raccoon | fac9410d22c0e26ebfb6aa70649656a38685924cfb37638f95f35eb46b0cb71a

Analysis

max time kernel
156s
max time network
139s
platform
windows7_x64
resource
win7v20201028
submitted
22-03-2021 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f400dab915cf4b65ce4a277f93b1fc7b.exe
Size

71KB
MD5

f400dab915cf4b65ce4a277f93b1fc7b
SHA1

f7d567c105c6ccec41b087699b786538d6a6cfdc
SHA256

fac9410d22c0e26ebfb6aa70649656a38685924cfb37638f95f35eb46b0cb71a
SHA512

f6595129735fb87e85197e3a3a76070d206a6979de167430e7c8ecd72de1705bffac922dc9899baf90855381187762d084cdc7e1fedbfe0ae349b67461469165

Score

10^/10

raccoon 2ce901d964b370c5ccda7e4d68354ba040db8218 c46f13f8aadc028907d65c627fd9163161661f6c persistence stealer

Malware Config

Extracted

Family

raccoon

Botnet

c46f13f8aadc028907d65c627fd9163161661f6c

Attributes

url4cnc
https://telete.in/capibar

rc4.plain

Extracted

Family

raccoon

Botnet

2ce901d964b370c5ccda7e4d68354ba040db8218

Attributes

url4cnc
https://telete.in/tomarsjsmith3

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Executes dropped EXE 9 IoCs

Processes:

2hc36h6KHgiFjGGfAF0W49nI.exe39238314794.exe74550458142.exe39238314794.exe39238314794.exe3U4maJwq4ruChECKgyZbXC8s.exeVMYsiEBUWmw073PkMnvcWhMK.exe1JB2DyuZKrOwxXO70N46JWYe.exeQf8ujhuK76F7ioYJ90KCF5c1.exe

pid	process
1824	2hc36h6KHgiFjGGfAF0W49nI.exe
1976	39238314794.exe
820	74550458142.exe
1412	39238314794.exe
1976	39238314794.exe
1804	3U4maJwq4ruChECKgyZbXC8s.exe
972	VMYsiEBUWmw073PkMnvcWhMK.exe
2016	1JB2DyuZKrOwxXO70N46JWYe.exe
568	Qf8ujhuK76F7ioYJ90KCF5c1.exe

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 18 IoCs

Processes:

f400dab915cf4b65ce4a277f93b1fc7b.execmd.exe39238314794.execmd.exe39238314794.exeWerFault.exe

pid	process
1056	f400dab915cf4b65ce4a277f93b1fc7b.exe
1056	f400dab915cf4b65ce4a277f93b1fc7b.exe
680	cmd.exe
680	cmd.exe
1976	39238314794.exe
896	cmd.exe
896	cmd.exe
1412	39238314794.exe
1056	f400dab915cf4b65ce4a277f93b1fc7b.exe
1056	f400dab915cf4b65ce4a277f93b1fc7b.exe
1056	f400dab915cf4b65ce4a277f93b1fc7b.exe
1056	f400dab915cf4b65ce4a277f93b1fc7b.exe
1056	f400dab915cf4b65ce4a277f93b1fc7b.exe
1056	f400dab915cf4b65ce4a277f93b1fc7b.exe
2236	WerFault.exe
2236	WerFault.exe
2236	WerFault.exe
2236	WerFault.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f400dab915cf4b65ce4a277f93b1fc7b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\mCSVf9LHgJGm4cihEg5yyv4BcNYbppC1 = "C:\\Users\\Admin\\Documents\\EYqieqvSX1iHwckzmjYcUMXw.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\wPo7kaBGmfjnQJgEbKraj41CEoKZupeR = "C:\\Users\\Admin\\Documents\\BzPUu5fwTw1a3yY8e8vk1tmF.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\haRICi7i8QtmPUiggbXTZPIkUjcP32j4 = "C:\\Users\\Admin\\Documents\\ZEvzGGiR21RVataud5g9HeqE.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\hvbEGyzgKez7y0QHPPPg7n58SpfcUiaN = "C:\\Users\\Admin\\Documents\\qQYWtIyBsSyWnwR2CibwBd7i.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\FPVbEw8lJnLEso2Hb7RLnPR5NbPdZNCW = "C:\\Users\\Admin\\Documents\\UJMkWnS4LiBnFvfoBcIhU7qI.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\YlN7U935XH14OicaIG6x8MHhaeiKoGfU = "C:\\Users\\Admin\\Documents\\elDR7kr9wIgIqLVPwZE0kKFD.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\QotxhAoyIuFUgByVmBQGI8fdaa6Z30FH = "C:\\Users\\Admin\\Documents\\XdfGcalVKpbK0JGplw7MOPEB.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\QUqpFH5KnaevQ39X5yiHHnFLzepaTaex = "C:\\Users\\Admin\\Documents\\QY41MShHYgvOLV6PT7slvdDc.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\mdYWRCUPXoApJqkmq1VMwGJ83ikWEKmH = "C:\\Users\\Admin\\Documents\\sAhcPS1f9Z7Z2BTrpK2P2khP.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MGXTZWsjet2XLVFbXfVjY3XA8I1YRVFk = "C:\\Users\\Admin\\Documents\\b2GQjEE2qB8ocLxXjjQrq0I4.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\u1WXku7bUV4FV4vwQmSAbfDrdsqUCPAw = "C:\\Users\\Admin\\Documents\\y1tHHLpC3NcdjN89YkcSeBJi.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\spYgFJgOq92FWj8TJRj2YHCv0jilWw7G = "C:\\Users\\Admin\\Documents\\iQ3PsOinzEBQOANsgWY3Rbzt.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\DRqsRJ7GBooKjEhJotFymL6H3sesiQ6G = "C:\\Users\\Admin\\Documents\\kIG6dJ1i8WEosFb6mBMkZeJb.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\3oTpoAY2PepYCtwXvRv3wFjXliTpH2YK = "C:\\Users\\Admin\\Documents\\QtFUFw1qG98Nx5GfMrElKGNd.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\m2r3Wd5UJ19StR1eWphVHWWrS9CsDf5O = "C:\\Users\\Admin\\Documents\\MgdAgpL1AbuRNRlACx59d8iN.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\OlWOxqg1F5JTLCIFEPFHHmG7IUyFL93E = "C:\\Users\\Admin\\Documents\\gOJeyvSUByBPfxDKmXLGQbHq.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\tXVReTSJoRo9RmumCBPAsori6n4dB4FK = "C:\\Users\\Admin\\Documents\\tMEdrvdUTYKsSZLOeyTKfjfT.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\9ZII6nTypuFouNb0KZH4K7yTSYq95Pye = "C:\\Users\\Admin\\Documents\\FJMFblAZeefeveXUYtMhol0u.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\4NLQCSxgSsGNd3p7Kno4Sw0b4Kagcelb = "C:\\Users\\Admin\\Documents\\qLnVh4VGY4Nq77Z6lXK6nOm7.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\VSAUAV1t4jI92ZHk7QD9hGU3tVgOdBTm = "C:\\Users\\Admin\\Documents\\nf7xngb2qSwHibBx59ajVAZF.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\wLP0Nt2sscxx2H9VSKekWvstX2QK2pFF = "C:\\Users\\Admin\\Documents\\ZhpnSmcNxAApeuGys7PIATzs.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\szUGpgsCSXBsBAgCPEImrBHWijGami9Z = "C:\\Users\\Admin\\Documents\\Wr35C24Qse8tvbqAR0su16W2.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\rXPujK7VP3nNPgTiP1NmFRyxrkwqwd82 = "C:\\Users\\Admin\\Documents\\C4WOjIfvbIGjI9akfOW6PKAg.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\TWqWwgJyF8n3qyXz4UBoEgSYLlgmGDU9 = "C:\\Users\\Admin\\Documents\\TNRTwteDQJgyqvJSoUeNAUID.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\A2yc640jUsI6TvJFLpFGBAUdDsxXqaFF = "C:\\Users\\Admin\\Documents\\G3IJ9p0HLX3aOuB4ORLvGARh.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\vXMDOg1cedvzxmwTorW9VguPktx4B5rQ = "C:\\Users\\Admin\\Documents\\vvh2Wzh5nt4hsTaBbMUSffzg.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\2moTg3MkC8ZoCouPanXlwSwCwIdFl88p = "C:\\Users\\Admin\\Documents\\xlSCtIJqJcxl1DqzEOjMAH6N.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\c6vVSq2GmeyKU0jX3Y66Za4lOe1Stwwp = "C:\\Users\\Admin\\Documents\\EkzQXodzdZ2d5gY1V3iBSY2U.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\UoqrOg4POQw9YdrvGy2ocYZ7cT3Sceke = "C:\\Users\\Admin\\Documents\\xqK1Oeg34ysNF94J8XN0fSnL.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaC6STRiazbHqx6p0PMzvhjPQauNuAfn = "C:\\Users\\Admin\\Documents\\krDMljjYvR2p2C1JcmZh17IS.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\90Rd6vYtPfkySyHtUK5mg2JUbQROk7R6 = "C:\\Users\\Admin\\Documents\\m3dY6uLl5655iRRbMmnUKpD3.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\wN6tCvo9Csa2IAPBLTpJQCS7MBAdLhzH = "C:\\Users\\Admin\\Documents\\gwnjVOHaDr626nuYiB3qiYbn.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\2NNuABZZ0jDKgxMvHPOnfxg1iHL6Fjpq = "C:\\Users\\Admin\\Documents\\0Az3TrJJZ3W3FdXHUZLI6JUd.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jod3GOmcWDY7EN3btnReE5LHgPQ7XXFf = "C:\\Users\\Admin\\Documents\\mEaMKST6OrkA67uIqT6MkGdK.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\6dXqVjH1pIZRPhX7dz5qM3UZhtHsbsKu = "C:\\Users\\Admin\\Documents\\tCyGRT4BQXdEa9ZTjE9Nn9f7.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xs2IeNxwyThXCEkULfqCCAUD0wNFbo9N = "C:\\Users\\Admin\\Documents\\1DrmVYN0n4X0Tg0ghhD4enpu.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\8Yf6Dz5ScYA7DdOgHBnRYVIEwZ0a4WQJ = "C:\\Users\\Admin\\Documents\\v5bQT9k6J5SpWTRgt92LPmEN.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZnPRgPtOHt9782974WyIr3lvIO5rHInm = "C:\\Users\\Admin\\Documents\\04JsNdUgnuIA31i3bNcDwOYZ.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\59xei8zdyFkium49koifODrjfoT19e2x = "C:\\Users\\Admin\\Documents\\fyZBMJVRtPk2SgH6An5Y4rlB.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\F3uOeGgiGRPbQz3tUAmnT5rWyx43wYsh = "C:\\Users\\Admin\\Documents\\TdpUYxTmP3rCGQps7ZY4zv3i.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\6luvUPdBfttj0g5EvbTHTAOEqPek8WyO = "C:\\Users\\Admin\\Documents\\in9vPfCx5mK51jjbZ76flU3m.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\VjzjpPiurhM4LWrfdQZoh1qmV5OgVRrm = "C:\\Users\\Admin\\Documents\\8p3LcIQyY8nEbRXidC5pYVy2.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\O1ZqlRiGdNBI7U8ae7dec7d6eQRiwx84 = "C:\\Users\\Admin\\Documents\\L5dPwHjpq9I0riUn68L9qRbG.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\XOYXSrTH86Tk4RMiRI5evsQ8jdOD8iiX = "C:\\Users\\Admin\\Documents\\RGFp1QjIFnR2SYpJjTmE14q4.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\eMpAlFL29Cg4bqce9xTiEk7jK3nfwZ75 = "C:\\Users\\Admin\\Documents\\LsYnz98pT8kX9zE6pB7oOQsw.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\5yPHWjLnpxKWx5YSQb6tS2aHAKMayoe0 = "C:\\Users\\Admin\\Documents\\6wvuXN1LAfZ3ae3grCPmkF6T.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\6Z2TE2gIs7LCztAiOZn8HnMbRHkM0JhW = "C:\\Users\\Admin\\Documents\\1g79me3oRRZkmDFq2cKo7e5P.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\nWVwoO3d5ZNXufqSGVUDsSew8xfi8TwC = "C:\\Users\\Admin\\Documents\\HNJMuoawEqTxT1NfBdjFIEgJ.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MDD1zvhbCWhRrdW5SSYO04nfkJ5cWU6K = "C:\\Users\\Admin\\Documents\\av2zZ2pz59xAAeES6V7QVQ41.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\NmrnXx9NjAWLmkHC9uKWX6OqTZo3gY8d = "C:\\Users\\Admin\\Documents\\ppKg0Qf41hxAw7RlePMB3M0u.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\RrycGrpFryOiD2rGMEZq19kfDT23Z3xA = "C:\\Users\\Admin\\Documents\\XqRpzZPT3sXJ9yfJXAdqHXpS.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\LUHAefvfYKqkSOreDgJrwZavSb2dM2tu = "C:\\Users\\Admin\\Documents\\693BBCjpqs4kgoNh5LC52Mx7.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\X0e8T9zT9hZxJ56ru9SaTjTXGv2BPrA7 = "C:\\Users\\Admin\\Documents\\b9KbTO1BzABYPeCh6X9HOdop.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\5Z9O7rN44hisHF11gxsJqvT2O76cNbig = "C:\\Users\\Admin\\Documents\\CsfMhBZ383D1MUZu8bJv8gJa.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\4n86LQtB9aQ91OAD2EONtamwQEiV9egQ = "C:\\Users\\Admin\\Documents\\Dr0nUtL6tn5UI4Kmew29MwOW.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\oXT4WmUWEDWyvR2P8q45pAM7lMSbc4lx = "C:\\Users\\Admin\\Documents\\ifBjRRWNuemgmYDTfRm2xux6.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Obmy0ywEqSNmxHcUyVRUu6D0HHXCSs7I = "C:\\Users\\Admin\\Documents\\7LoybdvoMzHeQv2utlfDlzG8.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\zEXu90AniAzlIGeoLesMeHRnlrv1hdDp = "C:\\Users\\Admin\\Documents\\IiZzFd892M5wDNvABUwy6dzl.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\bzoiT340WGs9W8ag2ltS9F8D19BbxUor = "C:\\Users\\Admin\\Documents\\kiYDn72Mo9zN8V9F8FFmG3Rj.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\9XETxgbf8cZ9PrerLfB7ZXgN0ed0rF1W = "C:\\Users\\Admin\\Documents\\YRJhj4Cp9aH59xPPMFBAbCM4.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\iuZ5tFUdpVNWgS0ZBzFs6eVysvuUkt7F = "C:\\Users\\Admin\\Documents\\vYmmBXgbEGmLd4h1hmzFqp3B.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\maXByRB5nMcyCuXbTd4V37GZBZRekD5T = "C:\\Users\\Admin\\Documents\\LDNJinmQhABdOoupzwzFw2CW.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\98S8sl2EhJVGgPvqyrr1kRODrtnYpP2I = "C:\\Users\\Admin\\Documents\\06YNVCFm4pNWeJ4dmnR8lsD0.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\eWgkR11iVrSrRkukXqEQZkj863hzB8Jf = "C:\\Users\\Admin\\Documents\\VW3MeertPNwq6kfzx4031zIl.exe"	f400dab915cf4b65ce4a277f93b1fc7b.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

Processes:

39238314794.exe39238314794.exe

description	pid	process	target process
PID 1976 set thread context of 1412	1976	39238314794.exe	39238314794.exe
PID 1412 set thread context of 1976	1412	39238314794.exe	39238314794.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2236 1976 WerFault.exe 39238314794.exe

pid	pid_target	process	target process
2236	1976	WerFault.exe	39238314794.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

74550458142.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	74550458142.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	74550458142.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1172 taskkill.exe

pid	process
1172	taskkill.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

2hc36h6KHgiFjGGfAF0W49nI.exe39238314794.exef400dab915cf4b65ce4a277f93b1fc7b.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2hc36h6KHgiFjGGfAF0W49nI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	39238314794.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	39238314794.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	f400dab915cf4b65ce4a277f93b1fc7b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	f400dab915cf4b65ce4a277f93b1fc7b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	2hc36h6KHgiFjGGfAF0W49nI.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2236 WerFault.exe
2236 WerFault.exe
2236 WerFault.exe
2236 WerFault.exe
2236 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

f400dab915cf4b65ce4a277f93b1fc7b.exe

pid process

1056 f400dab915cf4b65ce4a277f93b1fc7b.exe

pid	process
2236	WerFault.exe
2236	WerFault.exe
2236	WerFault.exe
2236	WerFault.exe
2236	WerFault.exe

Suspicious behavior: LoadsDriver 6 IoCs

Processes:

Qf8ujhuK76F7ioYJ90KCF5c1.exe1JB2DyuZKrOwxXO70N46JWYe.exe

pid	process
568	Qf8ujhuK76F7ioYJ90KCF5c1.exe
568	Qf8ujhuK76F7ioYJ90KCF5c1.exe
568	Qf8ujhuK76F7ioYJ90KCF5c1.exe
2016	1JB2DyuZKrOwxXO70N46JWYe.exe
2016	1JB2DyuZKrOwxXO70N46JWYe.exe
2016	1JB2DyuZKrOwxXO70N46JWYe.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

f400dab915cf4b65ce4a277f93b1fc7b.exetaskkill.exeQf8ujhuK76F7ioYJ90KCF5c1.exe1JB2DyuZKrOwxXO70N46JWYe.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe
Token: SeDebugPrivilege	1172	taskkill.exe
Token: SeLoadDriverPrivilege	568	Qf8ujhuK76F7ioYJ90KCF5c1.exe
Token: SeLoadDriverPrivilege	568	Qf8ujhuK76F7ioYJ90KCF5c1.exe
Token: SeLoadDriverPrivilege	568	Qf8ujhuK76F7ioYJ90KCF5c1.exe
Token: SeLoadDriverPrivilege	2016	1JB2DyuZKrOwxXO70N46JWYe.exe
Token: SeLoadDriverPrivilege	2016	1JB2DyuZKrOwxXO70N46JWYe.exe
Token: SeLoadDriverPrivilege	2016	1JB2DyuZKrOwxXO70N46JWYe.exe
Token: SeDebugPrivilege	2236	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f400dab915cf4b65ce4a277f93b1fc7b.exe2hc36h6KHgiFjGGfAF0W49nI.execmd.exe39238314794.execmd.execmd.exe39238314794.exe

description	pid	process	target process
PID 1056 wrote to memory of 1824	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	2hc36h6KHgiFjGGfAF0W49nI.exe
PID 1056 wrote to memory of 1824	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	2hc36h6KHgiFjGGfAF0W49nI.exe
PID 1056 wrote to memory of 1824	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	2hc36h6KHgiFjGGfAF0W49nI.exe
PID 1056 wrote to memory of 1824	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	2hc36h6KHgiFjGGfAF0W49nI.exe
PID 1824 wrote to memory of 680	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 1824 wrote to memory of 680	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 1824 wrote to memory of 680	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 1824 wrote to memory of 680	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 680 wrote to memory of 1976	680	cmd.exe	39238314794.exe
PID 680 wrote to memory of 1976	680	cmd.exe	39238314794.exe
PID 680 wrote to memory of 1976	680	cmd.exe	39238314794.exe
PID 680 wrote to memory of 1976	680	cmd.exe	39238314794.exe
PID 1824 wrote to memory of 896	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 1824 wrote to memory of 896	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 1824 wrote to memory of 896	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 1824 wrote to memory of 896	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 1976 wrote to memory of 1412	1976	39238314794.exe	39238314794.exe
PID 1976 wrote to memory of 1412	1976	39238314794.exe	39238314794.exe
PID 1976 wrote to memory of 1412	1976	39238314794.exe	39238314794.exe
PID 1976 wrote to memory of 1412	1976	39238314794.exe	39238314794.exe
PID 1976 wrote to memory of 1412	1976	39238314794.exe	39238314794.exe
PID 1976 wrote to memory of 1412	1976	39238314794.exe	39238314794.exe
PID 1976 wrote to memory of 1412	1976	39238314794.exe	39238314794.exe
PID 1976 wrote to memory of 1412	1976	39238314794.exe	39238314794.exe
PID 1976 wrote to memory of 1412	1976	39238314794.exe	39238314794.exe
PID 1976 wrote to memory of 1412	1976	39238314794.exe	39238314794.exe
PID 896 wrote to memory of 820	896	cmd.exe	74550458142.exe
PID 896 wrote to memory of 820	896	cmd.exe	74550458142.exe
PID 896 wrote to memory of 820	896	cmd.exe	74550458142.exe
PID 896 wrote to memory of 820	896	cmd.exe	74550458142.exe
PID 1824 wrote to memory of 1004	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 1824 wrote to memory of 1004	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 1824 wrote to memory of 1004	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 1824 wrote to memory of 1004	1824	2hc36h6KHgiFjGGfAF0W49nI.exe	cmd.exe
PID 1004 wrote to memory of 1172	1004	cmd.exe	taskkill.exe
PID 1004 wrote to memory of 1172	1004	cmd.exe	taskkill.exe
PID 1004 wrote to memory of 1172	1004	cmd.exe	taskkill.exe
PID 1004 wrote to memory of 1172	1004	cmd.exe	taskkill.exe
PID 1412 wrote to memory of 1976	1412	39238314794.exe	39238314794.exe
PID 1412 wrote to memory of 1976	1412	39238314794.exe	39238314794.exe
PID 1412 wrote to memory of 1976	1412	39238314794.exe	39238314794.exe
PID 1412 wrote to memory of 1976	1412	39238314794.exe	39238314794.exe
PID 1412 wrote to memory of 1976	1412	39238314794.exe	39238314794.exe
PID 1412 wrote to memory of 1976	1412	39238314794.exe	39238314794.exe
PID 1412 wrote to memory of 1976	1412	39238314794.exe	39238314794.exe
PID 1412 wrote to memory of 1976	1412	39238314794.exe	39238314794.exe
PID 1412 wrote to memory of 1976	1412	39238314794.exe	39238314794.exe
PID 1412 wrote to memory of 1976	1412	39238314794.exe	39238314794.exe
PID 1056 wrote to memory of 1804	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	3U4maJwq4ruChECKgyZbXC8s.exe
PID 1056 wrote to memory of 1804	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	3U4maJwq4ruChECKgyZbXC8s.exe
PID 1056 wrote to memory of 1804	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	3U4maJwq4ruChECKgyZbXC8s.exe
PID 1056 wrote to memory of 1804	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	3U4maJwq4ruChECKgyZbXC8s.exe
PID 1056 wrote to memory of 972	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	VMYsiEBUWmw073PkMnvcWhMK.exe
PID 1056 wrote to memory of 972	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	VMYsiEBUWmw073PkMnvcWhMK.exe
PID 1056 wrote to memory of 972	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	VMYsiEBUWmw073PkMnvcWhMK.exe
PID 1056 wrote to memory of 972	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	VMYsiEBUWmw073PkMnvcWhMK.exe
PID 1056 wrote to memory of 2016	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	1JB2DyuZKrOwxXO70N46JWYe.exe
PID 1056 wrote to memory of 2016	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	1JB2DyuZKrOwxXO70N46JWYe.exe
PID 1056 wrote to memory of 2016	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	1JB2DyuZKrOwxXO70N46JWYe.exe
PID 1056 wrote to memory of 2016	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	1JB2DyuZKrOwxXO70N46JWYe.exe
PID 1056 wrote to memory of 568	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	Qf8ujhuK76F7ioYJ90KCF5c1.exe
PID 1056 wrote to memory of 568	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	Qf8ujhuK76F7ioYJ90KCF5c1.exe
PID 1056 wrote to memory of 568	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	Qf8ujhuK76F7ioYJ90KCF5c1.exe
PID 1056 wrote to memory of 568	1056	f400dab915cf4b65ce4a277f93b1fc7b.exe	Qf8ujhuK76F7ioYJ90KCF5c1.exe

C:\Users\Admin\AppData\Local\Temp\f400dab915cf4b65ce4a277f93b1fc7b.exe
"C:\Users\Admin\AppData\Local\Temp\f400dab915cf4b65ce4a277f93b1fc7b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056

C:\Users\Admin\Documents\2hc36h6KHgiFjGGfAF0W49nI.exe
"C:\Users\Admin\Documents\2hc36h6KHgiFjGGfAF0W49nI.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:680

C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
"C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
"C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1412

C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
"C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe"
6⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 920
7⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\74550458142.exe" /mix
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896

C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\74550458142.exe
"C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\74550458142.exe" /mix
4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:820

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "2hc36h6KHgiFjGGfAF0W49nI.exe" /f & erase "C:\Users\Admin\Documents\2hc36h6KHgiFjGGfAF0W49nI.exe" & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "2hc36h6KHgiFjGGfAF0W49nI.exe" /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Users\Admin\Documents\3U4maJwq4ruChECKgyZbXC8s.exe
"C:\Users\Admin\Documents\3U4maJwq4ruChECKgyZbXC8s.exe"
2⤵
- Executes dropped EXE
PID:1804

C:\Users\Admin\Documents\VMYsiEBUWmw073PkMnvcWhMK.exe
"C:\Users\Admin\Documents\VMYsiEBUWmw073PkMnvcWhMK.exe"
2⤵
- Executes dropped EXE
PID:972

C:\Users\Admin\Documents\1JB2DyuZKrOwxXO70N46JWYe.exe
"C:\Users\Admin\Documents\1JB2DyuZKrOwxXO70N46JWYe.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Users\Admin\Documents\Qf8ujhuK76F7ioYJ90KCF5c1.exe
"C:\Users\Admin\Documents\Qf8ujhuK76F7ioYJ90KCF5c1.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:568

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\74550458142.exe
MD5
6f5b1279d943e548259d62f00650044a

SHA1
367d5ff6ee971fcac30cf8b453eea8f47a936264

SHA256
118f24dab3dce4a5ae6e3ab078551cbc628b475abeeafa07a5972622aaa38812

SHA512
75e655e6df832bccafca641f0af62165da644a92ce3055d30b12b2dd0d241df4b43ea4de4429e3719b9e7f198882c5a0b3f44ab45900797d41787fdaf60988fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\74550458142.exe
MD5
6f5b1279d943e548259d62f00650044a

SHA1
367d5ff6ee971fcac30cf8b453eea8f47a936264

SHA256
118f24dab3dce4a5ae6e3ab078551cbc628b475abeeafa07a5972622aaa38812

SHA512
75e655e6df832bccafca641f0af62165da644a92ce3055d30b12b2dd0d241df4b43ea4de4429e3719b9e7f198882c5a0b3f44ab45900797d41787fdaf60988fe

Download Submit
C:\Users\Admin\Documents\1JB2DyuZKrOwxXO70N46JWYe.exe
MD5
f0bc65a05ad0a598375cfcd88cebf2f7

SHA1
a293f92d4f7377b31e06ee0377d4f8069d923938

SHA256
cfce285cacd32aaa2b142c7cb7c23643a8d57825daaa51ea69df4d61ff3a819f

SHA512
b24ded01b55a90781a7a14e39b8ab9e44816e5fae8fd8a212ef89c42cf5f53876586af5653fb992579fe5d7ecfaae3b83e3f5a153d2f2cabf2b5a011bd9ae873

Download Submit
C:\Users\Admin\Documents\2hc36h6KHgiFjGGfAF0W49nI.exe
MD5
b22f601e1c1e2400a0fcd0e9835f03ed

SHA1
d23a32d7a9ac91a8bcc701b147e334ae47cc802a

SHA256
c23d42a1c5b99920c37bb46a6b64ef68b686255a915a0e8cf1942f3f65335268

SHA512
f2e9266248f9812bececa281f5218962ed37ea3ac4405d11e2220ec51a9e52ffab84d87c5cfa6b7f3ce7249e009cc0ed2a742b1e93d1b908c9e2dfd9f4b5295c

Download Submit
C:\Users\Admin\Documents\2hc36h6KHgiFjGGfAF0W49nI.exe
MD5
b22f601e1c1e2400a0fcd0e9835f03ed

SHA1
d23a32d7a9ac91a8bcc701b147e334ae47cc802a

SHA256
c23d42a1c5b99920c37bb46a6b64ef68b686255a915a0e8cf1942f3f65335268

SHA512
f2e9266248f9812bececa281f5218962ed37ea3ac4405d11e2220ec51a9e52ffab84d87c5cfa6b7f3ce7249e009cc0ed2a742b1e93d1b908c9e2dfd9f4b5295c

Download Submit
C:\Users\Admin\Documents\3U4maJwq4ruChECKgyZbXC8s.exe
MD5
b8dfbf8460b17bca22633963d6f863da

SHA1
b2f468d69dde881f730f53418bcfc02c4ec62f52

SHA256
e3b5d4113eeec5c27fafdabb16b48d42d35cfd3ad94e1e43cb0300155d5e48e9

SHA512
d0d317c4b66d3a2eaa9808801db6e86fcd4d7f819fc931b526d8a29f5ec67a03d18a4999205a12b4e97f2db5bab05320a4e243598007d797388ad1cfb2449f4a

Download Submit
C:\Users\Admin\Documents\Qf8ujhuK76F7ioYJ90KCF5c1.exe
MD5
f0bc65a05ad0a598375cfcd88cebf2f7

SHA1
a293f92d4f7377b31e06ee0377d4f8069d923938

SHA256
cfce285cacd32aaa2b142c7cb7c23643a8d57825daaa51ea69df4d61ff3a819f

SHA512
b24ded01b55a90781a7a14e39b8ab9e44816e5fae8fd8a212ef89c42cf5f53876586af5653fb992579fe5d7ecfaae3b83e3f5a153d2f2cabf2b5a011bd9ae873

Download Submit
C:\Users\Admin\Documents\VMYsiEBUWmw073PkMnvcWhMK.exe
MD5
b8dfbf8460b17bca22633963d6f863da

SHA1
b2f468d69dde881f730f53418bcfc02c4ec62f52

SHA256
e3b5d4113eeec5c27fafdabb16b48d42d35cfd3ad94e1e43cb0300155d5e48e9

SHA512
d0d317c4b66d3a2eaa9808801db6e86fcd4d7f819fc931b526d8a29f5ec67a03d18a4999205a12b4e97f2db5bab05320a4e243598007d797388ad1cfb2449f4a

Download Submit
\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\39238314794.exe
MD5
1204fd2475463856ee1e4b7e8bbc8a97

SHA1
9808fdb378aefed2bd85edf544dda0dd1c3ca90e

SHA256
8c2b2f56415981557ec7e2f321decb4cc3e7514d7e1007370e082ada9fae702c

SHA512
dad6ba60d8463d27754a61061826c14c107953ae8ac4727dfab59c2702bdd2c9806cf910bb10853b563924a3c40d51976292595e6d359b297c383e0cb1e45c3f

Download Submit
\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\74550458142.exe
MD5
6f5b1279d943e548259d62f00650044a

SHA1
367d5ff6ee971fcac30cf8b453eea8f47a936264

SHA256
118f24dab3dce4a5ae6e3ab078551cbc628b475abeeafa07a5972622aaa38812

SHA512
75e655e6df832bccafca641f0af62165da644a92ce3055d30b12b2dd0d241df4b43ea4de4429e3719b9e7f198882c5a0b3f44ab45900797d41787fdaf60988fe

Download Submit
\Users\Admin\AppData\Local\Temp\{NDMn-TiGAY-930w-GquSQ}\74550458142.exe
MD5
6f5b1279d943e548259d62f00650044a

SHA1
367d5ff6ee971fcac30cf8b453eea8f47a936264

SHA256
118f24dab3dce4a5ae6e3ab078551cbc628b475abeeafa07a5972622aaa38812

SHA512
75e655e6df832bccafca641f0af62165da644a92ce3055d30b12b2dd0d241df4b43ea4de4429e3719b9e7f198882c5a0b3f44ab45900797d41787fdaf60988fe

Download Submit
\Users\Admin\Documents\1JB2DyuZKrOwxXO70N46JWYe.exe
MD5
f0bc65a05ad0a598375cfcd88cebf2f7

SHA1
a293f92d4f7377b31e06ee0377d4f8069d923938

SHA256
cfce285cacd32aaa2b142c7cb7c23643a8d57825daaa51ea69df4d61ff3a819f

SHA512
b24ded01b55a90781a7a14e39b8ab9e44816e5fae8fd8a212ef89c42cf5f53876586af5653fb992579fe5d7ecfaae3b83e3f5a153d2f2cabf2b5a011bd9ae873

Download Submit
\Users\Admin\Documents\2hc36h6KHgiFjGGfAF0W49nI.exe
MD5
b22f601e1c1e2400a0fcd0e9835f03ed

SHA1
d23a32d7a9ac91a8bcc701b147e334ae47cc802a

SHA256
c23d42a1c5b99920c37bb46a6b64ef68b686255a915a0e8cf1942f3f65335268

SHA512
f2e9266248f9812bececa281f5218962ed37ea3ac4405d11e2220ec51a9e52ffab84d87c5cfa6b7f3ce7249e009cc0ed2a742b1e93d1b908c9e2dfd9f4b5295c

Download Submit
\Users\Admin\Documents\2hc36h6KHgiFjGGfAF0W49nI.exe
MD5
b22f601e1c1e2400a0fcd0e9835f03ed

SHA1
d23a32d7a9ac91a8bcc701b147e334ae47cc802a

SHA256
c23d42a1c5b99920c37bb46a6b64ef68b686255a915a0e8cf1942f3f65335268

SHA512
f2e9266248f9812bececa281f5218962ed37ea3ac4405d11e2220ec51a9e52ffab84d87c5cfa6b7f3ce7249e009cc0ed2a742b1e93d1b908c9e2dfd9f4b5295c

Download Submit
\Users\Admin\Documents\3U4maJwq4ruChECKgyZbXC8s.exe
MD5
b8dfbf8460b17bca22633963d6f863da

SHA1
b2f468d69dde881f730f53418bcfc02c4ec62f52

SHA256
e3b5d4113eeec5c27fafdabb16b48d42d35cfd3ad94e1e43cb0300155d5e48e9

SHA512
d0d317c4b66d3a2eaa9808801db6e86fcd4d7f819fc931b526d8a29f5ec67a03d18a4999205a12b4e97f2db5bab05320a4e243598007d797388ad1cfb2449f4a

Download Submit
\Users\Admin\Documents\3U4maJwq4ruChECKgyZbXC8s.exe
MD5
b8dfbf8460b17bca22633963d6f863da

SHA1
b2f468d69dde881f730f53418bcfc02c4ec62f52

SHA256
e3b5d4113eeec5c27fafdabb16b48d42d35cfd3ad94e1e43cb0300155d5e48e9

SHA512
d0d317c4b66d3a2eaa9808801db6e86fcd4d7f819fc931b526d8a29f5ec67a03d18a4999205a12b4e97f2db5bab05320a4e243598007d797388ad1cfb2449f4a

Download Submit
\Users\Admin\Documents\Qf8ujhuK76F7ioYJ90KCF5c1.exe
MD5
f0bc65a05ad0a598375cfcd88cebf2f7

SHA1
a293f92d4f7377b31e06ee0377d4f8069d923938

SHA256
cfce285cacd32aaa2b142c7cb7c23643a8d57825daaa51ea69df4d61ff3a819f

SHA512
b24ded01b55a90781a7a14e39b8ab9e44816e5fae8fd8a212ef89c42cf5f53876586af5653fb992579fe5d7ecfaae3b83e3f5a153d2f2cabf2b5a011bd9ae873

Download Submit
\Users\Admin\Documents\VMYsiEBUWmw073PkMnvcWhMK.exe
MD5
b8dfbf8460b17bca22633963d6f863da

SHA1
b2f468d69dde881f730f53418bcfc02c4ec62f52

SHA256
e3b5d4113eeec5c27fafdabb16b48d42d35cfd3ad94e1e43cb0300155d5e48e9

SHA512
d0d317c4b66d3a2eaa9808801db6e86fcd4d7f819fc931b526d8a29f5ec67a03d18a4999205a12b4e97f2db5bab05320a4e243598007d797388ad1cfb2449f4a

Download Submit
\Users\Admin\Documents\VMYsiEBUWmw073PkMnvcWhMK.exe
MD5
b8dfbf8460b17bca22633963d6f863da

SHA1
b2f468d69dde881f730f53418bcfc02c4ec62f52

SHA256
e3b5d4113eeec5c27fafdabb16b48d42d35cfd3ad94e1e43cb0300155d5e48e9

SHA512
d0d317c4b66d3a2eaa9808801db6e86fcd4d7f819fc931b526d8a29f5ec67a03d18a4999205a12b4e97f2db5bab05320a4e243598007d797388ad1cfb2449f4a

Download Submit
memory/568-85-0x0000000002C30000-0x000000000353F000-memory.dmp

Filesize
9.1MB

Download
memory/568-91-0x0000000002C30000-0x000000000353F000-memory.dmp

Filesize
9.1MB

Download
memory/568-84-0x0000000002330000-0x00000000027A6000-memory.dmp

Filesize
4.5MB

Download
memory/568-77-0x0000000000000000-mapping.dmp

Download
memory/680-18-0x0000000000000000-mapping.dmp

Download
memory/820-32-0x0000000000000000-mapping.dmp

Download
memory/820-46-0x0000000000920000-0x00000000009FF000-memory.dmp

Filesize
892KB

Download
memory/820-40-0x0000000000B00000-0x0000000000B11000-memory.dmp

Filesize
68KB

Download
memory/820-47-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/896-25-0x0000000000000000-mapping.dmp

Download
memory/940-17-0x000007FEF71F0000-0x000007FEF746A000-memory.dmp

Filesize
2.5MB

Download
memory/972-70-0x0000000000000000-mapping.dmp

Download
memory/972-86-0x00000000009F0000-0x0000000000A01000-memory.dmp

Filesize
68KB

Download
memory/972-92-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/1004-39-0x0000000000000000-mapping.dmp

Download
memory/1056-5-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/1056-3-0x0000000000E10000-0x0000000000E11000-memory.dmp

Filesize
4KB

Download
memory/1056-2-0x0000000073C60000-0x000000007434E000-memory.dmp

Filesize
6.9MB

Download
memory/1056-8-0x0000000000DF0000-0x0000000000DF3000-memory.dmp

Filesize
12KB

Download
memory/1056-6-0x0000000004D35000-0x0000000004D46000-memory.dmp

Filesize
68KB

Download
memory/1056-7-0x0000000004D46000-0x0000000004D47000-memory.dmp

Filesize
4KB

Download
memory/1172-42-0x0000000000000000-mapping.dmp

Download
memory/1412-36-0x0000000000401F10-mapping.dmp

Download
memory/1412-28-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/1412-48-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/1412-45-0x0000000002CF0000-0x0000000002D9C000-memory.dmp

Filesize
688KB

Download
memory/1412-51-0x0000000002E30000-0x0000000002EDC000-memory.dmp

Filesize
688KB

Download
memory/1412-43-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/1412-44-0x0000000002E30000-0x0000000002E41000-memory.dmp

Filesize
68KB

Download
memory/1804-82-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/1804-66-0x0000000000000000-mapping.dmp

Download
memory/1804-78-0x0000000000DC0000-0x0000000000DD1000-memory.dmp

Filesize
68KB

Download
memory/1824-14-0x0000000075A61000-0x0000000075A63000-memory.dmp

Filesize
8KB

Download
memory/1824-11-0x0000000000000000-mapping.dmp

Download
memory/1824-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1824-15-0x00000000002D0000-0x00000000002FD000-memory.dmp

Filesize
180KB

Download
memory/1824-13-0x00000000009B0000-0x00000000009C1000-memory.dmp

Filesize
68KB

Download
memory/1976-56-0x0000000002D90000-0x0000000002DA1000-memory.dmp

Filesize
68KB

Download
memory/1976-22-0x0000000000000000-mapping.dmp

Download
memory/1976-24-0x0000000000C80000-0x0000000000C91000-memory.dmp

Filesize
68KB

Download
memory/1976-34-0x0000000000AD0000-0x0000000000BA9000-memory.dmp

Filesize
868KB

Download
memory/1976-35-0x0000000000400000-0x00000000008D0000-memory.dmp

Filesize
4.8MB

Download
memory/1976-37-0x0000000000C80000-0x0000000000D54000-memory.dmp

Filesize
848KB

Download
memory/1976-63-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/1976-62-0x0000000002B50000-0x0000000002BE1000-memory.dmp

Filesize
580KB

Download
memory/1976-59-0x0000000000400000-0x0000000002B2D000-memory.dmp

Filesize
39.2MB

Download
memory/1976-58-0x0000000000220000-0x00000000002AD000-memory.dmp

Filesize
564KB

Download
memory/1976-57-0x0000000000400000-0x0000000002B44000-memory.dmp

Filesize
39.3MB

Download
memory/1976-53-0x0000000000400000-0x0000000002B44000-memory.dmp

Filesize
39.3MB

Download
memory/1976-54-0x0000000000403B90-mapping.dmp

Download
memory/2016-73-0x0000000000000000-mapping.dmp

Download
memory/2016-90-0x0000000002DD0000-0x00000000036DF000-memory.dmp

Filesize
9.1MB

Download
memory/2016-89-0x00000000024D0000-0x0000000002946000-memory.dmp

Filesize
4.5MB

Download
memory/2016-83-0x0000000002DD0000-0x00000000036DF000-memory.dmp

Filesize
9.1MB

Download
memory/2236-94-0x0000000001F60000-0x0000000001F71000-memory.dmp

Filesize
68KB

Download
memory/2236-96-0x0000000001F60000-0x0000000001F71000-memory.dmp

Filesize
68KB

Download
memory/2236-93-0x0000000000000000-mapping.dmp

Download
memory/2236-102-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download