpFilesize
1.8MB
-
memory/3656-83-0x00000000068D0000-0x00000000068E4000-memory.dmpFilesize
80KB
-
memory/3656-80-0x0000000000400000-0x000000000054E000-memory.dmpFilesize
1.3MB
-
memory/3656-51-0x0000000000BC0000-0x0000000001CDC000-memory.dmpFilesize
17.1MB
-
memory/3656-76-0x00000000068C0000-0x00000000068CA000-memory.dmpFilesize
40KB
-
memory/3656-53-0x00000000068E0000-0x0000000006972000-memory.dmpFilesize
584KB
-
memory/3656-52-0x0000000006E90000-0x000000000738E000-memory.dmpFilesize
5.0MB
-
memory/4156-228-0x00007FF7D4420000-0x00007FF7D4674000-memory.dmpFilesize
2.3MB
-
memory/4212-317-0x0000000002D90000-0x0000000002DB7000-memory.dmpFilesize
156KB
-
memory/4212-314-0x0000000002E60000-0x0000000002F60000-memory.dmpFilesize
1024KB
-
memory/4404-144-0x00000231AF760000-0x00000231AF782000-memory.dmpFilesize
136KB
-
memory/4404-227-0x00000231B0250000-0x00000231B02C6000-memory.dmpFilesize
472KB
-
memory/4404-105-0x0000023197100000-0x0000023197110000-memory.dmpFilesize
64KB
-
memory/4404-100-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmpFilesize
9.9MB
-
memory/4404-288-0x0000023197100000-0x0000023197110000-memory.dmpFilesize
64KB
-
memory/4404-119-0x0000023197100000-0x0000023197110000-memory.dmpFilesize
64KB
-
memory/4704-244-0x00007FFD618A0000-0x00007FFD6228C000-memory.dmpFilesize
9.9MB
-
memory/4704-222-0x0000000000600000-0x0000000000616000-memory.dmpFilesize
88KB