Malware Analysis Report

2024-09-11 05:55

Sample ID 240603-g6ggssfg42
Target e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16
SHA256 e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16
Tags
discovery execution exploit persistence upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16

Threat Level: Likely malicious

The file e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16 was found to be: Likely malicious.

Malicious Activity Summary

discovery execution exploit persistence upx

Creates new service(s)

Possible privilege escalation attempt

Loads dropped DLL

Deletes itself

Modifies file permissions

UPX packed file

Executes dropped EXE

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
System Services
T1569
Service Execution
T1569.002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Defense Evasion
TA0005
File and Directory Permissions Modification
T1222
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Remote System Discovery
T1018
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-03 06:24

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 06:24

Reported

2024-06-03 06:29

Platform

win7-20240508-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe"

Signatures

Creates new service(s)

persistence execution

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Media Player\background.jpg C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe N/A
File created C:\Program Files\Windows Media Player\mpsvc.dll C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe N/A
File created C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe N/A
File created C:\Program Files\Windows Media Player\wmixedwk.exe C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmixedwk.exe C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1580 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\System32\cmd.exe
PID 1580 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\System32\cmd.exe
PID 1580 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\System32\cmd.exe
PID 2768 wrote to memory of 2660 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 2768 wrote to memory of 2660 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 2768 wrote to memory of 2660 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 2768 wrote to memory of 2636 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 2768 wrote to memory of 2636 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 2768 wrote to memory of 2636 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 1580 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\System32\cmd.exe
PID 1580 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\System32\cmd.exe
PID 1580 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\System32\cmd.exe
PID 1580 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\system32\cmd.exe
PID 1580 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\system32\cmd.exe
PID 1580 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\system32\cmd.exe
PID 2544 wrote to memory of 1452 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2544 wrote to memory of 1452 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2544 wrote to memory of 1452 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2416 wrote to memory of 1144 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2416 wrote to memory of 1144 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2416 wrote to memory of 1144 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe

"C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" cmd /c takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" && icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" cmd /c sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own

C:\Windows\system32\cmd.exe

cmd /c ""C:\kkxqbh.bat" "

C:\Windows\system32\sc.exe

sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 sta.alie3ksgee.com udp
HK 103.146.158.221:80 sta.alie3ksgee.com tcp

Files

memory/1580-0-0x000000013F1ED000-0x000000013F1EF000-memory.dmp

memory/1580-3-0x0000000002180000-0x00000000021AC000-memory.dmp

memory/1580-5-0x000000013F1E0000-0x000000013F21C000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 90b85ffbdeead1be861d59134ea985b0
SHA1 55e9859aa7dba87678e7c529b571fdf6b7181339
SHA256 ed0dc979eed9ab9933c49204d362de575c7112a792633fda75bb5d1dab50a5c2
SHA512 8a1c10bbfe5651ab25bf36f4e8f2f65424c8e1004696c8141498b99ea2fbd7b3e5fae4d2cfee6835f7ff46bd2333602f4d8ac4a0f5b8e9757adb176332a3afce

memory/1580-27-0x0000000002180000-0x00000000021AC000-memory.dmp

C:\kkxqbh.bat

MD5 44a3af72a2e7efad7f05b5b264f2b133
SHA1 cfd7c8451a0c6e8123328b18f96bec50d04b50ab
SHA256 471ff503db8bd1d39701d587ec4f2d3c97c2843a53e812fe726c970f7306fbb4
SHA512 3d2009c7d4b82fd970ced78fe97b0d5ed08ca7a33480969deb5345195e50877e5efe8f80eeca86c63c5f87cc3779f7f9aba47eb1cca1c29656cb4f74bfd4e14a

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 06:24

Reported

2024-06-03 06:30

Platform

win10-20240404-en

Max time kernel

300s

Max time network

307s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe"

Signatures

Creates new service(s)

persistence execution

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmixedwk.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmixedwk.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\1928.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\4360.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\4688.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat C:\Windows\system32\SearchProtocolHost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\4388.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\1352.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\196.hecate C:\Windows\system32\svchost.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\Local\info C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\1280.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\3564.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\4316.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\1644.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\4444.hecate C:\Windows\system32\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1480 set thread context of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 1644 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 196 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 1280 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 3564 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 4388 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 4316 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 4688 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 1352 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 1928 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 4360 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 set thread context of 4444 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File created C:\Program Files\Windows Media Player\mpsvc.dll C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxds C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File created C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe N/A
File created C:\Program Files\Windows Media Player\wmixedwk.exe C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmixedwk.exe C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe N/A
File opened for modification C:\Program Files\Windows Media Player\mpsvc.dll C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File created C:\Program Files\Windows Media Player\down_info C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File created C:\Program Files\Windows Media Player\background.jpg C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpp C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpa C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\ESE.TXT C:\Windows\system32\SearchIndexer.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.jpe = "1" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice\ProgId = "AppX43hnxtbyyps62jhe9sqpdzxn1790zetc" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mod C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice\Hash = "PfWBoj5l814=" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2c4dadc7eb5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice\Hash = "onekBM5qT84=" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice\ProgId = "AppXd4nrz8ff68srnhf9t5a8sbjyar1cr723" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice\Hash = "1wvsnGAqSSQ=" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice\ProgId = "AppX43hnxtbyyps62jhe9sqpdzxn1790zetc" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.mov = "1" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.jfif = "1" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice\Hash = "4ig8Y5ZUOaA=" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000db645db7eb5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.MOD = "1" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.wmv = "1" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.html = "1" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice\ProgId = "AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096cf0c687fb5da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice\ProgId = "AppX43hnxtbyyps62jhe9sqpdzxn1790zetc" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice\Hash = "jDuzre2hbug=" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice\Hash = "d6a+IzDqHVo=" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice\Hash = "ZfkR1VfQ02c=" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchFilterHost.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1744 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\System32\cmd.exe
PID 1744 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\System32\cmd.exe
PID 4672 wrote to memory of 2076 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 4672 wrote to memory of 2076 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 4672 wrote to memory of 4728 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 4672 wrote to memory of 4728 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 1480 wrote to memory of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1480 wrote to memory of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1480 wrote to memory of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1480 wrote to memory of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1480 wrote to memory of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1480 wrote to memory of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1480 wrote to memory of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1480 wrote to memory of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1480 wrote to memory of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1480 wrote to memory of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1480 wrote to memory of 1788 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1644 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1644 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1644 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1644 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1644 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1644 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1644 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 2096 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 196 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 196 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1744 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\System32\cmd.exe
PID 1744 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\System32\cmd.exe
PID 1788 wrote to memory of 196 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 196 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 196 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 196 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1744 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\system32\cmd.exe
PID 1744 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe C:\Windows\system32\cmd.exe
PID 1788 wrote to memory of 196 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 3940 wrote to memory of 2428 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3940 wrote to memory of 2428 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 3940 wrote to memory of 5024 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 3940 wrote to memory of 5024 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4712 wrote to memory of 3952 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 4712 wrote to memory of 3952 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 3380 wrote to memory of 3936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 3380 wrote to memory of 3936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 1788 wrote to memory of 1280 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1280 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1280 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1280 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1280 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1280 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 1280 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 3564 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 3564 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 1788 wrote to memory of 3564 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe

"C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" cmd /c takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" && icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Program Files\Windows Media Player\wmixedwk.exe

"C:\Program Files\Windows Media Player\wmixedwk.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" cmd /c sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\kkxqbh.bat" "

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 684 688 696 8192 692

C:\Windows\system32\sc.exe

sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 3

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 684 688 696 8192 692

Network

Country Destination Domain Proto
US 8.8.8.8:53 sta.alie3ksgee.com udp
HK 103.146.158.221:80 sta.alie3ksgee.com tcp
US 8.8.8.8:53 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa udp
US 8.8.8.8:53 221.158.146.103.in-addr.arpa udp
US 8.8.8.8:53 myxqbh.top udp
CN 182.108.51.51:6666 myxqbh.top udp
US 8.8.8.8:53 51.51.108.182.in-addr.arpa udp
HK 103.146.158.221:80 sta.alie3ksgee.com tcp
US 8.8.8.8:53 cl.alie3ksgff.com udp
US 149.28.212.217:6666 cl.alie3ksgff.com udp
US 8.8.8.8:53 217.212.28.149.in-addr.arpa udp
CN 182.108.51.51:6666 myxqbh.top udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
CN 182.108.51.51:6666 myxqbh.top udp
CN 182.108.51.51:6666 myxqbh.top udp
US 8.8.8.8:53 195.201.50.20.in-addr.arpa udp
CN 182.108.51.51:6666 myxqbh.top udp
CN 182.108.51.51:6666 myxqbh.top udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
CN 182.108.51.51:6666 myxqbh.top udp
CN 182.108.51.51:6666 myxqbh.top udp
CN 182.108.51.51:6666 myxqbh.top udp
CN 182.108.51.51:6666 myxqbh.top udp

Files

memory/1744-0-0x00007FF6EE83D000-0x00007FF6EE83F000-memory.dmp

memory/1744-3-0x000001C7AEBD0000-0x000001C7AEBFC000-memory.dmp

memory/1744-5-0x00007FF6EE830000-0x00007FF6EE86C000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 90b85ffbdeead1be861d59134ea985b0
SHA1 55e9859aa7dba87678e7c529b571fdf6b7181339
SHA256 ed0dc979eed9ab9933c49204d362de575c7112a792633fda75bb5d1dab50a5c2
SHA512 8a1c10bbfe5651ab25bf36f4e8f2f65424c8e1004696c8141498b99ea2fbd7b3e5fae4d2cfee6835f7ff46bd2333602f4d8ac4a0f5b8e9757adb176332a3afce

memory/3940-19-0x000001A694F00000-0x000001A694F10000-memory.dmp

memory/3940-35-0x000001A695000000-0x000001A695010000-memory.dmp

memory/3940-51-0x000001A699560000-0x000001A699568000-memory.dmp

\Program Files\Windows Media Player\mpsvc.dll

MD5 7b207ce9f9d71dfc2eaa2e959634a54d
SHA1 8222daa0c820e50d02ffabdc55dfb7461bbaa1e5
SHA256 757af7a540628004b446117be432342674f7830fa008f97a5f4a1ac386954bc2
SHA512 6ffbe6e33768e2fbea8c7cee428eb4b61e3eb1dd12e470de363f1d6e274296adabc8d1e681fe5a5f2b1dc8e8eb08bd360572bfd34706e82580c51be57f6fcf5a

C:\Program Files\Windows Media Player\background.jpg

MD5 b37c3d3ab20f7e8a06232330122d1ed7
SHA1 6daa977d591b1cbb1ecde9fd82e14287a284bdd2
SHA256 e796f0d6d6960af232a1b8f039cd45a703c1743dfd6f4098cdde0a46a69e33a2
SHA512 da26eee1e9f1d594f2f4604838b66dac95db29373a59e347b1cf31022eb0040f5a9ebdd50c12f4af1dbbfd7c5bae20f3937cbdd8016e441d8822f9f86d03e5bb

memory/1788-63-0x0000000140000000-0x0000000140026000-memory.dmp

memory/1788-64-0x0000000140000000-0x0000000140026000-memory.dmp

memory/1788-65-0x0000000140000000-0x0000000140026000-memory.dmp

memory/1644-77-0x0000000140000000-0x0000000140138000-memory.dmp

memory/1644-86-0x0000000140000000-0x0000000140138000-memory.dmp

memory/196-91-0x0000000140000000-0x000000014011B000-memory.dmp

memory/2096-88-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/196-92-0x0000000140000000-0x000000014011B000-memory.dmp

memory/2096-89-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/2096-83-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/2096-82-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/2096-81-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/2096-80-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/2096-79-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/2096-78-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/2096-84-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1644-75-0x0000000140000000-0x0000000140138000-memory.dmp

memory/1644-73-0x0000000140000000-0x0000000140138000-memory.dmp

memory/1644-74-0x0000000140000000-0x0000000140138000-memory.dmp

C:\kkxqbh.bat

MD5 44a3af72a2e7efad7f05b5b264f2b133
SHA1 cfd7c8451a0c6e8123328b18f96bec50d04b50ab
SHA256 471ff503db8bd1d39701d587ec4f2d3c97c2843a53e812fe726c970f7306fbb4
SHA512 3d2009c7d4b82fd970ced78fe97b0d5ed08ca7a33480969deb5345195e50877e5efe8f80eeca86c63c5f87cc3779f7f9aba47eb1cca1c29656cb4f74bfd4e14a

memory/1788-72-0x0000000140000000-0x0000000140026000-memory.dmp

memory/1788-71-0x0000000140000000-0x0000000140026000-memory.dmp

memory/1788-69-0x0000000140000000-0x0000000140026000-memory.dmp

memory/1788-68-0x0000000140000000-0x0000000140026000-memory.dmp

memory/1788-67-0x0000000140000000-0x0000000140026000-memory.dmp

memory/1788-66-0x0000000140000000-0x0000000140026000-memory.dmp

C:\Program Files\Windows Media Player\down_info

MD5 980a875ff6ef9c2d75e74307cbf5d205
SHA1 0c1c59987caf71d73b78e043a76b13de097ac705
SHA256 5c7a722d8d8f97d6d923396f673c15bab9722658cbe5ab24438a3ddadde5403f
SHA512 09c201fe4e3aad3bb24e4e1fa2e1a6a480a60691dc3ad7a988850191dbe17c8a2f16280ddc9099c8060e3360597d56f19f7d5c05bdb6cb92adbacd0156c238ad

C:\Windows\Temp\aad9f05a9a826b65ff2b94740ca196c2

MD5 1f78e3f28bd6b8feca553e177cef2676
SHA1 00ed1cd0481114dfc9a38504a5e9faadccd6ab62
SHA256 a79c4852717dc78f7790af6f925d84234b91e125a98c9bf389f0e6bd582397c9
SHA512 547158c08d1f4b75809d805e8e417586a16428fb2012d953a050d06fdfcbe248992b010eef60514f809a6b0990f4579bfb0e1d5062bcfa48e1504f608d29d788