zgrat | 22ed346e6e5849b9a4ddc0f372382b062fe50145a4425562976531eb2b0819e1

Analysis

max time kernel
133s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17eb4c4e58353a5db52602d0ae321fbd.exe
Size

1.9MB
MD5

17eb4c4e58353a5db52602d0ae321fbd
SHA1

791e65e864b8831b86149c079b09d04cac894e59
SHA256

22ed346e6e5849b9a4ddc0f372382b062fe50145a4425562976531eb2b0819e1
SHA512

a93540c9b59a5000ef53834ff920d8fafa3e1d25da92ead4d523dc684d3824a6e3ccefda736194c0ec1a2e27229ea4096afd65be3ff462fd2e4f22c6058d8d14
SSDEEP

24576:kGcK2o1bNcsQSVR7z/7VlQR/Ys6Yy0RbZEd3oJ30mJrqTgOEOkm6GNBO0mQP:7l777HagqbZoaEoki5m6G/FmQ

Score

10^/10

zgrat execution persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/memory/2852-1-0x0000000000CE0000-0x0000000000ECA000-memory.dmp	family_zgrat_v1
behavioral1/files/0x0006000000014228-32.dat	family_zgrat_v1
behavioral1/memory/2592-146-0x0000000000150000-0x000000000033A000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\csrss.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\services.exe\", \"C:\\Users\\All Users\\Adobe\\Updater6\\Idle.exe\", \"C:\\Users\\All Users\\Package Cache\\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\\lsm.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\csrss.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\services.exe\", \"C:\\Users\\All Users\\Adobe\\Updater6\\Idle.exe\", \"C:\\Users\\All Users\\Package Cache\\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\\lsm.exe\", \"C:\\MSOCache\\All Users\\csrss.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\17eb4c4e58353a5db52602d0ae321fbd.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\csrss.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\csrss.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\services.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\csrss.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\services.exe\", \"C:\\Users\\All Users\\Adobe\\Updater6\\Idle.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\csrss.exe\", \"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\services.exe\", \"C:\\Users\\All Users\\Adobe\\Updater6\\Idle.exe\", \"C:\\Users\\All Users\\Package Cache\\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\\lsm.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	312	2680	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2680	schtasks.exe	28

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1752	powershell.exe
2272	powershell.exe
540	powershell.exe
2240	powershell.exe
1964	powershell.exe
1428	powershell.exe
2832	powershell.exe
2236	powershell.exe
2068	powershell.exe
2256	powershell.exe
1520	powershell.exe
752	powershell.exe
2160	powershell.exe
2432	powershell.exe
2244	powershell.exe
324	powershell.exe
2044	powershell.exe
2300	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2592	Idle.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\csrss.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\csrss.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\services.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\All Users\\Adobe\\Updater6\\Idle.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\All Users\\Adobe\\Updater6\\Idle.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\77984722-d108-11ee-bdd4-c695cbc44580\\services.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\All Users\\Package Cache\\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\\lsm.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\All Users\\Package Cache\\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\\lsm.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\csrss.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\17eb4c4e58353a5db52602d0ae321fbd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\17eb4c4e58353a5db52602d0ae321fbd.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\17eb4c4e58353a5db52602d0ae321fbd = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\17eb4c4e58353a5db52602d0ae321fbd.exe\""	17eb4c4e58353a5db52602d0ae321fbd.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ipinfo.io
8	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCF6159402EB3A46FCBB1E9A1D243FDD99.TMP	csc.exe
File created	\??\c:\Windows\System32\ickr0a.exe	csc.exe

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1980	schtasks.exe
1252	schtasks.exe
1556	schtasks.exe
664	schtasks.exe
1676	schtasks.exe
1036	schtasks.exe
2732	schtasks.exe
2932	schtasks.exe
2776	schtasks.exe
2632	schtasks.exe
2000	schtasks.exe
1032	schtasks.exe
2892	schtasks.exe
2532	schtasks.exe
312	schtasks.exe
2772	schtasks.exe
2588	schtasks.exe
1704	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Idle.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Idle.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2420	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe
2852	17eb4c4e58353a5db52602d0ae321fbd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	Idle.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	17eb4c4e58353a5db52602d0ae321fbd.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	324	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe
Token: SeDebugPrivilege	2592	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2928	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	32
PID 2852 wrote to memory of 2928	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	32
PID 2852 wrote to memory of 2928	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	32
PID 2928 wrote to memory of 2628	2928	csc.exe	34
PID 2928 wrote to memory of 2628	2928	csc.exe	34
PID 2928 wrote to memory of 2628	2928	csc.exe	34
PID 2852 wrote to memory of 1520	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	50
PID 2852 wrote to memory of 1520	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	50
PID 2852 wrote to memory of 1520	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	50
PID 2852 wrote to memory of 2244	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	51
PID 2852 wrote to memory of 2244	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	51
PID 2852 wrote to memory of 2244	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	51
PID 2852 wrote to memory of 2272	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	52
PID 2852 wrote to memory of 2272	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	52
PID 2852 wrote to memory of 2272	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	52
PID 2852 wrote to memory of 1752	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	53
PID 2852 wrote to memory of 1752	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	53
PID 2852 wrote to memory of 1752	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	53
PID 2852 wrote to memory of 2236	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	55
PID 2852 wrote to memory of 2236	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	55
PID 2852 wrote to memory of 2236	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	55
PID 2852 wrote to memory of 2256	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	56
PID 2852 wrote to memory of 2256	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	56
PID 2852 wrote to memory of 2256	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	56
PID 2852 wrote to memory of 2068	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	57
PID 2852 wrote to memory of 2068	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	57
PID 2852 wrote to memory of 2068	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	57
PID 2852 wrote to memory of 1964	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	58
PID 2852 wrote to memory of 1964	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	58
PID 2852 wrote to memory of 1964	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	58
PID 2852 wrote to memory of 2300	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	59
PID 2852 wrote to memory of 2300	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	59
PID 2852 wrote to memory of 2300	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	59
PID 2852 wrote to memory of 2044	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	60
PID 2852 wrote to memory of 2044	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	60
PID 2852 wrote to memory of 2044	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	60
PID 2852 wrote to memory of 2832	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	62
PID 2852 wrote to memory of 2832	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	62
PID 2852 wrote to memory of 2832	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	62
PID 2852 wrote to memory of 2432	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	64
PID 2852 wrote to memory of 2432	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	64
PID 2852 wrote to memory of 2432	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	64
PID 2852 wrote to memory of 1428	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	66
PID 2852 wrote to memory of 1428	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	66
PID 2852 wrote to memory of 1428	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	66
PID 2852 wrote to memory of 2240	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	68
PID 2852 wrote to memory of 2240	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	68
PID 2852 wrote to memory of 2240	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	68
PID 2852 wrote to memory of 540	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	69
PID 2852 wrote to memory of 540	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	69
PID 2852 wrote to memory of 540	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	69
PID 2852 wrote to memory of 2160	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	70
PID 2852 wrote to memory of 2160	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	70
PID 2852 wrote to memory of 2160	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	70
PID 2852 wrote to memory of 324	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	71
PID 2852 wrote to memory of 324	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	71
PID 2852 wrote to memory of 324	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	71
PID 2852 wrote to memory of 752	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	72
PID 2852 wrote to memory of 752	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	72
PID 2852 wrote to memory of 752	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	72
PID 2852 wrote to memory of 3000	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	86
PID 2852 wrote to memory of 3000	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	86
PID 2852 wrote to memory of 3000	2852	17eb4c4e58353a5db52602d0ae321fbd.exe	86
PID 3000 wrote to memory of 472	3000	cmd.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\17eb4c4e58353a5db52602d0ae321fbd.exe
"C:\Users\Admin\AppData\Local\Temp\17eb4c4e58353a5db52602d0ae321fbd.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hk1esbkf\hk1esbkf.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD59.tmp" "c:\Windows\System32\CSCF6159402EB3A46FCBB1E9A1D243FDD99.TMP"
    3⤵
    PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Updater6\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\17eb4c4e58353a5db52602d0ae321fbd.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J1o8y5Rq4c.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:472
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:2420
- - C:\Users\All Users\Adobe\Updater6\Idle.exe
    "C:\Users\All Users\Adobe\Updater6\Idle.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Adobe\Updater6\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Updater6\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Adobe\Updater6\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "17eb4c4e58353a5db52602d0ae321fbd1" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\17eb4c4e58353a5db52602d0ae321fbd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "17eb4c4e58353a5db52602d0ae321fbd" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\17eb4c4e58353a5db52602d0ae321fbd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "17eb4c4e58353a5db52602d0ae321fbd1" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\17eb4c4e58353a5db52602d0ae321fbd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\csrss.exe

Filesize
1.9MB

MD5
17eb4c4e58353a5db52602d0ae321fbd

SHA1
791e65e864b8831b86149c079b09d04cac894e59

SHA256
22ed346e6e5849b9a4ddc0f372382b062fe50145a4425562976531eb2b0819e1

SHA512
a93540c9b59a5000ef53834ff920d8fafa3e1d25da92ead4d523dc684d3824a6e3ccefda736194c0ec1a2e27229ea4096afd65be3ff462fd2e4f22c6058d8d14

Download Submit
C:\Users\Admin\AppData\Local\Temp\J1o8y5Rq4c.bat

Filesize
170B

MD5
1a5ea423c58bb2c31526927e225c7723

SHA1
4b70d9983725ab3bb215a1410cd865755108d6fc

SHA256
b0a520cd1a1b08803d00931587fc3284df108c116e2bbf8d502370e758853a51

SHA512
f4a3f8d4e8d833ab9820589c9da69a5d99b9097118138043719d640ed1de1f250b4b934e095fe546afbb08d803af816954ddbdfbce2005018fcce4edb2e62463

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD59.tmp

Filesize
1KB

MD5
e91e5b815c11f0394d2d645f73c964fd

SHA1
0d00cb6d027c6090b0046d9763abd57c58d8956d

SHA256
dc76de7db95d0ba4df9e6e4ae0c7fe07f6aa1d1c4f6aa168a14d90fa8fc6f329

SHA512
1f942675fc7c80c069ee71f3f4763250032cff5ea45cd39adefee36a297455984b815e2d96c7237d74ff4ded360831c9ce6410b2b0a1f40519db7db1a9e375f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0cf54f666ff995a80367648a31f94f0b

SHA1
634d10b723d3f6815f7745bceae808b891872e50

SHA256
da977b17a23899f5027967aa4e7a5e84ab19d8327ed6c9f355dd2f18c504ad00

SHA512
f40b5fdff9b220f582f0bf219dd05a7d0dad0547a1c367d6825226ebf91f08b7a83a7ebd6fea12c4092c18beac79cb3ad14616ff0c5c1e42b5dea526c8dc456b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hk1esbkf\hk1esbkf.0.cs

Filesize
390B

MD5
5921d9ddff616b8059bcaf7bc37d6f11

SHA1
4975fb2d543eb5ff3503189c60050a6b98e7d160

SHA256
65d992addd7c4e41506bb99cd9f572a06e1c5fe9b8a1ef3fc1e925a6a4d3472e

SHA512
87bb9fa0004b81f3d9280e3a0dad18f6c56ea5cca20a55f22fcae7cfebbbea788b14e47a18d5ac7289c01e38bee72e685b2b1010fdf68655f764c4842d22581a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hk1esbkf\hk1esbkf.cmdline

Filesize
235B

MD5
f8cc380e5b266fb6d105db47f3161b3f

SHA1
d2df8ebc7651aee6af1769ec7c758946a145c945

SHA256
d778fb9976df3b24befb6cabcb1846d61cd3d275705868beb19466f6b933a925

SHA512
5be579a6715418d15b7dbc1e812a108a3ed28e5f147bbfc6ef3ce1d19cef6546403aa784e736a28abc25de2b7add6bde140ba306482717f7772487a86798286e

Download Submit
\??\c:\Windows\System32\CSCF6159402EB3A46FCBB1E9A1D243FDD99.TMP

Filesize
1KB

MD5
3ffa0b85adc175bc535d5b61b093b6a5

SHA1
7fa7715f9f18aa1d9edc45935ca867602fa37894

SHA256
f05ea17245f2e54aa3b2a0a8ede3f86af5fb4e4f0cf0a6aa69c4e95103304d46

SHA512
d1034200ad1232d7e36d3d867e701357c9eb8e8ad063743deceb563b24eb099e6ea660e38099cf161c12c97fe11cf6b044a31846949d63d4a121f1692c9e6fde

Download Submit
memory/752-101-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/2256-94-0x000000001B490000-0x000000001B772000-memory.dmp

Filesize
2.9MB

Download
memory/2592-146-0x0000000000150000-0x000000000033A000-memory.dmp

Filesize
1.9MB

Download
memory/2852-9-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-13-0x0000000000530000-0x000000000053E000-memory.dmp

Filesize
56KB

Download
memory/2852-22-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-19-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-16-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-18-0x0000000000A30000-0x0000000000A3C000-memory.dmp

Filesize
48KB

Download
memory/2852-34-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-30-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-15-0x0000000000540000-0x0000000000548000-memory.dmp

Filesize
32KB

Download
memory/2852-20-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-8-0x00000000009F0000-0x0000000000A0C000-memory.dmp

Filesize
112KB

Download
memory/2852-0-0x000007FEF5BC3000-0x000007FEF5BC4000-memory.dmp

Filesize
4KB

Download
memory/2852-11-0x0000000000A10000-0x0000000000A28000-memory.dmp

Filesize
96KB

Download
memory/2852-6-0x0000000000520000-0x000000000052E000-memory.dmp

Filesize
56KB

Download
memory/2852-117-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-4-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-3-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-2-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2852-1-0x0000000000CE0000-0x0000000000ECA000-memory.dmp

Filesize
1.9MB

Download