Resubmissions
09-04-2024 08:32
240409-kfg77aaf85 1009-04-2024 08:32
240409-kfglnaaf84 1009-04-2024 08:32
240409-kffz5aea2y 1009-04-2024 08:32
240409-kffpcsaf79 1011-03-2024 08:03
240311-jxm94afe6y 1010-03-2024 15:15
240310-snee9sfd3y 10Analysis
-
max time kernel
1198s -
max time network
1199s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09-04-2024 08:32
General
-
Target
FUCKER.exe
-
Size
10KB
-
MD5
2a94f3960c58c6e70826495f76d00b85
-
SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
-
SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
-
SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
-
SSDEEP
192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
Malware Config
Extracted
quasar
1.4.1
Office04
185.196.10.233:4782
a244256d-314d-4857-83fe-790ac24d7897
-
encryption_key
0EC03133971030F6D05E6D59F71626F6543BBE65
-
install_name
gfdgfdg.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
fgfdhdgg
-
subdirectory
gfgfgf
Extracted
amadey
4.18
http://185.172.128.3
-
install_dir
One_Dragon_Center
-
install_file
MSI.CentralServer.exe
-
strings_key
fd2f5851d3165c210396dcbe9930d294
-
url_paths
/QajE3OBS/index.php
Extracted
asyncrat
0.5.7B
KZ1
77.232.132.25:5001
AsyncMutex_6SI8OJU68
-
delay
3
-
install
false
-
install_file
service.exe
-
install_folder
%AppData%
Extracted
quasar
1.4.1
KZ1
77.232.132.25:4999
8892f097-602a-41ca-8df2-0bf3fd113bd2
-
encryption_key
790BD6D1C1540AE1BFB811F2DC1E0185525C5DCB
-
install_name
LestaClient.exe
-
log_directory
LestaLogs
-
reconnect_delay
3000
-
startup_key
Lesta Game Center
-
subdirectory
Lesta
Extracted
redline
666
195.20.16.103:18305
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Detect ZGRat V1 7 IoCs
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 3 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 5 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Async RAT payload 1 IoCs
-
XMRig Miner payload 9 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Stops running service(s) 3 TTPs
-
.NET Reactor proctector 4 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 16 IoCs
-
UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Launches sc.exe 23 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 6 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies system certificate store 2 TTPs 10 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe"C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 6003⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Files\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\Files\FirstZ.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"3⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\Files\hghgfhjfhmain.exe"C:\Users\Admin\AppData\Local\Temp\Files\hghgfhjfhmain.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "fgfdhdgg" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\gfgfgf\gfdgfdg.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe"C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 2564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe"C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 5843⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Files\RtkAudUKZ1.exe"C:\Users\Admin\AppData\Local\Temp\Files\RtkAudUKZ1.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Control.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Control.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Anyns.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Anyns.exe4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Header.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Header.exe4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\Files3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\Files4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Taskhost.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Taskhost.exe4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Runtime.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Runtime.exe4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\Sideload\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\Sideload\4⤵
-
C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Control.exe"C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Control.exe"3⤵
-
C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Anyns.exe"C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Anyns.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\koooooo.exe"C:\Users\Admin\AppData\Local\Temp\Files\koooooo.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 5603⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"C:\Users\Admin\AppData\Local\Temp\Files\Doublepulsar-1.3.1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\tidex_-_short_stuff.exe"C:\Users\Admin\AppData\Local\Temp\Files\tidex_-_short_stuff.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 4603⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup5.exe"C:\Users\Admin\AppData\Local\Temp\Files\ISetup5.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u28k.0.exe"C:\Users\Admin\AppData\Local\Temp\u28k.0.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AAFIJKKEHJ.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\AAFIJKKEHJ.exe"C:\Users\Admin\AppData\Local\Temp\AAFIJKKEHJ.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\AAFIJKKEHJ.exe6⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30007⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KKEHIEBKJK.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\u28k.1.exe"C:\Users\Admin\AppData\Local\Temp\u28k.1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\fud.exe"C:\Users\Admin\AppData\Local\Temp\Files\fud.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe"C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\Files\Ledger-Live.exe3⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30004⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\Files\lummahelp.exe"C:\Users\Admin\AppData\Local\Temp\Files\lummahelp.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 2524⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Files\Max.exe"C:\Users\Admin\AppData\Local\Temp\Files\Max.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted_15a94542.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted_15a94542.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\TJeAjWEEeH.exe"C:\Users\Admin\AppData\Local\Temp\Files\TJeAjWEEeH.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\juditttt.exe"C:\Users\Admin\AppData\Local\Temp\Files\juditttt.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\onefile_1920_133571325990190000\stub.exe"C:\Users\Admin\AppData\Local\Temp\Files\juditttt.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe"C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe"2⤵
-
C:\Windows\SysWOW64\clip.exe"C:\Windows\SysWOW64\clip.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\System32\taskhost.exe"C:\Users\Admin\AppData\Roaming\System32\taskhost.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\niks.exe"C:\Users\Admin\AppData\Local\Temp\Files\niks.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\mk.exe"C:\Users\Admin\AppData\Local\Temp\Files\mk.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\native.exe"C:\Users\Admin\AppData\Local\Temp\Files\native.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\file300un-1.exe"C:\Users\Admin\AppData\Local\Temp\Files\file300un-1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
-
C:\Users\Admin\Pictures\mwsPoDEpmOp2TiZIT377BcHq.exe"C:\Users\Admin\Pictures\mwsPoDEpmOp2TiZIT377BcHq.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\u9s.0.exe"C:\Users\Admin\AppData\Local\Temp\u9s.0.exe"5⤵
-
C:\Users\Admin\Pictures\UrcGgJ10JMw6iw0OHVzsuRsn.exe"C:\Users\Admin\Pictures\UrcGgJ10JMw6iw0OHVzsuRsn.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\u1bk.0.exe"C:\Users\Admin\AppData\Local\Temp\u1bk.0.exe"5⤵
-
C:\Users\Admin\Pictures\uF7dOdZWjV3GT7Wb1dsZ662y.exe"C:\Users\Admin\Pictures\uF7dOdZWjV3GT7Wb1dsZ662y.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\VLTKNhatRac.exe"C:\Users\Admin\AppData\Local\Temp\Files\VLTKNhatRac.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\AUTOKEY.exe"C:\Users\Admin\AppData\Local\Temp\Files\AUTOKEY.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\SystemUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Files\SystemUpdate.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\sc.exe"C:\Users\Admin\AppData\Local\Temp\Files\sc.exe"2⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\Files\123p.exe"C:\Users\Admin\AppData\Local\Temp\Files\123p.exe"2⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OBGPQMHF"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OBGPQMHF"3⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\Files\Ama2.exe"C:\Users\Admin\AppData\Local\Temp\Files\Ama2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\ce0b953269c74bc.exe"C:\Users\Admin\AppData\Local\Temp\Files\ce0b953269c74bc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\AppGate2103v01.exe"C:\Users\Admin\AppData\Local\Temp\Files\AppGate2103v01.exe"2⤵
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exe"C:\ProgramData\wikombernizc\reakuqnanrkn.exe"3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5081⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Chrome\CNSWA.exeFilesize
37.1MB
MD555056a354010e2d3efccfcc90d507b5b
SHA1a8887594be566a5b8cbd9cb9b03fdc419d9de7cb
SHA256263a4d5c1dd9ddaf2f466008c3e188448ff53bec48220e063d686a8b5ab27a5f
SHA51283f494960608f8160778286439c38f9bdd39e0965e5d3e82b04858be871e6693f54d5af915a0ddb6c7cdc35f13f72aefb739b10f77aa8e8ef6f3b30b7606a650
-
C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Anyns.exeFilesize
45KB
MD5310b982faa6a9c8473c6a6097a64317f
SHA1abdc0ee76d9f21d318c04b12cbbb4453c18a4c57
SHA256c21d1dd6391ae93398507c94f9b075dbe8baceed4903a78b3f6bebfa85cd155e
SHA512e9434ff38d01f8983febbd7a4cafeaa4b2f11166adee44a4f6e10a9c25c265e0cefbe7c7a43dd38a3c77bdebdf662e98311184595e52419c03666658a0a4cb8c
-
C:\ProgramData\Microsoft\Diagnosis\Microsoft.ServiceHub.Control.exeFilesize
3.1MB
MD57b9d9f41d274ddd8fac0544e188ade4a
SHA120050de536fbf27cdbfbdd0671af913e04106363
SHA25650684cb3400e3cd4959c2ccd2dd900a157ef3163179adcf8da15ed5b7b41694b
SHA512c102873fa15ffd776ab17b16cd39d6ac95c8412dc8c4a0c8c28e1579dd0d03f9fa4f4985d419a76cd4853c5769ea4e95a24c4c1a9c61c98b7508d97c13b345af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a4cb9cd87502f167adfcbae6bfe9833c
SHA11ac4605dab9950f0568c076ddf28efaeafebe2dc
SHA25634e598c48bad44ae9e8f674660026c95295bab4cd141107739e415df900c45be
SHA51246ae4dd2f28ff6ee6cf3da5dc6cadd46655639668648ee288eb11653c1086c012e8f984463c24dcd1cbaa04de8b6519c857eca7e44798a0e93db3fc04a89cded
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD529f3629b98dd0b666a0e08bb21416b92
SHA131632278bd5ae09ecf0c752f07a305fbf78beb4d
SHA25611318f88ec93705f631a6b4495c88577fc4957dd956292d00e5c7d4bfa12e97b
SHA512cb12fde90b3fac8213ae6a452b2f84798e81aceab55e71534558e3b0a6ba5468f309984133725609a3438b702145fc6bf2322a5fdbde444c0971eeffdecb7bbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5f64dbd1b496dc1aef31dab55d93380df
SHA1b497d6c63ea1a78c1827daf5e97fb7654547e456
SHA256d905efe63d1e7420486038859e0ac6bacdbfd35c748620b167e3cb4db321357a
SHA5127a28032b4b6548548820db6ed8978414449138affc436d265b02241736260fb4905b425593b9553d06c757a937fc0301757e061582a384eae648e7ada830a7ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5529b3d67030fffe821c28db5ffa96d78
SHA1521f2c879990ff54fd81190885af9797d356b000
SHA2569869e46469e6cc430070b88df90e820f7a351eb30124a6c8ef5defa3f55a40cc
SHA5127ff41bb81bc6dfd5da818f8979de385f4ab466e112618ca19bb8571ffb1b9a9e08c62106c4e09f4358071ea52aae69ff199dbbd9d88b7809f9cf953eabc277f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59ecb0bac4b052ddad48a3bcc4993e0a3
SHA13d9e085fc10ba35c80490aaf48a8d946df325994
SHA256f0333e82f2b0db312fec19b142732a311794c45e578912b4725b58af1e35bcd7
SHA512e45a0e5ae14e90f5024261cbdbe53e46f102847d7386f12c8e8b634722c295871abf7056c9c9299e89a1a8dbe429687322c1178dbe411a1d7bef8ef68d8aeee9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD543e7789e129dc23da672686d42aa3920
SHA1a2e434c39e2a873aa52d7edba5ca7e8cb3b545de
SHA2569d3dcc2e157530de22897481374a5791eb27285fe38a431cd2e5073904527a4f
SHA512956209e445db1c67d1828a9b75f4ed9c666a763b49a0b5905118831049ca41ae7ecdf38b2cb6913357a29ead6b49607d96d387548d3d430a0880f36200f73492
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50affe2526986ff1506df0d30b301b8d4
SHA163e40cc3e39faac40536a6ffc5592a16033ea3fc
SHA25626c088e93e2fc9661c55474ddbbad7d85cfd4cd06d5f0cb63c2ed4d34f347c2b
SHA512e53c0de30db704124f93333ef5274a0b2372e82f6fe95fd62a3f2d3d9085a9c4f2d6b7cb60d9c73800eddd3826998ce019f377f517d29beaa680e40886d5f50a
-
C:\Users\Admin\AppData\Local\5Swb1qD2ThJM84u7lq9wIqMy.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\AppData\Local\Temp\AAFIJKKEHJ.exeFilesize
106KB
MD5fe380780b5c35bd6d54541791151c2be
SHA17fe3a583cf91474c733f85cebf3c857682e269e1
SHA256b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53
SHA512ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c
-
C:\Users\Admin\AppData\Local\Temp\Files\123p.exeFilesize
10.7MB
MD5b091c4848287be6601d720997394d453
SHA19180e34175e1f4644d5fa63227d665b2be15c75b
SHA256d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
SHA512a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a
-
C:\Users\Admin\AppData\Local\Temp\Files\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\Files\Max.exeFilesize
5.1MB
MD5db5417155182f4e3a9277c2652065256
SHA1d6ebaa6ee5c323a562c3f1742731f0eb3e333f42
SHA2560f1fe064d3d23499968b8f3e972e775bf81903a9b3e85422d156e36795c48ad3
SHA512961b2108bfd1c8afa8c125cc7d94e122a2085b6d49151ea00b0a7def1d8c83edac3ae02ab562732aa1be5fef71cec5eca5d3cce19f7c7a9eaf134de405d69a15
-
C:\Users\Admin\AppData\Local\Temp\Files\RtkAudUKZ1.exeFilesize
16KB
MD52644dec48ca3539cfc4a7b4dba0bd212
SHA1d5fd9c4b6f865ba7dec0604bdd7b06f0f00023f8
SHA256ea7efe5b685adb6324eea4717d5a9ef0c09c0222acc527d3bff2dc752d0cdcf9
SHA512756a9acf67292a0cc2107188316e0ccf15c3ca8317e65fb5add57a525bb0fece07f5e0d9ef430a54ec21ae6b2a9242f7bd3926b1791dc3e704ae40f10b194ad3
-
C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exeFilesize
351KB
MD5059e591f9dda7d3ee0de23f64d791cb1
SHA155e1be730e1426d00354e994f3596764d40634a6
SHA2569550addd57ac80afc9a177a5e7c9e961892d96593296bac79ec7a6ea65cc12d9
SHA512c67663ee4b68cdee2d834b9ef8e29af6e39926c547efbe02568adb7eb5e37c6a933205592888b0716936635a9e6e60673f12599778a5196e5fdafcfb262af629
-
C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exeFilesize
958KB
MD5aa3cdd5145d9fb980c061d2d8653fa8d
SHA1de696701275b01ddad5461e269d7ab15b7466d6a
SHA25641376827ba300374727d29048920ca2a2d9f20b929e964098181981581e47af2
SHA5124be32b5e9eaffa8d3f4cce515717faa6259373e8dbd258b9ebc2534fd0b62aaa7043093204e43627983fe332f63d8f998a90dc1cbb74f54a18c55f67e42a8a32
-
C:\Users\Admin\AppData\Local\Temp\Files\fud.exeFilesize
414KB
MD56e56b1e5660b59f0c44738f837adabe1
SHA141b7d0db71ac1bd1d673574f0cea0419ea4c4c2a
SHA256b36d61f1da438fef617ecb289756a700e545ec7033e9fdffd929d79a9e2f37d7
SHA512fac7fb348ad204330e6b4864a29495d2db575d3b39b442ba0c91d18bada1558ba6a3ab7670c5145556c30e65ceaed7ee000bf8f4e86dfddfe68642f89531c286
-
C:\Users\Admin\AppData\Local\Temp\Files\hghgfhjfhmain.exeFilesize
3.1MB
MD5caddfe2adb6d8c878a2a1001e7fd4fd7
SHA16d4b54d81a061efc4a1562d3adae524a22d158df
SHA2565ac4db28729ef274c94e5a65ea6f2900be893f63d3b984a7ba27cc83a2c54e1b
SHA5121aa011a1be34baa824468af55317c66cf78abc36883075cb3388a0631db512c97d05b0b9ab2a6ee9f93bfe3a276fd557eab07d5653a02b5eb67eb3f62870a405
-
C:\Users\Admin\AppData\Local\Temp\Files\hv.exeFilesize
5.4MB
MD56a1db4f73db4ed058c8cd7e04dfa7cc3
SHA1e3e074af4f3a6ed332eedf518b2d1f9a20314fd6
SHA2560a5355f8e8a6665e7da928c50309b811b88f011d763d0ab5057a8b969992f5ec
SHA5121ce79d2b5f58c9d1f6e68cb86a0d24fec883defd55115640b021816facd4bf3748da5a61b1e5da9f76f6b7a2b6c382b72261536bc28f48d0643a9f8aceb98fde
-
C:\Users\Admin\AppData\Local\Temp\Files\koooooo.exeFilesize
379KB
MD590f41880d631e243cec086557cb74d63
SHA1cb385e4172cc227ba72baf29ca1c4411fa99a26d
SHA25623b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0
SHA512eeb85b34aa66a7e9a1b1807012999ee439433df23126a52ffa8d4b3cb2026be3bcf63ca25f143de58ba929c0d4feeaf2a603fd6ec6b5379fc48147c22f3783e3
-
C:\Users\Admin\AppData\Local\Temp\Files\ma.exeFilesize
5.0MB
MD5a3fb2b623f4490ae1979fea68cfe36d6
SHA134bec167e0f95ecc36761f77c93c1229c2c5d1f4
SHA2563bc9c1d7f87f71c9e98fac63c2f10d2651f51848082a85d6b3550649e4289d56
SHA512370b23364bcf8f07aa951c1c6a9d6b03b516db8fd7444d25087ad8071c54bb06fd50ce311a205e0770211167728d86516e934a39a606f0bf0c9fbdd13dca7912
-
C:\Users\Admin\AppData\Local\Temp\Files\native.exeFilesize
5.3MB
MD5de08b70c1b36bce2c90a34b9e5e61f09
SHA11628635f073c61ad744d406a16d46dfac871c9c2
SHA256432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67
SHA51218a30e480ce7d122cfad5a99570042e3bef9e1f9feda1f7be32b273a7248274285c65ac997c90d3d6a950a37b4ea62e6b928bfefc924187c90e32ea571bfd1f5
-
C:\Users\Admin\AppData\Local\Temp\Files\niks.exeFilesize
1.7MB
MD53f6a4819237be89e6871a3f02ebed508
SHA1bfe8f70423e337d0c9f5db31d63a386f30afa3bf
SHA2567d4b825f76a58f12e5b1f44cfa5396623fe5b4b26cd1000fd1c4d871e2303012
SHA512a5b68c6fd95ac1bddbaa23f3cd50276a3ab6222050e76e2ab47c814f6cc666f789d7c9c6ffeace4d7867fa8e83b8d741467f56656dacee8145e68e7b8f7de9b5
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exeFilesize
7.1MB
MD545d20d471e6f3f8f088d489d62058f23
SHA1d261d037781fb5e7124a40df3d2e32e4d694c2c4
SHA25636fb77c427020d85e61482f25c7e8127221e1d48c358be97728068e6a487b711
SHA5123e04852233147146e76684ebcc335e6281413796cf148d34234b86753a3f2b2afb2e58853d44873dc43f9578639ef55f35aab98aaee7dda718f6cfaeb4e4a02e
-
C:\Users\Admin\AppData\Local\Temp\Files\tidex_-_short_stuff.exeFilesize
14KB
MD5674d01a41b61e42f0b7761712261e5dc
SHA14edd3b1ae2284db54b504258a9d8c54f1dc983c8
SHA2563142397ba09a68329f93013aeee8ea89c84c01a4e6f337502d8f13f8da74660f
SHA512065c8e2a1118a7d82a0c18396eaa836849f4ac856e9f7970141cd44c341eae1e00118deaf5bae25ab610788a9bf896496d349f971bd6ac0b135357f5d1d0e326
-
C:\Users\Admin\AppData\Local\Temp\Tar3F0A.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD5ca0cd1b75712d27e9f38302b5d55d18f
SHA13b4cdb2b6aaf894ac4cc79b41f51397fd7168f7b
SHA256d085a801ad4396c1f33db8c16cbd02493dec0fdd1500c7201577497db68fa03b
SHA51221a9838065f4ac83ff47c1e05bec922319023d221d659e548a3bf6efa0b14b8c25e7e87ab2a917f6f43ce4b2f7cd289b89b0b9aada476bfd81606bb18b45cc1c
-
C:\Users\Admin\AppData\Local\Temp\u28k.0.exeFilesize
272KB
MD531765c43b9bf0da3a52bfeb68733655c
SHA1c6ccc6b435e123ef62c4996a82019432cde58d4b
SHA25606d92df4f5d05897df05e9a9b89986a7b4e534cec4d46e3219d79c90edb645b2
SHA5120f4b867ff7680c2946f0c801b69157de9b2f5007030a1c17d15ac99d4acd1933e9515e48c9109206f4498f4c020ef89aca21c0de920609a77cef2c03d3258c92
-
C:\Users\Admin\AppData\Local\Temp\u28k.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Local\ynZnCybQCYZARS9HQ81mhRww.exeFilesize
413KB
MD5765e590bdf6597f282def847dd94d4bd
SHA11029898323e174062d9d0adb298bb0f6874675ae
SHA2566d9a0fff1e5344852494b9eb3a12f4c8119d2009c16b7d762386217e6924e2fd
SHA512bfde5fa68047b4fada753c110dd1830431467756d2881ad63a32fad9fdb29091fba35887935ac745036bcd88530fbcc2a0ad05b444ae5159c1c5e2c9bf9a4fa3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5b34d13a263e74cca31a4861b23abaf87
SHA1d8525d74faa5a38f207d0a94e908dba008ba9b60
SHA2565f62d4244288e9538b0f101aa94b5ba60a21e01a562f9b19fc12dd9a4ba692f9
SHA512383c0b0c308e2910a54a246422b19abf964ec4adbd2b4062b5b00ad5701a132946546f136a7fa753c87da4a7239d4ae0b868fc5837adc7ffe1a9c84ae177e713
-
\Users\Admin\AppData\Local\Temp\Files\M5traider.exeFilesize
4.6MB
MD51713300ba962c869477e37e4b31e40af
SHA1d5c4835bc910acccd28dbed0c451043ea8de95ef
SHA2562bcdb7a75707f841615be19f4bbcb95fc6b16ce19fb7ea782c5ff43ea1be024d
SHA51270b2a2b17c6b3a0a295baf536451ef38c6e9e292a3c967a9fc950a6de321bbac0dc45e942ef151ba81b717f8ede3166388e68ce75f2afff0ec16aea98ea742e1
-
\Users\Admin\AppData\Local\Temp\Files\cp.exeFilesize
1.8MB
MD597256cf11c9109c24fde65395fef1306
SHA1e60278d8383912f03f25e3f92bf558e2a33f229d
SHA25621c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934
SHA51241e9c7911c1f461ec389ac9d430898bd9e21accf6b4291d30c4e743084bb19c2ae9279597f4a43cfaec621263cb135c3ada21e23e27cc7961c794fa499910c6e
-
\Users\Admin\AppData\Local\Temp\Files\dsdasda.exeFilesize
484KB
MD55e88980bb982663f2d687fd72bacd880
SHA104ea23d8cc91ee71b13476b4b60eee4fe478e01c
SHA256c61c9ed0fdbcc1a5be82feb4895fe1a553659738137d8ed319c9f63ad301e423
SHA51206b744b1a238c76b90a1182315838ee22e240cbd33d7ba9fabca344abca6e52e20fdfcd965febc18d82d05ad478aff7a4720715d7ed124ead75d9b91afc8301d
-
memory/772-450-0x00000000001B0000-0x00000000001B8000-memory.dmpFilesize
32KB
-
memory/772-451-0x000007FEF5B40000-0x000007FEF652C000-memory.dmpFilesize
9.9MB
-
memory/884-552-0x0000000002C40000-0x0000000002CC0000-memory.dmpFilesize
512KB
-
memory/1160-616-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1160-621-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1532-504-0x0000000002CD0000-0x0000000002D50000-memory.dmpFilesize
512KB
-
memory/1532-503-0x000007FEEDB20000-0x000007FEEE4BD000-memory.dmpFilesize
9.6MB
-
memory/1532-505-0x000007FEEDB20000-0x000007FEEE4BD000-memory.dmpFilesize
9.6MB
-
memory/1532-509-0x0000000002CD0000-0x0000000002D50000-memory.dmpFilesize
512KB
-
memory/1532-510-0x0000000002CD0000-0x0000000002D50000-memory.dmpFilesize
512KB
-
memory/1640-427-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/1640-439-0x0000000000930000-0x0000000000970000-memory.dmpFilesize
256KB
-
memory/1640-428-0x0000000000FB0000-0x00000000016C0000-memory.dmpFilesize
7.1MB
-
memory/1816-513-0x000007FEEDB20000-0x000007FEEE4BD000-memory.dmpFilesize
9.6MB
-
memory/1816-517-0x0000000002E80000-0x0000000002F00000-memory.dmpFilesize
512KB
-
memory/1816-518-0x0000000002E80000-0x0000000002F00000-memory.dmpFilesize
512KB
-
memory/1816-514-0x0000000002E80000-0x0000000002F00000-memory.dmpFilesize
512KB
-
memory/1856-543-0x0000000002C80000-0x0000000002D00000-memory.dmpFilesize
512KB
-
memory/1856-537-0x0000000002C80000-0x0000000002D00000-memory.dmpFilesize
512KB
-
memory/1856-538-0x0000000002C80000-0x0000000002D00000-memory.dmpFilesize
512KB
-
memory/1872-520-0x0000000002820000-0x00000000028A0000-memory.dmpFilesize
512KB
-
memory/1872-519-0x000007FEEDB20000-0x000007FEEE4BD000-memory.dmpFilesize
9.6MB
-
memory/1872-531-0x0000000002820000-0x00000000028A0000-memory.dmpFilesize
512KB
-
memory/1872-523-0x0000000002820000-0x00000000028A0000-memory.dmpFilesize
512KB
-
memory/1884-615-0x00000000000F0000-0x000000000015C000-memory.dmpFilesize
432KB
-
memory/1900-508-0x0000000001FA0000-0x0000000002020000-memory.dmpFilesize
512KB
-
memory/1900-507-0x0000000001FA0000-0x0000000002020000-memory.dmpFilesize
512KB
-
memory/1900-486-0x000000001B4B0000-0x000000001B792000-memory.dmpFilesize
2.9MB
-
memory/1900-511-0x0000000001FA0000-0x0000000002020000-memory.dmpFilesize
512KB
-
memory/1900-506-0x000007FEEDB20000-0x000007FEEE4BD000-memory.dmpFilesize
9.6MB
-
memory/1900-488-0x0000000001F70000-0x0000000001F78000-memory.dmpFilesize
32KB
-
memory/2120-234-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2120-223-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2120-270-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2120-233-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2120-273-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2120-236-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2120-219-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2120-232-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2120-231-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2196-272-0x0000000004EF0000-0x0000000004F30000-memory.dmpFilesize
256KB
-
memory/2196-1-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2196-0-0x0000000000370000-0x0000000000378000-memory.dmpFilesize
32KB
-
memory/2196-217-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2196-2-0x0000000004EF0000-0x0000000004F30000-memory.dmpFilesize
256KB
-
memory/2400-544-0x0000000002D20000-0x0000000002DA0000-memory.dmpFilesize
512KB
-
memory/2400-532-0x0000000002D20000-0x0000000002DA0000-memory.dmpFilesize
512KB
-
memory/2400-521-0x000007FEEDB20000-0x000007FEEE4BD000-memory.dmpFilesize
9.6MB
-
memory/2400-522-0x0000000002D20000-0x0000000002DA0000-memory.dmpFilesize
512KB
-
memory/2400-533-0x0000000002D20000-0x0000000002DA0000-memory.dmpFilesize
512KB
-
memory/2432-551-0x0000000000ED0000-0x000000000143C000-memory.dmpFilesize
5.4MB
-
memory/2472-178-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2472-179-0x0000000004740000-0x0000000004780000-memory.dmpFilesize
256KB
-
memory/2472-418-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2472-180-0x0000000004740000-0x0000000004780000-memory.dmpFilesize
256KB
-
memory/2472-181-0x0000000004780000-0x00000000047E4000-memory.dmpFilesize
400KB
-
memory/2472-177-0x00000000046D0000-0x0000000004736000-memory.dmpFilesize
408KB
-
memory/2516-955-0x0000000005130000-0x00000000055DB000-memory.dmpFilesize
4.7MB
-
memory/2516-952-0x0000000005130000-0x00000000055DB000-memory.dmpFilesize
4.7MB
-
memory/2560-789-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-778-0x00000000001F0000-0x0000000000210000-memory.dmpFilesize
128KB
-
memory/2560-786-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-788-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-787-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-770-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-772-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-830-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-777-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-775-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-774-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-771-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-769-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-790-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2560-834-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2592-205-0x0000000000D60000-0x0000000000DE0000-memory.dmpFilesize
512KB
-
memory/2592-438-0x000007FEF5B40000-0x000007FEF652C000-memory.dmpFilesize
9.9MB
-
memory/2592-449-0x0000000000D60000-0x0000000000DE0000-memory.dmpFilesize
512KB
-
memory/2592-204-0x000007FEF5B40000-0x000007FEF652C000-memory.dmpFilesize
9.9MB
-
memory/2592-203-0x00000000013A0000-0x00000000016C4000-memory.dmpFilesize
3.1MB
-
memory/2616-751-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2616-753-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2616-748-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2616-744-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2616-740-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2616-729-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2616-728-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2616-727-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2784-417-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2784-416-0x0000000000F90000-0x000000000142E000-memory.dmpFilesize
4.6MB
-
memory/2784-512-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2784-419-0x0000000000BD0000-0x0000000000C10000-memory.dmpFilesize
256KB
-
memory/2892-214-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2892-271-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2892-220-0x00000000022F0000-0x00000000042F0000-memory.dmpFilesize
32.0MB
-
memory/2892-213-0x00000000009C0000-0x0000000000A1E000-memory.dmpFilesize
376KB
-
memory/2936-764-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2936-761-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2936-762-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2936-763-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2936-765-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2936-767-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2944-524-0x000007FEEDB20000-0x000007FEEE4BD000-memory.dmpFilesize
9.6MB
-
memory/2944-534-0x0000000002BF0000-0x0000000002C70000-memory.dmpFilesize
512KB
-
memory/2944-536-0x0000000002BF0000-0x0000000002C70000-memory.dmpFilesize
512KB
-
memory/2944-572-0x0000000002BF0000-0x0000000002C70000-memory.dmpFilesize
512KB
-
memory/2944-525-0x0000000002BF0000-0x0000000002C70000-memory.dmpFilesize
512KB
-
memory/2968-725-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2968-709-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2968-711-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2968-717-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2968-718-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2968-719-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2968-721-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/2968-723-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB