f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd

Analysis

max time kernel
149s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Size

188KB
MD5

7523679f6e5f103125526940dfbdd9ca
SHA1

cdddb2b45547f288c78bb3cee519912035258a9f
SHA256

f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd
SHA512

43c16bf3cd54a6b7ea17fd8f17908b8e156f9102a2f61f5bba50d42243c734e3890d359b1cc0e5ddbb6f13d4078a4c58740c916141f6ad52b9d9fabd343ee20f
SSDEEP

3072:Iy3pOBC3bEpqavBSPcC2ScrgCjlyKOanF9t6xtZYwlslGp:Iy3pOBC3wpqavBSPcC2ScrgCCs3o7lsk

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Usbconeted.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Usbconeted.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\PYDWGGUE = "userinity.exe"	Usbconeted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\PYDWGGUE = "userinity.exe"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Usbconeted.exe

Executes dropped EXE 4 IoCs

pid	Process
3220	Usbconeted.exe
2268	Usbconeted.exe
5060	32rc.exe
2920	32rc.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*"	Usbconeted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command	Usbconeted.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023b89-64.dat	upx
behavioral2/memory/5060-66-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2920-70-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2920-74-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/5060-79-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Usbconeted.exe"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Usbconeted.exe"	Usbconeted.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\3dPAD.exe	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
File opened for modification	C:\Windows\SysWOW64\32rc.exe	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
File opened for modification	C:\Windows\SysWOW64\userinity.exe	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
File opened for modification	C:\windows\SysWOW64\temp32.exe	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
File opened for modification	C:\windows\SysWOW64\temp32.exe	Usbconeted.exe
File opened for modification	C:\Windows\SysWOW64\Epen.exe	Usbconeted.exe
File opened for modification	C:\Windows\SysWOW64\sym32.exe	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzt\ = "txtfile"	Usbconeted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	Usbconeted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command	Usbconeted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzt	Usbconeted.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\SysWow64\\sym32.exe %1"	Usbconeted.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzt	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tzt\ = "txtfile"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\SysWow64\\sym32.exe %1"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\Open\Command	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*"	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\windows\\SysWow64\\temp32.exe \"%1\" %*"	Usbconeted.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
4448	REG.exe
4036	REG.exe
5100	REG.exe
4308	REG.exe
4684	REG.exe
3284	REG.exe
4376	REG.exe
3740	REG.exe
4504	REG.exe
4508	REG.exe
1336	REG.exe
3488	REG.exe
2700	REG.exe
3188	REG.exe
2408	REG.exe
4100	REG.exe
1156	REG.exe
3484	REG.exe
2208	REG.exe
2292	REG.exe
2020	REG.exe
4240	REG.exe
1920	REG.exe
2964	REG.exe
1836	REG.exe
1116	REG.exe
3224	REG.exe
3804	REG.exe
4864	REG.exe
3564	REG.exe
3288	REG.exe
4588	REG.exe
3196	REG.exe
2492	REG.exe
3852	REG.exe
1548	REG.exe
2940	REG.exe
3632	REG.exe
2332	REG.exe
4448	REG.exe
1436	REG.exe
900	REG.exe
3624	REG.exe
4584	REG.exe
5064	REG.exe
2960	REG.exe
2112	REG.exe
640	REG.exe
448	REG.exe
3748	REG.exe
1568	REG.exe
1452	REG.exe
1144	REG.exe
748	REG.exe
932	REG.exe
5028	REG.exe
2700	REG.exe
2976	REG.exe
1284	REG.exe
4444	REG.exe
2460	REG.exe
2124	REG.exe
4644	REG.exe
3524	REG.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5060	32rc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3488	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
3220	Usbconeted.exe
2268	Usbconeted.exe
5060	32rc.exe
2920	32rc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3224	3488	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	83
PID 3488 wrote to memory of 3224	3488	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	83
PID 3488 wrote to memory of 3224	3488	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	83
PID 3488 wrote to memory of 3220	3488	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	85
PID 3488 wrote to memory of 3220	3488	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	85
PID 3488 wrote to memory of 3220	3488	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	85
PID 3220 wrote to memory of 2268	3220	Usbconeted.exe	86
PID 3220 wrote to memory of 2268	3220	Usbconeted.exe	86
PID 3220 wrote to memory of 2268	3220	Usbconeted.exe	86
PID 3220 wrote to memory of 5060	3220	Usbconeted.exe	87
PID 3220 wrote to memory of 5060	3220	Usbconeted.exe	87
PID 3220 wrote to memory of 5060	3220	Usbconeted.exe	87
PID 3488 wrote to memory of 2920	3488	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	88
PID 3488 wrote to memory of 2920	3488	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	88
PID 3488 wrote to memory of 2920	3488	f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe	88
PID 3220 wrote to memory of 3484	3220	Usbconeted.exe	92
PID 3220 wrote to memory of 3484	3220	Usbconeted.exe	92
PID 3220 wrote to memory of 3484	3220	Usbconeted.exe	92
PID 3220 wrote to memory of 2208	3220	Usbconeted.exe	94
PID 3220 wrote to memory of 2208	3220	Usbconeted.exe	94
PID 3220 wrote to memory of 2208	3220	Usbconeted.exe	94
PID 3220 wrote to memory of 2584	3220	Usbconeted.exe	101
PID 3220 wrote to memory of 2584	3220	Usbconeted.exe	101
PID 3220 wrote to memory of 2584	3220	Usbconeted.exe	101
PID 3220 wrote to memory of 2460	3220	Usbconeted.exe	105
PID 3220 wrote to memory of 2460	3220	Usbconeted.exe	105
PID 3220 wrote to memory of 2460	3220	Usbconeted.exe	105
PID 3220 wrote to memory of 3636	3220	Usbconeted.exe	107
PID 3220 wrote to memory of 3636	3220	Usbconeted.exe	107
PID 3220 wrote to memory of 3636	3220	Usbconeted.exe	107
PID 3220 wrote to memory of 5008	3220	Usbconeted.exe	109
PID 3220 wrote to memory of 5008	3220	Usbconeted.exe	109
PID 3220 wrote to memory of 5008	3220	Usbconeted.exe	109
PID 3220 wrote to memory of 2676	3220	Usbconeted.exe	112
PID 3220 wrote to memory of 2676	3220	Usbconeted.exe	112
PID 3220 wrote to memory of 2676	3220	Usbconeted.exe	112
PID 3220 wrote to memory of 4620	3220	Usbconeted.exe	114
PID 3220 wrote to memory of 4620	3220	Usbconeted.exe	114
PID 3220 wrote to memory of 4620	3220	Usbconeted.exe	114
PID 3220 wrote to memory of 260	3220	Usbconeted.exe	116
PID 3220 wrote to memory of 260	3220	Usbconeted.exe	116
PID 3220 wrote to memory of 260	3220	Usbconeted.exe	116
PID 3220 wrote to memory of 4332	3220	Usbconeted.exe	119
PID 3220 wrote to memory of 4332	3220	Usbconeted.exe	119
PID 3220 wrote to memory of 4332	3220	Usbconeted.exe	119
PID 3220 wrote to memory of 2292	3220	Usbconeted.exe	121
PID 3220 wrote to memory of 2292	3220	Usbconeted.exe	121
PID 3220 wrote to memory of 2292	3220	Usbconeted.exe	121
PID 3220 wrote to memory of 3564	3220	Usbconeted.exe	123
PID 3220 wrote to memory of 3564	3220	Usbconeted.exe	123
PID 3220 wrote to memory of 3564	3220	Usbconeted.exe	123
PID 3220 wrote to memory of 4448	3220	Usbconeted.exe	126
PID 3220 wrote to memory of 4448	3220	Usbconeted.exe	126
PID 3220 wrote to memory of 4448	3220	Usbconeted.exe	126
PID 3220 wrote to memory of 3740	3220	Usbconeted.exe	128
PID 3220 wrote to memory of 3740	3220	Usbconeted.exe	128
PID 3220 wrote to memory of 3740	3220	Usbconeted.exe	128
PID 3220 wrote to memory of 3632	3220	Usbconeted.exe	130
PID 3220 wrote to memory of 3632	3220	Usbconeted.exe	130
PID 3220 wrote to memory of 3632	3220	Usbconeted.exe	130
PID 3220 wrote to memory of 3976	3220	Usbconeted.exe	132
PID 3220 wrote to memory of 3976	3220	Usbconeted.exe	132
PID 3220 wrote to memory of 3976	3220	Usbconeted.exe	132
PID 3220 wrote to memory of 692	3220	Usbconeted.exe	134

C:\Users\Admin\AppData\Local\Temp\f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe
"C:\Users\Admin\AppData\Local\Temp\f958c9c4ce058c67b74090cfb18fe68178c8bbe87595564a2c7ce7ba121c89fd.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\REG.exe
  REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
  2⤵
  - Modifies registry key
  PID:3224
- C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
  C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
    C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2268
- - C:\windows\SysWOW64\32rc.exe
    C:\windows\system32\32rc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5060
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3484
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2208
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2584
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2460
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3636
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:260
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2292
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3564
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4448
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3740
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3632
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3976
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:692
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2700
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4704
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3624
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:696
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2112
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4036
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3684
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4344
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4504
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3748
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3288
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2124
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:748
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4644
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3212
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4060
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3524
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1920
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2964
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:696
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2332
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1836
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3804
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4864
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4588
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4448
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:5100
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:640
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:932
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1176
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1436
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2020
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3188
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3516
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:8
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3196
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4240
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3244
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3060
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4480
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2976
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4940
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4508
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:448
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1116
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:5028
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4980
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4584
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1568
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:540
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:224
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4920
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1336
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:748
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:972
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:5064
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2960
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2408
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3488
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3520
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3604
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4100
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4272
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:900
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4352
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3684
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1452
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3284
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4364
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1840
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1156
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4636
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4376
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:3852
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1548
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4308
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1144
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:448
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2700
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2492
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:1284
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:2940
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4684
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    - Modifies registry key
    PID:4444
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3548
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:1468
- - C:\Windows\SysWOW64\REG.exe
    REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
    3⤵
    PID:3200
- C:\windows\SysWOW64\32rc.exe
  C:\windows\system32\32rc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Usbconeted.exe

Filesize
188KB

MD5
7ba0e6ffb92209afe74c5cd6b0db8529

SHA1
6c8967483fb708b451a0bf955938ddf5147bb21f

SHA256
216054dfbef3c8a1a645d0e5aec1c418fa1e965836b0cdf84fcd471fc1d85ce5

SHA512
ec6d4cc806b946312908a09de8aa28b3e2dc70b3e785c00abad075116078a8283c743535bb2b489673797ee490575241701fc5df010a977f1901f38da429a65e

Download Submit
C:\Windows\SysWOW64\32rc.exe

Filesize
8KB

MD5
f9f7458e38836264fadd8769e4f0593d

SHA1
263fde556ff45d19ace363febaf2ebbe0a1ac4cd

SHA256
db2805e1c03086d98463331811f8c1021fd11c1f85b9b1532045fd72de2a31f0

SHA512
45861833b9b5e3448aa10d39323749617532ecfc5f6d2d29e823c6760e8f2fe610086317eee4e3f6d4b1d446a9309b7e8c70fd7567bb541058ebd75563cdb535

Download Submit
memory/2920-70-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2920-74-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/5060-66-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/5060-79-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads