gh0strat | 8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
Size 8.5MB
Sample240509-eypr4aad3s
SHA256 8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322
MD5 6bd706eabf223f274bea8841592d998e
SHA1 09ef233680250e39d870efaae697792d3258ff7b
SHA512 854e5fdc525e5176586699755e33f841f25216cbeca443b5160455afaf750c962230470841d88d4b828a77323a6af0fa8b8444064a3be4102f5d524cb78fd5fd
SSDEEP 196608:fyEui8kKU1qXD0QwAIYfIFtCe8lN4XuWEA1HaugJKvgabfT8z//QTDQsNoLMnx:ffK8qjwAaCe8f4eWVYKoabfT6QT0sws
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat discovery rat upx

Malware Config

Signatures

Gh0st RAT payload 10 IoCs

resource	yara_rule
behavioral2/memory/5012-141-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/5012-140-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/5012-142-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/5012-143-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/4212-169-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/4212-168-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/5080-191-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/5080-190-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/2988-206-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/2988-207-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002341b-9.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	w.exe

Executes dropped EXE 64 IoCs

pid	Process
2840	w.exe
5096	kpzs.exe
2624	kpzs.exe
4808	kpzs.exe
876	kpzs.exe
1372	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
1928	EPEvenue_SB.exe
4212	EPEvenue_SB.exe
1092	EPEvenue_SB.exe
5080	EPEvenue_SB.exe
3308	EPEvenue_SB.exe
2988	EPEvenue_SB.exe
3572	EPEvenue_SB.exe
4072	EPEvenue_SB.exe
4600	EPEvenue_SB.exe
804	EPEvenue_SB.exe
3148	EPEvenue_SB.exe
3132	EPEvenue_SB.exe
3800	EPEvenue_SB.exe
4648	EPEvenue_SB.exe
4792	EPEvenue_SB.exe
2624	EPEvenue_SB.exe
3852	EPEvenue_SB.exe
2088	EPEvenue_SB.exe
332	EPEvenue_SB.exe
828	EPEvenue_SB.exe
404	EPEvenue_SB.exe
228	EPEvenue_SB.exe
4784	EPEvenue_SB.exe
4788	EPEvenue_SB.exe
2364	EPEvenue_SB.exe
3952	EPEvenue_SB.exe
532	EPEvenue_SB.exe
4364	EPEvenue_SB.exe
4092	EPEvenue_SB.exe
3056	EPEvenue_SB.exe
1484	EPEvenue_SB.exe
1760	EPEvenue_SB.exe
1852	EPEvenue_SB.exe
3308	EPEvenue_SB.exe
3764	EPEvenue_SB.exe
3572	EPEvenue_SB.exe
4440	EPEvenue_SB.exe
668	EPEvenue_SB.exe
1620	EPEvenue_SB.exe
4188	EPEvenue_SB.exe
4856	EPEvenue_SB.exe
3464	EPEvenue_SB.exe
760	EPEvenue_SB.exe
2116	EPEvenue_SB.exe
1328	EPEvenue_SB.exe
8	EPEvenue_SB.exe
4036	EPEvenue_SB.exe
3876	EPEvenue_SB.exe
3276	EPEvenue_SB.exe
3012	EPEvenue_SB.exe
4296	EPEvenue_SB.exe
1880	EPEvenue_SB.exe
3240	EPEvenue_SB.exe
4260	EPEvenue_SB.exe
116	EPEvenue_SB.exe
2940	EPEvenue_SB.exe
3404	EPEvenue_SB.exe

Loads dropped DLL 64 IoCs

pid	Process
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
2840	w.exe
2840	w.exe
2840	w.exe
2840	w.exe
5096	kpzs.exe
5096	kpzs.exe
5096	kpzs.exe
2624	kpzs.exe
2624	kpzs.exe
2624	kpzs.exe
4808	kpzs.exe
4808	kpzs.exe
876	kpzs.exe
876	kpzs.exe
1372	EPEvenue_SB.exe
1372	EPEvenue_SB.exe
1372	EPEvenue_SB.exe
1372	EPEvenue_SB.exe
1372	EPEvenue_SB.exe
1372	EPEvenue_SB.exe
1928	EPEvenue_SB.exe
1928	EPEvenue_SB.exe
1928	EPEvenue_SB.exe
1928	EPEvenue_SB.exe
1928	EPEvenue_SB.exe
1092	EPEvenue_SB.exe
1092	EPEvenue_SB.exe
1092	EPEvenue_SB.exe
1092	EPEvenue_SB.exe
1092	EPEvenue_SB.exe
1092	EPEvenue_SB.exe
3308	EPEvenue_SB.exe
3308	EPEvenue_SB.exe
3308	EPEvenue_SB.exe
3308	EPEvenue_SB.exe
3308	EPEvenue_SB.exe
3308	EPEvenue_SB.exe
3308	EPEvenue_SB.exe
3572	EPEvenue_SB.exe
3572	EPEvenue_SB.exe
3572	EPEvenue_SB.exe
3572	EPEvenue_SB.exe
3572	EPEvenue_SB.exe
4600	EPEvenue_SB.exe
4600	EPEvenue_SB.exe
4600	EPEvenue_SB.exe
4600	EPEvenue_SB.exe
4600	EPEvenue_SB.exe
4600	EPEvenue_SB.exe
3148	EPEvenue_SB.exe
3148	EPEvenue_SB.exe
3148	EPEvenue_SB.exe
3148	EPEvenue_SB.exe
3148	EPEvenue_SB.exe
3148	EPEvenue_SB.exe
3800	EPEvenue_SB.exe
3800	EPEvenue_SB.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002341b-9.dat	upx
behavioral2/memory/4504-11-0x0000000074880000-0x000000007493C000-memory.dmp	upx
behavioral2/memory/5012-141-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/5012-140-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/5012-138-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/5012-142-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/5012-143-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/4212-169-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/4212-168-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/5080-191-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/5080-190-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/2988-206-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/2988-207-0x0000000010000000-0x000000001018F000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	EPEvenue_SB.exe
File opened (read-only)	\??\E:	EPEvenue_SB.exe
File opened (read-only)	\??\L:	EPEvenue_SB.exe
File opened (read-only)	\??\M:	EPEvenue_SB.exe
File opened (read-only)	\??\N:	EPEvenue_SB.exe
File opened (read-only)	\??\P:	EPEvenue_SB.exe
File opened (read-only)	\??\S:	EPEvenue_SB.exe
File opened (read-only)	\??\T:	EPEvenue_SB.exe
File opened (read-only)	\??\U:	EPEvenue_SB.exe
File opened (read-only)	\??\V:	EPEvenue_SB.exe
File opened (read-only)	\??\G:	EPEvenue_SB.exe
File opened (read-only)	\??\H:	EPEvenue_SB.exe
File opened (read-only)	\??\J:	EPEvenue_SB.exe
File opened (read-only)	\??\W:	EPEvenue_SB.exe
File opened (read-only)	\??\Z:	EPEvenue_SB.exe
File opened (read-only)	\??\I:	EPEvenue_SB.exe
File opened (read-only)	\??\K:	EPEvenue_SB.exe
File opened (read-only)	\??\O:	EPEvenue_SB.exe
File opened (read-only)	\??\Q:	EPEvenue_SB.exe
File opened (read-only)	\??\R:	EPEvenue_SB.exe
File opened (read-only)	\??\X:	EPEvenue_SB.exe
File opened (read-only)	\??\Y:	EPEvenue_SB.exe

Suspicious use of SetThreadContext 61 IoCs

description	pid	Process	procid_target
PID 1372 set thread context of 5012	1372	EPEvenue_SB.exe	94
PID 1928 set thread context of 4212	1928	EPEvenue_SB.exe	96
PID 1092 set thread context of 5080	1092	EPEvenue_SB.exe	98
PID 3308 set thread context of 2988	3308	EPEvenue_SB.exe	100
PID 3572 set thread context of 4072	3572	EPEvenue_SB.exe	103
PID 4600 set thread context of 804	4600	EPEvenue_SB.exe	105
PID 3148 set thread context of 3132	3148	EPEvenue_SB.exe	107
PID 3800 set thread context of 4648	3800	EPEvenue_SB.exe	109
PID 4792 set thread context of 2624	4792	EPEvenue_SB.exe	111
PID 3852 set thread context of 2088	3852	EPEvenue_SB.exe	113
PID 332 set thread context of 828	332	EPEvenue_SB.exe	115
PID 404 set thread context of 228	404	EPEvenue_SB.exe	117
PID 4784 set thread context of 4788	4784	EPEvenue_SB.exe	119
PID 2364 set thread context of 3952	2364	EPEvenue_SB.exe	121
PID 532 set thread context of 4364	532	EPEvenue_SB.exe	123
PID 4092 set thread context of 3056	4092	EPEvenue_SB.exe	125
PID 1484 set thread context of 1760	1484	EPEvenue_SB.exe	127
PID 1852 set thread context of 3308	1852	EPEvenue_SB.exe	129
PID 3764 set thread context of 3572	3764	EPEvenue_SB.exe	131
PID 4440 set thread context of 668	4440	EPEvenue_SB.exe	133
PID 1620 set thread context of 4188	1620	EPEvenue_SB.exe	135
PID 4856 set thread context of 3464	4856	EPEvenue_SB.exe	137
PID 760 set thread context of 2116	760	EPEvenue_SB.exe	139
PID 1328 set thread context of 8	1328	EPEvenue_SB.exe	141
PID 4036 set thread context of 3876	4036	EPEvenue_SB.exe	143
PID 3276 set thread context of 3012	3276	EPEvenue_SB.exe	145
PID 4296 set thread context of 1880	4296	EPEvenue_SB.exe	147
PID 3240 set thread context of 4260	3240	EPEvenue_SB.exe	149
PID 116 set thread context of 2940	116	EPEvenue_SB.exe	151
PID 3404 set thread context of 5008	3404	EPEvenue_SB.exe	153
PID 1128 set thread context of 3380	1128	EPEvenue_SB.exe	155
PID 1464 set thread context of 3136	1464	EPEvenue_SB.exe	157
PID 2124 set thread context of 2964	2124	EPEvenue_SB.exe	159
PID 5084 set thread context of 4460	5084	EPEvenue_SB.exe	161
PID 4628 set thread context of 1620	4628	EPEvenue_SB.exe	165
PID 1668 set thread context of 1800	1668	EPEvenue_SB.exe	167
PID 4040 set thread context of 2400	4040	EPEvenue_SB.exe	169
PID 4652 set thread context of 1724	4652	EPEvenue_SB.exe	171
PID 2948 set thread context of 4900	2948	EPEvenue_SB.exe	173
PID 680 set thread context of 4152	680	EPEvenue_SB.exe	175
PID 4464 set thread context of 2792	4464	EPEvenue_SB.exe	177
PID 1920 set thread context of 2480	1920	EPEvenue_SB.exe	179
PID 4332 set thread context of 4920	4332	EPEvenue_SB.exe	181
PID 4428 set thread context of 4368	4428	EPEvenue_SB.exe	183
PID 3520 set thread context of 3856	3520	EPEvenue_SB.exe	185
PID 2812 set thread context of 1524	2812	EPEvenue_SB.exe	187
PID 2956 set thread context of 3000	2956	EPEvenue_SB.exe	189
PID 748 set thread context of 3192	748	EPEvenue_SB.exe	191
PID 4532 set thread context of 3764	4532	EPEvenue_SB.exe	193
PID 1352 set thread context of 1040	1352	EPEvenue_SB.exe	195
PID 1340 set thread context of 2436	1340	EPEvenue_SB.exe	197
PID 3800 set thread context of 3604	3800	EPEvenue_SB.exe	199
PID 3696 set thread context of 4888	3696	EPEvenue_SB.exe	201
PID 936 set thread context of 3852	936	EPEvenue_SB.exe	203
PID 332 set thread context of 2372	332	EPEvenue_SB.exe	205
PID 2076 set thread context of 2320	2076	EPEvenue_SB.exe	207
PID 1472 set thread context of 3440	1472	EPEvenue_SB.exe	209
PID 2732 set thread context of 3940	2732	EPEvenue_SB.exe	211
PID 4488 set thread context of 3080	4488	EPEvenue_SB.exe	213
PID 3392 set thread context of 3520	3392	EPEvenue_SB.exe	215
PID 2040 set thread context of 4536	2040	EPEvenue_SB.exe	217

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\132\rtl70.bpl	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\DuiLib.dll	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\libcef.dll	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\msvcp100.dll	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\EPEvenue_SB.exe	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\kpzs.exe	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\msvcr100.dll	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\vcl70.bpl	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\XPFarmer.bpl	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\12345678.exe	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\CefControl.dll	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\msvcr100.exe	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
File created	C:\Program Files (x86)\132\w.exe	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EPEvenue_SB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EPEvenue_SB.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
4504	8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
2840	w.exe
2840	w.exe
2840	w.exe
2840	w.exe
2840	w.exe
2840	w.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe
5012	EPEvenue_SB.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2840	w.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5012	EPEvenue_SB.exe
Token: SeDebugPrivilege	4212	EPEvenue_SB.exe
Token: SeDebugPrivilege	5080	EPEvenue_SB.exe
Token: SeDebugPrivilege	2988	EPEvenue_SB.exe
Token: SeDebugPrivilege	4072	EPEvenue_SB.exe
Token: SeDebugPrivilege	804	EPEvenue_SB.exe
Token: SeDebugPrivilege	3132	EPEvenue_SB.exe
Token: SeDebugPrivilege	4648	EPEvenue_SB.exe
Token: SeDebugPrivilege	2624	EPEvenue_SB.exe
Token: SeDebugPrivilege	2088	EPEvenue_SB.exe
Token: SeDebugPrivilege	828	EPEvenue_SB.exe
Token: SeDebugPrivilege	228	EPEvenue_SB.exe
Token: SeDebugPrivilege	4788	EPEvenue_SB.exe
Token: SeDebugPrivilege	3952	EPEvenue_SB.exe
Token: SeDebugPrivilege	4364	EPEvenue_SB.exe
Token: SeDebugPrivilege	3056	EPEvenue_SB.exe
Token: SeDebugPrivilege	1760	EPEvenue_SB.exe
Token: SeDebugPrivilege	3308	EPEvenue_SB.exe
Token: SeDebugPrivilege	3572	EPEvenue_SB.exe
Token: SeDebugPrivilege	668	EPEvenue_SB.exe
Token: SeDebugPrivilege	4188	EPEvenue_SB.exe
Token: SeDebugPrivilege	3464	EPEvenue_SB.exe
Token: SeDebugPrivilege	2116	EPEvenue_SB.exe
Token: SeDebugPrivilege	8	EPEvenue_SB.exe
Token: SeDebugPrivilege	3876	EPEvenue_SB.exe
Token: SeDebugPrivilege	3012	EPEvenue_SB.exe
Token: SeDebugPrivilege	1880	EPEvenue_SB.exe
Token: SeDebugPrivilege	4260	EPEvenue_SB.exe
Token: SeDebugPrivilege	2940	EPEvenue_SB.exe
Token: SeDebugPrivilege	5008	EPEvenue_SB.exe
Token: 33	5012	EPEvenue_SB.exe
Token: SeIncBasePriorityPrivilege	5012	EPEvenue_SB.exe
Token: SeDebugPrivilege	3380	EPEvenue_SB.exe
Token: SeDebugPrivilege	3136	EPEvenue_SB.exe
Token: SeDebugPrivilege	2964	EPEvenue_SB.exe
Token: SeDebugPrivilege	4460	EPEvenue_SB.exe
Token: SeDebugPrivilege	1620	EPEvenue_SB.exe
Token: SeDebugPrivilege	1800	EPEvenue_SB.exe
Token: SeDebugPrivilege	2400	EPEvenue_SB.exe
Token: SeDebugPrivilege	1724	EPEvenue_SB.exe
Token: SeDebugPrivilege	4900	EPEvenue_SB.exe
Token: SeDebugPrivilege	4152	EPEvenue_SB.exe
Token: SeDebugPrivilege	2792	EPEvenue_SB.exe
Token: SeDebugPrivilege	2480	EPEvenue_SB.exe
Token: SeDebugPrivilege	4920	EPEvenue_SB.exe
Token: SeDebugPrivilege	4368	EPEvenue_SB.exe
Token: SeDebugPrivilege	3856	EPEvenue_SB.exe
Token: SeDebugPrivilege	1524	EPEvenue_SB.exe
Token: SeDebugPrivilege	3000	EPEvenue_SB.exe
Token: SeDebugPrivilege	3192	EPEvenue_SB.exe
Token: SeDebugPrivilege	3764	EPEvenue_SB.exe
Token: SeDebugPrivilege	1040	EPEvenue_SB.exe
Token: SeDebugPrivilege	2436	EPEvenue_SB.exe
Token: SeDebugPrivilege	3604	EPEvenue_SB.exe
Token: SeDebugPrivilege	4888	EPEvenue_SB.exe
Token: SeDebugPrivilege	3852	EPEvenue_SB.exe
Token: SeDebugPrivilege	2372	EPEvenue_SB.exe
Token: SeDebugPrivilege	2320	EPEvenue_SB.exe
Token: SeDebugPrivilege	3440	EPEvenue_SB.exe
Token: SeDebugPrivilege	3940	EPEvenue_SB.exe
Token: SeDebugPrivilege	3520	EPEvenue_SB.exe
Token: 33	5012	EPEvenue_SB.exe
Token: SeIncBasePriorityPrivilege	5012	EPEvenue_SB.exe
Token: SeDebugPrivilege	4536	EPEvenue_SB.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2840	w.exe
5096	kpzs.exe
2624	kpzs.exe
4808	kpzs.exe
876	kpzs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 5096	2840	w.exe	86
PID 2840 wrote to memory of 5096	2840	w.exe	86
PID 2840 wrote to memory of 5096	2840	w.exe	86
PID 2840 wrote to memory of 4808	2840	w.exe	91
PID 2840 wrote to memory of 4808	2840	w.exe	91
PID 2840 wrote to memory of 4808	2840	w.exe	91
PID 2840 wrote to memory of 1372	2840	w.exe	93
PID 2840 wrote to memory of 1372	2840	w.exe	93
PID 2840 wrote to memory of 1372	2840	w.exe	93
PID 1372 wrote to memory of 5012	1372	EPEvenue_SB.exe	94
PID 1372 wrote to memory of 5012	1372	EPEvenue_SB.exe	94
PID 1372 wrote to memory of 5012	1372	EPEvenue_SB.exe	94
PID 1372 wrote to memory of 5012	1372	EPEvenue_SB.exe	94
PID 1372 wrote to memory of 5012	1372	EPEvenue_SB.exe	94
PID 2840 wrote to memory of 1928	2840	w.exe	95
PID 2840 wrote to memory of 1928	2840	w.exe	95
PID 2840 wrote to memory of 1928	2840	w.exe	95
PID 1928 wrote to memory of 4212	1928	EPEvenue_SB.exe	96
PID 1928 wrote to memory of 4212	1928	EPEvenue_SB.exe	96
PID 1928 wrote to memory of 4212	1928	EPEvenue_SB.exe	96
PID 1928 wrote to memory of 4212	1928	EPEvenue_SB.exe	96
PID 1928 wrote to memory of 4212	1928	EPEvenue_SB.exe	96
PID 2840 wrote to memory of 1092	2840	w.exe	97
PID 2840 wrote to memory of 1092	2840	w.exe	97
PID 2840 wrote to memory of 1092	2840	w.exe	97
PID 1092 wrote to memory of 5080	1092	EPEvenue_SB.exe	98
PID 1092 wrote to memory of 5080	1092	EPEvenue_SB.exe	98
PID 1092 wrote to memory of 5080	1092	EPEvenue_SB.exe	98
PID 1092 wrote to memory of 5080	1092	EPEvenue_SB.exe	98
PID 1092 wrote to memory of 5080	1092	EPEvenue_SB.exe	98
PID 2840 wrote to memory of 3308	2840	w.exe	99
PID 2840 wrote to memory of 3308	2840	w.exe	99
PID 2840 wrote to memory of 3308	2840	w.exe	99
PID 3308 wrote to memory of 2988	3308	EPEvenue_SB.exe	100
PID 3308 wrote to memory of 2988	3308	EPEvenue_SB.exe	100
PID 3308 wrote to memory of 2988	3308	EPEvenue_SB.exe	100
PID 3308 wrote to memory of 2988	3308	EPEvenue_SB.exe	100
PID 3308 wrote to memory of 2988	3308	EPEvenue_SB.exe	100
PID 2840 wrote to memory of 3572	2840	w.exe	102
PID 2840 wrote to memory of 3572	2840	w.exe	102
PID 2840 wrote to memory of 3572	2840	w.exe	102
PID 3572 wrote to memory of 4072	3572	EPEvenue_SB.exe	103
PID 3572 wrote to memory of 4072	3572	EPEvenue_SB.exe	103
PID 3572 wrote to memory of 4072	3572	EPEvenue_SB.exe	103
PID 3572 wrote to memory of 4072	3572	EPEvenue_SB.exe	103
PID 3572 wrote to memory of 4072	3572	EPEvenue_SB.exe	103
PID 2840 wrote to memory of 4600	2840	w.exe	104
PID 2840 wrote to memory of 4600	2840	w.exe	104
PID 2840 wrote to memory of 4600	2840	w.exe	104
PID 4600 wrote to memory of 804	4600	EPEvenue_SB.exe	105
PID 4600 wrote to memory of 804	4600	EPEvenue_SB.exe	105
PID 4600 wrote to memory of 804	4600	EPEvenue_SB.exe	105
PID 4600 wrote to memory of 804	4600	EPEvenue_SB.exe	105
PID 4600 wrote to memory of 804	4600	EPEvenue_SB.exe	105
PID 2840 wrote to memory of 3148	2840	w.exe	106
PID 2840 wrote to memory of 3148	2840	w.exe	106
PID 2840 wrote to memory of 3148	2840	w.exe	106
PID 3148 wrote to memory of 3132	3148	EPEvenue_SB.exe	107
PID 3148 wrote to memory of 3132	3148	EPEvenue_SB.exe	107
PID 3148 wrote to memory of 3132	3148	EPEvenue_SB.exe	107
PID 3148 wrote to memory of 3132	3148	EPEvenue_SB.exe	107
PID 3148 wrote to memory of 3132	3148	EPEvenue_SB.exe	107
PID 2840 wrote to memory of 3800	2840	w.exe	108
PID 2840 wrote to memory of 3800	2840	w.exe	108

C:\Users\Admin\AppData\Local\Temp\8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe
"C:\Users\Admin\AppData\Local\Temp\8575806eaf962430954b428f39642e0942f8e500b9cce54331c956943cfa2322.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4504

C:\Program Files (x86)\132\w.exe
"C:\Program Files (x86)\132\w.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Program Files (x86)\132\kpzs.exe
  "C:\Program Files (x86)\132\kpzs.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5096
- C:\Program Files (x86)\132\kpzs.exe
  "C:\Program Files (x86)\132\kpzs.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4808
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4072
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:804
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  PID:3800
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4792
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3852
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:332
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:828
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:404
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4784
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2364
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:532
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4092
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1484
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1852
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3764
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4440
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:668
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1620
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4856
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:760
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1328
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4036
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3876
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3276
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3012
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4296
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3240
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4260
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:116
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3404
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:1128
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:1464
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:2124
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:5084
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4628
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:1668
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4040
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4652
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:2948
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:680
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4464
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:1920
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2480
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4332
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4428
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:3520
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:2812
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:2956
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:748
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4532
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:1352
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:1340
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:3800
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:3696
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:936
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:332
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:2076
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:1472
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:2732
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:4488
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    PID:3080
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:3392
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3520
- C:\Program Files (x86)\132\EPEvenue_SB.exe
  "C:\Program Files (x86)\132\EPEvenue_SB.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:2040
- - C:\Program Files (x86)\132\EPEvenue_SB.exe
    "C:\Program Files (x86)\132\EPEvenue_SB.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:4684

C:\Program Files (x86)\132\kpzs.exe
"C:\Program Files (x86)\132\kpzs.exe" "C:\Users\Admin\AppData\Local\Temp\\FADA1CFD6FB14e7981035D.lnk"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2624

C:\Program Files (x86)\132\kpzs.exe
"C:\Program Files (x86)\132\kpzs.exe" "C:\Users\Admin\AppData\Local\Temp\\E9FD3B19F1C1410cA75A74.lnk"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12345678.exe

Path C:\Program Files (x86)\132\12345678.exe
Size 302KB
SHA256 fa54f5bc71a33ff9534fa0571049a9675864875917c1faabd755c528a14e9dc5
MD5 6795c4e184b8d4e170cda0254346b55a
SHA1 eda08d80571169379e349ee3ef6101f09c2d9cf7
SHA512 4ddc45ae5f797406b09281a44e4995a205c7b484c43e53a870375375da08ad26f1b1bbdc49fad1d52db67f72c92fc7531f8c38ff03205a6270117b93433247e7
SSDEEP 6144:yjj3ndpuFbE1idOakOQ6TIeAe+7xxeI89cg7e9mRcnxU7fMZ2TrJK4IKQTcLLmJz:W3n6FbEsd77TIea7Lc997e5U7vTrWwLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

CefControl.dll

Path C:\Program Files (x86)\132\CefControl.dll
Size 590KB
SHA256 2422e71145ae364a4992cf37eba2938e541253bec467419ea6d1f037822c77f4
MD5 037d4ae83b30c3ba8f7f23e54a168bb2
SHA1 05a291f0397928c30d5b8fd4980c9ffb0472a4e7
SHA512 fe2119eb042044049e0916086a815b19af8873133ea85edb8657533abeea95d2608aae3a6a0519132a7d064726121ae792ba9a22d6393f43ec1f28e1f857dac4
SSDEEP 12288:CTDQVo0VMHN+sLr+2lIBPQEi28S8nVBOyje6h3ghvNBv5:fT+HMKffw8GhmePv5
MD5 SHA1 SHA512 SSDEEP

Submit Download

DuiLib.dll

Path C:\Program Files (x86)\132\DuiLib.dll
Size 2.2MB
SHA256 4640ad02300c1311697c5592acdcfa59dba923eae1f2f2cb215a4a09d5055676
MD5 cbfc4a8bc75a556dd97981531fadd751
SHA1 25e8eccb28e804db23d1d5123f3766d29b99294f
SHA512 3b02ea196b431e44a242ddafb0392420f1221b95e4a987a453bf3b1f72cc9ff707df7d5ff27f421edac0b6138cfa0205a98abf1dd92c7c5defcfdae2db34988c
SSDEEP 49152:SXzeJ3AJMsYuXoWZwGTc7a6h1JGMZtS4Vx7N:4z4AJHoyc7a6T
MD5 SHA1 SHA512 SSDEEP

Submit Download

EPEvenue_SB.exe

Path C:\Program Files (x86)\132\EPEvenue_SB.exe
Size 1.1MB
SHA256 37865f209c91b291282c51515a868e6993070d3d7594cf931b42f5a6a8f09a3a
MD5 4ddce14e5c6c09bbe5154167a74d271e
SHA1 3985cd3c8b49fcaa9c9dd244ef53d9e86889a3ad
SHA512 f49cf8709fbc1a507416cc61c0678cf153d8fab38527d8e9eece7619196e4c194be437e57de635bea511cdcde7bc62469380f97005b7202c625ae6ceb70b610b
SSDEEP 12288:rmFzj/Jm4rhXkMuDop9rCisKcrDORyqA8EgNFAGU:qFf/Jm4rlkMusfiKcXOkuAGU
MD5 SHA1 SHA512 SSDEEP

Submit Download

XPFarmer.bpl

Path C:\Program Files (x86)\132\XPFarmer.bpl
Size 1.5MB
SHA256 a2b6b2c4e1a49809936780149416e8cbb793a0631f81f746350c3c06fcd2bc8e
MD5 b6b5969b658b647fa0c6ec11de139c96
SHA1 87b0e1176b5d5cae31bee708c8daa383da4adf02
SHA512 28b4ef210ac75e5d93ed7f99ed39e7bc1d918852a5f34ff0a95d0f4c742f190a969e5be30dd1845457d0880e1ce1975fb9d5e614de5b5b5e66e362ec3bde3842
SSDEEP 12288:bzC29ELzScwv9gU5kcoXq1dhpAntAhXcZP5aNyCqBPN4vRgQ3gqX8aE05mtiB7YW:2Fwv9RLs4tDYn7JnNs6hBb7+g6
MD5 SHA1 SHA512 SSDEEP

Submit Download

kpzs.exe

Path C:\Program Files (x86)\132\kpzs.exe
Size 72KB
SHA256 8ce68528e25b86977f18d42c8c5dddbd6e6f24f34a340d447f4b4db0cb96bfbe
MD5 3ffb2d1b619bd7841df50aaf619922fd
SHA1 6973d1b9f33ceb741569db9d0d1fa06712a2565e
SHA512 7855b96335088bb718215eeea63d6d36c871f3f946de3de48fcc0bb7666cc61c7922f7c84d886d19c5454d283971a5e704c2cc97795c629fc20183c29040d4da
SSDEEP 1536:xn/FBQUbzaRnQmDkdeWZOmoZ4wOMYyC4x8ghV:xn/FBQUna9d1WZOmW4wsmp
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcef.dll

Path C:\Program Files (x86)\132\libcef.dll
Size 2.3MB
SHA256 8cbf2119df0183acad56d9c8db40bfcde91007cbc956b39ab15764273baa04bf
MD5 973289689f5caa955afae5fc92190353
SHA1 2b1879a82bfc6f53aaf9d4dc286c59d749c38718
SHA512 5674e6ffa232fd85409fae66605b118eb4be226886ce3430b8d7d6039536807629907becad1c1cd0a43e680da5c5eea9755b4fff0ecb978cefb7ff9c3649b4a5
SSDEEP 49152:8ebWtuUzhKHf8eWwB+M6sidPq0cUX/2AbpWhYx4MZmbDs:8ebJqK/8eW++7sidbcUX/2AbpWhYx4MR
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp100.dll

Path C:\Program Files (x86)\132\msvcp100.dll
Size 411KB
SHA256 d769fafa2b3232de9fa7153212ba287f68e745257f1c00fafb511e7a02de7adf
MD5 e3c817f7fe44cc870ecdbcbc3ea36132
SHA1 2ada702a0c143a7ae39b7de16a4b5cc994d2548b
SHA512 4fcf3fcdd27c97a714e173aa221f53df6c152636d77dea49e256a9788f2d3f2c2d7315dd0b4d72ecefc553082f9149b8580779abb39891a88907f16ec9e13cbe
SSDEEP 12288:zNb8zxr1aWPaHX7dGP57rhUgiW6QR7t5qv3Ooc8UHkC2ejGH:zNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eKH
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr100.dll

Path C:\Program Files (x86)\132\msvcr100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtl70.bpl

Path C:\Program Files (x86)\132\rtl70.bpl
Size 1.8MB
SHA256 94bc0e96d3cbab43de9110ca979975007412e2f477b393409fbad3fc27de384f
MD5 92f4a54a2ce971ef1971c05bc653bcf6
SHA1 13a5ea44bfa6b1cce7a997b6cc1408ef89cc19c4
SHA512 ebc87bd74cc81b6a2f63a064dad93d6d3814d2a18a9800c5d4b4b17d993bfead1db424863e1cba12218d1faa4dce2fe413de4f00ccf4c7225759a829cdbdc299
SSDEEP 12288:jDHLMDRopkqbtkID/PVFjBba8izfFzjnYtuKPbhd89Ug3a+B9NsQ0:jDHLOupkqbKID/bkXzdzjGw9UQ96
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcl70.bpl

Path C:\Program Files (x86)\132\vcl70.bpl
Size 1.3MB
SHA256 a7a26cbf6968063c51d4d70f4599f295e4a88e352f19bdd475f3416e6411c390
MD5 16a1c27ed415d1816f8888ea2cefb3f6
SHA1 80db800b805d548f6df4eb2cb37ba2064dc37c05
SHA512 68a3e563dd9745210eb7295cde692af68cd5fc430a95856f4823dc10e42d067f332ae1d2445e8810e0c15c3c779e195735bd311c45e9690cb05dbedcd7354306
SSDEEP 12288:HYURhofl6VUvxusfIuJ25+G1gMBpSFxZTemnMc3YB4gisIKXKjj5Oby17fGlC:Hof30jJBpSfZyWIGBsKH5ObC4C
MD5 SHA1 SHA512 SSDEEP

Submit Download

w.exe

Path C:\Program Files (x86)\132\w.exe
Size 5.2MB
SHA256 2df0837884c042ec6c889702bed52df643722e9f949b4f2d7b9834ae42c6f246
MD5 dfff7fdeb342305504b35b2261eab611
SHA1 000f37471c5cf6d245848368d3eec4c1a21b624e
SHA512 588b6f3fdf64c695c0b4465f78ae6eaf36a9b350b9ccd2fd5e891ae1b4e36329403184a2e0f60dc45d7ca33f43a0546ae24c909f3b82e5f402b03bf46fdb01d8
SSDEEP 98304:iQsIVT2BIsWeEmJETnAVmqLq8cFcptyx2/Q3N3Q:izIshVJLLPtL/Qd3Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

BgWorker.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc5843.tmp\BgWorker.dll
Size 2KB
SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
MD5 33ec04738007e665059cf40bc0f0c22b
SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
MD5 SHA1 SHA512

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc5843.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc5843.tmp\System.dll
Size 12KB
SHA256 00f7604d4f36a728c7759f4d9cf3e30c9728c503557aac49bbcd55cfc3e4fcb4
MD5 e38d8ff9f749ee1b141a122fec7280e0
SHA1 fbc8e410ef716fdb36977e5c16d3373a6100189a
SHA512 2b1dccf42d435445331291db94f869c4e8f6dcdfe4371969e76ee275d4e845e1d2e947c216f80484a7dd4b8e85158298e6ec7ed9add6d4259c07fdf87c316a8f
SSDEEP 192:lGvqZRJOts/+FEi3wIYbhTe+j++RSlpUZCai:XRYtsxi3gdTXtOpyC
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsNiuniuSkin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc5843.tmp\nsNiuniuSkin.dll
Size 288KB
SHA256 21a9a74fd631030981cdca42ab580f5aa030068ab80c183b73e99bea2d4f7708
MD5 1e88afb7fe5b58d09d8a1b631e442538
SHA1 9ddb655cb32d002f68bdee962ce917002faa3614
SHA512 a7723bd73f55a716ea450f075d7a4fc7cd2080992c56ad67b6d46fdf4e30cef386068e1f4c2c788764cb092b529589cc1119ea2d62d07e32ea6d201e3afaf876
SSDEEP 6144:kczmqW3rkWU6nSS0Jrco7Wj5ssBE9O8A2Bce5LX7kgvrRT2RMw7sN:kMZWQWU6ntcRvWgO8AhgX7kgzRT2BwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc5843.tmp\nsProcess.dll
Size 4KB
SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
MD5 88d3e48d1c1a051c702d47046ade7b4c
SHA1 8fc805a8b7900b6ba895d1b809a9f3ad4c730d23
SHA512 83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7
MD5 SHA1 SHA512

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\nsc5843.tmp\skin.zip
Size 344KB
SHA256 2b69df6672798883288c1f9d9b47d68fb617a190af2ed6bdd36a8dc6971cd273
MD5 989d079b049754111b4e7338073b3475
SHA1 19246a065ab5f30a2defd4105c453e876bf4682a
SHA512 2e9e878beec13263b5366201e4acdb9b9cde5d5182b06390ea3da0da71f59c5826eb72f579f555edd70ffcb0e6ee0f50ab9ccecc958b4fc503b6415918409568
SSDEEP 6144:ItYdu2fIPkxOj1FFiJK0u0tdr1MnMqiuRlPuVwUzMkIUBgY/xbIiB+Xknl2K:KYdlIPfj1HiI0lMnM7uRlPuVwU4OgYB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1092-183-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1092-189-0x0000000000AE0000-0x0000000000C5A000-memory.dmp

Download

memory/1092-186-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/1092-179-0x0000000000AE0000-0x0000000000C5A000-memory.dmp

Download

memory/1372-134-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1372-137-0x0000000000990000-0x0000000000B0A000-memory.dmp

Download

memory/1372-130-0x0000000000990000-0x0000000000B0A000-memory.dmp

Download

memory/1372-135-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/1928-162-0x0000000000990000-0x0000000000B0A000-memory.dmp

Download

memory/1928-161-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/1928-160-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/2988-207-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/2988-206-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/3308-196-0x0000000000BF0000-0x0000000000D6A000-memory.dmp

Download

memory/3308-199-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/3308-198-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/3308-201-0x0000000000BF0000-0x0000000000D6A000-memory.dmp

Download

memory/3572-212-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/3572-211-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/3572-209-0x00000000009E0000-0x0000000000B5A000-memory.dmp

Download

memory/4212-170-0x0000000000450000-0x0000000000519000-memory.dmp

Download

memory/4212-171-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4212-169-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/4212-168-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/4504-11-0x0000000074880000-0x000000007493C000-memory.dmp

Download

memory/5012-141-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/5012-140-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/5012-143-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/5012-132-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5012-138-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/5012-136-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5012-142-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/5080-190-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/5080-191-0x0000000010000000-0x000000001018F000-memory.dmp

Download