Overview

overview

10

Static

static

3

Debug/BulbaZ.exe

windows7-x64

8

Debug/BulbaZ.exe

windows10-2004-x64

10

Debug/bin/Xeno.dll

windows7-x64

1

Debug/bin/Xeno.dll

windows10-2004-x64

1

Debug/bin/...64.dll

windows7-x64

1

Debug/bin/...64.dll

windows10-2004-x64

1

Debug/bin/...64.dll

windows7-x64

1

Debug/bin/...64.dll

windows10-2004-x64

1

Debug/bin/xxhash.dll

windows7-x64

1

Debug/bin/xxhash.dll

windows10-2004-x64

1

Debug/bin/zstd.dll

windows7-x64

1

Debug/bin/zstd.dll

windows10-2004-x64

1

Debug/bulba.dll

windows7-x64

1

Debug/bulba.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 17:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Debug/BulbaZ.exe

  • Size

    51KB

  • MD5

    671037658a67820363d670b4e2c3fa17

  • SHA1

    bbae9179361f49ccdccfd4338bb108ffc1d4118a

  • SHA256

    8bd3ee1d96fdfd71f84cdf404bf33d50d1032eb5ae8bbe45da2de693d23bf6dd

  • SHA512

    5d79862596e234349e0fac8b904d23369d0c5b8f2ab958744b320fd0e6f3374def18f812c54f7dc7246c8cc6ed94ff503a6be53311a42fcaa39d6d9adef124eb

  • SSDEEP

    384:3dc83wVFJoJ8nI/SV65XSxbihO2KZYTZbrrNGB5nYLEyw4VmkvwKwq6u7H:Nc8Ebio2JTZimEEh

Score
10/10
dcratxwormdiscoveryexecutioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %Temp%

  • install_file

    svchost.exe

  • pastebin_url

    https://pastebin.com/raw/vJmE27fr

Extracted

Family

xworm

Version

3.0

C2

plus-loves.gl.at.ply.gg:59327

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Detect Xworm Payload 4 IoCs
  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 13 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 14 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 35 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Debug\BulbaZ.exe
    "C:\Users\Admin\AppData\Local\Temp\Debug\BulbaZ.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3644
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2368
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:552
    • C:\Users\Admin\AppData\Local\Temp\BulbaZUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\BulbaZUpdate.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\BulbaZUpdate.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3960
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'BulbaZUpdate.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1924
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:60
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2508
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4916
      • C:\Users\Admin\AppData\Local\Temp\2D2RN1UNCDI59SU.exe
        "C:\Users\Admin\AppData\Local\Temp\2D2RN1UNCDI59SU.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1340
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "2D2RN1UNCDI59SU" /tr "C:\Users\Admin\AppData\Roaming\2D2RN1UNCDI59SU.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2780
      • C:\Users\Admin\AppData\Local\Temp\I488HK10IWGV9ZV.exe
        "C:\Users\Admin\AppData\Local\Temp\I488HK10IWGV9ZV.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe"
          4⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2460
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\HypercomponentCommon\cemEzm0xYx1.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5052
            • C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
              "C:\HypercomponentCommon/hyperSurrogateagentCrt.exe"
              6⤵
              • Modifies WinLogon for persistence
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4756
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wzikpz2l\wzikpz2l.cmdline"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:896
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDDD8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5781E80DFFB04190BDE7548F7372986.TMP"
                  8⤵
                    PID:4128
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\45d1z13y\45d1z13y.cmdline"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5060
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE65.tmp" "c:\Users\Admin\AppData\Roaming\CSCF3BACFCC4A5D475E8488A8E69042ECD7.TMP"
                    8⤵
                      PID:4816
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g4s40hic\g4s40hic.cmdline"
                    7⤵
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:4696
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDF10.tmp" "c:\Windows\System32\CSCA5655F4925F2416A868C2DD74FA372B.TMP"
                      8⤵
                        PID:4132
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\smss.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4508
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3064
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Recent\smss.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3240
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\TrustedInstaller.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:400
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2608
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'
                      7⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4360
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SEB1nXAs61.bat"
                      7⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1924
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        8⤵
                          PID:784
                        • C:\Windows\system32\PING.EXE
                          ping -n 10 localhost
                          8⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:2560
                        • C:\Recovery\WindowsRE\wininit.exe
                          "C:\Recovery\WindowsRE\wininit.exe"
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:524
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2412
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            C:\Users\Admin\AppData\Local\Temp\svchost.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1148
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Downloads\smss.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:2832
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Downloads\smss.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:1724
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\smss.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:3976
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:1128
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:4232
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:456
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Recent\smss.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:3260
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Recent\smss.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:3364
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Recent\smss.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:4740
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 12 /tr "'C:\Users\Public\TrustedInstaller.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:4452
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Users\Public\TrustedInstaller.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:224
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\Users\Public\TrustedInstaller.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:5112
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:3992
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:2108
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:5044
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 12 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:4252
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "hyperSurrogateagentCrt" /sc ONLOGON /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:2460
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 7 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:2088
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            C:\Users\Admin\AppData\Local\Temp\svchost.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4404
            • C:\Users\Admin\AppData\Local\Temp\svchost.exe.exe
              "C:\Users\Admin\AppData\Local\Temp\svchost.exe.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3520
            • C:\Users\Default\Downloads\smss.exe
              "C:\Users\Default\Downloads\smss.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:2372
          • C:\Users\Admin\AppData\Roaming\2D2RN1UNCDI59SU.exe
            C:\Users\Admin\AppData\Roaming\2D2RN1UNCDI59SU.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            PID:3160
            • C:\Users\Default\Downloads\smss.exe
              "C:\Users\Default\Downloads\smss.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4916
            • C:\Users\Admin\AppData\Roaming\2D2RN1UNCDI59SU.exe.exe
              "C:\Users\Admin\AppData\Roaming\2D2RN1UNCDI59SU.exe.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3740
          • C:\Users\Admin\AppData\Roaming\2D2RN1UNCDI59SU.exe
            C:\Users\Admin\AppData\Roaming\2D2RN1UNCDI59SU.exe
            1⤵
            • Executes dropped EXE
            PID:4472
            • C:\Users\Admin\AppData\Roaming\2D2RN1UNCDI59SU.exe.exe
              "C:\Users\Admin\AppData\Roaming\2D2RN1UNCDI59SU.exe.exe"
              2⤵
                PID:3280
              • C:\Users\Default\Downloads\smss.exe
                "C:\Users\Default\Downloads\smss.exe"
                2⤵
                  PID:1928
              • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                C:\Users\Admin\AppData\Local\Temp\svchost.exe
                1⤵
                  PID:4688

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Modify Registry

                2
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Query Registry

                2
                T1012

                Remote System Discovery

                1
                T1018

                System Information Discovery

                2
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe
                  Filesize

                  220B

                  MD5

                  47085bdd4e3087465355c9bb9bbc6005

                  SHA1

                  bf0c5b11c20beca45cc9d4298f2a11a16c793a61

                  SHA256

                  80577e4666fad86273b01f60b8d63c15e4ce37774575ac1e0df7a7c396979752

                  SHA512

                  e74dd8e9756cab1123410a46609dc91540cc29a8fea93017155746f7bb9b7a41bfd3d7595a62788264bedceb475b2a733cce9b70f37cc4478302d5fc228d7684

                  Download Submit

                • C:\HypercomponentCommon\cemEzm0xYx1.bat
                  Filesize

                  105B

                  MD5

                  5ee2935a1949f69f67601f7375b3e8a3

                  SHA1

                  6a3229f18db384e57435bd3308298da56aa8c404

                  SHA256

                  c24a0d7f53a7aa3437f6b6566d3aaebdb36053b64e72cbd1d3796596fc8e3c06

                  SHA512

                  9777fcb9ee8a8aa0c770c835c5f30aff6efc5fb16a1819047e13d580d748703ffcb446db110067fb2546a637213cb8f25416d4b621a95a789b8e113d31d3401a

                  Download Submit

                • C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
                  Filesize

                  1.9MB

                  MD5

                  7be5cea1c84ad0b2a6d2e5b6292c8d80

                  SHA1

                  631e3de0fe83ebacbe5be4e7f895dd0bd8b095ce

                  SHA256

                  6eb90684ebc56fb2713f5c468b55a964625ec2af698d9687492b1de4225693b7

                  SHA512

                  ea58d3b1664fe70968635c2722e19ce65ce4c1d66c68aed2d98441e60e773c7295f18d9c99cf4c454c510f33f5e37d3d2c0053b7434a46c542a0d63a4cc03647

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2D2RN1UNCDI59SU.exe.log
                  Filesize

                  226B

                  MD5

                  28d7fcc2b910da5e67ebb99451a5f598

                  SHA1

                  a5bf77a53eda1208f4f37d09d82da0b9915a6747

                  SHA256

                  2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c

                  SHA512

                  2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                  Filesize

                  2KB

                  MD5

                  750e4be22a6fdadd7778a388198a9ee3

                  SHA1

                  8feb2054d8a3767833dd972535df54f0c3ab6648

                  SHA256

                  26209c196c9c45202d27468ea707b2b46f375bb612d50271924a28f9210df6a1

                  SHA512

                  b0415087dfc32908b449b876b395a607698b0f7b72031916b6fe7c002e4b163ba318b7e85c8ce41f007429e666974c04967bc14345e3f4614e34d94f5c8ae804

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
                  Filesize

                  654B

                  MD5

                  2ff39f6c7249774be85fd60a8f9a245e

                  SHA1

                  684ff36b31aedc1e587c8496c02722c6698c1c4e

                  SHA256

                  e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                  SHA512

                  1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  944B

                  MD5

                  3b444d3f0ddea49d84cc7b3972abe0e6

                  SHA1

                  0a896b3808e68d5d72c2655621f43b0b2c65ae02

                  SHA256

                  ab075b491d20c6f66c7bd40b57538c1cfdaab5aac4715bfe3bbc7f4745860a74

                  SHA512

                  eb0ab5d68472ec42de4c9b6d84306d7bca3874be1d0ac572030a070f21a698432418068e1a6006ff88480be8c8f54c769dee74b2def403f734109dba7261f36b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  944B

                  MD5

                  b51dc9e5ec3c97f72b4ca9488bbb4462

                  SHA1

                  5c1e8c0b728cd124edcacefb399bbd5e25b21bd3

                  SHA256

                  976f9534aa2976c85c2455bdde786a3f55d63aefdd40942eba1223c4c93590db

                  SHA512

                  0e5aa6cf64c535aefb833e5757b68e1094c87424abe2615a7d7d26b1b31eff358d12e36e75ca57fd690a9919b776600bf4c5c0e5a5df55366ba62238bdf3f280

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  944B

                  MD5

                  46bf20e17dec660ef09b16e41372a7c3

                  SHA1

                  cf8daa89a45784a385b75cf5e90d3f59706ac5d5

                  SHA256

                  719589acc67594a2add00dca3c097551163199edbdd59a7f62f783871ef96e17

                  SHA512

                  91225c1aac17fa26ec00913d5e96950ed11d44a1fd28f34a1810fe143176864cf2b9624dc053183d8f28db5a3903c5e092aab180fb21ce2a3775223ee111df54

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  944B

                  MD5

                  c08aea9c78561a5f00398a723fdf2925

                  SHA1

                  2c880cbb5d02169a86bb9517ce2a0184cb177c6e

                  SHA256

                  63d2688b92da4d1bb69980b7998b9be1595dd9e53951434a9414d019c4f825a7

                  SHA512

                  d30db2f55bbda7102ffe90520d233355633313dcc77cdb69a26fdbb56e59dd41793def23d69dc5dc3f94c5bd41d3c26b3628886fd2edbed2df0b332e9a21f95c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  944B

                  MD5

                  2d6baabb78161c2401e97f08de1b3b4e

                  SHA1

                  7bd22cebd5f310d8ac2ef8027caf6a0ec3bf709e

                  SHA256

                  1cea816e9897ec6852edb3671e5a93b05ea817bc969c4d47ee70f5573f95df42

                  SHA512

                  9f35b70cdb0159002143296f11dd22bec6e28836d36bb2ec0527692935cfc3f43df54871a9397bbdf2aaf6912943968310320433ca51a39e360d7227262c754c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  944B

                  MD5

                  0d1b0653effb6a181f44d0111227f620

                  SHA1

                  3254d41e3f1b65868cb8cc5c21121f1e247e7c70

                  SHA256

                  e9b2c5904cca322711aea0c0da3ae8897ad59d7d4d0201b49fa61d2344bf0eac

                  SHA512

                  a504a5c7833a4125fd91070f64a2767017a913df087f94b10329e7c21afa9fa4a6fb1b396bda5a3719a5592cb91ef978523542e1df0f361d3dac4e495838a278

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  944B

                  MD5

                  2dc5265f82001e6c83a3fcb0257d362d

                  SHA1

                  dac0a408dd61c7e23ab7f798ca6a4c8dd2f3a170

                  SHA256

                  70e34783cb327c2d69ef3bd579438bbaaf4e8c72d11b561033c1c7fc04434e58

                  SHA512

                  815ea7d4b10910a31bb31f37cf5b0339eb52b8924a410560254fcb897ebc14df6c142aebc536b0434cbe6f24388fc527387939813e1c6cff9af9bf0dbcbe98b7

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  944B

                  MD5

                  eb1ad317bd25b55b2bbdce8a28a74a94

                  SHA1

                  98a3978be4d10d62e7411946474579ee5bdc5ea6

                  SHA256

                  9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

                  SHA512

                  d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  944B

                  MD5

                  10890cda4b6eab618e926c4118ab0647

                  SHA1

                  1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

                  SHA256

                  00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

                  SHA512

                  a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  944B

                  MD5

                  ce4540390cc4841c8973eb5a3e9f4f7d

                  SHA1

                  2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

                  SHA256

                  e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

                  SHA512

                  2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\2D2RN1UNCDI59SU.exe
                  Filesize

                  185KB

                  MD5

                  e0c8976957ffdc4fe5555adbe8cb0d0c

                  SHA1

                  226a764bacfa17b92131993aa85fe63f1dbf347c

                  SHA256

                  b8260ac46e03f2a7baa9ae01bee5443d16d9eb96f6ee8588a887d6de72a750d4

                  SHA512

                  3a1ea48e81ebfd5586938a72afd68bcc48d4c5d69949cfdacf33aee3371d98f202443f5db12bac876ca7cecc982ddc56827f8d9b1857d22bda71242d5b2cc71e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\BulbaZUpdate.exe
                  Filesize

                  73KB

                  MD5

                  d6e46bbc2d5aff61a5a6ef1e9622cd74

                  SHA1

                  07df7137ffd475f77bdbdc6c25e9a17d41807bc0

                  SHA256

                  337d1a295dc78a08800cbb19f8dcb563218eb0a89819282384990f6a8fe305be

                  SHA512

                  d0ae2166d11c683e14db1149a3f498a4868442fad08384440dcdccc18c0110f295307e3d41885b8b540c1c964d4e6db102fb6b014b3a7cf64d8b2dadb075638f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\I488HK10IWGV9ZV.exe
                  Filesize

                  2.2MB

                  MD5

                  05d87a4a162784fd5256f4118aff32af

                  SHA1

                  484ed03930ed6a60866b6f909b37ef0d852dbefd

                  SHA256

                  7e3d0dabaded78094abfac40d694eaebf861f3cb865d3835bb053d435e996950

                  SHA512

                  3d4ce511e9671d8bfa15e93d681fedd972f4fe4c09ac9cfd9653afe83e936654c88ee515a76e7ac80e8f34868802e68c6531fdea0b718029d2196ad1425981fc

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\RESDDD8.tmp
                  Filesize

                  1KB

                  MD5

                  0d444a8dd31797723953b6cca7516c40

                  SHA1

                  2bf0f6bdfb3da7507de5171e096e3a4c29edf1f8

                  SHA256

                  262862e30e2ecdf11b2e741fed814e37e0aab33fa4508e3fc4c182611ffa0e51

                  SHA512

                  c812edfc8bb966d06c87b7fed1224b8ebe1c209722d82b89a9c999343099f43167e1b6d4f59578bb1e498efd32d02d57cd92ac6e4d62af3e375ddca09279fd5a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\RESDE65.tmp
                  Filesize

                  1KB

                  MD5

                  cf07765f3fcab4f91be70a75c71b09bf

                  SHA1

                  2656f1959dea1e64ef5e2438d77d45231b0fa3f1

                  SHA256

                  0b012274688f7c2df5fc41a36be83d1d18bbde29f90c64b4a98b5069b71571bb

                  SHA512

                  fd1d7ddb196fbc95db589b5059049248c2ab3d10c8c9fb2e493b7a3375b96676d8123aa0c01c29d6ca9c558059ec4d7d2aeb9cb46812be81e633fc6c4c90dbc1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\RESDF10.tmp
                  Filesize

                  1KB

                  MD5

                  63ba75391b0303d812183009a2c6f903

                  SHA1

                  cf1d882d032b2efe4109a573b79d66f61c4c8e2f

                  SHA256

                  d802c51b6eb86dae79dad407d10fdea865940174a3db52931c9adae5df3677c7

                  SHA512

                  0eeb7af3e51cf2e15b6e1d7ad8e3c8a9f5a8ac229e36fee22f44381316907b4826fe1d2746ed3d29eea83bba8b71a743939c3432ddfddd91d9aa138736bd3b3b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\SEB1nXAs61.bat
                  Filesize

                  161B

                  MD5

                  6264edec99da8359ff0295c3fcb3bff1

                  SHA1

                  f9c6d911a1b6969004abd5090f0766f0a413e186

                  SHA256

                  c08f762c2e5a60f6dc3291fa9a22d266b8bbbc033513243a61756ccb85714abf

                  SHA512

                  31618002171c6e9e662c6ce6d9a07d8bc8fd4dbfa850de560c5087c99b33d49bd1bc9c15cb2ebdf356f703eeabd517ef74fc5451043cb95a1ebad1bfecd15691

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3efjghuc.xjj.ps1
                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                  Filesize

                  4KB

                  MD5

                  103ed5522e02a68f2ac1b92c0785e4a6

                  SHA1

                  04c8a8e82371f5632378cdb1f8bec9952f81ae87

                  SHA256

                  35864b16834f10cef6ff472bc7be369fa0c155adea200202005a5d52dbc090ab

                  SHA512

                  36d497a7de42e2986fc0fc795379af16e867142489d865c8234dc17b576aaf6cb3b6aa54159b68e0c4821fda196e07802939bb5a04e42ad9a9f34394ccb18545

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\2D2RN1UNCDI59SU.exe
                  Filesize

                  4KB

                  MD5

                  4cb9dfd2ddee2a82c848f6c411a56e49

                  SHA1

                  fcef984213c1773501b790e900c51466284dd7d9

                  SHA256

                  2e95e94a0638e7cd781e2d5e2117de36ca7972d8e7776a06d971cf25ccc2d762

                  SHA512

                  bde957116db7a04847e5db437dff71198b1b3d3d186bbc3a5d52c0594b10f33758ce65bb60a13296b5b09979137f652192a7f3f1cb7acbf539fe17f341da2919

                  Download Submit

                • C:\Users\Default\Downloads\smss.exe
                  Filesize

                  5KB

                  MD5

                  84b5898c5da2fc5a924f77fdb56f5ed3

                  SHA1

                  f3eb37476b1b97ae9642ee96b9206c81cd62d0a1

                  SHA256

                  262770048d7828fd13394b423c7ab2e7578d381d5126aefc4e2265a26e0c6a67

                  SHA512

                  92e585bbbde43554e827a55a2c64d3bcd4fe04f926fcf234666a4bd778cdc4afcdc5afbc1e4757d299e53f4776e4c75932522b6c9a0f008feca103339de90645

                  Download Submit

                • \??\c:\Users\Admin\AppData\Local\Temp\45d1z13y\45d1z13y.0.cs
                  Filesize

                  387B

                  MD5

                  71732e1cda604b0a483a87e0e45fc175

                  SHA1

                  08e3283025bba042eb405ffa570ae889a082f9a2

                  SHA256

                  d9f5015c3c385463e6cc877a77d056f731d76ed12a1af7df3bec2e0ad30d7e4f

                  SHA512

                  8f0649bb8b818ddcf03b9c3a2ea344b12cf9202a7b613c9e3a71d652f2f2f987698232779f6872d9e5ffc896b241734d86d62b06048cea162901f7fd5479dc18

                  Download Submit

                • \??\c:\Users\Admin\AppData\Local\Temp\45d1z13y\45d1z13y.cmdline
                  Filesize

                  255B

                  MD5

                  9e5f0fbcfcf5b0e14e74c05fa6316163

                  SHA1

                  ec2f9d7f71c213ccc534a763a04743b0e1242e29

                  SHA256

                  70685c3a0aa3ebb668e5a1fa20b6a4249eb10e3ccbad17b51da5f578cea338b0

                  SHA512

                  ba0ae011947b8ed1f30e7c045fa8f3c21388d65143af85396aadda1fbdbc9def283c69abaa44aacdd14650f5e334d21a38adc370e433a3a3ab91367a2193b17b

                  Download Submit

                • \??\c:\Users\Admin\AppData\Local\Temp\CSC5781E80DFFB04190BDE7548F7372986.TMP
                  Filesize

                  1KB

                  MD5

                  b10290e193d94a5e3c95660f0626a397

                  SHA1

                  7b9de1fd7a43f6f506e5fc3426836b8c52d0d711

                  SHA256

                  75c9e1766bfb99754b6a00d37ef93488ab216b5ac48984ed7d9d2076a7056fd2

                  SHA512

                  6ae4201552a499eaa726416b29230f48d94ac7f40ff038165bf8582626bbefe601ef6c051ad97d9156dc4b9b55fd22081db61bcd013916136340c5f1324e4bb5

                  Download Submit

                • \??\c:\Users\Admin\AppData\Local\Temp\g4s40hic\g4s40hic.0.cs
                  Filesize

                  367B

                  MD5

                  fed0f6a92c29669dad3fc5f96ed4ecbd

                  SHA1

                  e2865d642495c55268d0c8373be1e35b362ffa09

                  SHA256

                  b7bc71f7a37ef5a9365a091856b5a299dc85d68b46c04f595cba704fefb70797

                  SHA512

                  a78d6c1ef779369e4e4ea2e1f6eae0a6da6cf28589ad602520bc2a4e356915fc5276cbf018d9f9adf874b6edf212ddbd9612ce4b77239960345994d02a42bba8

                  Download Submit

                • \??\c:\Users\Admin\AppData\Local\Temp\g4s40hic\g4s40hic.cmdline
                  Filesize

                  235B

                  MD5

                  e5df960c5e97e2da4ff0da2c0d46e69b

                  SHA1

                  f0f37959db57b21002d92d52f78c0f0748f0533c

                  SHA256

                  7125307770b695cb435c2bbfbeba9875751e3a89984adedcc8dd4996e12018ec

                  SHA512

                  71c1ff23a0e6c87fa1e0402ca41a905501b15d54f9ad15e3311daa320b630893c43faa2883aaaba88e1efff9806fb0ca46eb8a0697031ba0607957c7bd7d4dcd

                  Download Submit

                • \??\c:\Users\Admin\AppData\Local\Temp\wzikpz2l\wzikpz2l.0.cs
                  Filesize

                  382B

                  MD5

                  ddb3eab7f580159da4a5907a4e78242f

                  SHA1

                  8c8c93c1dd10ed4a6e127fd2b07da2e745aa0f69

                  SHA256

                  3cd19bc5594f1ea0f8392f58991ff486e1e0c9c7103759056b737f66b92eedc0

                  SHA512

                  49a4aded4787f9dac8edfe3813e22b715f348f85750db764542cabdd4f7af296ad818212c3f8e11c4de2c423b1e96cac48690554971e50d3191b84fa1fa8c7ba

                  Download Submit

                • \??\c:\Users\Admin\AppData\Local\Temp\wzikpz2l\wzikpz2l.cmdline
                  Filesize

                  250B

                  MD5

                  2f0a8d6239dfe29fb18ac3a3ea6e4e71

                  SHA1

                  63e458a89c27dd5a32fb6fa67ca51cb504281d4a

                  SHA256

                  140faad46a92ec9d8e895e9abda5b0aa08695764f5b24475a6e5ad41fd4a2641

                  SHA512

                  546d92d4c8a1df2dbc5506d4278cde6bf30708e2b0874883ed1c895b9d568ea9e4ed479f0447782c51f7c3d543e423c0ae014417f9a1e8fb1f0eea29c364807c

                  Download Submit

                • \??\c:\Users\Admin\AppData\Roaming\CSCF3BACFCC4A5D475E8488A8E69042ECD7.TMP
                  Filesize

                  1KB

                  MD5

                  32fab2bc4d201b74a55e4fa3e337410d

                  SHA1

                  473b09d6086c0f70274754039e919560805ae797

                  SHA256

                  762affe7877b205ca49ded7a7b383194d27fda1e64d34c330ab393afa947eea3

                  SHA512

                  7864222bdab1c4390de6c219b6aae9b5e4d863f612ef7b90998d1b53575040e65e9197a59247e2ccfbc31f5fbb6407a106d377b5fec85e48e7314a1553b28786

                  Download Submit

                • \??\c:\Windows\System32\CSCA5655F4925F2416A868C2DD74FA372B.TMP
                  Filesize

                  1KB

                  MD5

                  1c519e4618f2b468d0f490d4a716da11

                  SHA1

                  1a693d0046e48fa813e4fa3bb94ccd20d43e3106

                  SHA256

                  4dbf16e3b3bb06c98eeaf27d0a25d9f34ee0ceac51e6365218ef7cd09edb3438

                  SHA512

                  99f293878a08b56db6ff2297f243f5f5b85864e6925a1d6af61a65369f7eb323ae1b75fe5f1465fac0b982ac9f49b9e0a295b5dac947da40f61991c4411233fd

                  Download Submit

                • memory/1340-123-0x0000000000BE0000-0x0000000000C14000-memory.dmp

                  Filesize

                  208KB

                  Download

                • memory/1668-47-0x0000000000150000-0x0000000000168000-memory.dmp

                  Filesize

                  96KB

                  Download

                • memory/1668-111-0x00000000020E0000-0x00000000020EC000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/2368-6-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/2368-19-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/2368-16-0x000002569EC90000-0x000002569ECB2000-memory.dmp

                  Filesize

                  136KB

                  Download

                • memory/2368-23-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/2368-17-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/3160-293-0x0000000000450000-0x0000000000458000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/3644-5-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/3644-1-0x000001AA24D70000-0x000001AA24D82000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/3644-0-0x00007FFA89BB3000-0x00007FFA89BB5000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/3644-20-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/3644-2-0x000001AA25150000-0x000001AA25158000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/3644-18-0x00007FFA89BB3000-0x00007FFA89BB5000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/3644-3-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/3644-59-0x00007FFA89BB0000-0x00007FFA8A671000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4404-287-0x0000000000CE0000-0x0000000000CE8000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/4756-163-0x000000001B2F0000-0x000000001B2FE000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/4756-154-0x0000000000600000-0x00000000007E6000-memory.dmp

                  Filesize

                  1.9MB

                  Download

                • memory/4756-159-0x000000001C060000-0x000000001C0B0000-memory.dmp

                  Filesize

                  320KB

                  Download

                • memory/4756-161-0x000000001C010000-0x000000001C028000-memory.dmp

                  Filesize

                  96KB

                  Download

                • memory/4756-156-0x000000001B2E0000-0x000000001B2EE000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/4756-158-0x000000001BFF0000-0x000000001C00C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/4756-165-0x000000001B300000-0x000000001B30C000-memory.dmp

                  Filesize

                  48KB

                  Download