Analysis
-
max time kernel
299s -
max time network
296s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
22-04-2024 05:17
General
-
Target
72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe
-
Size
1.8MB
-
MD5
733fce8af4aa232cb80b7d61fa272764
-
SHA1
1bcc5b6309f5ff21b3e7d69a26d65ab318d2e760
-
SHA256
72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5
-
SHA512
8d4384aa54bce3ab173fc9b2f8146e08499c2be3520b41a5a24cdc4fbc15f37ffae6287bc4e32337a5a617942c3d70f46e70d4400718c2097e3ec8ff0db728be
-
SSDEEP
49152:4MtlcinxPGTqYeF1mj5OkN8Si74S82w0WR34Hm6VeWN:4MM38NUYw0aVA
Malware Config
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
amadey
4.12
http://185.172.128.19
-
install_dir
cd1f156d67
-
install_file
Utsysc.exe
-
strings_key
0dd3e5ee91b367c60c9e575983554b30
-
url_paths
/ghsdh39s/index.php
Extracted
redline
LiveTraffic
4.184.225.183:30592
Extracted
redline
Test1234
185.215.113.67:26260
Extracted
stealc
http://52.143.157.84
-
url_path
/c73eed764cc59dcb.php
Extracted
lumma
https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://pillowbrocccolipe.shop/api
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Detect ZGRat V1 2 IoCs
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 2 IoCs
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
Modifies firewall policy service 2 TTPs 1 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 9 IoCs
-
Stealc
Stealc is an infostealer written in C++.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 7 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
-
Blocklisted process makes network request 3 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 31 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 13 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
-
Windows security modification 2 TTPs 7 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Drops file in System32 directory 15 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 10 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 5 IoCs
-
Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe"C:\Users\Admin\AppData\Local\Temp\72a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 7563⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\699363923187_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u2m4.0.exe"C:\Users\Admin\AppData\Local\Temp\u2m4.0.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exeC:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exeC:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe8⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\u2m4.1.exe"C:\Users\Admin\AppData\Local\Temp\u2m4.1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 4964⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe"C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe"C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe"3⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
4Windows Service
4Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
7Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
3Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD57ce47df53c8f0ba7ccf885c309afc484
SHA1b25ad9723b06d3861498caa32ffb1b7b38701a95
SHA2567031b6b7bc43cf4ee90d4ec4860b78a442352243ea28f5d959b56222b13de2e4
SHA51278585fbfcfe2e7a27f0ee168075958923184e67da1668850d0e66e31f0fd0a5516c04a17693ad197da7ffffb179265cd54fe0629fa30e00a6f269c6d68277efd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD52b8ace391ff9fbf4b220ab7f26ce72f0
SHA157cb3225fe4b4149425f75d0c8f323ad045f9749
SHA256dcf75a4c727bad240a960b8fdf1d9607a3c4537a1810c2e5afb429fc1c85af3b
SHA51262abc6f845519e0a1e6acdbc4788a141142705029a438c1e043deb50dbe526436f084666b1008877e6e58159e56974156fcb9b2ac7038bd2ce5253cf2ff34944
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
488KB
MD582053649cadec1a338509e46ba776fbd
SHA16d8e479a6dc76d54109bb2e602b8087d55537510
SHA25630468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e
SHA512e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exeFilesize
3.3MB
MD5b9882fe8bb7ab2a4d094f9ff5442df1c
SHA1e17c146530a4371e0595c195c24863935a3dee8b
SHA2564f47d84b03f5cfa3845d1b36df5e40df984756fc6ba2d98586eb39dced212628
SHA512bee33d43deb43854975e6c7a57f27ab8c6519ea3e6df51297ca670ac62831f29f6a18eff0bb0af14f9e985ebf9e2169ed97582fa64998cfb33b1d8b61ec72db4
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exeFilesize
414KB
MD554a03236a463e61572b8098d37944f15
SHA16279b885b11630156b8554f5aac5b5720b5b6238
SHA256562bbfb4dcfdc559641f3a83f0de7323d60220e94bb46e85de889475fb643333
SHA512bfc15816cb1ddc33c6525d0d94305871d4a1d51b225c49273289745ba7269881131c1df587703f0a96d79199a1424ce2fc90f36a57267fe3ca0fa07cfe540695
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exeFilesize
283KB
MD5ace2b92a3208dec19577cbac84d543b2
SHA1c40b8908ebbfa819c3581ec85bfca66bca77b605
SHA2561d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e
SHA512e7e6244087d993ae9beac2fba78452c3eb55f52cbcf515a5888e6078d87f235f1f54c12408eb4d0457102d22a8aa18d069dda0788cce72b0b456a74f7439459f
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.2MB
MD51c480386f3a4a56142b7a140590865de
SHA1a2ac30674033c69e96fff4abe4a9693d1713ed75
SHA2560f5ff3c62f03a74c17111cfd684520f46e09371ee861edcba67370fc92800d43
SHA512609fff5db8a0b565dc52a1828677848a4b7691ed51b9312f35171d36cd2342f75976ca4c991c3c3a46fb0402f848f86af12cda7dca1bac98400b6cd4983f34d4
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exeFilesize
556KB
MD5e1d8325b086f91769120381b78626e2e
SHA10eb6827878445d3e3e584b7f08067a7a4dc9e618
SHA256b925abb193e7003f4a692064148ffe7840096022a44f4d5ae4c0abb59a287934
SHA512c8c0b424c2ed7ee598997bdc0b0d2099b650a280903716891b0eaa340acf556c0642d921fcb7f654387a4a1f1ec4a32feaf8d872b51ca482a977f11e2974072c
-
C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exeFilesize
5.4MB
MD509567a19fa958357b14baf7841aa959c
SHA1be50017f35f7a24e91dd3f9be7367939b3c6f681
SHA256efc1ed06c96dfe3ed1a4c3944b02282c21a881b8227d1e4297eb56f716cd09b8
SHA5123e02e5ca0435b921ed4199f3314bb3ea1316aa58dc02bd6bb322c14d13157b504a71f6c746f28137de6ed5e504dc178dd2f999e2009b4b5725419cffd88e0019
-
C:\Users\Admin\AppData\Local\Temp\1ec8640cFilesize
3.8MB
MD513418f74a7ce25cdd6997c9fcb718a0e
SHA1f4c880821fee72c37c882b1e8ebf100efcafe31c
SHA256a890935a36903669f35522c85c75e296404a4595453f060398cb64c5b0d6dfd0
SHA51259017162877bbbdf823450a946e3e54e9130d8ebbf5baba24471c68a10d1fad3452be08c693cd7a78d0bf2fcfd6d3086edeec1a379f9b53fd66bb246c128d4c1
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeFilesize
1.8MB
MD5733fce8af4aa232cb80b7d61fa272764
SHA11bcc5b6309f5ff21b3e7d69a26d65ab318d2e760
SHA25672a9a731d6a1237c6cc4cc3dd1b4cf2e1ddfdbed917c6f822b4c33d342366fc5
SHA5128d4384aa54bce3ab173fc9b2f8146e08499c2be3520b41a5a24cdc4fbc15f37ffae6287bc4e32337a5a617942c3d70f46e70d4400718c2097e3ec8ff0db728be
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exeFilesize
7.6MB
MD5862bf3003dca41d88ac49a6846149623
SHA1b34f1d42dd0649d6b83f9a92124a554f48df0434
SHA25650c10789db130a98c63e6e7f6e23b1c89b38c5ea4678f1e06fd1796fba25c75c
SHA512fe5ab7888633dbfecca57ecd1732360796c2f19c62fc4282e2a92e9b8b440cc01e25b7a0c6a608cf9c2e9c9e3c49a8509a08851afcaef7e1afc21c0abcc2c969
-
C:\Users\Admin\AppData\Local\Temp\TmpCDFE.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\MSVCP140.dllFilesize
427KB
MD571a0aa2d05e9174cefd568347bd9c70f
SHA1cb9247a0fa59e47f72df7d1752424b33a903bbb2
SHA256fdb3d86c512adff90967cb860d02a4682850ab96727f0376e4d4836504c50e47
SHA5126e65520528facaa4058720eb16d6bfdcc7bb36923b7e8e6551f3526709f0fabafab123999e618438e6abe7efed4a1332547cfc988f2b24b0e3d91198b95a911a
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\cosmetician.mpegFilesize
79KB
MD58e1bbc6d6c4d207393b59853f73945ae
SHA1b66d632eae41267175bf5332d43a785dd929d79f
SHA256b04725aaa99b27e04c02bec7d98fb4511331ea53761272325fff9c27a679e279
SHA5121b45a7be00f54498df289641745ca6ee99e11d63100fb838b96c2d9412f8b5f0ea5aa8b964f32a4f9182cd599765f5ca08b91e8e8eecd06d1c53543284a59001
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exeFilesize
938KB
MD5b15bac961f62448c872e1dc6d3931016
SHA11dcb61babb08fe5db711e379cb67335357a5db82
SHA256bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5
SHA512932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\quersprung.vhdFilesize
1.3MB
MD53bee67dd0e04559c8fdc7761336dee47
SHA1027ef9dca01fb928db79e57b418130165f06ed5f
SHA25657745aba2885cf8bf770e7e9195697c05e35333417ca23af153367bf31cbf812
SHA51235fb66f98a57b0d14c3044a91abac3e0670d516edfd691d6670df034e8454c550d3d2e702ab90cd32b70fcba8aeb2e02b7b3a07b6a340a932738968473f77dce
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cvx5d5hr.kk1.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
3KB
MD5ed854b08470302186d368ee769086f58
SHA133899aea23d6b54d67b206af9617ffbf3b43a822
SHA2568cc981a83ae5dedeeccb38ca3b6ce96ed35f4a3e6d596edb3ce1160bc48591ed
SHA512a8c83cde80c7c67fb6aa3778ad68634e603a0800c2e1eb8589e85a3f19731c7bcc83573ddb01305f4acc08bed46eef63a998395e51bdb27e8f2721101af5c566
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD50d90a6460ce154c64e55833706d6497b
SHA1e13bf2e4cb12983cb3b893a863263708626fde22
SHA256b2e6d2c49eced7c85856d56f7e7f2249b338be94a247fcef05c62b2399e43eb4
SHA51211afe6788b1751b9a6e16a342f387814a3f65e6be81915ba11f24f778b28a98921de2150b9c3cc0430dca375526440dbdcaea8d8906b1769979a2d91d96e3e52
-
C:\Users\Admin\AppData\Local\Temp\tmp5D79.tmpFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Local\Temp\u2m4.0.exeFilesize
270KB
MD551627ffc0192dd8143c0c0208392166d
SHA1dba1a938466fd61f41198400e2a899fa43819d7e
SHA2563200fac8ca4eb6abba8e97221ee8e74f68edc6385b02bb5d04adb57e32432b6b
SHA512f92f5d1f598480a34f5bad1a58de59b7c11e9311ee64147c33fedc2889f9184f91e0e02237c2eff6a5efa02543a87d36c99c34ff2b361fca8bd5d8a3baa6025b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3699363923-1875576828-3287151903-1000\76b53b3ec448f7ccdda2063b15d2bfc3_98f325b1-1085-43b7-8e27-43d9cdb6ea3fFilesize
2KB
MD56b7db241c2df272478135ef082a32aa8
SHA13bf9d0c0d78f1954b92c7114dd78d849ac155666
SHA256ec4e171a6fa5aa8a7a44a0c594ace01be27d3b37807d032c5f9739335275d530
SHA51272e56707eae30ab96a2b759a888983457c39c165aab58fd3ee2567721318ede3f42f919e5d725945118bd0b2fb739907548cfdd764537ab2fa16c8ce665d8514
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Pictures\uZjEI7Za0auUxVx4ExZq9Bxk.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5bbd926e228027517d5c6176c85a68569
SHA1ba334fd2111fe358cc710598cc23a28c680beecf
SHA2561a7def19519d17495270381b82f955f870ec38e4e9c8835dc59d2edf2572b865
SHA5127a0f9a22fe40acdb41f6524d7a0c70c81fbe79170cb2016153c90aba05924bc0963f59d0eee77917c39b77b7355ef4e41ca9807d070649d55fec55f48ca29044
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\WCLDll.dllFilesize
590KB
MD563206e3b4f1fa4dcfbe1f2cc5d0c4e9d
SHA1fe731b2e9c296d9ecc75ed96c2d29fe46c7cd924
SHA2568f5b8645b5e5ea48acc411b21a1b3cd56d2660ac931989b9f064c8ff82039885
SHA51232bdcce9e8e7f1ebe50e114f65f762391d52f482a112515ccb16b09653b93873528ea1a7473a2512075bf8f729997a65f455bf6599482e997b85e06a2f87f3d6
-
\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\vcruntime140.dllFilesize
81KB
MD516b26bc43943531d7d7e379632ed4e63
SHA1565287de39649e59e653a3612478c2186096d70a
SHA256346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517
SHA512b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc
-
memory/304-77-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/304-84-0x0000000072E10000-0x00000000734FE000-memory.dmpFilesize
6.9MB
-
memory/760-137-0x0000000006180000-0x000000000628A000-memory.dmpFilesize
1.0MB
-
memory/760-132-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/760-141-0x0000000006110000-0x000000000614E000-memory.dmpFilesize
248KB
-
memory/760-107-0x0000000004A90000-0x0000000004A9A000-memory.dmpFilesize
40KB
-
memory/760-135-0x0000000006610000-0x0000000006C16000-memory.dmpFilesize
6.0MB
-
memory/760-133-0x0000000005DA0000-0x0000000005DBE000-memory.dmpFilesize
120KB
-
memory/760-92-0x0000000072E10000-0x00000000734FE000-memory.dmpFilesize
6.9MB
-
memory/760-93-0x00000000001D0000-0x0000000000222000-memory.dmpFilesize
328KB
-
memory/760-94-0x0000000004F60000-0x000000000545E000-memory.dmpFilesize
5.0MB
-
memory/760-95-0x0000000004B00000-0x0000000004B92000-memory.dmpFilesize
584KB
-
memory/760-144-0x0000000006290000-0x00000000062DB000-memory.dmpFilesize
300KB
-
memory/760-130-0x0000000005660000-0x00000000056D6000-memory.dmpFilesize
472KB
-
memory/760-138-0x00000000060B0000-0x00000000060C2000-memory.dmpFilesize
72KB
-
memory/1632-54-0x00000000005B0000-0x00000000005F0000-memory.dmpFilesize
256KB
-
memory/1632-53-0x00000000005B0000-0x00000000005F0000-memory.dmpFilesize
256KB
-
memory/1632-55-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1632-45-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1632-52-0x00000000005B0000-0x00000000005F0000-memory.dmpFilesize
256KB
-
memory/1632-51-0x00000000005B0000-0x00000000005F0000-memory.dmpFilesize
256KB
-
memory/1632-50-0x00000000005B0000-0x00000000005F0000-memory.dmpFilesize
256KB
-
memory/1632-48-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1764-249-0x00007FF884DD0000-0x00007FF8857BC000-memory.dmpFilesize
9.9MB
-
memory/1764-517-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2188-72-0x0000000072E10000-0x00000000734FE000-memory.dmpFilesize
6.9MB
-
memory/2188-83-0x0000000002E70000-0x0000000004E70000-memory.dmpFilesize
32.0MB
-
memory/2188-80-0x0000000072E10000-0x00000000734FE000-memory.dmpFilesize
6.9MB
-
memory/2188-74-0x0000000005540000-0x0000000005550000-memory.dmpFilesize
64KB
-
memory/2188-71-0x0000000000A20000-0x0000000000BDC000-memory.dmpFilesize
1.7MB
-
memory/2248-216-0x0000000000910000-0x0000000000962000-memory.dmpFilesize
328KB
-
memory/2248-234-0x0000000005150000-0x0000000005160000-memory.dmpFilesize
64KB
-
memory/2248-215-0x0000000072E10000-0x00000000734FE000-memory.dmpFilesize
6.9MB
-
memory/2672-461-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2796-4-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/2796-2-0x0000000000980000-0x0000000000E39000-memory.dmpFilesize
4.7MB
-
memory/2796-10-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/2796-6-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/2796-8-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/2796-15-0x0000000000980000-0x0000000000E39000-memory.dmpFilesize
4.7MB
-
memory/2796-3-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/2796-7-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/2796-9-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/2796-5-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/2796-0-0x0000000000980000-0x0000000000E39000-memory.dmpFilesize
4.7MB
-
memory/2796-1-0x0000000077BC4000-0x0000000077BC5000-memory.dmpFilesize
4KB
-
memory/2820-139-0x0000000000B00000-0x0000000000B7D000-memory.dmpFilesize
500KB
-
memory/2820-143-0x0000000000B00000-0x0000000000B7D000-memory.dmpFilesize
500KB
-
memory/2876-42-0x0000000072E10000-0x00000000734FE000-memory.dmpFilesize
6.9MB
-
memory/2876-128-0x0000000072E10000-0x00000000734FE000-memory.dmpFilesize
6.9MB
-
memory/2876-41-0x0000000000070000-0x00000000000C2000-memory.dmpFilesize
328KB
-
memory/2876-131-0x00000000023F0000-0x00000000043F0000-memory.dmpFilesize
32.0MB
-
memory/2876-49-0x00000000023F0000-0x00000000043F0000-memory.dmpFilesize
32.0MB
-
memory/3124-726-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3124-597-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/3388-876-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/3388-401-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/3388-746-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/3388-264-0x0000000002F90000-0x0000000003090000-memory.dmpFilesize
1024KB
-
memory/4408-27-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/4408-57-0x0000000000EE0000-0x0000000001399000-memory.dmpFilesize
4.7MB
-
memory/4408-22-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/4408-21-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/4408-19-0x0000000000EE0000-0x0000000001399000-memory.dmpFilesize
4.7MB
-
memory/4408-20-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/4408-18-0x0000000000EE0000-0x0000000001399000-memory.dmpFilesize
4.7MB
-
memory/4408-73-0x0000000000EE0000-0x0000000001399000-memory.dmpFilesize
4.7MB
-
memory/4408-589-0x0000000000EE0000-0x0000000001399000-memory.dmpFilesize
4.7MB
-
memory/4408-23-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/4408-24-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/4408-247-0x0000000000EE0000-0x0000000001399000-memory.dmpFilesize
4.7MB
-
memory/4408-56-0x0000000000EE0000-0x0000000001399000-memory.dmpFilesize
4.7MB
-
memory/4408-405-0x0000000000EE0000-0x0000000001399000-memory.dmpFilesize
4.7MB
-
memory/4408-776-0x0000000000EE0000-0x0000000001399000-memory.dmpFilesize
4.7MB
-
memory/4408-26-0x00000000057E0000-0x00000000057E1000-memory.dmpFilesize
4KB
-
memory/4408-25-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/4492-142-0x0000000072E10000-0x00000000734FE000-memory.dmpFilesize
6.9MB
-
memory/4492-140-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4672-345-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/4672-292-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/4672-287-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/4712-125-0x000000001B170000-0x000000001B180000-memory.dmpFilesize
64KB
-
memory/4712-108-0x00007FF884DD0000-0x00007FF8857BC000-memory.dmpFilesize
9.9MB
-
memory/4712-106-0x0000000000430000-0x00000000004BC000-memory.dmpFilesize
560KB
-
memory/4784-584-0x0000000000400000-0x0000000002C26000-memory.dmpFilesize
40.1MB
-
memory/4784-508-0x0000000000400000-0x0000000002C26000-memory.dmpFilesize
40.1MB
-
memory/5668-672-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/5668-720-0x000000006A8B0000-0x000000006AA2B000-memory.dmpFilesize
1.5MB
-
memory/5668-712-0x000000006A8B0000-0x000000006AA2B000-memory.dmpFilesize
1.5MB
-
memory/5668-716-0x00007FF8A1F80000-0x00007FF8A215B000-memory.dmpFilesize
1.9MB
-
memory/5668-852-0x000000006A8B0000-0x000000006AA2B000-memory.dmpFilesize
1.5MB
-
memory/5668-855-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/5872-923-0x00007FF713C30000-0x00007FF71432C000-memory.dmpFilesize
7.0MB
-
memory/5872-915-0x00007FF713C30000-0x00007FF71432C000-memory.dmpFilesize
7.0MB
-
memory/5872-917-0x00007FF713C30000-0x00007FF71432C000-memory.dmpFilesize
7.0MB
-
memory/5992-755-0x00007FF8A1F80000-0x00007FF8A215B000-memory.dmpFilesize
1.9MB
-
memory/5992-753-0x000000006A8B0000-0x000000006AA2B000-memory.dmpFilesize
1.5MB
-
memory/6132-883-0x000000006A8B0000-0x000000006AA2B000-memory.dmpFilesize
1.5MB
-
memory/6132-775-0x00007FF8A1F80000-0x00007FF8A215B000-memory.dmpFilesize
1.9MB
-
memory/6132-774-0x000000006A8B0000-0x000000006AA2B000-memory.dmpFilesize
1.5MB