Analysis
-
max time kernel
299s -
max time network
291s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
22-04-2024 05:00
General
-
Target
3bc252962fd10b4a2705189d369217a624992a02964b514291808c4511507534.exe
-
Size
1.8MB
-
MD5
21bd925af956d373183c56f05a2f022b
-
SHA1
bbb8ee6062eb77770b9b0791e4904c0e9b5c89bb
-
SHA256
3bc252962fd10b4a2705189d369217a624992a02964b514291808c4511507534
-
SHA512
730366f793dbfbeb5185e31b5c18c8c191bf47ffc4d0dc25c41e3a36cad8eb59cb8239d8cdaa5b752083ceb7dea826b679c91de3a3f2daa4235adce47a1ada6d
-
SSDEEP
24576:f1ikQmEFWHyo8NsetBxomkreW071oo2HCA/VLAS+fBPGorpH8jh4dRFdzUCXoKVK:/hyRyMBqZvviA/VLAS+zp5JmU3s8
Malware Config
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
redline
LiveTraffic
4.184.225.183:30592
Extracted
stealc
http://52.143.157.84
-
url_path
/c73eed764cc59dcb.php
Extracted
lumma
https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://pillowbrocccolipe.shop/api
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detect ZGRat V1 2 IoCs
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 1 IoCs
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
Modifies firewall policy service 2 TTPs 1 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 8 IoCs
-
Stealc
Stealc is an infostealer written in C++.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 7 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
-
Blocklisted process makes network request 3 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 31 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 11 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 8 IoCs
Detects Themida, an advanced Windows software protection system.
-
Windows security modification 2 TTPs 7 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Drops file in System32 directory 15 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 10 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 5 IoCs
-
Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bc252962fd10b4a2705189d369217a624992a02964b514291808c4511507534.exe"C:\Users\Admin\AppData\Local\Temp\3bc252962fd10b4a2705189d369217a624992a02964b514291808c4511507534.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 8003⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\uu4.0.exe"C:\Users\Admin\AppData\Local\Temp\uu4.0.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exeC:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exeC:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe8⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\uu4.1.exe"C:\Users\Admin\AppData\Local\Temp\uu4.1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 4964⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe"C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe"C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe"3⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\106386276412_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
4Windows Service
4Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
7Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
3Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD57ce47df53c8f0ba7ccf885c309afc484
SHA1b25ad9723b06d3861498caa32ffb1b7b38701a95
SHA2567031b6b7bc43cf4ee90d4ec4860b78a442352243ea28f5d959b56222b13de2e4
SHA51278585fbfcfe2e7a27f0ee168075958923184e67da1668850d0e66e31f0fd0a5516c04a17693ad197da7ffffb179265cd54fe0629fa30e00a6f269c6d68277efd
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
488KB
MD582053649cadec1a338509e46ba776fbd
SHA16d8e479a6dc76d54109bb2e602b8087d55537510
SHA25630468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e
SHA512e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exeFilesize
3.3MB
MD5b9882fe8bb7ab2a4d094f9ff5442df1c
SHA1e17c146530a4371e0595c195c24863935a3dee8b
SHA2564f47d84b03f5cfa3845d1b36df5e40df984756fc6ba2d98586eb39dced212628
SHA512bee33d43deb43854975e6c7a57f27ab8c6519ea3e6df51297ca670ac62831f29f6a18eff0bb0af14f9e985ebf9e2169ed97582fa64998cfb33b1d8b61ec72db4
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exeFilesize
414KB
MD554a03236a463e61572b8098d37944f15
SHA16279b885b11630156b8554f5aac5b5720b5b6238
SHA256562bbfb4dcfdc559641f3a83f0de7323d60220e94bb46e85de889475fb643333
SHA512bfc15816cb1ddc33c6525d0d94305871d4a1d51b225c49273289745ba7269881131c1df587703f0a96d79199a1424ce2fc90f36a57267fe3ca0fa07cfe540695
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exeFilesize
283KB
MD5ace2b92a3208dec19577cbac84d543b2
SHA1c40b8908ebbfa819c3581ec85bfca66bca77b605
SHA2561d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e
SHA512e7e6244087d993ae9beac2fba78452c3eb55f52cbcf515a5888e6078d87f235f1f54c12408eb4d0457102d22a8aa18d069dda0788cce72b0b456a74f7439459f
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.2MB
MD51c480386f3a4a56142b7a140590865de
SHA1a2ac30674033c69e96fff4abe4a9693d1713ed75
SHA2560f5ff3c62f03a74c17111cfd684520f46e09371ee861edcba67370fc92800d43
SHA512609fff5db8a0b565dc52a1828677848a4b7691ed51b9312f35171d36cd2342f75976ca4c991c3c3a46fb0402f848f86af12cda7dca1bac98400b6cd4983f34d4
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exeFilesize
556KB
MD5e1d8325b086f91769120381b78626e2e
SHA10eb6827878445d3e3e584b7f08067a7a4dc9e618
SHA256b925abb193e7003f4a692064148ffe7840096022a44f4d5ae4c0abb59a287934
SHA512c8c0b424c2ed7ee598997bdc0b0d2099b650a280903716891b0eaa340acf556c0642d921fcb7f654387a4a1f1ec4a32feaf8d872b51ca482a977f11e2974072c
-
C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exeFilesize
5.4MB
MD509567a19fa958357b14baf7841aa959c
SHA1be50017f35f7a24e91dd3f9be7367939b3c6f681
SHA256efc1ed06c96dfe3ed1a4c3944b02282c21a881b8227d1e4297eb56f716cd09b8
SHA5123e02e5ca0435b921ed4199f3314bb3ea1316aa58dc02bd6bb322c14d13157b504a71f6c746f28137de6ed5e504dc178dd2f999e2009b4b5725419cffd88e0019
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeFilesize
1.8MB
MD521bd925af956d373183c56f05a2f022b
SHA1bbb8ee6062eb77770b9b0791e4904c0e9b5c89bb
SHA2563bc252962fd10b4a2705189d369217a624992a02964b514291808c4511507534
SHA512730366f793dbfbeb5185e31b5c18c8c191bf47ffc4d0dc25c41e3a36cad8eb59cb8239d8cdaa5b752083ceb7dea826b679c91de3a3f2daa4235adce47a1ada6d
-
C:\Users\Admin\AppData\Local\Temp\9d367a81Filesize
3.8MB
MD513418f74a7ce25cdd6997c9fcb718a0e
SHA1f4c880821fee72c37c882b1e8ebf100efcafe31c
SHA256a890935a36903669f35522c85c75e296404a4595453f060398cb64c5b0d6dfd0
SHA51259017162877bbbdf823450a946e3e54e9130d8ebbf5baba24471c68a10d1fad3452be08c693cd7a78d0bf2fcfd6d3086edeec1a379f9b53fd66bb246c128d4c1
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exeFilesize
7.6MB
MD5862bf3003dca41d88ac49a6846149623
SHA1b34f1d42dd0649d6b83f9a92124a554f48df0434
SHA25650c10789db130a98c63e6e7f6e23b1c89b38c5ea4678f1e06fd1796fba25c75c
SHA512fe5ab7888633dbfecca57ecd1732360796c2f19c62fc4282e2a92e9b8b440cc01e25b7a0c6a608cf9c2e9c9e3c49a8509a08851afcaef7e1afc21c0abcc2c969
-
C:\Users\Admin\AppData\Local\Temp\Tmp290F.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\cosmetician.mpegFilesize
79KB
MD58e1bbc6d6c4d207393b59853f73945ae
SHA1b66d632eae41267175bf5332d43a785dd929d79f
SHA256b04725aaa99b27e04c02bec7d98fb4511331ea53761272325fff9c27a679e279
SHA5121b45a7be00f54498df289641745ca6ee99e11d63100fb838b96c2d9412f8b5f0ea5aa8b964f32a4f9182cd599765f5ca08b91e8e8eecd06d1c53543284a59001
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exeFilesize
938KB
MD5b15bac961f62448c872e1dc6d3931016
SHA11dcb61babb08fe5db711e379cb67335357a5db82
SHA256bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5
SHA512932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\quersprung.vhdFilesize
1.3MB
MD53bee67dd0e04559c8fdc7761336dee47
SHA1027ef9dca01fb928db79e57b418130165f06ed5f
SHA25657745aba2885cf8bf770e7e9195697c05e35333417ca23af153367bf31cbf812
SHA51235fb66f98a57b0d14c3044a91abac3e0670d516edfd691d6670df034e8454c550d3d2e702ab90cd32b70fcba8aeb2e02b7b3a07b6a340a932738968473f77dce
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_je3lumhh.2tv.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
3KB
MD5d1af56046419c67cb9a4d76fd3c82e88
SHA1735186067f82841d06d5cfd8c2dd052129072956
SHA2563b2f265d70ab8499119ea8c8bb3b8a881ae93cef72a2eec572e88d1db6184b76
SHA51235fb8a7642449807c2d5d97cb32ee9eb8563487bc5aed0928ca535422d6d19a6139287435a9e33d998571d97bfec60ea34d497faa79379b227d4f94d7c9a445f
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD570a026bf9663182a2ae9328c9fbdff1c
SHA10a16b7253423426cf2de55f6321d378ed7d7b5ca
SHA256a2a9c78fde0a783f320a3d4969fe7cf0a449e9319eae92e765457f3c9b09ce6b
SHA5127218523c9b91d30b23288496613ab2e5828d3711dc0e38db2fd179a6435bd67f862db6e3e01160c3682afcb551b811ca658a8e4f01c4a3bc8c52d0de0c175dfc
-
C:\Users\Admin\AppData\Local\Temp\tmp71B1.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmpC079.tmpFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Local\Temp\uu4.0.exeFilesize
270KB
MD551627ffc0192dd8143c0c0208392166d
SHA1dba1a938466fd61f41198400e2a899fa43819d7e
SHA2563200fac8ca4eb6abba8e97221ee8e74f68edc6385b02bb5d04adb57e32432b6b
SHA512f92f5d1f598480a34f5bad1a58de59b7c11e9311ee64147c33fedc2889f9184f91e0e02237c2eff6a5efa02543a87d36c99c34ff2b361fca8bd5d8a3baa6025b
-
C:\Users\Admin\AppData\Local\Temp\uu4.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4106386276-4127174233-3637007343-1000\76b53b3ec448f7ccdda2063b15d2bfc3_ebaa0802-254d-4be1-a642-a8a5c0b06224Filesize
2KB
MD5fa7acefa6e55dc7dd88e8ceaf29810d6
SHA15b906d7f8d74796d54c4d4a18a676e3b71a67227
SHA256e7a899bacef7189a3a5f676bcc2ffe2565b029cd6b7364a7a10817f8f0cdb565
SHA5128d510ca6aa87ca760d7a0b095debcc2f3b8636bbe61777e0940c9c808c328756d18ba9bc8d8cfd2cfd73658ded7ffca5315741b12db05f4cc94378eb572aa650
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Pictures\OScX1vjxByqq1S2GuobRihhN.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5c01f05f08621230cfd1f0be4f3a083e3
SHA1bd3173b79a6d1cd3ae811689be33b52644926750
SHA25602c8ec24d83d7f8532b8f3e6b28adae62c75945dc0e9e5c76375082563f2fdae
SHA512448a81229144c8df77e496fae37d7885473506504b84d3e4532acd2dc5a156e5b7cbc9038e11c4758e5253e0fc5a13228ffa7f7de30db49a85f23e0e6a4fa326
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\WCLDll.dllFilesize
590KB
MD563206e3b4f1fa4dcfbe1f2cc5d0c4e9d
SHA1fe731b2e9c296d9ecc75ed96c2d29fe46c7cd924
SHA2568f5b8645b5e5ea48acc411b21a1b3cd56d2660ac931989b9f064c8ff82039885
SHA51232bdcce9e8e7f1ebe50e114f65f762391d52f482a112515ccb16b09653b93873528ea1a7473a2512075bf8f729997a65f455bf6599482e997b85e06a2f87f3d6
-
\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\msvcp140.dllFilesize
427KB
MD571a0aa2d05e9174cefd568347bd9c70f
SHA1cb9247a0fa59e47f72df7d1752424b33a903bbb2
SHA256fdb3d86c512adff90967cb860d02a4682850ab96727f0376e4d4836504c50e47
SHA5126e65520528facaa4058720eb16d6bfdcc7bb36923b7e8e6551f3526709f0fabafab123999e618438e6abe7efed4a1332547cfc988f2b24b0e3d91198b95a911a
-
\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\vcruntime140.dllFilesize
81KB
MD516b26bc43943531d7d7e379632ed4e63
SHA1565287de39649e59e653a3612478c2186096d70a
SHA256346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517
SHA512b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc
-
memory/1084-74-0x0000000002790000-0x00000000027A0000-memory.dmpFilesize
64KB
-
memory/1084-411-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/1084-654-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/1084-83-0x00000000721C0000-0x00000000728AE000-memory.dmpFilesize
6.9MB
-
memory/1084-84-0x00000000028C0000-0x00000000048C0000-memory.dmpFilesize
32.0MB
-
memory/1084-548-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/1084-73-0x00000000721C0000-0x00000000728AE000-memory.dmpFilesize
6.9MB
-
memory/1084-72-0x00000000002E0000-0x000000000049C000-memory.dmpFilesize
1.7MB
-
memory/1288-192-0x000000001C2E0000-0x000000001C2F2000-memory.dmpFilesize
72KB
-
memory/1288-191-0x000000001D7A0000-0x000000001D8AA000-memory.dmpFilesize
1.0MB
-
memory/1288-121-0x00007FFA5EB60000-0x00007FFA5F54C000-memory.dmpFilesize
9.9MB
-
memory/1288-100-0x0000000000650000-0x00000000006DC000-memory.dmpFilesize
560KB
-
memory/1288-193-0x000000001D690000-0x000000001D6CE000-memory.dmpFilesize
248KB
-
memory/1288-123-0x000000001B250000-0x000000001B260000-memory.dmpFilesize
64KB
-
memory/1520-425-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2512-700-0x00007FFA6A7B0000-0x00007FFA6A98B000-memory.dmpFilesize
1.9MB
-
memory/2512-694-0x000000006A120000-0x000000006A29B000-memory.dmpFilesize
1.5MB
-
memory/2676-7-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/2676-11-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/2676-1-0x0000000076F74000-0x0000000076F75000-memory.dmpFilesize
4KB
-
memory/2676-0-0x0000000000E40000-0x00000000012FE000-memory.dmpFilesize
4.7MB
-
memory/2676-2-0x0000000000E40000-0x00000000012FE000-memory.dmpFilesize
4.7MB
-
memory/2676-4-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/2676-3-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/2676-6-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/2676-5-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/2676-8-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/2676-16-0x0000000000E40000-0x00000000012FE000-memory.dmpFilesize
4.7MB
-
memory/2676-9-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/2676-10-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/2972-56-0x0000000000D60000-0x0000000000DA0000-memory.dmpFilesize
256KB
-
memory/2972-55-0x0000000000D60000-0x0000000000DA0000-memory.dmpFilesize
256KB
-
memory/2972-47-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2972-52-0x0000000000D60000-0x0000000000DA0000-memory.dmpFilesize
256KB
-
memory/2972-53-0x0000000000D60000-0x0000000000DA0000-memory.dmpFilesize
256KB
-
memory/2972-57-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2972-50-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2972-54-0x0000000000D60000-0x0000000000DA0000-memory.dmpFilesize
256KB
-
memory/3260-85-0x00000000721C0000-0x00000000728AE000-memory.dmpFilesize
6.9MB
-
memory/3260-77-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/3392-620-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3428-304-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/3428-363-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/3428-300-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/3500-144-0x0000000000A80000-0x0000000000AFD000-memory.dmpFilesize
500KB
-
memory/3500-142-0x0000000000A80000-0x0000000000AFD000-memory.dmpFilesize
500KB
-
memory/3908-516-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4180-145-0x00000000721C0000-0x00000000728AE000-memory.dmpFilesize
6.9MB
-
memory/4180-143-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4220-547-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/4220-619-0x000000006A120000-0x000000006A29B000-memory.dmpFilesize
1.5MB
-
memory/4220-615-0x00007FFA6A7B0000-0x00007FFA6A98B000-memory.dmpFilesize
1.9MB
-
memory/4220-609-0x000000006A120000-0x000000006A29B000-memory.dmpFilesize
1.5MB
-
memory/4256-93-0x00000000721C0000-0x00000000728AE000-memory.dmpFilesize
6.9MB
-
memory/4256-94-0x0000000000090000-0x00000000000E2000-memory.dmpFilesize
328KB
-
memory/4256-125-0x0000000006030000-0x000000000613A000-memory.dmpFilesize
1.0MB
-
memory/4256-124-0x00000000064C0000-0x0000000006AC6000-memory.dmpFilesize
6.0MB
-
memory/4256-120-0x0000000005C50000-0x0000000005C6E000-memory.dmpFilesize
120KB
-
memory/4256-117-0x00000000054B0000-0x0000000005526000-memory.dmpFilesize
472KB
-
memory/4256-126-0x0000000005F60000-0x0000000005F72000-memory.dmpFilesize
72KB
-
memory/4256-119-0x0000000004950000-0x0000000004960000-memory.dmpFilesize
64KB
-
memory/4256-194-0x0000000006270000-0x00000000062D6000-memory.dmpFilesize
408KB
-
memory/4256-136-0x0000000005FC0000-0x0000000005FFE000-memory.dmpFilesize
248KB
-
memory/4256-99-0x0000000004960000-0x000000000496A000-memory.dmpFilesize
40KB
-
memory/4256-137-0x0000000006140000-0x000000000618B000-memory.dmpFilesize
300KB
-
memory/4256-96-0x0000000004990000-0x0000000004A22000-memory.dmpFilesize
584KB
-
memory/4256-95-0x0000000004DF0000-0x00000000052EE000-memory.dmpFilesize
5.0MB
-
memory/4572-178-0x0000000000AF0000-0x0000000000FAE000-memory.dmpFilesize
4.7MB
-
memory/4572-509-0x0000000000AF0000-0x0000000000FAE000-memory.dmpFilesize
4.7MB
-
memory/4572-20-0x0000000000AF0000-0x0000000000FAE000-memory.dmpFilesize
4.7MB
-
memory/4572-26-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/4572-19-0x0000000000AF0000-0x0000000000FAE000-memory.dmpFilesize
4.7MB
-
memory/4572-78-0x0000000000AF0000-0x0000000000FAE000-memory.dmpFilesize
4.7MB
-
memory/4572-58-0x0000000000AF0000-0x0000000000FAE000-memory.dmpFilesize
4.7MB
-
memory/4572-718-0x0000000000AF0000-0x0000000000FAE000-memory.dmpFilesize
4.7MB
-
memory/4572-22-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/4572-375-0x0000000000AF0000-0x0000000000FAE000-memory.dmpFilesize
4.7MB
-
memory/4572-27-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/4572-29-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/4572-28-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/4572-21-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/4572-25-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/4572-23-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/4572-24-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/4656-662-0x00007FFA6A7B0000-0x00007FFA6A98B000-memory.dmpFilesize
1.9MB
-
memory/4656-653-0x000000006A120000-0x000000006A29B000-memory.dmpFilesize
1.5MB
-
memory/5004-44-0x00000000721C0000-0x00000000728AE000-memory.dmpFilesize
6.9MB
-
memory/5004-43-0x00000000009F0000-0x0000000000A42000-memory.dmpFilesize
328KB
-
memory/5004-51-0x0000000002CD0000-0x0000000004CD0000-memory.dmpFilesize
32.0MB
-
memory/5004-98-0x00000000721C0000-0x00000000728AE000-memory.dmpFilesize
6.9MB
-
memory/5004-118-0x0000000002CD0000-0x0000000004CD0000-memory.dmpFilesize
32.0MB
-
memory/5412-741-0x00007FF75F100000-0x00007FF75F7FC000-memory.dmpFilesize
7.0MB
-
memory/5412-749-0x00007FF75F100000-0x00007FF75F7FC000-memory.dmpFilesize
7.0MB
-
memory/5412-754-0x00007FF75F100000-0x00007FF75F7FC000-memory.dmpFilesize
7.0MB
-
memory/5412-752-0x00007FF75F100000-0x00007FF75F7FC000-memory.dmpFilesize
7.0MB
-
memory/5412-757-0x00007FF75F100000-0x00007FF75F7FC000-memory.dmpFilesize
7.0MB
-
memory/5412-759-0x00007FF75F100000-0x00007FF75F7FC000-memory.dmpFilesize
7.0MB
-
memory/5412-762-0x00007FF75F100000-0x00007FF75F7FC000-memory.dmpFilesize
7.0MB