Overview
overview
10Static
static
3New Text D...od.exe
windows7-x64
10New Text D...od.exe
windows10-1703-x64
10New Text D...od.exe
windows10-2004-x64
10New Text D...od.exe
windows11-21h2-x64
10New Text D...od.exe
windows7-x64
10New Text D...od.exe
windows10-1703-x64
10New Text D...od.exe
windows10-2004-x64
10New Text D...od.exe
windows11-21h2-x64
10Resubmissions
09-04-2024 07:01
240409-htps3scd2w 1009-04-2024 07:01
240409-htf6yacc9x 1009-04-2024 07:00
240409-hs6p7scc81 1009-04-2024 07:00
240409-hss44scc7z 1007-03-2024 22:29
240307-2eh7jagg41 10Analysis
-
max time kernel
1801s -
max time network
1794s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 07:01
Static task
static1
Behavioral task
behavioral1
Sample
New Text Document mod.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
New Text Document mod.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
New Text Document mod.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
New Text Document mod.exe
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
New Text Document mod.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
New Text Document mod.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
New Text Document mod.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral8
Sample
New Text Document mod.exe
Resource
win11-20240221-en
General
-
Target
New Text Document mod.exe
-
Size
8KB
-
MD5
69994ff2f00eeca9335ccd502198e05b
-
SHA1
b13a15a5bea65b711b835ce8eccd2a699a99cead
-
SHA256
2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
-
SHA512
ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
-
SSDEEP
96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
Malware Config
Extracted
redline
6077866846
https://pastebin.com/raw/KE5Mft0T
Extracted
metasploit
metasploit_stager
91.92.247.21:8405
Extracted
xworm
94.156.8.213:58002
-
Install_directory
%Public%
-
install_file
svchost.exe
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\svchost.exe family_xworm -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral5/memory/2044-202-0x00000000000E0000-0x0000000000102000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
mQxBvlTA.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ mQxBvlTA.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mQxBvlTA.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mQxBvlTA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion mQxBvlTA.exe -
Executes dropped EXE 22 IoCs
Processes:
mQxBvlTA.exexIPJVPDq.exeYSSZDuYz.execrypted6077866846MVYQY.exei1gcbW1E.exedisable-defender.exepclient.exeresponsibilitylead.exeMStore.exeProps.exewininit.exe1234.exeISetup8.exetest2.exeu24g.0.exe1111.exeu24g.1.exeISetup2.exeTester.exesvchost.exeword.exesvchost.exepid process 1696 mQxBvlTA.exe 600 xIPJVPDq.exe 2724 YSSZDuYz.exe 2044 crypted6077866846MVYQY.exe 2140 i1gcbW1E.exe 1908 disable-defender.exe 2032 pclient.exe 1996 responsibilitylead.exe 1516 MStore.exe 2112 Props.exe 2376 wininit.exe 2692 1234.exe 2752 ISetup8.exe 596 test2.exe 1440 u24g.0.exe 3000 1111.exe 1216 u24g.1.exe 2464 ISetup2.exe 2892 Tester.exe 1248 svchost.exe 1864 word.exe 2332 svchost.exe -
Loads dropped DLL 25 IoCs
Processes:
xIPJVPDq.exeNew Text Document mod.exepclient.exeISetup8.exewininit.exepid process 600 xIPJVPDq.exe 600 xIPJVPDq.exe 2036 New Text Document mod.exe 2036 New Text Document mod.exe 2036 New Text Document mod.exe 1056 2036 New Text Document mod.exe 2032 pclient.exe 2036 New Text Document mod.exe 2036 New Text Document mod.exe 2036 New Text Document mod.exe 2504 2036 New Text Document mod.exe 2036 New Text Document mod.exe 2752 ISetup8.exe 2752 ISetup8.exe 2752 ISetup8.exe 2752 ISetup8.exe 2752 ISetup8.exe 2752 ISetup8.exe 2752 ISetup8.exe 2752 ISetup8.exe 2036 New Text Document mod.exe 2036 New Text Document mod.exe 2376 wininit.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
pclient.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" pclient.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
mQxBvlTA.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mQxBvlTA.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
Processes:
flow ioc 14 raw.githubusercontent.com 15 raw.githubusercontent.com 27 pastebin.com 30 pastebin.com -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a\wininit.exe autoit_exe C:\Users\Admin\AppData\Local\directory\word.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
mQxBvlTA.exepid process 1696 mQxBvlTA.exe -
Drops file in Windows directory 2 IoCs
Processes:
Tester.exedescription ioc process File created C:\Windows\svchost.exe Tester.exe File opened for modification C:\Windows\svchost.exe Tester.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
u24g.0.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 u24g.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString u24g.0.exe -
Processes:
MStore.exeNew Text Document mod.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MStore.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MStore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 New Text Document mod.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e New Text Document mod.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e New Text Document mod.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MStore.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MStore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MStore.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
xIPJVPDq.exeYSSZDuYz.execrypted6077866846MVYQY.exedisable-defender.exepowershell.exeu24g.0.exeTester.exepowershell.exepowershell.exesvchost.exepid process 600 xIPJVPDq.exe 600 xIPJVPDq.exe 600 xIPJVPDq.exe 600 xIPJVPDq.exe 2724 YSSZDuYz.exe 2724 YSSZDuYz.exe 2724 YSSZDuYz.exe 2724 YSSZDuYz.exe 2044 crypted6077866846MVYQY.exe 1908 disable-defender.exe 2232 powershell.exe 1440 u24g.0.exe 2892 Tester.exe 2892 Tester.exe 2892 Tester.exe 944 powershell.exe 2788 powershell.exe 2332 svchost.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
New Text Document mod.exexIPJVPDq.exeYSSZDuYz.execrypted6077866846MVYQY.exedisable-defender.exeresponsibilitylead.exepowershell.exesvchost.exeTester.exevssvc.exepowershell.exepowershell.exesvchost.exedescription pid process Token: SeDebugPrivilege 2036 New Text Document mod.exe Token: SeDebugPrivilege 600 xIPJVPDq.exe Token: SeDebugPrivilege 2724 YSSZDuYz.exe Token: SeDebugPrivilege 2044 crypted6077866846MVYQY.exe Token: SeDebugPrivilege 1908 disable-defender.exe Token: SeImpersonatePrivilege 1908 disable-defender.exe Token: SeDebugPrivilege 1996 responsibilitylead.exe Token: SeDebugPrivilege 2232 powershell.exe Token: SeDebugPrivilege 1248 svchost.exe Token: SeDebugPrivilege 2892 Tester.exe Token: SeBackupPrivilege 280 vssvc.exe Token: SeRestorePrivilege 280 vssvc.exe Token: SeAuditPrivilege 280 vssvc.exe Token: SeDebugPrivilege 944 powershell.exe Token: SeDebugPrivilege 2788 powershell.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeDebugPrivilege 2332 svchost.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
wininit.exeword.exepid process 2376 wininit.exe 2376 wininit.exe 1864 word.exe 1864 word.exe 1864 word.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
wininit.exeword.exepid process 2376 wininit.exe 2376 wininit.exe 1864 word.exe 1864 word.exe 1864 word.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 2332 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
New Text Document mod.exexIPJVPDq.exepclient.exeMStore.execmd.exeISetup8.exedescription pid process target process PID 2036 wrote to memory of 1696 2036 New Text Document mod.exe mQxBvlTA.exe PID 2036 wrote to memory of 1696 2036 New Text Document mod.exe mQxBvlTA.exe PID 2036 wrote to memory of 1696 2036 New Text Document mod.exe mQxBvlTA.exe PID 2036 wrote to memory of 1696 2036 New Text Document mod.exe mQxBvlTA.exe PID 2036 wrote to memory of 600 2036 New Text Document mod.exe xIPJVPDq.exe PID 2036 wrote to memory of 600 2036 New Text Document mod.exe xIPJVPDq.exe PID 2036 wrote to memory of 600 2036 New Text Document mod.exe xIPJVPDq.exe PID 2036 wrote to memory of 600 2036 New Text Document mod.exe xIPJVPDq.exe PID 600 wrote to memory of 2724 600 xIPJVPDq.exe YSSZDuYz.exe PID 600 wrote to memory of 2724 600 xIPJVPDq.exe YSSZDuYz.exe PID 600 wrote to memory of 2724 600 xIPJVPDq.exe YSSZDuYz.exe PID 600 wrote to memory of 2724 600 xIPJVPDq.exe YSSZDuYz.exe PID 2036 wrote to memory of 2044 2036 New Text Document mod.exe crypted6077866846MVYQY.exe PID 2036 wrote to memory of 2044 2036 New Text Document mod.exe crypted6077866846MVYQY.exe PID 2036 wrote to memory of 2044 2036 New Text Document mod.exe crypted6077866846MVYQY.exe PID 2036 wrote to memory of 2044 2036 New Text Document mod.exe crypted6077866846MVYQY.exe PID 2036 wrote to memory of 2140 2036 New Text Document mod.exe i1gcbW1E.exe PID 2036 wrote to memory of 2140 2036 New Text Document mod.exe i1gcbW1E.exe PID 2036 wrote to memory of 2140 2036 New Text Document mod.exe i1gcbW1E.exe PID 2036 wrote to memory of 1908 2036 New Text Document mod.exe disable-defender.exe PID 2036 wrote to memory of 1908 2036 New Text Document mod.exe disable-defender.exe PID 2036 wrote to memory of 1908 2036 New Text Document mod.exe disable-defender.exe PID 2036 wrote to memory of 2032 2036 New Text Document mod.exe pclient.exe PID 2036 wrote to memory of 2032 2036 New Text Document mod.exe pclient.exe PID 2036 wrote to memory of 2032 2036 New Text Document mod.exe pclient.exe PID 2032 wrote to memory of 1996 2032 pclient.exe responsibilitylead.exe PID 2032 wrote to memory of 1996 2032 pclient.exe responsibilitylead.exe PID 2032 wrote to memory of 1996 2032 pclient.exe responsibilitylead.exe PID 2036 wrote to memory of 1516 2036 New Text Document mod.exe MStore.exe PID 2036 wrote to memory of 1516 2036 New Text Document mod.exe MStore.exe PID 2036 wrote to memory of 1516 2036 New Text Document mod.exe MStore.exe PID 2036 wrote to memory of 2112 2036 New Text Document mod.exe Props.exe PID 2036 wrote to memory of 2112 2036 New Text Document mod.exe Props.exe PID 2036 wrote to memory of 2112 2036 New Text Document mod.exe Props.exe PID 1516 wrote to memory of 2772 1516 MStore.exe cmd.exe PID 1516 wrote to memory of 2772 1516 MStore.exe cmd.exe PID 1516 wrote to memory of 2772 1516 MStore.exe cmd.exe PID 2772 wrote to memory of 2232 2772 cmd.exe powershell.exe PID 2772 wrote to memory of 2232 2772 cmd.exe powershell.exe PID 2772 wrote to memory of 2232 2772 cmd.exe powershell.exe PID 2036 wrote to memory of 2376 2036 New Text Document mod.exe wininit.exe PID 2036 wrote to memory of 2376 2036 New Text Document mod.exe wininit.exe PID 2036 wrote to memory of 2376 2036 New Text Document mod.exe wininit.exe PID 2036 wrote to memory of 2376 2036 New Text Document mod.exe wininit.exe PID 2036 wrote to memory of 2692 2036 New Text Document mod.exe 1234.exe PID 2036 wrote to memory of 2692 2036 New Text Document mod.exe 1234.exe PID 2036 wrote to memory of 2692 2036 New Text Document mod.exe 1234.exe PID 2036 wrote to memory of 2692 2036 New Text Document mod.exe 1234.exe PID 2036 wrote to memory of 2752 2036 New Text Document mod.exe ISetup8.exe PID 2036 wrote to memory of 2752 2036 New Text Document mod.exe ISetup8.exe PID 2036 wrote to memory of 2752 2036 New Text Document mod.exe ISetup8.exe PID 2036 wrote to memory of 2752 2036 New Text Document mod.exe ISetup8.exe PID 2036 wrote to memory of 2752 2036 New Text Document mod.exe ISetup8.exe PID 2036 wrote to memory of 2752 2036 New Text Document mod.exe ISetup8.exe PID 2036 wrote to memory of 2752 2036 New Text Document mod.exe ISetup8.exe PID 2036 wrote to memory of 596 2036 New Text Document mod.exe test2.exe PID 2036 wrote to memory of 596 2036 New Text Document mod.exe test2.exe PID 2036 wrote to memory of 596 2036 New Text Document mod.exe test2.exe PID 2752 wrote to memory of 1440 2752 ISetup8.exe u24g.0.exe PID 2752 wrote to memory of 1440 2752 ISetup8.exe u24g.0.exe PID 2752 wrote to memory of 1440 2752 ISetup8.exe u24g.0.exe PID 2752 wrote to memory of 1440 2752 ISetup8.exe u24g.0.exe PID 2752 wrote to memory of 1216 2752 ISetup8.exe u24g.1.exe PID 2752 wrote to memory of 1216 2752 ISetup8.exe u24g.1.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\YSSZDuYz.exe"C:\Users\Admin\AppData\Local\Temp\YSSZDuYz.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionExtension .exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exe"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\directory\word.exe"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exe"C:\Users\Admin\AppData\Local\Temp\a\1234.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u24g.0.exe"C:\Users\Admin\AppData\Local\Temp\u24g.0.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\u24g.1.exe"C:\Users\Admin\AppData\Local\Temp\u24g.1.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exe"C:\Users\Admin\AppData\Local\Temp\a\test2.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exe"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u1wg.0.exe"C:\Users\Admin\AppData\Local\Temp\u1wg.0.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\555.exe"C:\Users\Admin\AppData\Local\Temp\a\555.exe"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {BE3C9589-79C7-4298-8B17-6569B3916593} S-1-5-21-2461186416-2307104501-1787948496-1000:MGILJUBR\Admin:Interactive:[1]1⤵
-
C:\Windows\svchost.exeC:\Windows\svchost.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Virtualization/Sandbox Evasion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51dc55510147bb78eafaa01aa0320f0d3
SHA14fc97b9e5d27f911b46595c8cbea2d40dae95d34
SHA2563bd0ce1e9bf867c876f4465041e6214be318d0d614127cad4b6f36e9ef1bbfc0
SHA512d8018d3034093c983a5e0516b85158cfe87dc30dbab391191f521ac5ec905d31eb045db9355e07853fe10aa90b47c91128ed5801f92b5e379377efcd5c2e42dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5545e4be4bd6160702356f96dc0e6bb41
SHA1e05d8150778f80064ab84c73de5c6e45c50d1508
SHA2564bfb28eb3f29c9ed8cc737067031c33260aa08d859cecf39967c338cab97e548
SHA51292c9a74d50dbb0c92a3a3e22984f6ca271faa6ff1ce5f2d62c45784b717917cead6771026d72b5b11511afcd33c55daeb4a9dd8420e86fde5ec7d9a09064798c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50be58cd6cc8ff5c158fa67d78c195648
SHA1b5fe2d176140b4f77a97054a54c739ce5f2df229
SHA25622161ffa9d659eba547ebb4efc804e20e8bb7a99fb2ece3fcb4f5a29163b1262
SHA5121b54014cf74232d6d4e14cd4d0b832c83d9bbfd00b9531ad9dcd1453f461a9005eb5c78596c92f72b9dc7b625c5b13ebca44c1c24386a59fdfd92414a2e6459e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeFilesize
6KB
MD5f7930c4859ccd34bd2b80a9995f49926
SHA18b5b95fb51619e20246f90d60f2137da7654fc5e
SHA256163969ebee8180e125eb00c02307adda1eb31174ba6f7e011b7b4b3441d8950a
SHA5128f5a440541b227083f3d2a3a251758bf699a290db3c066ae3209d4c2df5e1e933b9c24cd4c0da0a7f3cb6ca0ce025acf22f65cc06ee1e306ecb9b1318a223a43
-
C:\Users\Admin\AppData\Local\Temp\MaianthemumFilesize
29KB
MD51680954b249062aa27483ac80d9d2016
SHA1acb196e38638fa7332a450b8ed9c127f1d56acff
SHA2563614592179f15f4bc0cba05bac8e9dd7e545e6f623bd71b841aaa665f82b16cb
SHA5129c94ec10f0577953a6bbc994b1339d9e414622efd07e4a61f31c5213f588d7327bd772c225a7a127736b721ec026ff836cf4167f9467dbf6df819bdec6e2ed93
-
C:\Users\Admin\AppData\Local\Temp\Tar6540.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exeFilesize
2.8MB
MD5e670bdc7c82eee75a6d3ada6a7c9134e
SHA1b0f0bab6f6e92bc86e86fd7bff93c257a4235859
SHA256a5cf4844df86abc9222fe436dbc0726e09383a61f4708cdc1a3e8a89cc3540fb
SHA5127384550bb19ccc11243b79d3bfc9c3f25dce84de64891e7f7eb078b246bfedcd26a958a019a3a7b4ecf5ee1c4e8c8d44790f5c958a58266e5676f3a8e58f4643
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exeFilesize
1.3MB
MD55e13199a94cf8664e5bfbe2f68d4738e
SHA18cfaa21f68226ae775615f033507b5756f5ccacc
SHA25671b320a5d9456acc43494213dcd1f4ae8b7f6e27a15ac80cb42df5f19f692ec5
SHA512b7b682717cd49b9fff9885c85f1421050613559308aa7160dee7ce493d5bff126c8157727d8f88fdfd602092203c64ab0dbff718b7ce7af9f9f2ad8375d703b5
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exeFilesize
413KB
MD5d388d6918f1e8a6a3b34ad993d8159eb
SHA1cf3cd31a4dd6571cc78016c7b0f97f621b1f253d
SHA25627d2a005efcb4da7da558eaafb6bc955a008c4beb5814d262cee38cf379f7645
SHA51254cdbb862536ce1deffc37c5a185e85e52ea1b69bb4c8e0e9137e4d34787ad4b66b047a90b1dbe6694b1d41233e947ffa7119f08e01616f472daf3f72e35761e
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exeFilesize
413KB
MD594e9960a45131af61e599acee54d21d6
SHA139b03e050337d4eb127ae5ff5f0868e986bec7ad
SHA2567add2d9d67534037b7ae6e8d1682595f5bc45cd71f6bcc933994f53f5ff00172
SHA512179f713f0ce01a70b176373d042538f95a1653cf364510b7f35d3d46a7fee2d295c6e24755d2a1363e5ca82494caec8252dd94bcd31c7a015ef5640636f7e81a
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exeFilesize
7KB
MD59c938f91a0530150a2b1c4546334570c
SHA1f4ae9acba920744457739fef0205f86443dbdf65
SHA25635a6319c334d545be1aff625c27d51d583762b44c77f172f532c27021459345a
SHA512f5b8fa5f95011fe6677f2f751b5364745607a027e49de05d2a11a5bea5040c97b6cb4285007ee34ce05b00217dd9665065b276df21bf37f823691f57ad2a6a0b
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exeFilesize
267KB
MD50803c1aec008e75859877844cfa81492
SHA116924d5802ddf76a2096fcfade0ce06d4c0670bd
SHA256d5ab98bd209db0ed18272fe616ea4b8be34fd13d36116d25793fa7aa6f8b33e3
SHA5129001e77da2562652ae51bdb3b8b9bfe686d0ed0c4eb8d338b20b7c4eb6eb8e90a4fae01d8212b1908037d5ff456e982500e4907686c38e5c33e969d55ba914d9
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exeFilesize
524KB
MD5c8edf453ed433cefb2696bb859e0f782
SHA1e34cf939d6c5a34c7bedfd885249bb7fb15336e5
SHA2560c5c2b10c3161ad9452c25d4a10e082ec94f0eb39b583c03ab3534a5e45649a0
SHA51261d0ba50f9678d6614e4d8ab8b06d759891979e0debfda88246871ee110a07c16ceeed4e7baec475b4b63de851bc5d62c69c5ae41674ffc207b94515f6ab197c
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exeFilesize
2.3MB
MD5262a7eb58a01d1aab21b24292c181cd3
SHA1535312b7048fb90be981e04ea759c5ad8aaf6eda
SHA256107090a44888272297ecb7a715a9abca4bc17dafe6aa57505436722a5a9926a6
SHA512358b34a792eadc739446283e42a352147aac1bad6d9a535eedabeb2427735b03e7977d25086cfa6b6e8e17df628e37d9a8cd584dd1a64d703e99a8f7af1a0e9b
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exeFilesize
7.7MB
MD57aca152e7040f43dae201cfe01ce37b4
SHA183eb2fa2d400f96b241e61f81e4d80317eea0200
SHA256ce602c6700032c737e7f29dc604f3b92f4a78217b5d3970e1666aab998443c50
SHA51284415dcc06c965ef9cf159a06e492efe37e48ce7e6c55c514ef7c17c9782ee20faeed3fc18e1517711fc83a9fa337f84c0f2a45c10d85d8b3ea826c6b5c472d4
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exeFilesize
157KB
MD55790d1417f8f00bd7ec6fb7011c79d9c
SHA136076ed9457c45d94e664ea291eb01e5c70d084b
SHA256ad07503bc046f5b3d65eb61646fa826bc39560916c6e1ef2c3437b6465b30a82
SHA512b19195510624ad16a4730282c97b68d05e4890a33d91f86f24eaf921e23e7786649e4e31aaaec2d9d6c7bb3695c615851d7aed3e53b13083e03acbc8d0543ef0
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeFilesize
66KB
MD500135a86ab829fc2d4678179d7a6e70f
SHA1ef75c259865d7685d566b6e25b7a20d134952555
SHA2560b8b21af69d0b465b7b8cd584bdba1f86d062bb0c7c51656f36a66fce8e9bd89
SHA512011389f2bc93f45b36233238a32991823c3334e3259af98e7dd6cedb455fc930d5b603f51bb69e415ab24f285309eda0b272250f1ec82a21508de0681281a0ef
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exeFilesize
2.7MB
MD55347852b24409aed42423f0118637f03
SHA16c7947428231ab857ee8c9dab7a7e62fdeed024b
SHA256a2e678bb376d2dcec5b7d0abac428c87cd8ae75936e28c03cb4232ae97015131
SHA5120a52f226be962eb8187f444657317d3e0385d9d47d507e6f1c028143f57153a7b8e34ef7b0c8732bb3b3d361da483a13264f511ca5c80cedda3bc439fe936991
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exeFilesize
1.3MB
MD5ddee86f4db0d3b8010110445b0545526
SHA1b41380b50d17dd679f85a224771398b81966bb9e
SHA2560d1277800ce70608ae6223a3361f709c7c68743178ca51fe3a2409a610c76de5
SHA5124271e530a7090d58e41adc441eed6aacd6238d4e562cbab05bf273549e15a22dda668450746eda64e2435d480dc46531a29de3ba797a235a9c1a411a1f8f3710
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exeFilesize
13KB
MD50c550ce9bb3efa8c3ce80a507cadfffa
SHA16559cb9db9c13147da5139cc3b8d9c60b914b667
SHA2560dc62bc58b6ae1a7971a73973731b6d3f23e8003280451b84623803c39a3f912
SHA512c74d6f53192d2dbee74278e1d67f5f7912bc61283c5582fecbff5dcadf699f208dbb60e5cb8272d28a184bbb1209f8558517868e62afbad92fcec14c2a8a6bbf
-
C:\Users\Admin\AppData\Local\Temp\crocFilesize
483KB
MD5ceea497fc0601e397a9b0dba479b6ad3
SHA1b791fd1115d9517d7e9cb9a987db2307aa900f67
SHA256a17f87f849572c5977fa38198d6697a248424f2559aed98136834e188ac2d3f2
SHA512702cff5d69b609e25d75545f58352aecf7ed28730c012f3a4ce6113842ebcda3308bc05e7658c27a260dec0bebaf25cad2bda1bff476aa79b2bb0ed4ad561858
-
C:\Users\Admin\AppData\Local\directory\word.exeFilesize
106.3MB
MD5dba5e1c79c2c72e17bb71754ea09d49f
SHA148de7f77fb2629310b6137b5cb035a2a4e2fe31f
SHA256ae7f2a3492b309be229d9fd90ebf040dcaac81e5c6f69788625b484a691a7edf
SHA512782d86a12229f02e22ece653f955bac10aa6828713cc64d4ab159ab29fdfb98556300890284885f4ab4d0d6527899913ec3a65f03022fd0932a4ae10c614b137
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\47393D2ACT35ODRAVO5P.tempFilesize
7KB
MD5c329c3890f8f8ee9bb3818810d60558d
SHA153c79a702b0e1de73952f67b4ed839c270f4c056
SHA25615c9f0b4bc1b1adad5baff436ac38226ed162d6af46899276ca2cff99c9e9b64
SHA512d572629d0b6b0bb4ac17f41bc8b5412a5434869b7ad463d2f31fadd057a1057e38b4a3fda1316ba6dbcafe58d309ad81fa3b52c32e5f71e3bfb855d25a730e9c
-
\Users\Admin\AppData\Local\Temp\YSSZDuYz.exeFilesize
5KB
MD56a2c09749219d577535d0338c6cffe06
SHA1576b00c03455a518664308c976097097f691bca4
SHA25675b57c1c27f33b59ab9b62dc15a2a66b0a0b28a55bdc72119edbb98a1692573c
SHA512cd5d2269011a79e7bcdf8dfceb78e908f8bb2b6561228a25ebe3161a6194eafb6a6d79a390215e0f1d8bf04f7a2d6f26b7c532835f1187d25fa2889a84be6e0c
-
\Users\Admin\AppData\Local\Temp\a\MStore.exeFilesize
12KB
MD5282c1ebb16ad0edc41389d1e73a74607
SHA1fbcdda121484ea6125827ed4e7b1b00f6a88835d
SHA2567712424f2dec2d08630237c737e5f81789d2e92edc31111c72eaa0388b6df1dc
SHA51294be4f173c5c63947a6e7902a86c8851ee84a06d1ddec104af91592178adafc3180f652791badc3e0c1139bbc7c9f64b9e47ccd0adadd16159a40ab6c188b292
-
\Users\Admin\AppData\Local\Temp\a\disable-defender.exeFilesize
294KB
MD510fc8b2915c43aa16b6a2e2b4529adc5
SHA10c15286457963eb86d61d83642870a3473ef38fe
SHA256feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5
SHA512421631c06408c3be522953459228d2e1d45eeeafce29dba7746c8485a105b59c3a2c0d9e2ffc6d89126cd825ffd09ebe7eb82223a69d1f5caf441feb01e57897
-
\Users\Admin\AppData\Local\Temp\u24g.0.exeFilesize
271KB
MD5b95747cad90e982d44da8fd74f50b9a6
SHA1d7f267d2042f6b67f63542395ff6a5a1b3ba1250
SHA2567b4d39265da2ddc442c1bc4335c92fe527bf6b8d644d4d465f1476a97a1fb153
SHA512615d35780262f55313ccbe31e323bb6ba9787120ce06d5236a74844736543c7551e4e227e350bf1604208095165c42564234bb2dafe575785008683ae4e5393c
-
\Users\Admin\AppData\Local\Temp\u24g.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
memory/1216-615-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/1440-613-0x0000000000400000-0x0000000002D21000-memory.dmpFilesize
41.1MB
-
memory/1440-567-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/1696-393-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-124-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-391-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-321-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-324-0x0000000000C60000-0x0000000001D7C000-memory.dmpFilesize
17.1MB
-
memory/1696-325-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-326-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-388-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-332-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-333-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-387-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-386-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-335-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-336-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-337-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-67-0x0000000000C60000-0x0000000001D7C000-memory.dmpFilesize
17.1MB
-
memory/1696-348-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-385-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-111-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-122-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-396-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-291-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-123-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-394-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-125-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-214-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-374-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-224-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-383-0x0000000076520000-0x0000000076567000-memory.dmpFilesize
284KB
-
memory/1696-282-0x0000000076520000-0x0000000076567000-memory.dmpFilesize
284KB
-
memory/1696-281-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-379-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-380-0x0000000075510000-0x0000000075620000-memory.dmpFilesize
1.1MB
-
memory/1696-381-0x0000000076520000-0x0000000076567000-memory.dmpFilesize
284KB
-
memory/1996-305-0x0000000000C20000-0x0000000000C26000-memory.dmpFilesize
24KB
-
memory/1996-351-0x000000001B0B0000-0x000000001B130000-memory.dmpFilesize
512KB
-
memory/1996-317-0x000007FEF5C40000-0x000007FEF662C000-memory.dmpFilesize
9.9MB
-
memory/1996-390-0x000007FEF5C40000-0x000007FEF662C000-memory.dmpFilesize
9.9MB
-
memory/2036-319-0x0000000140000000-0x0000000140005000-memory.dmpFilesize
20KB
-
memory/2036-226-0x000007FEF5C40000-0x000007FEF662C000-memory.dmpFilesize
9.9MB
-
memory/2036-330-0x0000000140000000-0x0000000140005000-memory.dmpFilesize
20KB
-
memory/2036-2-0x000000001B270000-0x000000001B2F0000-memory.dmpFilesize
512KB
-
memory/2036-395-0x0000000140000000-0x0000000140005000-memory.dmpFilesize
20KB
-
memory/2036-1-0x000007FEF5C40000-0x000007FEF662C000-memory.dmpFilesize
9.9MB
-
memory/2036-0-0x0000000001120000-0x0000000001128000-memory.dmpFilesize
32KB
-
memory/2036-392-0x0000000140000000-0x0000000140005000-memory.dmpFilesize
20KB
-
memory/2044-229-0x0000000074640000-0x0000000074D2E000-memory.dmpFilesize
6.9MB
-
memory/2044-202-0x00000000000E0000-0x0000000000102000-memory.dmpFilesize
136KB
-
memory/2044-397-0x0000000004880000-0x00000000048C0000-memory.dmpFilesize
256KB
-
memory/2044-357-0x0000000074640000-0x0000000074D2E000-memory.dmpFilesize
6.9MB
-
memory/2044-334-0x0000000004880000-0x00000000048C0000-memory.dmpFilesize
256KB
-
memory/2112-320-0x0000000140000000-0x0000000140004278-memory.dmpFilesize
16KB
-
memory/2140-228-0x000000013FAD0000-0x000000013FD24000-memory.dmpFilesize
2.3MB
-
memory/2232-378-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB
-
memory/2232-389-0x000007FEEE8E0000-0x000007FEEF27D000-memory.dmpFilesize
9.6MB
-
memory/2232-358-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB
-
memory/2232-382-0x000007FEEE8E0000-0x000007FEEF27D000-memory.dmpFilesize
9.6MB
-
memory/2232-373-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB
-
memory/2232-384-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB
-
memory/2232-371-0x000007FEEE8E0000-0x000007FEEF27D000-memory.dmpFilesize
9.6MB
-
memory/2232-370-0x0000000002360000-0x0000000002368000-memory.dmpFilesize
32KB
-
memory/2232-369-0x000000001B330000-0x000000001B612000-memory.dmpFilesize
2.9MB
-
memory/2376-349-0x0000000000120000-0x0000000000124000-memory.dmpFilesize
16KB
-
memory/2464-624-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/2752-400-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/2752-375-0x0000000002DF0000-0x0000000002EF0000-memory.dmpFilesize
1024KB
-
memory/2752-508-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/2752-376-0x00000000002F0000-0x000000000035C000-memory.dmpFilesize
432KB
-
memory/2752-489-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB
-
memory/2752-377-0x0000000000400000-0x0000000002D44000-memory.dmpFilesize
41.3MB