Analysis
-
max time kernel
103s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
21-04-2024 06:01
General
-
Target
949eec359c5477369714b627a01403c70942ba456815d59a3cf167f6f8ffc6f9.exe
-
Size
1.9MB
-
MD5
07cef615474a090cb5f7796b6ffed613
-
SHA1
b9e912c5305acd8b06eb6642b247fa14f70123e2
-
SHA256
949eec359c5477369714b627a01403c70942ba456815d59a3cf167f6f8ffc6f9
-
SHA512
bae595c50567a3e4c56a8e486189153075b0dc95c3b29e3e9be14954bd2337129c8a0618e467ee27a96f9518258b10b051e57a174fa04991ed9a11519e9ffd28
-
SSDEEP
49152:FTnrnfpQW41aKqXFaj0Ur6hFjBGu9Fw50fSx0dFK+Z1u:Zrd44Kqwz6TjB9U50fNn
Malware Config
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
redline
LiveTraffic
4.184.225.183:30592
Extracted
stealc
http://185.172.128.209
http://52.143.157.84
-
url_path
/3cd2b41cbde8fc9c.php
Extracted
lumma
https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://pillowbrocccolipe.shop/api
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detect ZGRat V1 2 IoCs
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 7 IoCs
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
-
Stealc
Stealc is an infostealer written in C++.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 2 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Blocklisted process makes network request 2 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 27 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 3 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Drops file in System32 directory 7 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 5 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 5 IoCs
-
Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 5 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\949eec359c5477369714b627a01403c70942ba456815d59a3cf167f6f8ffc6f9.exe"C:\Users\Admin\AppData\Local\Temp\949eec359c5477369714b627a01403c70942ba456815d59a3cf167f6f8ffc6f9.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 8643⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\132431369515_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u27w.0.exe"C:\Users\Admin\AppData\Local\Temp\u27w.0.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 10165⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 3564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe"C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe"3⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe" -Force4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\ZBtpoQ4LhdIYGesx7OHkQcY0.exe"C:\Users\Admin\Pictures\ZBtpoQ4LhdIYGesx7OHkQcY0.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\ZBtpoQ4LhdIYGesx7OHkQcY0.exe"C:\Users\Admin\Pictures\ZBtpoQ4LhdIYGesx7OHkQcY0.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\uxRcRdfnOejiacluOQYKXA1G.exe"C:\Users\Admin\Pictures\uxRcRdfnOejiacluOQYKXA1G.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u234.0.exe"C:\Users\Admin\AppData\Local\Temp\u234.0.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 10127⤵
- Program crash
-
C:\Users\Admin\Pictures\lOxDv2dagn0h3DH0MItiKfOJ.exe"C:\Users\Admin\Pictures\lOxDv2dagn0h3DH0MItiKfOJ.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\lOxDv2dagn0h3DH0MItiKfOJ.exe"C:\Users\Admin\Pictures\lOxDv2dagn0h3DH0MItiKfOJ.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Kp1d26vcRJdc01SaKSEIOAss.exe"C:\Users\Admin\Pictures\Kp1d26vcRJdc01SaKSEIOAss.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
C:\Users\Admin\Pictures\BIXb7gugeeAzOx0ZwOnWW9WF.exe"C:\Users\Admin\Pictures\BIXb7gugeeAzOx0ZwOnWW9WF.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\Kd7ZuAdv29WrxPifM3cQ2KeG.exe"C:\Users\Admin\Pictures\Kd7ZuAdv29WrxPifM3cQ2KeG.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\Kd7ZuAdv29WrxPifM3cQ2KeG.exe"C:\Users\Admin\Pictures\Kd7ZuAdv29WrxPifM3cQ2KeG.exe"5⤵
-
C:\Users\Admin\Pictures\lrcGJyKo5aXEjAV1RdlOuOfi.exe"C:\Users\Admin\Pictures\lrcGJyKo5aXEjAV1RdlOuOfi.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\u3a0.0.exe"C:\Users\Admin\AppData\Local\Temp\u3a0.0.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 10166⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000193001\dirtquire.exe"C:\Users\Admin\AppData\Local\Temp\1000193001\dirtquire.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Start-Process 'C:\Users\Admin\AppData\Roaming\8M83I8P01X.exe'"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 840 -ip 8401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3372 -ip 33721⤵
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6064 -ip 60641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5196 -ip 51961⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5fa1d525a11d9544a529986330378d813
SHA18be7cf5b05fd2f20aa79f3a0a50ddafe29e22132
SHA2560d6877ef9e8a236745b6ed4aa8cd298ae59d95c9346044066dad8cf71049e941
SHA5126a83e1ee002df1c62f08c8c1f19f914a64d34aadaeda5479e55e42541be92a2fdeace833995c9f8075b928d2183d286d23ace1b51d99587724098b757bd282dd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5ba14a5b5d8345ad433f7f921da435bdd
SHA12de3107be5988cfb506637a51d929208445e059c
SHA256feb14bb0eb8d177962d3a6a40a3b18fa8aa27339572f9297e442dc903bdebd82
SHA512a059d1715f51b31fd0ac4927b24644457ba6609a3324185d1fdae7ba3fd870304d7d06bee30fd709bc728ca26962515071ef73f11b42173e6f600c3d7b2b8655
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD51c34b78b62a15df4596843d3771d37eb
SHA1ffc96b6f6f56164798f1780ec0375c6d7d91f2c9
SHA256cb9bc4df14155ca86f345357865c23dfe98e33306e201380b23fa826e86188b2
SHA51245d66c8e429cff4e110b26ecf9df76ec6ecd4c64443e3978549f9d1b7d0ff5013bb63acb7ea63f2ebdb4a43755408ae8b3cceb70613b1e84fed12944dd6057fa
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
488KB
MD582053649cadec1a338509e46ba776fbd
SHA16d8e479a6dc76d54109bb2e602b8087d55537510
SHA25630468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e
SHA512e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exeFilesize
3.3MB
MD5b9882fe8bb7ab2a4d094f9ff5442df1c
SHA1e17c146530a4371e0595c195c24863935a3dee8b
SHA2564f47d84b03f5cfa3845d1b36df5e40df984756fc6ba2d98586eb39dced212628
SHA512bee33d43deb43854975e6c7a57f27ab8c6519ea3e6df51297ca670ac62831f29f6a18eff0bb0af14f9e985ebf9e2169ed97582fa64998cfb33b1d8b61ec72db4
-
C:\Users\Admin\AppData\Local\Temp\1000193001\dirtquire.exeFilesize
273KB
MD5e795115169cc800de0392d6a675d58fd
SHA18dd75837e360ba1cb8acf5a3d348dd020a5da482
SHA25617f929c1d40a7fd6f897c0b15ca9c44b2059cbccb3037c31619d87954659478e
SHA5125fb6543e91de175bd365462a1cc87d6772e43b0effd3757b3e408b08a4de5a004de9a85e7f1d09578fa3bc6b6486c5f5016c1b879496582dbb39b2e62e168f38
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exeFilesize
445KB
MD5a4ff45669edba40e7cf0e41e0c154c4f
SHA14b87fca932cea0d1c2d62234e10edef8e658b2ae
SHA2562a08e27c78c12acefbd49668d9384b5e54a5f907bedac5c3f5d2094e8bf3f9d1
SHA512ca509c14c201102564804e5e67f51c631ef2c0647bd555bdbd0fd290b1ac6d0a74f42d326abe8051d230c80181f0dc90b2d70d75a7c94aab52532a2b506eb52d
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exeFilesize
324KB
MD5b53fd458a492bc8159c7343ff6facaf9
SHA12ad05ffaf407e06a2e41216f66a3839f8d107273
SHA25630c188b8b015cd09e21c82db0f53c74153fd0415ff096625501ff16df1e75de9
SHA5121392b9b8ec4dd8105edd3b1361db62be6c160dc56263e194fab03ee5a2006ef6e33d25c37a2bae440f894a5a1fc45d0c3555c1c3160fc7b00fc2b1ef1f87f9bc
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.2MB
MD5ed8593e5f283b8088fbdc61de4dc48d2
SHA156be3c8af7b97b0e3ed033a53a8fc056528321d5
SHA256769a2271e023a176150f121941025e07722a8ac7a45efbadd1f8018b528083d3
SHA5129505a39dabf78ae5461cdff430147bc995c5cd6523dd87688338c7344903817c180adfdcff971ffd22b3d854adfa711c73812bbde59d302a064152ec8aab7023
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exeFilesize
556KB
MD5e1d8325b086f91769120381b78626e2e
SHA10eb6827878445d3e3e584b7f08067a7a4dc9e618
SHA256b925abb193e7003f4a692064148ffe7840096022a44f4d5ae4c0abb59a287934
SHA512c8c0b424c2ed7ee598997bdc0b0d2099b650a280903716891b0eaa340acf556c0642d921fcb7f654387a4a1f1ec4a32feaf8d872b51ca482a977f11e2974072c
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeFilesize
1.9MB
MD507cef615474a090cb5f7796b6ffed613
SHA1b9e912c5305acd8b06eb6642b247fa14f70123e2
SHA256949eec359c5477369714b627a01403c70942ba456815d59a3cf167f6f8ffc6f9
SHA512bae595c50567a3e4c56a8e486189153075b0dc95c3b29e3e9be14954bd2337129c8a0618e467ee27a96f9518258b10b051e57a174fa04991ed9a11519e9ffd28
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exeFilesize
14.4MB
MD51bb6c7adef5d1f8a3cf2f5f7269256a9
SHA108d71fd2082cc606d256290e7f42409b2ee6a670
SHA2560e8115a2bcdafa2d679cab12a03d3e8fc8bfd87122073840618d175975e89953
SHA512cec7eab2eaf532920717d1e8378bd102079d9717cdeea5c42e6800d6ea026aa005356835e09fac2e4f96401d2ff7c52c4052955ec38a359e51a6f7ea12afaeb5
-
C:\Users\Admin\AppData\Local\Temp\TmpC469.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uiztxgou.4g3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\u27w.0.exeFilesize
323KB
MD51d4341aa0ca4aefcb043d19eb205d8ac
SHA1c6e7a063a22e6bad72b2c81017747ab31cb59579
SHA25642af762221074082dc3aa6e4efdc2b6439cc026d6e94d6eeae97fcfafda272b4
SHA5121bcc133000feb1ab7944295a14601ff1a66432dcbe117e9e60c9f98cb8aee5b28f0ddcbbc25e2b6d91b677ca67de32a8930a1317de9b8be17524a9bea43c73a7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1132431369-515282257-1998160155-1000\76b53b3ec448f7ccdda2063b15d2bfc3_70c90021-9ffc-4518-9838-e0670256fcd5Filesize
2KB
MD5abd3f51e38eaa223219341385175b750
SHA166327a7747d026c124d440d4ac8209b712e94a59
SHA2560f8204c5dbb9e235ff97c295dca69398334e29886ded616f363a9ba7ba39f2a4
SHA5126e1f25a64b85789e02071127366557d5ff54def00e1b9b5213399320dc3c68cfebb93a80c83be0b97e47141759a2c8a291cdc52f69e2a61d2aa12bea21c00f71
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Pictures\Bdq0vzSOH6lhAOTYQlyC132d.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\Pictures\Kp1d26vcRJdc01SaKSEIOAss.exeFilesize
3.9MB
MD5ffee05ea98b1d51026a44fad0841a8a9
SHA150a703329c7b9812c17a02b554cf406040079fec
SHA2564cb040696b9ffb14794955b0e56eed04fde0cae3a5ee748dd513ad42c411c823
SHA512626ddc18a906b74a231daa5bcc092a90708e0e3d42e4db645d59d19de7ef38a2d91a843f11dbc7873d379bfa14e87c5fc6d09a657e0b44abd24b9991cb971f86
-
C:\Users\Admin\Pictures\ZBtpoQ4LhdIYGesx7OHkQcY0.exeFilesize
4.2MB
MD512c1251ddacc8c6651573aaae2a36711
SHA1aa4a4fc95f24a847f33a0fcc22d318fe947929d0
SHA256a018166a731757f43374b0b24baecfbf31b85cf9de793b9d11b186acf887bf22
SHA512e8e9723b210254504ae06f77ed86ff5c7da0ac1ba5134cb2ab99cd42b06744cdf2379835d5e8cbd413da69b1184a0d6297d29dc8393794d8959c5a2dc94f0a69
-
C:\Users\Admin\Pictures\uxRcRdfnOejiacluOQYKXA1G.exeFilesize
445KB
MD5962689a584907a91344cd3427b586a04
SHA1662bccdb6bd35082045778a68361dd3bf849dd57
SHA2566abeb832e0ebffa3c8f166620d0aba275c0d51c4f75465e79a85716aead44cb4
SHA512c9fa49f5c86498857c78ca833c847758b0e8b61db68454a5a5b3950332ac3f7238606f0ead0b1c288fcf82f7e450fb90b07f8770badac376bb8786caa755f6cb
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5172f4df0963c9636db6ece5aac9f6abe
SHA1cce0cd016cd10388bffc1b198409189a50752b61
SHA25635571050d0a67c7c9b527993c04f93daf9b7949574d73bcc24567954143b5d68
SHA51287834f32b98d7a927a7442ff5b5fd78d1091f94a5021d29744c0b81df5321ce56aed883db3608e7474bc91551bf66950e252c86ad20ca800714ed52d63ef9772
-
C:\Users\Public\Desktop\Microsoft Edge.lnkFilesize
2KB
MD56c00b30a034d7ed9b4ff1fd8e6d032ae
SHA1c03f14e1dce11ce1891e6942af28c9f9a298046d
SHA25628b702b0163caa2edd0fb7c80b8b28df6ce6ef1535d1d05ca52689f853eabd3e
SHA512bbce5f0c43d4cc39b8b45c83465a06341f992ca7b470d569d3267855ec6b1f562ac7b4245017ddf36430eb5301a0acd72ae9a724183522c6791810e13bc22094
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD598396ef0f3bee459c247956c8bdae037
SHA1c6795ddba6f58387463b47aeba4c0b807c53ed38
SHA2567c15f4e2564d642351917b69cabceb4e41608ae9c31733257369142497b2ab25
SHA51230f85fe97c47054fd755d35c56fc95c9f723aeea64c8122453fdffd9dce90b558b4c76536c451271baed96ce4e45bc4aad9fd230823bfbc0f7fb1f2cc5c600c9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD52bfa9f1171151673bc059a390a1c19c2
SHA1780e4202ab89040384514cb461d1e1299ce4a8d9
SHA2567794dfa059d058d76965e628a00237b27ac4f71a1dc886758f0afc438ad848d6
SHA51239cb00221add4b68d4b3c64e4ac0fb6a0d353b3a6f99385fcb529cb1e8a5306137d66aa8a7c6c95c66c94dfe7f6185081207111e02d7bdce544043ea12d1459d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5280a78ae6201be3694fd2235b7cb3ce6
SHA1fd2c82a90498a34186ec6cd3ff432d7c25f753e0
SHA256cf5e599c8cbae8e7d9e76d0d135009f4aff7132306642c74538e8acfcddd3990
SHA512c7f77b0385f9f307a2ad7bea76f97d7906fef11fd889373b13c0c98ebd5087fd3d34026c3db0852ad1df4b74ec7d66569e9126e32efc3b28a748abb775668f3c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5dbf5103c1cb5da6dd4dae99f13dceaf5
SHA11aa671deb2cf3cee07f7f14051b67097f6fe33fb
SHA256844f848bda02a1a78938d124adda7aee755317fe70a892d867e0157a2c130dd3
SHA512ba8b5e1d2a8de0080f9db6723a1773d8b385971afb4c294ba3d4bf779ea179647e542ac18b5c17f2b9ff5625a536c699067711e26cb30b2d8d1a423e8c912334
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5ab2d659946290a666dc195ee3b94c490
SHA1f192b33d6c374f10656a0e69ba8715c0981b9a7e
SHA25608bd3d8f89672c33ad200b18b1831733e6e237fa02dda38141ca86732beafb9f
SHA512cd717da3fb3e0f69f96f85417150edc6b508ec5856fe22d7d2a8f24c7cda9fe5860c5eafb6d6b0be00fdac9d9afbd36b8a71fc2dc39b3e71ffdd4c44250abbfb
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/220-133-0x00000000057C0000-0x00000000057D0000-memory.dmpFilesize
64KB
-
memory/220-132-0x0000000073440000-0x0000000073BF0000-memory.dmpFilesize
7.7MB
-
memory/220-125-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/840-49-0x0000000000800000-0x0000000000852000-memory.dmpFilesize
328KB
-
memory/840-50-0x0000000073440000-0x0000000073BF0000-memory.dmpFilesize
7.7MB
-
memory/840-63-0x0000000073440000-0x0000000073BF0000-memory.dmpFilesize
7.7MB
-
memory/840-57-0x0000000002B20000-0x0000000004B20000-memory.dmpFilesize
32.0MB
-
memory/1628-59-0x0000000000A50000-0x0000000000A82000-memory.dmpFilesize
200KB
-
memory/1628-61-0x0000000000A50000-0x0000000000A82000-memory.dmpFilesize
200KB
-
memory/1628-60-0x0000000000A50000-0x0000000000A82000-memory.dmpFilesize
200KB
-
memory/1628-58-0x0000000000A50000-0x0000000000A82000-memory.dmpFilesize
200KB
-
memory/1628-56-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1628-53-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1628-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2004-949-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/2112-223-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/2704-975-0x0000000000400000-0x0000000001A3A000-memory.dmpFilesize
22.2MB
-
memory/3296-11-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/3296-9-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/3296-2-0x00000000009D0000-0x0000000000EA8000-memory.dmpFilesize
4.8MB
-
memory/3296-4-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/3296-5-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/3296-3-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/3296-6-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/3296-1-0x0000000077834000-0x0000000077836000-memory.dmpFilesize
8KB
-
memory/3296-0-0x00000000009D0000-0x0000000000EA8000-memory.dmpFilesize
4.8MB
-
memory/3296-7-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/3296-16-0x00000000009D0000-0x0000000000EA8000-memory.dmpFilesize
4.8MB
-
memory/3296-8-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/3296-10-0x0000000005560000-0x0000000005561000-memory.dmpFilesize
4KB
-
memory/3372-91-0x000001EF45DB0000-0x000001EF45DC0000-memory.dmpFilesize
64KB
-
memory/3372-92-0x000001EF45F00000-0x000001EF45F12000-memory.dmpFilesize
72KB
-
memory/3372-89-0x00007FFEFF100000-0x00007FFEFFBC1000-memory.dmpFilesize
10.8MB
-
memory/3372-93-0x000001EF45D50000-0x000001EF45D5A000-memory.dmpFilesize
40KB
-
memory/3372-88-0x000001EF45D70000-0x000001EF45D92000-memory.dmpFilesize
136KB
-
memory/3372-383-0x0000000000400000-0x0000000001A1C000-memory.dmpFilesize
22.1MB
-
memory/3372-99-0x00007FFEFF100000-0x00007FFEFFBC1000-memory.dmpFilesize
10.8MB
-
memory/3372-90-0x000001EF45DB0000-0x000001EF45DC0000-memory.dmpFilesize
64KB
-
memory/3956-119-0x00000000006B0000-0x000000000086C000-memory.dmpFilesize
1.7MB
-
memory/3956-127-0x0000000002AE0000-0x0000000004AE0000-memory.dmpFilesize
32.0MB
-
memory/3956-122-0x0000000005130000-0x0000000005140000-memory.dmpFilesize
64KB
-
memory/3956-121-0x0000000073440000-0x0000000073BF0000-memory.dmpFilesize
7.7MB
-
memory/3956-131-0x0000000073440000-0x0000000073BF0000-memory.dmpFilesize
7.7MB
-
memory/3972-179-0x00000000016A0000-0x00000000016B0000-memory.dmpFilesize
64KB
-
memory/3972-199-0x000000001EA50000-0x000000001EB5A000-memory.dmpFilesize
1.0MB
-
memory/3972-175-0x00007FFEFF580000-0x00007FFF00041000-memory.dmpFilesize
10.8MB
-
memory/3972-160-0x0000000000E30000-0x0000000000EBC000-memory.dmpFilesize
560KB
-
memory/4836-23-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/4836-1007-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-287-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-890-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-29-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/4836-120-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-64-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-450-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-22-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/4836-28-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/4836-571-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-27-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/4836-26-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/4836-65-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-25-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/4836-24-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/4836-688-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-21-0x0000000004AD0000-0x0000000004AD1000-memory.dmpFilesize
4KB
-
memory/4836-783-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-66-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-19-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4836-20-0x00000000007D0000-0x0000000000CA8000-memory.dmpFilesize
4.8MB
-
memory/4956-158-0x00000000053E0000-0x00000000053EA000-memory.dmpFilesize
40KB
-
memory/4956-178-0x0000000005FD0000-0x0000000006046000-memory.dmpFilesize
472KB
-
memory/4956-156-0x0000000005410000-0x00000000054A2000-memory.dmpFilesize
584KB
-
memory/4956-180-0x00000000067F0000-0x000000000680E000-memory.dmpFilesize
120KB
-
memory/4956-155-0x0000000005920000-0x0000000005EC4000-memory.dmpFilesize
5.6MB
-
memory/4956-184-0x0000000006BC0000-0x0000000006CCA000-memory.dmpFilesize
1.0MB
-
memory/4956-157-0x0000000002D60000-0x0000000002D70000-memory.dmpFilesize
64KB
-
memory/4956-196-0x0000000006CD0000-0x0000000006D1C000-memory.dmpFilesize
304KB
-
memory/4956-185-0x0000000006B00000-0x0000000006B12000-memory.dmpFilesize
72KB
-
memory/4956-183-0x0000000007070000-0x0000000007688000-memory.dmpFilesize
6.1MB
-
memory/4956-153-0x0000000073440000-0x0000000073BF0000-memory.dmpFilesize
7.7MB
-
memory/4956-154-0x0000000000A90000-0x0000000000AE2000-memory.dmpFilesize
328KB
-
memory/4956-186-0x0000000006B60000-0x0000000006B9C000-memory.dmpFilesize
240KB
-
memory/5188-616-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/5188-737-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/5352-964-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/5364-889-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/5628-528-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/5628-437-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/5628-433-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/5684-960-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/5684-833-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/5684-762-0x0000000000400000-0x0000000001DF9000-memory.dmpFilesize
26.0MB
-
memory/5768-787-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB