Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
12-07-2024 05:47
General
-
Target
3c31ae3a0e6825a0e37ae6a662ea5afa_JaffaCakes118.exe
-
Size
21.2MB
-
MD5
3c31ae3a0e6825a0e37ae6a662ea5afa
-
SHA1
5fd70780a64c8386e365c598b2e766858967aec5
-
SHA256
1d2dd29ed3e57eb0da6ed185cc2ebe7f69985953a3c214c4ba47c4b4e915fec8
-
SHA512
56732de6ed6519fcad796004d195ad042686322928f56cfeacc5b731e1437c205aee9cfb1694ec64629a16b71962a28eb8fdd06c55d0e59cd41b32c34068baf0
-
SSDEEP
393216:roWcToMPDllAY4l81+I833ZvjG1ZMrCzMjauPIyPQJtAiB:Sp7V4Fb5bG1CM8augyIMi
Malware Config
Extracted
njrat
0.7.3
Client
dontreachme3.ddns.net:3604
EdgeBrowser.exe
-
reg_key
EdgeBrowser.exe
-
splitter
123
Extracted
blacknet
v3.7.0 Public
Bot
https://furyx.de/panel
BN[e5decf896675e5ecc7bbef8ebff8a786]
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
50651597687556f33b7fc75d90350b99
-
startup
false
-
usb_spread
true
Extracted
asyncrat
0.5.7B
Default
dontreachme3.ddns.net:3601
dontreachme1.ddns.net:3601
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
EpicGames.exe
-
install_folder
%AppData%
Extracted
nanocore
1.2.2.0
dontreachme3.ddns.net:3603
dontreachme1.ddns.net:3603
19a5c2b0-5593-40da-9945-6c6b53e85d75
-
activate_away_mode
false
-
backup_connection_host
dontreachme1.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-11-15T15:45:18.745530536Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3603
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
19a5c2b0-5593-40da-9945-6c6b53e85d75
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
dontreachme3.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
BlackNET
BlackNET is an open source remote access tool written in VB.NET.
-
BlackNET payload 1 IoCs
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies WinLogon for persistence 2 TTPs 13 IoCs
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
UAC bypass 3 TTPs 3 IoCs
-
Windows security bypass 2 TTPs 15 IoCs
-
XMRig Miner payload 3 IoCs
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Adds policy Run key to start application 2 TTPs 4 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 39 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 18 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 15 IoCs
-
Executes dropped EXE 37 IoCs
-
Loads dropped DLL 3 IoCs
-
Windows security modification 2 TTPs 23 IoCs
-
Adds Run key to start application 2 TTPs 23 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
-
Suspicious use of SetThreadContext 10 IoCs
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 10 IoCs
-
Delays execution with timeout.exe 9 IoCs
-
Modifies registry key 1 TTPs 2 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c31ae3a0e6825a0e37ae6a662ea5afa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c31ae3a0e6825a0e37ae6a662ea5afa_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpC563.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC563.tmp.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ProtonVPN_win_v1.18.5.exe"C:\Users\Admin\AppData\Local\Temp\ProtonVPN_win_v1.18.5.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\tmpCE7C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCE7C.tmp.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WD+UAC.exe"C:\Users\Admin\AppData\Local\Temp\WD+UAC.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System policy modification
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 9044⤵
- Program crash
-
C:\Users\Admin\Documents\EdgeExplorer.exe"C:\Users\Admin\Documents\EdgeExplorer.exe"3⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeExplorer.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeExplorer.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeExplorer.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\EdgeExplorer.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\EdgeExplorer.exe"C:\Users\Admin\Documents\EdgeExplorer.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\Documents\EdgeExplorer.exe" /sc minute /mo 15⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Users\Admin\EdgeBrowser.exe"C:\Users\Admin\EdgeBrowser.exe"5⤵
- Modifies WinLogon for persistence
- Windows security bypass
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeBrowser.exe" -Force6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\EdgeBrowser.exe" -Force6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\EdgeBrowser.exe"C:\Users\Admin\EdgeBrowser.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\EdgeBrowser.exe" /sc minute /mo 17⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8092 -s 22086⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 21324⤵
- Program crash
-
C:\Users\Admin\Documents\EpicGames Service.exe"C:\Users\Admin\Documents\EpicGames Service.exe"3⤵
- Modifies WinLogon for persistence
- Windows security bypass
- Blocklisted process makes network request
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EpicGames Service.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EpicGames Service.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EpicGames Service.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\EpicGames Service.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\EpicGames Service.exe"C:\Users\Admin\Documents\EpicGames Service.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 21844⤵
- Program crash
-
C:\Users\Admin\Documents\Firefoxinstaller.exe"C:\Users\Admin\Documents\Firefoxinstaller.exe"3⤵
- Modifies WinLogon for persistence
- Windows security bypass
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Firefoxinstaller.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\Firefoxinstaller.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\Firefoxinstaller.exe"C:\Users\Admin\Documents\Firefoxinstaller.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\Firefoxinstaller.exe"C:\Users\Admin\Documents\Firefoxinstaller.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 21524⤵
- Program crash
-
C:\Users\Admin\Documents\Microsoft Compatibilitys Telemetry.exe"C:\Users\Admin\Documents\Microsoft Compatibilitys Telemetry.exe"3⤵
- Modifies WinLogon for persistence
- Windows security bypass
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Compatibilitys Telemetry.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Compatibilitys Telemetry.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Compatibilitys Telemetry.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\Microsoft Compatibilitys Telemetry.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\Microsoft Compatibilitys Telemetry.exe"C:\Users\Admin\Documents\Microsoft Compatibilitys Telemetry.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Microsoft Compatibilitys Telemetry.exe"C:\Users\Admin\Documents\Microsoft Compatibilitys Telemetry.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Microsoft Compatibilitys Telemetry.exe"C:\Users\Admin\Documents\Microsoft Compatibilitys Telemetry.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\Documents\Microsoft Compatibility Telemetry.exe"C:\Users\Admin\Documents\Microsoft Compatibility Telemetry.exe"5⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\reagentc.exereagentc.exe /disable6⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension exe6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /SC ONLOGON /RU "NT Authority\System" /TR C:\Windows\MicrosoftCompabilityTelemetry.exe /TN MicrosoftCT6⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\MicrosoftCompabilityTelemetry.exe"C:\Windows\MicrosoftCompabilityTelemetry.exe"7⤵
- Executes dropped EXE
-
C:\Windows\MicrosoftCompabilityTelemetry.exe"C:\Windows\MicrosoftCompabilityTelemetry.exe"7⤵
- Executes dropped EXE
-
C:\Windows\MicrosoftCompabilityTelemetry.exe"C:\Windows\MicrosoftCompabilityTelemetry.exe"7⤵
- Executes dropped EXE
-
C:\Windows\MicrosoftCompabilityTelemetry.exe"C:\Windows\MicrosoftCompabilityTelemetry.exe"7⤵
- Executes dropped EXE
-
C:\Windows\MicrosoftCompabilityTelemetry.exe"C:\Windows\MicrosoftCompabilityTelemetry.exe"7⤵
- Executes dropped EXE
-
C:\Windows\MicrosoftCompabilityTelemetry.exe"C:\Windows\MicrosoftCompabilityTelemetry.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\attrib.exeattrib +h C:\Users\Admin\AppData\Roaming\xmrig.exe6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exeattrib +h C:\Users\Admin\AppData\Roaming\WinRing0x64.sys6⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 22324⤵
- Program crash
-
C:\Users\Admin\Documents\NortonInstaller.exe"C:\Users\Admin\Documents\NortonInstaller.exe"3⤵
- Modifies WinLogon for persistence
- Windows security bypass
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NortonInstaller.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NortonInstaller.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NortonInstaller.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\NortonInstaller.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\NortonInstaller.exe"C:\Users\Admin\Documents\NortonInstaller.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\NortonInstaller.exe"C:\Users\Admin\Documents\NortonInstaller.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "NAT Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4E4A.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 22524⤵
- Program crash
-
C:\Users\Admin\Documents\WinExplorer.exe"C:\Users\Admin\Documents\WinExplorer.exe"3⤵
- Modifies WinLogon for persistence
- Windows security bypass
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinExplorer.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\WinExplorer.exe" -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\WinExplorer.exe"C:\Users\Admin\Documents\WinExplorer.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\Documents\WindowsExplorer.exe"C:\Users\Admin\Documents\WindowsExplorer.exe"5⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "6⤵
-
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 27⤵
- Runs ping.exe
-
C:\explorer\explorer.exe"C:\explorer\explorer.exe"7⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f8⤵
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f9⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 21924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 324 -ip 3241⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3854CECAA075DA0C8B252424F0995150 C2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1676 -ip 16761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2372 -ip 23721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 628 -ip 6281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1548 -ip 15481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2492 -ip 24921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2348 -ip 23481⤵
-
C:\Users\Admin\Documents\EdgeExplorer.exeC:\Users\Admin\Documents\EdgeExplorer.exe1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeExplorer.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeExplorer.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeExplorer.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\EdgeExplorer.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\EdgeExplorer.exe"C:\Users\Admin\Documents\EdgeExplorer.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\EdgeExplorer.exe"C:\Users\Admin\Documents\EdgeExplorer.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\Documents\EdgeExplorer.exe" /sc minute /mo 13⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8080 -s 21442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 8092 -ip 80921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 8080 -ip 80801⤵
-
C:\Users\Admin\Documents\EdgeExplorer.exeC:\Users\Admin\Documents\EdgeExplorer.exe1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeExplorer.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeExplorer.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeExplorer.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\EdgeExplorer.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\EdgeExplorer.exe"C:\Users\Admin\Documents\EdgeExplorer.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\Documents\EdgeExplorer.exe" /sc minute /mo 13⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 10322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4948 -ip 49481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
12Impair Defenses
5Disable or Modify Tools
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Subvert Trust Controls
1Install Root Certificate
1Hide Artifacts
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Firefoxinstaller.exe.logFilesize
507B
MD576ffb2f33cb32ade8fc862a67599e9d8
SHA1920cc4ab75b36d2f9f6e979b74db568973c49130
SHA256f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310
SHA512f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5124edf3ad57549a6e475f3bc4e6cfe51
SHA180f5187eeebb4a304e9caa0ce66fcd78c113d634
SHA256638c51e173ca6b3469494a7e2e0b656021a761f77b4a83f3e430e82e7b9af675
SHA512b6c1a9051feeffad54ba1092fd799d34a9578368d7e66b31780fe478c1def0eb4094dce2879003f7389f2f9d86b94a3ef3975e78092a604597841c9b8db120ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5764b98b91c93e712ba5926e03017e509
SHA10c4670aa346cd84f0216743c7d731ffda4cecb59
SHA2564e9cc0a846f5d5ee4edb192e8f795e4b049a7fc9d3208eb3477c30c8808367d3
SHA51200f5538a8a17b55d4b80646546f2b728686c649eed981ade06e732c10cd416793e8e4f32756921769a38be919523c16be4996581368f11d7d01c93e2e59c3f99
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD54a805112e66d8833d719d701d95b307b
SHA1c632d8ef209d1789bffb5950d66db0eef72c8e8e
SHA25676146f5901628510184de9ad0c885cc97a1cb25c0c6a0fc553cd852fc0c419ee
SHA512f6c76ba4071abbd14f8c4e08b48fe45c0a297db3c62444ebcde436dddaafcc08f569498ad4f1bb6237e3e09c09436d7a8285bf8f6a2a3eafd8e5bcd148cd58b1
-
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_536\dialogFilesize
26KB
MD58a372c8339a8facc35088ce99a977d96
SHA1bf83cad6c9ef75277ed308a6999a08491df106ef
SHA2566a9f617ad2117b3756188ff46ae14e43981f0672904d68b9ba0b9c5ab3525ecf
SHA512f23c3a0427b743061cfffc0310d97f7d62bf152e0acc3f13076f4c75ee653ef327ebb6a8f1b0553e7bddfe129b7261f061865b35791109a5ca08c4e00c73c1c1
-
C:\Users\Admin\AppData\Local\Temp\MSI2B82.tmpFilesize
381KB
MD51784f93d75b7bb91d6d0f8b58dc4c8a5
SHA10687632aaea1b8e8f5ae3a571c38f8231b7ebd6b
SHA25612e19e33cac72fc0bc613de6b971075596df231ec52c063711edff4672da530c
SHA51200501e54c0d7e4ccba3c307567f9b68a590738ac8d07a685de3c334f468cbc52631c038b79a6868caf7bfa65386580462f530317f85512db8f545919105975a1
-
C:\Users\Admin\AppData\Local\Temp\ProtonVPN_win_v1.18.5.exeFilesize
15.3MB
MD5262b6d09ac1b4c02b38abde0e272c833
SHA1f99ee3f05216f764f536c2e8aeeb70d6a7f7dd72
SHA2565a29fed9209c85b1417f4a0efdf10f2779a5b838f8eccdb28cf3555a64e1ba6f
SHA51275ed8c44a429572cbff9e0afdb0924f80c03f0b249da857a935b30f89fbeb4f4e04faa7f2c89e37a1ff718df01e648c90716fe7f501a65f3215237a11c98cc91
-
C:\Users\Admin\AppData\Local\Temp\WD+UAC.exeFilesize
97KB
MD577796247470714fe3672f805d5ff6903
SHA11aca720af56f7120cbb923c5bd7ac877bcd834e6
SHA256dfb39aae10f9924bf6658a9c16451968f8f677fde6d66f02269d3a9be106e0c5
SHA51271118f3d837c10f813369203f0a58b9a0861b5981d47860d6f83227e56278f09d00ce8ae8c5c75fa442eeb79c3601eefcee50e91e4009d7902ea7c9be4bc49ae
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wlhp1grr.vuc.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\install.batFilesize
127B
MD580b32b79bf519fce07cdf7b8b7881067
SHA12fe368e8f5855ef5f08c46f389bf3b5482ace60b
SHA2568ed98d8b82c482aaa79a8ea2f1aaea676c5641d69f2478ba7f241e990d5d99b1
SHA512dc7b986bd5de842d8beb315dea77a424194701b6272cac884dd31cd04586879fa93f3d1f44ec9ca01625b31115b00a2b5fe5028baef7d9ab277881653cab116e
-
C:\Users\Admin\AppData\Local\Temp\tmp4E4A.tmpFilesize
1KB
MD58d64f65d497b498fe88d9f446628e0e6
SHA12c01f76965fa52f717649db191a016b04c296b97
SHA256735f05df747c5fee00b019083ce51cc52bc338382228e43441f1700a8dc3385b
SHA512e9f3df490abd42ca4321a771ee35a54819e37eea99256a398544d94c6ff30f7d021a23d87233e3112a2edb5d5fecef4835b688281e2b29d114af01a90cd6fbf1
-
C:\Users\Admin\AppData\Local\Temp\tmpC563.tmp.exeFilesize
15.4MB
MD54328c8add156ae46095b9dca33124965
SHA15619d8300ae539380e6e8f9bd162c4b1e2a758a3
SHA256c721819731018c283a7349f78b70490b226a7910d22d7ed3c6a9f290add5b38a
SHA512bfefb038568b70adba5aff2daead04e2ca584f66ca4b24b3ec916c5973f322d4700f305d78715283ee851509d3b254719d61d33568f3cb63a0829f154fa39471
-
C:\Users\Admin\AppData\Local\Temp\tmpCE7C.tmp.exeFilesize
5.8MB
MD5fdd4d52bbb965c0bbf636127143f47e1
SHA19ec40fb93806d2eb78ce5521d049169949a7e542
SHA256165e41f653679302af8c4cd10153a1910afa48f785291825bf0f53e79424fe41
SHA512abfe680f13cf4ff8d5255fe2f3f8cef173df3be62f96a4387ae61445653018628c360d15b77473a27b4c0704e2f04cb079c0e105b7297830dd66282a5055c465
-
C:\Users\Admin\AppData\Local\Temp\{FFAFEA09-E7DA-4710-A278-7F0506C96829}\6C96829\ProtonVPN_win_v1.18.5.msiFilesize
10.0MB
MD5a60dd28d024fcf9e8a6127ebc48607d3
SHA108c0f02a46a11b26def6a4904f4b23e3e5eab0a4
SHA25688d69e7711dfea37fe593fdf1b98c7648eb96a85e44bf0aa42dc038f192107e3
SHA5123d6dfd48bc3650022be30bca4148b15f081005be7bf32872ac35a7c642641b56b05f59429245fd5b7870024b7a5d830cbebbb80776078a08a99034724b4582d0
-
C:\Users\Admin\AppData\Local\Temp\{FFAFEA09-E7DA-4710-A278-7F0506C96829}\decoder.dllFilesize
182KB
MD598c6c9d8f62c556e0de37ed9b6b09f9c
SHA13cbd11ded91c511f2f0f752541fab831d03d4f13
SHA2567b90f9f0879d1b1b8d1ea396a0ad2684971b2b1d2303eee8b54d8294246f9440
SHA5120897841429087873ddf2a0b3283d1ca582333ecf60f376ce06220a33e778d513a589be52473ae11c7ae474039925b434c99cd286eb250225075777446687cc3a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security.exeFilesize
125KB
MD593862586de9fb44aef2df179caecea3a
SHA1e2e2335701f80b8e3c8b52d67e02ef93f27d319a
SHA2566aa96397546d89da9465c6eb628daabd5c793b3d92e82057b480e502bcfc22f6
SHA512149bb8300b6d7fcb7233d85aa47261f8e5aa11b90b3d9bf904a62f1472e20da486ab16522af2516ba8f25aab82c1b4d9d6e99adb2d6d38c6e2d0794c740021ed
-
C:\Users\Admin\Documents\EdgeExplorer.exeFilesize
1.3MB
MD5824438344c636fdd81ff2e0d02577912
SHA1ae288a2cc5bd0cce01615d8d568031c3e84902e2
SHA256eaba5f0fb075665dc6568f05f66a271b0a03046da739d41de5920d78c40deb65
SHA51209f1903c6244af5f191e64e9ff6025af6a1c752096b48d43094e5eb6f92c00a77381b49dd6d0d57fc995d4bc4a8375f0ef13d2a9cbc823e3d91b6b9f418b568b
-
C:\Users\Admin\Documents\EpicGames Service.exeFilesize
1.1MB
MD5b117965f227519eb5c8d6e86bc2dd2a4
SHA1e1d80bd0958b69cc73eaf1ee26aa816f795aad63
SHA256f8cfedc4ecdfa6a3e14f46968b5a8e6797a448b0d30f12015cd721121470fcfd
SHA512728252062ff056079c811cfd42c52971b55e96771ecbd911c49f01c94927a1259ab96c2079e78aced2cae737302401889a3fda52c91d0eccc3719f24d17c177f
-
C:\Users\Admin\Documents\Firefoxinstaller.exeFilesize
1.5MB
MD570d3bb5c6ca4166d190ad265b14f117e
SHA195497e892ee875ef226edf3db059121c2c5284ed
SHA2567d8f13128ef978852b8a1446bba4f9c9dea53cbcd1fcedc08b2054cbe8b0e5d9
SHA5120abff26122a137960f1d4564828b1456d0bdff68c87d120c3514cc2c819038d0c6c34398f67377898058b6e8d08f4676393831c413d80181786e459ef4d01720
-
C:\Users\Admin\Documents\Microsoft Compatibility Telemetry.exeFilesize
7.1MB
MD5006dfcd7f4d12929d5074900bf00dc22
SHA1d8010282f5afad78f03871a8040feebb18253284
SHA25602aa35eaff80eeb6d4bb7a773fdeac11aa9224e6c45a7af66fa1457f2662e4f0
SHA5120d6794eba62e63ba7d6f905fdfdeb1f50c418c70b3efed5be7eab853123da5ae5959a06682b369bbe29ceb1226504476096e2fe32edff9bf251747d151a59934
-
C:\Users\Admin\Documents\Microsoft Compatibilitys Telemetry.exeFilesize
21.4MB
MD5e784df27426bef5378a6bcfc425acca8
SHA17da2e99357435e829444bb4e213738503f4c4b43
SHA2568fc8e3f97a795ba56b3795dfc34495b0ff22cea8392197a4f0e3c97d9ca00e7d
SHA5125dfd0838dcf47642f1f958a95301aa2a1f382c921458b8e66987d0bc6e86ebca12f9ca0c8cab158f8c8cb66dc3c57422157eb3ff26e33c11274785f27e60fca0
-
C:\Users\Admin\Documents\NortonInstaller.exeFilesize
2.1MB
MD5d2fe1a2f73303d37c178250add341b97
SHA1e341e8adaec629d299101bbf1b9a3ca2bfaf7417
SHA25626742bef88539fcb6beb9753293a4fef4044663cfcb0a799e989194fcdfd3456
SHA5120c685c265ed28f7655bf27c1a5c1f735670df40ae6e4b835bac3cc62b63b8fe54af82ab0941ca988b1c3220e740c0b2508103a1736b72a79a27ea17bf9a1bc81
-
C:\Users\Admin\Documents\WinExplorer.exeFilesize
1.0MB
MD53830fb01bdf4b41e2e9551d422caf795
SHA1d63a892fc41d2be82de8d02a04b906a8595dcac9
SHA2566c07127df2ebac66a59a3bc4157a891def20b61d87cf2d206353025893d01422
SHA5125f2c54bd05b2fe4109b66e3721a19cd533899c3c694ca3a51422cb5d4015d536b96d0e16ea1f5ed8a43dc6d3e690a1702351034f3a68765d6dc6b16983c19886
-
C:\Users\Admin\Documents\WindowsExplorer.exeFilesize
92KB
MD501ccde20287004986c0f29ff0df2e3b1
SHA118f9831e3246a08f000b0f4d6f009f2294c7c652
SHA256862e652677b7a597b24efc1bdb16030ed8512a8e262050a4b40a829b58855860
SHA512785545dcb74ca29b405261931be0464e65aadc84ebf51e7ad62af709b3867c3a706c9b4efc1e7f922e90c301ff0944feb2dbe6a790db7ac0ba4215b75fde86ee
-
memory/216-555-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/324-61-0x00000000002D0000-0x00000000002F2000-memory.dmpFilesize
136KB
-
memory/324-80-0x0000000009640000-0x0000000009BE4000-memory.dmpFilesize
5.6MB
-
memory/324-66-0x0000000006F80000-0x0000000006F86000-memory.dmpFilesize
24KB
-
memory/628-99-0x00000000007F0000-0x0000000000980000-memory.dmpFilesize
1.6MB
-
memory/628-120-0x0000000005330000-0x0000000005370000-memory.dmpFilesize
256KB
-
memory/1272-391-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/1548-155-0x0000000005970000-0x000000000599E000-memory.dmpFilesize
184KB
-
memory/1548-148-0x0000000000E80000-0x0000000000F8C000-memory.dmpFilesize
1.0MB
-
memory/1548-156-0x0000000005AE0000-0x0000000005AEA000-memory.dmpFilesize
40KB
-
memory/1596-28-0x00007FFE85343000-0x00007FFE85345000-memory.dmpFilesize
8KB
-
memory/1596-151-0x00007FFE85340000-0x00007FFE85E01000-memory.dmpFilesize
10.8MB
-
memory/1596-29-0x00000000003E0000-0x00000000009BA000-memory.dmpFilesize
5.9MB
-
memory/1596-35-0x00007FFE85340000-0x00007FFE85E01000-memory.dmpFilesize
10.8MB
-
memory/1596-33-0x00007FFE85340000-0x00007FFE85E01000-memory.dmpFilesize
10.8MB
-
memory/1596-34-0x00007FFE85340000-0x00007FFE85E01000-memory.dmpFilesize
10.8MB
-
memory/1604-431-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/1660-480-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/1676-109-0x0000000004DF0000-0x0000000004E26000-memory.dmpFilesize
216KB
-
memory/1676-108-0x0000000004F20000-0x0000000004FB2000-memory.dmpFilesize
584KB
-
memory/1676-72-0x00000000002A0000-0x00000000003E6000-memory.dmpFilesize
1.3MB
-
memory/1676-83-0x0000000004C10000-0x0000000004CAC000-memory.dmpFilesize
624KB
-
memory/1684-453-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/2044-492-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/2108-614-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/2348-336-0x000000000BE90000-0x000000000C19A000-memory.dmpFilesize
3.0MB
-
memory/2348-134-0x0000000000B90000-0x0000000002106000-memory.dmpFilesize
21.5MB
-
memory/2372-918-0x0000000006310000-0x0000000006664000-memory.dmpFilesize
3.3MB
-
memory/2372-113-0x00000000055B0000-0x00000000055E0000-memory.dmpFilesize
192KB
-
memory/2372-84-0x0000000000AB0000-0x0000000000BC4000-memory.dmpFilesize
1.1MB
-
memory/2380-463-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/2492-158-0x0000000006150000-0x00000000061A4000-memory.dmpFilesize
336KB
-
memory/2492-137-0x0000000000220000-0x0000000000444000-memory.dmpFilesize
2.1MB
-
memory/2640-401-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/3184-3-0x000000001CD50000-0x000000001CDF6000-memory.dmpFilesize
664KB
-
memory/3184-0-0x00007FFE87BB5000-0x00007FFE87BB6000-memory.dmpFilesize
4KB
-
memory/3184-2-0x00007FFE87900000-0x00007FFE882A1000-memory.dmpFilesize
9.6MB
-
memory/3184-1-0x00007FFE87900000-0x00007FFE882A1000-memory.dmpFilesize
9.6MB
-
memory/3184-30-0x00007FFE87900000-0x00007FFE882A1000-memory.dmpFilesize
9.6MB
-
memory/3652-442-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/3680-16-0x000000007458E000-0x000000007458F000-memory.dmpFilesize
4KB
-
memory/3680-31-0x0000000000BF0000-0x0000000001B4E000-memory.dmpFilesize
15.4MB
-
memory/4116-421-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/4192-379-0x0000000007C30000-0x00000000082AA000-memory.dmpFilesize
6.5MB
-
memory/4192-366-0x00000000068A0000-0x00000000068D2000-memory.dmpFilesize
200KB
-
memory/4192-452-0x0000000007890000-0x0000000007926000-memory.dmpFilesize
600KB
-
memory/4192-441-0x0000000007680000-0x000000000768A000-memory.dmpFilesize
40KB
-
memory/4192-145-0x00000000029E0000-0x0000000002A16000-memory.dmpFilesize
216KB
-
memory/4192-181-0x0000000005F60000-0x00000000062B4000-memory.dmpFilesize
3.3MB
-
memory/4192-287-0x0000000006830000-0x000000000687C000-memory.dmpFilesize
304KB
-
memory/4192-169-0x0000000005C70000-0x0000000005C92000-memory.dmpFilesize
136KB
-
memory/4192-378-0x00000000074D0000-0x0000000007573000-memory.dmpFilesize
652KB
-
memory/4192-479-0x0000000007810000-0x0000000007821000-memory.dmpFilesize
68KB
-
memory/4192-170-0x0000000005DD0000-0x0000000005E36000-memory.dmpFilesize
408KB
-
memory/4192-286-0x00000000062E0000-0x00000000062FE000-memory.dmpFilesize
120KB
-
memory/4192-380-0x00000000075F0000-0x000000000760A000-memory.dmpFilesize
104KB
-
memory/4192-149-0x0000000005410000-0x0000000005A38000-memory.dmpFilesize
6.2MB
-
memory/4192-171-0x0000000005EF0000-0x0000000005F56000-memory.dmpFilesize
408KB
-
memory/4192-377-0x0000000006800000-0x000000000681E000-memory.dmpFilesize
120KB
-
memory/4192-367-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/4216-381-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/4316-759-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/4532-590-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/4856-946-0x0000000006210000-0x000000000625C000-memory.dmpFilesize
304KB
-
memory/4900-603-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/4948-540-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/5028-613-0x0000000007660000-0x000000000766E000-memory.dmpFilesize
56KB
-
memory/5028-637-0x0000000007750000-0x0000000007758000-memory.dmpFilesize
32KB
-
memory/5028-636-0x0000000007770000-0x000000000778A000-memory.dmpFilesize
104KB
-
memory/5028-625-0x0000000007670000-0x0000000007684000-memory.dmpFilesize
80KB
-
memory/5028-411-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/5280-624-0x0000000005B90000-0x0000000005BE6000-memory.dmpFilesize
344KB
-
memory/5280-600-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/5284-641-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/5320-626-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/5636-651-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/6200-716-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/6316-691-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/6404-529-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/6436-740-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/6536-730-0x000000006E320000-0x000000006E36C000-memory.dmpFilesize
304KB
-
memory/6856-1005-0x0000000000F70000-0x0000000000F98000-memory.dmpFilesize
160KB
-
memory/6996-554-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/7044-565-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/7044-589-0x0000000005270000-0x000000000527A000-memory.dmpFilesize
40KB
-
memory/7148-640-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/7412-663-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/7412-685-0x00000000058A0000-0x00000000058AA000-memory.dmpFilesize
40KB
-
memory/7412-689-0x00000000058B0000-0x00000000058CE000-memory.dmpFilesize
120KB
-
memory/7412-690-0x0000000006510000-0x000000000651A000-memory.dmpFilesize
40KB
-
memory/7920-834-0x00000000004D0000-0x0000000000BFC000-memory.dmpFilesize
7.2MB
-
memory/7920-896-0x0000000006C50000-0x0000000006C68000-memory.dmpFilesize
96KB
-
memory/7960-990-0x00000000060F0000-0x000000000613C000-memory.dmpFilesize
304KB