hxxps://drive[.]google[.]com/file/d/1S8gh0sxx1JFDv4hT1UdxXChtapeqjDC3/view?usp=sharing

Analysis

max time kernel
282s
max time network
301s
platform
windows10_x64
resource
win10v20210410
submitted
19-04-2021 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1S8gh0sxx1JFDv4hT1UdxXChtapeqjDC3/view?usp=sharing
Sample

210419-npkxz59afj

Score

10^/10

discovery persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

uninstall.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Executes dropped EXE 22 IoCs

Processes:

winrar-x64-601.exeuninstall.exeWinRAR.exeWinRAR.exeXHANGERcsgo.exeDCRatBuild.exestart.exedllcommonmonitordll.exeCL_Debug_Log.txtcmd.exeXHANGERcsgo.exeDCRatBuild.exestart.exedllcommonmonitordll.exeCL_Debug_Log.txtstart.exeCL_Debug_Log.txtXHANGERcsgo.exeDCRatBuild.exestart.exedllcommonmonitordll.exeCL_Debug_Log.txt

pid	process
3532	winrar-x64-601.exe
4496	uninstall.exe
4384	WinRAR.exe
412	WinRAR.exe
4196	XHANGERcsgo.exe
3568	DCRatBuild.exe
3312	start.exe
1408	dllcommonmonitordll.exe
2720	CL_Debug_Log.txt
4656	cmd.exe
4588	XHANGERcsgo.exe
4564	DCRatBuild.exe
3896	start.exe
3468	dllcommonmonitordll.exe
4728	CL_Debug_Log.txt
4644	start.exe
2088	CL_Debug_Log.txt
2072	XHANGERcsgo.exe
3192	DCRatBuild.exe
1716	start.exe
4056	dllcommonmonitordll.exe
4264	CL_Debug_Log.txt

Loads dropped DLL 1 IoCs

Processes:

pid process

3048
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3048

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllcommonmonitordll.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Documents and Settings\\System.exe\""	dllcommonmonitordll.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

223 ipinfo.io
224 ipinfo.io

flow	ioc
223	ipinfo.io
224	ipinfo.io

Drops file in System32 directory 11 IoCs

Processes:

dllcommonmonitordll.exe

description	ioc	process
File created	C:\Windows\System32\WallpaperHost\winlogon.exe	dllcommonmonitordll.exe
File created	C:\Windows\System32\wbem\IMAPIv2-FileSystemSupport\WmiPrvSE.exe	dllcommonmonitordll.exe
File created	C:\Windows\System32\wbem\IMAPIv2-FileSystemSupport\24dbde2999530ef5fd907494bc374d663924116c	dllcommonmonitordll.exe
File created	C:\Windows\System32\wbem\Dscpspluginwkr\WmiPrvSE.exe	dllcommonmonitordll.exe
File created	C:\Windows\System32\wbem\Dscpspluginwkr\24dbde2999530ef5fd907494bc374d663924116c	dllcommonmonitordll.exe
File opened for modification	C:\Windows\System32\WallpaperHost\winlogon.exe	dllcommonmonitordll.exe
File created	C:\Windows\System32\WallpaperHost\cc11b995f2a76da408ea6a601e682e64743153ad	dllcommonmonitordll.exe
File created	C:\Windows\System32\wbem\wpdshext\WmiPrvSE.exe	dllcommonmonitordll.exe
File created	C:\Windows\System32\wbem\wpdshext\24dbde2999530ef5fd907494bc374d663924116c	dllcommonmonitordll.exe
File created	C:\Windows\System32\DafGip\dllhost.exe	dllcommonmonitordll.exe
File created	C:\Windows\System32\DafGip\5940a34987c99120d96dace90a3f93f329dcad63	dllcommonmonitordll.exe

Drops file in Program Files directory 48 IoCs

Processes:

winrar-x64-601.exeuninstall.exe

description	ioc	process
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\Zip64.SFX	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_259320156	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\Default64.SFX	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\WinCon64.SFX	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-601.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-601.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-601.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4108 4384 WerFault.exe WinRAR.exe

pid	pid_target	process	target process
4108	4384	WerFault.exe	WinRAR.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
5032	schtasks.exe
4676	schtasks.exe
4640	schtasks.exe
4632	schtasks.exe
3160	schtasks.exe
4444	schtasks.exe
5016	schtasks.exe
4544	schtasks.exe
2744	schtasks.exe
4036	schtasks.exe
3152	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

WinRAR.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	WinRAR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	WinRAR.exe

Modifies registry class 64 IoCs

Processes:

uninstall.exeWinRAR.exefirefox.exeDCRatBuild.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r22\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r16\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar\ShellNew	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext32.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r12\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r13	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r15\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r25	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r29\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew\FileName = "C:\\Program Files\\WinRAR\\zipnew.dat"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r11	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.r03\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev\ = "WinRAR.REV"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	WinRAR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r27	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.arj\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ShellNew	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r15	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r23	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.r01	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\DefaultIcon	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uu	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\ContextMenuHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\shellex\DropHandler\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip\ = "WinRAR.ZIP"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers	uninstall.exe

NTFS ADS 6 IoCs

Processes:

start.exestart.exestart.exefirefox.exestart.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\RarSFX0\winmgmts:\RJMQBVDN\root\CIMV2	start.exe
File opened for modification	C:\\winmgmts:\RJMQBVDN\root\CIMV2	start.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\RarSFX0\winmgmts:\RJMQBVDN\root\CIMV2	start.exe
File created	C:\Users\Admin\Downloads\XHANGERcsgo.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-601.exe:Zone.Identifier	firefox.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\RarSFX0\winmgmts:\RJMQBVDN\root\CIMV2	start.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2756 PING.EXE

pid	process
2756	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WerFault.exestart.exe

pid	process
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

WinRAR.execmd.exe

pid process

412 WinRAR.exe
4656 cmd.exe

pid	process
412	WinRAR.exe
4656	cmd.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

firefox.exeWerFault.exeCL_Debug_Log.txtdllcommonmonitordll.execmd.exeCL_Debug_Log.txtdllcommonmonitordll.exeCL_Debug_Log.txtCL_Debug_Log.txtdllcommonmonitordll.exe

description	pid	process
Token: SeDebugPrivilege	680	firefox.exe
Token: SeDebugPrivilege	680	firefox.exe
Token: SeDebugPrivilege	680	firefox.exe
Token: SeDebugPrivilege	4108	WerFault.exe
Token: SeRestorePrivilege	2720	CL_Debug_Log.txt
Token: 35	2720	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2720	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2720	CL_Debug_Log.txt
Token: SeDebugPrivilege	1408	dllcommonmonitordll.exe
Token: SeDebugPrivilege	4656	cmd.exe
Token: SeRestorePrivilege	4728	CL_Debug_Log.txt
Token: 35	4728	CL_Debug_Log.txt
Token: SeSecurityPrivilege	4728	CL_Debug_Log.txt
Token: SeSecurityPrivilege	4728	CL_Debug_Log.txt
Token: SeDebugPrivilege	3468	dllcommonmonitordll.exe
Token: SeRestorePrivilege	2088	CL_Debug_Log.txt
Token: 35	2088	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2088	CL_Debug_Log.txt
Token: SeSecurityPrivilege	2088	CL_Debug_Log.txt
Token: SeRestorePrivilege	4264	CL_Debug_Log.txt
Token: 35	4264	CL_Debug_Log.txt
Token: SeSecurityPrivilege	4264	CL_Debug_Log.txt
Token: SeSecurityPrivilege	4264	CL_Debug_Log.txt
Token: SeDebugPrivilege	4056	dllcommonmonitordll.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

firefox.exeWinRAR.exestart.exestart.exestart.exestart.exe

pid	process
680	firefox.exe
680	firefox.exe
680	firefox.exe
680	firefox.exe
412	WinRAR.exe
412	WinRAR.exe
412	WinRAR.exe
412	WinRAR.exe
412	WinRAR.exe
412	WinRAR.exe
412	WinRAR.exe
412	WinRAR.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3896	start.exe
3896	start.exe
3896	start.exe
4644	start.exe
4644	start.exe
4644	start.exe
1716	start.exe
1716	start.exe
1716	start.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

firefox.exestart.exestart.exestart.exestart.exe

pid	process
680	firefox.exe
680	firefox.exe
680	firefox.exe
3312	start.exe
3312	start.exe
3312	start.exe
3312	start.exe
3896	start.exe
3896	start.exe
3896	start.exe
4644	start.exe
4644	start.exe
4644	start.exe
1716	start.exe
1716	start.exe
1716	start.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

firefox.exewinrar-x64-601.exeuninstall.exeWinRAR.execmd.exe

pid	process
680	firefox.exe
680	firefox.exe
680	firefox.exe
680	firefox.exe
680	firefox.exe
680	firefox.exe
680	firefox.exe
3532	winrar-x64-601.exe
3532	winrar-x64-601.exe
3532	winrar-x64-601.exe
4496	uninstall.exe
680	firefox.exe
680	firefox.exe
680	firefox.exe
4384	WinRAR.exe
4384	WinRAR.exe
680	firefox.exe
680	firefox.exe
680	firefox.exe
4656	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2208 wrote to memory of 680	2208	firefox.exe	firefox.exe
PID 2208 wrote to memory of 680	2208	firefox.exe	firefox.exe
PID 2208 wrote to memory of 680	2208	firefox.exe	firefox.exe
PID 2208 wrote to memory of 680	2208	firefox.exe	firefox.exe
PID 2208 wrote to memory of 680	2208	firefox.exe	firefox.exe
PID 2208 wrote to memory of 680	2208	firefox.exe	firefox.exe
PID 2208 wrote to memory of 680	2208	firefox.exe	firefox.exe
PID 2208 wrote to memory of 680	2208	firefox.exe	firefox.exe
PID 2208 wrote to memory of 680	2208	firefox.exe	firefox.exe
PID 680 wrote to memory of 2420	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 2420	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 3400	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 1624	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 1624	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 1624	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 1624	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 1624	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 1624	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 1624	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 1624	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 1624	680	firefox.exe	firefox.exe
PID 680 wrote to memory of 1624	680	firefox.exe	firefox.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://drive.google.com/file/d/1S8gh0sxx1JFDv4hT1UdxXChtapeqjDC3/view?usp=sharing
1⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:680

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="680.0.651717032\507818490" -parentBuildID 20200403170909 -prefsHandle 1496 -prefMapHandle 1488 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 680 "\\.\pipe\gecko-crash-server-pipe.680" 1596 gpu
2⤵
PID:2420

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="680.3.1627814205\775697707" -childID 1 -isForBrowser -prefsHandle 2180 -prefMapHandle 2164 -prefsLen 122 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 680 "\\.\pipe\gecko-crash-server-pipe.680" 2176 tab
2⤵
PID:3400

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="680.13.1452586757\1353603682" -childID 2 -isForBrowser -prefsHandle 3336 -prefMapHandle 2964 -prefsLen 6979 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 680 "\\.\pipe\gecko-crash-server-pipe.680" 3380 tab
2⤵
PID:1624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="680.20.343742954\1034405144" -childID 3 -isForBrowser -prefsHandle 4148 -prefMapHandle 4400 -prefsLen 7907 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 680 "\\.\pipe\gecko-crash-server-pipe.680" 4136 tab
2⤵
PID:4588

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="680.27.1479173750\1916777090" -childID 4 -isForBrowser -prefsHandle 4844 -prefMapHandle 4876 -prefsLen 8215 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 680 "\\.\pipe\gecko-crash-server-pipe.680" 4736 tab
2⤵
PID:4948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://drive.google.com/file/d/1S8gh0sxx1JFDv4hT1UdxXChtapeqjDC3/view?usp=sharing
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Users\Admin\Downloads\winrar-x64-601.exe
"C:\Users\Admin\Downloads\winrar-x64-601.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3532

C:\Program Files\WinRAR\uninstall.exe
"C:\Program Files\WinRAR\uninstall.exe" /setup
2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4560

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:4120

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe"
1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4384

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4384 -s 3240
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\XHANGERcsgo.rar"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:412

C:\Users\Admin\Desktop\XHANGERcsgo.exe
"C:\Users\Admin\Desktop\XHANGERcsgo.exe"
1⤵
- Executes dropped EXE
PID:4196

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe"
2⤵
- Executes dropped EXE
PID:3568

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\dllcommon\lZ7qJ0Y8s.vbe"
3⤵
PID:4500

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\dllcommon\se4b4LLfM0BNfxMBzpSP.bat" "
4⤵
PID:1292

C:\dllcommon\dllcommonmonitordll.exe
"C:\dllcommon\dllcommonmonitordll.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\WallpaperHost\winlogon.exe'" /rl HIGHEST /f
6⤵
- Creates scheduled task(s)
PID:5032

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\wpdshext\WmiPrvSE.exe'" /rl HIGHEST /f
6⤵
- Creates scheduled task(s)
PID:4676

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\Documents and Settings\System.exe'" /rl HIGHEST /f
6⤵
- Creates scheduled task(s)
PID:4640

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\IMAPIv2-FileSystemSupport\WmiPrvSE.exe'" /rl HIGHEST /f
6⤵
- Creates scheduled task(s)
PID:4632

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\Dscpspluginwkr\WmiPrvSE.exe'" /rl HIGHEST /f
6⤵
- Creates scheduled task(s)
PID:3160

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\DafGip\dllhost.exe'" /rl HIGHEST /f
6⤵
- Creates scheduled task(s)
PID:4444

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "cmd" /sc ONLOGON /tr "'C:\PerfLogs\cmd.exe'" /rl HIGHEST /f
6⤵
- Creates scheduled task(s)
PID:4036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Public\13ZlKG4msG.bat"
6⤵
PID:5076

C:\Windows\system32\chcp.com
chcp 65001
7⤵
PID:3828

C:\Windows\system32\PING.EXE
ping -n 5 localhost
7⤵
- Runs ping.exe
PID:2756

C:\PerfLogs\cmd.exe
"C:\PerfLogs\cmd.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4656

C:\start.exe
"C:\start.exe"
8⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4644

C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
9⤵
PID:1296

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
10⤵
- Creates scheduled task(s)
PID:3152

C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe"
2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3312

C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
3⤵
PID:4388

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
4⤵
- Creates scheduled task(s)
PID:2744

C:\Users\Admin\Desktop\XHANGERcsgo.exe
"C:\Users\Admin\Desktop\XHANGERcsgo.exe"
1⤵
- Executes dropped EXE
PID:4588

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe"
2⤵
- Executes dropped EXE
PID:4564

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\dllcommon\lZ7qJ0Y8s.vbe"
3⤵
PID:4072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\dllcommon\se4b4LLfM0BNfxMBzpSP.bat" "
4⤵
PID:2280

C:\dllcommon\dllcommonmonitordll.exe
"C:\dllcommon\dllcommonmonitordll.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe"
2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3896

C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
3⤵
PID:4984

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
4⤵
- Creates scheduled task(s)
PID:5016

C:\Users\Admin\Desktop\XHANGERcsgo.exe
"C:\Users\Admin\Desktop\XHANGERcsgo.exe"
1⤵
- Executes dropped EXE
PID:2072

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe"
2⤵
- Executes dropped EXE
- Modifies registry class
PID:3192

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\dllcommon\lZ7qJ0Y8s.vbe"
3⤵
PID:4944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\dllcommon\se4b4LLfM0BNfxMBzpSP.bat" "
4⤵
PID:5080

C:\dllcommon\dllcommonmonitordll.exe
"C:\dllcommon\dllcommonmonitordll.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe"
2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1716

C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
3⤵
PID:4688

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
4⤵
- Creates scheduled task(s)
PID:4544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\cmd.exe
MD5
f6412efd69e1abab2a242da134889b4b

SHA1
7375e429b9fb0e8c7a03dacc7260f1204a8fe226

SHA256
51ba79258787d8171e15ba82713f7d9310c0723b91fcd4568c2c15a039716f67

SHA512
641002ac4b7e33a322d1080a9ea3a2ee1f6f50adff1a236d9a7712935c408fac4ab55f93a122497c4b22105f0f16134ca3d08b911581e40724aa61e3bfc703cc

Download Submit
C:\PerfLogs\cmd.exe
MD5
f6412efd69e1abab2a242da134889b4b

SHA1
7375e429b9fb0e8c7a03dacc7260f1204a8fe226

SHA256
51ba79258787d8171e15ba82713f7d9310c0723b91fcd4568c2c15a039716f67

SHA512
641002ac4b7e33a322d1080a9ea3a2ee1f6f50adff1a236d9a7712935c408fac4ab55f93a122497c4b22105f0f16134ca3d08b911581e40724aa61e3bfc703cc

Download Submit
C:\Program Files\WinRAR\Rar.txt
MD5
fc96c74be0cee755d9b3e2ff42afdcc4

SHA1
e18507f16d55aeda8e9e6772f079e96b78e356a1

SHA256
04a0e8d53a30e8d889cea6777d51628c844ce993745752bd28f7e64e76be849a

SHA512
ef53ef0ec9b382957c5d5a7babb925cdcf766460fc5720b4f60d983088d71d608521798f43e020d1d8079f9f1747e44f8f3fce222ebc82a2ed1b44fb647f5b76

Download Submit
C:\Program Files\WinRAR\Uninstall.exe
MD5
1394d90eb4ebe5d812264139afbc93ec

SHA1
a7b15ecc2ac3da314a140b30b6d5bcd08747d8ca

SHA256
f169c5567cbf2b7afc1dbe669c2903078a422013b24b4c0b04dae8e838c103ff

SHA512
4088f304c1d62fe7d59c884a21520b2f10bdc37c0000c9cbc0363f076237588d365ba73fc635fdee3add3492024ed0a8aa81e699252ae653627f2cee2e46d3bf

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt
MD5
eb5e9956913d971541a456c1701d5040

SHA1
eaf1e6a948f63ae40a6a3d1a8d3d93ff6b2b15d3

SHA256
9c83044f1d6654f685af82a61158110eff604ac6f9df54078337807be542bdda

SHA512
42cc08802921394cd723b403a7fab481044c36960d7004a27bec421212515082e34194005bc7b96a8f831f58ad75074f0156a1b8b23005774384fcc707e11c39

Download Submit
C:\Program Files\WinRAR\WinRAR.chm
MD5
0742228ac72eaaafbafc003eece35938

SHA1
fa4d56ead1ccff59b54acb75f1597fce7f72e3b9

SHA256
59b2ea0ccd15804557a3b5c788fe6854ab72de9d07c31068bc28b454600184c9

SHA512
4c32ae438cbd564a837fe2673b9cbc4f0f1973dfe6308e20543f3a76e91166b112868771c6db585f7a8927065fe79b291d419e1bde75188050038928b85b4636

Download Submit
C:\Program Files\WinRAR\WinRAR.exe
MD5
1079ca09290b27a4a9a35e62ed612575

SHA1
308e97a8879e3ee54ddd13dd5ff4f450fa21e856

SHA256
f32babb526c28cf42b548543e6e1a07ad123b769b3591417387ce0166850bf25

SHA512
3e0d5f6fff12faf1b1b698ee3bf77625d0b060ede92aac648a54f1a9dfe1b880e535492bf921774d39503fa7db5dbe087f0a018fe07ec39a442c6f4ee9052cf0

Download Submit
C:\Program Files\WinRAR\WinRAR.exe
MD5
1079ca09290b27a4a9a35e62ed612575

SHA1
308e97a8879e3ee54ddd13dd5ff4f450fa21e856

SHA256
f32babb526c28cf42b548543e6e1a07ad123b769b3591417387ce0166850bf25

SHA512
3e0d5f6fff12faf1b1b698ee3bf77625d0b060ede92aac648a54f1a9dfe1b880e535492bf921774d39503fa7db5dbe087f0a018fe07ec39a442c6f4ee9052cf0

Download Submit
C:\Program Files\WinRAR\WinRAR.exe
MD5
1079ca09290b27a4a9a35e62ed612575

SHA1
308e97a8879e3ee54ddd13dd5ff4f450fa21e856

SHA256
f32babb526c28cf42b548543e6e1a07ad123b769b3591417387ce0166850bf25

SHA512
3e0d5f6fff12faf1b1b698ee3bf77625d0b060ede92aac648a54f1a9dfe1b880e535492bf921774d39503fa7db5dbe087f0a018fe07ec39a442c6f4ee9052cf0

Download Submit
C:\Program Files\WinRAR\uninstall.exe
MD5
1394d90eb4ebe5d812264139afbc93ec

SHA1
a7b15ecc2ac3da314a140b30b6d5bcd08747d8ca

SHA256
f169c5567cbf2b7afc1dbe669c2903078a422013b24b4c0b04dae8e838c103ff

SHA512
4088f304c1d62fe7d59c884a21520b2f10bdc37c0000c9cbc0363f076237588d365ba73fc635fdee3add3492024ed0a8aa81e699252ae653627f2cee2e46d3bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllcommonmonitordll.exe.log
MD5
4f31fbcbdb904cb34e1abf5977c9b4c8

SHA1
24dcf849a19dce3606bf33d37b5f627832ee4b06

SHA256
c93b99973e4a5f37b442f5d3312cb2fee7ebd2fc6d409a93f76933d91b21eb1c

SHA512
6a56471f6358cbba98ab99bd9074f6327bf90d329bb93a5776b95d3318136519e3ef68ac9b7529204517d2ababd373ae8e8189e882ae884dcfe2cf429a1cfc57

Download Submit
C:\Users\Admin\AppData\Local\Temp\32.exe
MD5
82f981b993f0d9be028178f67f408981

SHA1
01088d60adc24555d546b3ee21b461e1f63f4239

SHA256
b16cf2e38e845833da360f71b4a74a43e652bc06ff0089eeef9069b6259d6327

SHA512
be43e07a2b1a1cb5d5375ae1ae06f1139a7e8b8144d2ea2b566f4f84ea8685f536159d6548d6e676844077215fd5b2da2432d83121370a6c08a1c1a196f6985f

Download Submit
C:\Users\Admin\AppData\Local\Temp\32.exe
MD5
82f981b993f0d9be028178f67f408981

SHA1
01088d60adc24555d546b3ee21b461e1f63f4239

SHA256
b16cf2e38e845833da360f71b4a74a43e652bc06ff0089eeef9069b6259d6327

SHA512
be43e07a2b1a1cb5d5375ae1ae06f1139a7e8b8144d2ea2b566f4f84ea8685f536159d6548d6e676844077215fd5b2da2432d83121370a6c08a1c1a196f6985f

Download Submit
C:\Users\Admin\AppData\Local\Temp\32.exe
MD5
82f981b993f0d9be028178f67f408981

SHA1
01088d60adc24555d546b3ee21b461e1f63f4239

SHA256
b16cf2e38e845833da360f71b4a74a43e652bc06ff0089eeef9069b6259d6327

SHA512
be43e07a2b1a1cb5d5375ae1ae06f1139a7e8b8144d2ea2b566f4f84ea8685f536159d6548d6e676844077215fd5b2da2432d83121370a6c08a1c1a196f6985f

Download Submit
C:\Users\Admin\AppData\Local\Temp\64.exe
MD5
fd2c0683873d430acab49d35ca4829af

SHA1
425fa3f472a3748904536f15e6e2eb934509088b

SHA256
91bdfa799c62bab3a106ef7125db6f9d816ffb4a6e79866a8fa5b388d06238c1

SHA512
5f4a5bdea03d7e0a3ad220082e394eea0dd03a4cafd92ded30a6618c0c0ac1d5706169a655dc3bdaa17164d7c96ef88f6040b56edebffcb51707200cf5240b42

Download Submit
C:\Users\Admin\AppData\Local\Temp\64.exe
MD5
fd2c0683873d430acab49d35ca4829af

SHA1
425fa3f472a3748904536f15e6e2eb934509088b

SHA256
91bdfa799c62bab3a106ef7125db6f9d816ffb4a6e79866a8fa5b388d06238c1

SHA512
5f4a5bdea03d7e0a3ad220082e394eea0dd03a4cafd92ded30a6618c0c0ac1d5706169a655dc3bdaa17164d7c96ef88f6040b56edebffcb51707200cf5240b42

Download Submit
C:\Users\Admin\AppData\Local\Temp\64.exe
MD5
fd2c0683873d430acab49d35ca4829af

SHA1
425fa3f472a3748904536f15e6e2eb934509088b

SHA256
91bdfa799c62bab3a106ef7125db6f9d816ffb4a6e79866a8fa5b388d06238c1

SHA512
5f4a5bdea03d7e0a3ad220082e394eea0dd03a4cafd92ded30a6618c0c0ac1d5706169a655dc3bdaa17164d7c96ef88f6040b56edebffcb51707200cf5240b42

Download Submit
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
MD5
43141e85e7c36e31b52b22ab94d5e574

SHA1
cfd7079a9b268d84b856dc668edbb9ab9ef35312

SHA256
ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

SHA512
9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
MD5
43141e85e7c36e31b52b22ab94d5e574

SHA1
cfd7079a9b268d84b856dc668edbb9ab9ef35312

SHA256
ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

SHA512
9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
MD5
43141e85e7c36e31b52b22ab94d5e574

SHA1
cfd7079a9b268d84b856dc668edbb9ab9ef35312

SHA256
ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

SHA512
9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
MD5
43141e85e7c36e31b52b22ab94d5e574

SHA1
cfd7079a9b268d84b856dc668edbb9ab9ef35312

SHA256
ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

SHA512
9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
MD5
f7aaf2fd8d6fa42268e90f95ad487c81

SHA1
dfb2207db8df80b8e3e8b98f3372ed24d592da7e

SHA256
31cacb77c5ee110b2f879127c7b8f05a2dd5aa9866bdb5d059e193b521461ac5

SHA512
fe1ec5666170e7a704c57e2723a7a49661ab14cd8573221a4df9741e7206455ee9062783ed4fc9a2222d8e28f8a7f8e6bb6e16256401fab60e49a21db8ab31ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
MD5
f7aaf2fd8d6fa42268e90f95ad487c81

SHA1
dfb2207db8df80b8e3e8b98f3372ed24d592da7e

SHA256
31cacb77c5ee110b2f879127c7b8f05a2dd5aa9866bdb5d059e193b521461ac5

SHA512
fe1ec5666170e7a704c57e2723a7a49661ab14cd8573221a4df9741e7206455ee9062783ed4fc9a2222d8e28f8a7f8e6bb6e16256401fab60e49a21db8ab31ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
MD5
f7aaf2fd8d6fa42268e90f95ad487c81

SHA1
dfb2207db8df80b8e3e8b98f3372ed24d592da7e

SHA256
31cacb77c5ee110b2f879127c7b8f05a2dd5aa9866bdb5d059e193b521461ac5

SHA512
fe1ec5666170e7a704c57e2723a7a49661ab14cd8573221a4df9741e7206455ee9062783ed4fc9a2222d8e28f8a7f8e6bb6e16256401fab60e49a21db8ab31ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
MD5
f7aaf2fd8d6fa42268e90f95ad487c81

SHA1
dfb2207db8df80b8e3e8b98f3372ed24d592da7e

SHA256
31cacb77c5ee110b2f879127c7b8f05a2dd5aa9866bdb5d059e193b521461ac5

SHA512
fe1ec5666170e7a704c57e2723a7a49661ab14cd8573221a4df9741e7206455ee9062783ed4fc9a2222d8e28f8a7f8e6bb6e16256401fab60e49a21db8ab31ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe
MD5
a5e117f7f6ed9dead39755a97fe0b3ca

SHA1
1791a15e795b1be214fd0356feb6c0336daa7996

SHA256
0d34cd1dc006eb07e0f0729d32e0c7ff1c3e50ff00da3ae2fad2eba2d23b4836

SHA512
9825d74de48bc9472800da754e50dd95c489b9f13effab26dc83769bb090af8dbbfc6c7da6731ea0341d79ac99596d170dd92fc96a0712eb97b55a37708c3507

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe
MD5
a5e117f7f6ed9dead39755a97fe0b3ca

SHA1
1791a15e795b1be214fd0356feb6c0336daa7996

SHA256
0d34cd1dc006eb07e0f0729d32e0c7ff1c3e50ff00da3ae2fad2eba2d23b4836

SHA512
9825d74de48bc9472800da754e50dd95c489b9f13effab26dc83769bb090af8dbbfc6c7da6731ea0341d79ac99596d170dd92fc96a0712eb97b55a37708c3507

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe
MD5
a5e117f7f6ed9dead39755a97fe0b3ca

SHA1
1791a15e795b1be214fd0356feb6c0336daa7996

SHA256
0d34cd1dc006eb07e0f0729d32e0c7ff1c3e50ff00da3ae2fad2eba2d23b4836

SHA512
9825d74de48bc9472800da754e50dd95c489b9f13effab26dc83769bb090af8dbbfc6c7da6731ea0341d79ac99596d170dd92fc96a0712eb97b55a37708c3507

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe
MD5
a5e117f7f6ed9dead39755a97fe0b3ca

SHA1
1791a15e795b1be214fd0356feb6c0336daa7996

SHA256
0d34cd1dc006eb07e0f0729d32e0c7ff1c3e50ff00da3ae2fad2eba2d23b4836

SHA512
9825d74de48bc9472800da754e50dd95c489b9f13effab26dc83769bb090af8dbbfc6c7da6731ea0341d79ac99596d170dd92fc96a0712eb97b55a37708c3507

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe
MD5
a5e117f7f6ed9dead39755a97fe0b3ca

SHA1
1791a15e795b1be214fd0356feb6c0336daa7996

SHA256
0d34cd1dc006eb07e0f0729d32e0c7ff1c3e50ff00da3ae2fad2eba2d23b4836

SHA512
9825d74de48bc9472800da754e50dd95c489b9f13effab26dc83769bb090af8dbbfc6c7da6731ea0341d79ac99596d170dd92fc96a0712eb97b55a37708c3507

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\DCRatBuild.exe
MD5
a5e117f7f6ed9dead39755a97fe0b3ca

SHA1
1791a15e795b1be214fd0356feb6c0336daa7996

SHA256
0d34cd1dc006eb07e0f0729d32e0c7ff1c3e50ff00da3ae2fad2eba2d23b4836

SHA512
9825d74de48bc9472800da754e50dd95c489b9f13effab26dc83769bb090af8dbbfc6c7da6731ea0341d79ac99596d170dd92fc96a0712eb97b55a37708c3507

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe
MD5
1955b63613b2cc5ad34a9433153a844f

SHA1
0b7ad659cc50ad38b1179a29a2efc0b91f0e8cb1

SHA256
b73c0b4e8d404487745c60a4c2309c50aa3fd03f21ee35b5cd3085c4ce82336e

SHA512
ec46e4d171b898bbf563cb48e0e4e944bba0d963d442d79cac5d274523f8ba7fa17f8c9be956a5a322ac3d0fdedbc3f0f032076486e7e9b25c546a33e7d52005

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe
MD5
1955b63613b2cc5ad34a9433153a844f

SHA1
0b7ad659cc50ad38b1179a29a2efc0b91f0e8cb1

SHA256
b73c0b4e8d404487745c60a4c2309c50aa3fd03f21ee35b5cd3085c4ce82336e

SHA512
ec46e4d171b898bbf563cb48e0e4e944bba0d963d442d79cac5d274523f8ba7fa17f8c9be956a5a322ac3d0fdedbc3f0f032076486e7e9b25c546a33e7d52005

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe
MD5
1955b63613b2cc5ad34a9433153a844f

SHA1
0b7ad659cc50ad38b1179a29a2efc0b91f0e8cb1

SHA256
b73c0b4e8d404487745c60a4c2309c50aa3fd03f21ee35b5cd3085c4ce82336e

SHA512
ec46e4d171b898bbf563cb48e0e4e944bba0d963d442d79cac5d274523f8ba7fa17f8c9be956a5a322ac3d0fdedbc3f0f032076486e7e9b25c546a33e7d52005

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe
MD5
1955b63613b2cc5ad34a9433153a844f

SHA1
0b7ad659cc50ad38b1179a29a2efc0b91f0e8cb1

SHA256
b73c0b4e8d404487745c60a4c2309c50aa3fd03f21ee35b5cd3085c4ce82336e

SHA512
ec46e4d171b898bbf563cb48e0e4e944bba0d963d442d79cac5d274523f8ba7fa17f8c9be956a5a322ac3d0fdedbc3f0f032076486e7e9b25c546a33e7d52005

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe
MD5
1955b63613b2cc5ad34a9433153a844f

SHA1
0b7ad659cc50ad38b1179a29a2efc0b91f0e8cb1

SHA256
b73c0b4e8d404487745c60a4c2309c50aa3fd03f21ee35b5cd3085c4ce82336e

SHA512
ec46e4d171b898bbf563cb48e0e4e944bba0d963d442d79cac5d274523f8ba7fa17f8c9be956a5a322ac3d0fdedbc3f0f032076486e7e9b25c546a33e7d52005

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\start.exe
MD5
1955b63613b2cc5ad34a9433153a844f

SHA1
0b7ad659cc50ad38b1179a29a2efc0b91f0e8cb1

SHA256
b73c0b4e8d404487745c60a4c2309c50aa3fd03f21ee35b5cd3085c4ce82336e

SHA512
ec46e4d171b898bbf563cb48e0e4e944bba0d963d442d79cac5d274523f8ba7fa17f8c9be956a5a322ac3d0fdedbc3f0f032076486e7e9b25c546a33e7d52005

Download Submit
C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml
MD5
9160347bec74471e1a79edfd950629ae

SHA1
c149a7e5aab6e349a70b7b458d0eaaa9d301c790

SHA256
0fe356f3d04bb43f772604b049fd2b20f3038ca2ce84bf9778b8ccdd481d77ab

SHA512
b8061834f658567a1e742496c38688bdecd60191a92163d47470f64aa1fba23e92dd36fa1d2bb7efa36f14002c0606013973718b9f107e62d845a17be4b0d358

Download Submit
C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml
MD5
9160347bec74471e1a79edfd950629ae

SHA1
c149a7e5aab6e349a70b7b458d0eaaa9d301c790

SHA256
0fe356f3d04bb43f772604b049fd2b20f3038ca2ce84bf9778b8ccdd481d77ab

SHA512
b8061834f658567a1e742496c38688bdecd60191a92163d47470f64aa1fba23e92dd36fa1d2bb7efa36f14002c0606013973718b9f107e62d845a17be4b0d358

Download Submit
C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml
MD5
9160347bec74471e1a79edfd950629ae

SHA1
c149a7e5aab6e349a70b7b458d0eaaa9d301c790

SHA256
0fe356f3d04bb43f772604b049fd2b20f3038ca2ce84bf9778b8ccdd481d77ab

SHA512
b8061834f658567a1e742496c38688bdecd60191a92163d47470f64aa1fba23e92dd36fa1d2bb7efa36f14002c0606013973718b9f107e62d845a17be4b0d358

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
MD5
82f981b993f0d9be028178f67f408981

SHA1
01088d60adc24555d546b3ee21b461e1f63f4239

SHA256
b16cf2e38e845833da360f71b4a74a43e652bc06ff0089eeef9069b6259d6327

SHA512
be43e07a2b1a1cb5d5375ae1ae06f1139a7e8b8144d2ea2b566f4f84ea8685f536159d6548d6e676844077215fd5b2da2432d83121370a6c08a1c1a196f6985f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
MD5
82f981b993f0d9be028178f67f408981

SHA1
01088d60adc24555d546b3ee21b461e1f63f4239

SHA256
b16cf2e38e845833da360f71b4a74a43e652bc06ff0089eeef9069b6259d6327

SHA512
be43e07a2b1a1cb5d5375ae1ae06f1139a7e8b8144d2ea2b566f4f84ea8685f536159d6548d6e676844077215fd5b2da2432d83121370a6c08a1c1a196f6985f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\j9e93b1g.default-release\cookies.sqlite
MD5
af7eb169a5b07afdf9cb4f394d25b7cb

SHA1
25d037c84bc6a67f75c0a8bdcafa371b08618e30

SHA256
822fd4d21a2d448c296d6534159d1a240f6fc9e822b22d478cd5d886f88295a3

SHA512
14bd1f2b78a7c366d8d865afcab832404c972c8c39385d982ba8fe6f1d2a9cd7c9cf3a3f7bf6013070ebe91c9be7d8583d57544c4cf01648be0a2f4f28deae96

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
MD5
89bbc627d5d8dd07c09458705215285c

SHA1
6632d982e6f0d0b59b1ff5a4c2126d26b6b5918e

SHA256
d3adcfd77878f93248fa6de7f14d676a09216be813f7c2c2ae6282b990435141

SHA512
af9e0e413a3ed7855434252b80edf8b80ba06a75950e85f89d86ff575452afd00fcede173a684f5103ee0455f5167a3da2d33189253a40e03e550ef9307a5803

Download Submit
C:\Users\Admin\Desktop\XHANGERcsgo.exe
MD5
f78f41a09a2d0cd3a997e2f320e18aa9

SHA1
b397f39cac9124102922b6567930c66684863bff

SHA256
4cfb7474b1940e54f532ca39f1afe68928558337e259de308bd7a7f54fd47b6c

SHA512
84da85b1be5342f48e669bcde3f40949ccdea2d01175c14d4605b3c0e0827ec756067d0568a8b0e1716beb7774620dbada2c6291d40fa0f433a71017a076fddf

Download Submit
C:\Users\Admin\Desktop\XHANGERcsgo.exe
MD5
f78f41a09a2d0cd3a997e2f320e18aa9

SHA1
b397f39cac9124102922b6567930c66684863bff

SHA256
4cfb7474b1940e54f532ca39f1afe68928558337e259de308bd7a7f54fd47b6c

SHA512
84da85b1be5342f48e669bcde3f40949ccdea2d01175c14d4605b3c0e0827ec756067d0568a8b0e1716beb7774620dbada2c6291d40fa0f433a71017a076fddf

Download Submit
C:\Users\Admin\Desktop\XHANGERcsgo.exe
MD5
f78f41a09a2d0cd3a997e2f320e18aa9

SHA1
b397f39cac9124102922b6567930c66684863bff

SHA256
4cfb7474b1940e54f532ca39f1afe68928558337e259de308bd7a7f54fd47b6c

SHA512
84da85b1be5342f48e669bcde3f40949ccdea2d01175c14d4605b3c0e0827ec756067d0568a8b0e1716beb7774620dbada2c6291d40fa0f433a71017a076fddf

Download Submit
C:\Users\Admin\Desktop\XHANGERcsgo.exe
MD5
f78f41a09a2d0cd3a997e2f320e18aa9

SHA1
b397f39cac9124102922b6567930c66684863bff

SHA256
4cfb7474b1940e54f532ca39f1afe68928558337e259de308bd7a7f54fd47b6c

SHA512
84da85b1be5342f48e669bcde3f40949ccdea2d01175c14d4605b3c0e0827ec756067d0568a8b0e1716beb7774620dbada2c6291d40fa0f433a71017a076fddf

Download Submit
C:\Users\Admin\Downloads\XHANGERcsgo.rar
MD5
d6274cf34a79b68060a8cc3bceacdb1b

SHA1
7c77564400f4fde314e25618187b2fe2609a9e34

SHA256
655abfc2e5b8ee878a5460c4b8a725576ffa373b8ccc41ce3ac68bd1adee872c

SHA512
ad602dd4a095f9b9e8e349a8f8fd9f0f51d0b0e893418573b3b6c39d81acb06ed13da840abdbb8a4de1a6d66d6c0c3b1c2a08bbebcf29872b3674b248ba3340b

Download Submit
C:\Users\Admin\Downloads\winrar-x64-601.exe
MD5
fd89b7a343d98c4b49bd4488f044f8b5

SHA1
dda26c8b2b0d953ed044557becd5069cfc43470e

SHA256
4133385f3e53f760edccd7ea31fe060ce2f8d72f956d902c0b0c053a4971df2c

SHA512
9b897be51947871cbc4a3395e4f25644ac5bf328c86b033c58b127710264abb1486dac28f91b421c6f8e1196466fd91313acd379077fdfba7795df8cb929a7b2

Download Submit
C:\Users\Admin\Downloads\winrar-x64-601.exe
MD5
fd89b7a343d98c4b49bd4488f044f8b5

SHA1
dda26c8b2b0d953ed044557becd5069cfc43470e

SHA256
4133385f3e53f760edccd7ea31fe060ce2f8d72f956d902c0b0c053a4971df2c

SHA512
9b897be51947871cbc4a3395e4f25644ac5bf328c86b033c58b127710264abb1486dac28f91b421c6f8e1196466fd91313acd379077fdfba7795df8cb929a7b2

Download Submit
C:\Users\Public\13ZlKG4msG.bat
MD5
b9127adea7468ad776385a8f02e8c903

SHA1
82e66fb4a59060f57101141a77a82192706afaa2

SHA256
b63e7debad8b4b65095cb6e87386b838371aadde22b4a5d993aef9d7ffe3a32e

SHA512
798b3b5998211936e68f9afa1592a8c441268de5c9d75c0d8354da363de8956ea40617740ef06103ea05299849b1f7aa4f680e229b27b21420cfab8f51194570

Download Submit
C:\dllcommon\dllcommonmonitordll.exe
MD5
f6412efd69e1abab2a242da134889b4b

SHA1
7375e429b9fb0e8c7a03dacc7260f1204a8fe226

SHA256
51ba79258787d8171e15ba82713f7d9310c0723b91fcd4568c2c15a039716f67

SHA512
641002ac4b7e33a322d1080a9ea3a2ee1f6f50adff1a236d9a7712935c408fac4ab55f93a122497c4b22105f0f16134ca3d08b911581e40724aa61e3bfc703cc

Download Submit
C:\dllcommon\dllcommonmonitordll.exe
MD5
f6412efd69e1abab2a242da134889b4b

SHA1
7375e429b9fb0e8c7a03dacc7260f1204a8fe226

SHA256
51ba79258787d8171e15ba82713f7d9310c0723b91fcd4568c2c15a039716f67

SHA512
641002ac4b7e33a322d1080a9ea3a2ee1f6f50adff1a236d9a7712935c408fac4ab55f93a122497c4b22105f0f16134ca3d08b911581e40724aa61e3bfc703cc

Download Submit
C:\dllcommon\dllcommonmonitordll.exe
MD5
f6412efd69e1abab2a242da134889b4b

SHA1
7375e429b9fb0e8c7a03dacc7260f1204a8fe226

SHA256
51ba79258787d8171e15ba82713f7d9310c0723b91fcd4568c2c15a039716f67

SHA512
641002ac4b7e33a322d1080a9ea3a2ee1f6f50adff1a236d9a7712935c408fac4ab55f93a122497c4b22105f0f16134ca3d08b911581e40724aa61e3bfc703cc

Download Submit
C:\dllcommon\dllcommonmonitordll.exe
MD5
f6412efd69e1abab2a242da134889b4b

SHA1
7375e429b9fb0e8c7a03dacc7260f1204a8fe226

SHA256
51ba79258787d8171e15ba82713f7d9310c0723b91fcd4568c2c15a039716f67

SHA512
641002ac4b7e33a322d1080a9ea3a2ee1f6f50adff1a236d9a7712935c408fac4ab55f93a122497c4b22105f0f16134ca3d08b911581e40724aa61e3bfc703cc

Download Submit
C:\dllcommon\lZ7qJ0Y8s.vbe
MD5
ad32c1633fc81719ef8e488628253064

SHA1
d9c416e7c0e587b4e15d91dc4544ee9e5b0414da

SHA256
6072a192ecb683af1401bef260c6ddc634cae6d3506e715ebca75fda5921a99c

SHA512
0044522537aad09ba4b973b926e60881252c906925641e09605d9046c28e1ccfbd1f4506bfc3bcaed12cf6d153d4c019e7354de223525ac379c61ad6336dafcc

Download Submit
C:\dllcommon\se4b4LLfM0BNfxMBzpSP.bat
MD5
10e8a097b270c3354937f8656a55bc2b

SHA1
21694e8ceb68d1ba3d9f4c81d1c3c4dd5d3f98ae

SHA256
6f9f3f08beba718c91e33c1593e71f320d526fa0825d1ba9004769583555ff76

SHA512
8c1f24e5ca4f01b0c1c9844781ef67e29235290c68aa23d8caa732cb3666d6b505ccac6797b406e347ad42b5320b9351955a4528a0726d0ebea93efa34e74ba7

Download Submit
C:\start.exe
MD5
1955b63613b2cc5ad34a9433153a844f

SHA1
0b7ad659cc50ad38b1179a29a2efc0b91f0e8cb1

SHA256
b73c0b4e8d404487745c60a4c2309c50aa3fd03f21ee35b5cd3085c4ce82336e

SHA512
ec46e4d171b898bbf563cb48e0e4e944bba0d963d442d79cac5d274523f8ba7fa17f8c9be956a5a322ac3d0fdedbc3f0f032076486e7e9b25c546a33e7d52005

Download Submit
C:\start.exe
MD5
1955b63613b2cc5ad34a9433153a844f

SHA1
0b7ad659cc50ad38b1179a29a2efc0b91f0e8cb1

SHA256
b73c0b4e8d404487745c60a4c2309c50aa3fd03f21ee35b5cd3085c4ce82336e

SHA512
ec46e4d171b898bbf563cb48e0e4e944bba0d963d442d79cac5d274523f8ba7fa17f8c9be956a5a322ac3d0fdedbc3f0f032076486e7e9b25c546a33e7d52005

Download Submit
\Program Files\WinRAR\RarExt.dll
MD5
92839ae3a30782319f31d88a6edcb02a

SHA1
4e674c087cc1af6e7957802a17b897de8cb466ec

SHA256
f74664f25da3b87f7cbe3da8f449e52c27ff3ad026e3d1de3e5f22dd0c43ea7d

SHA512
3e5530de3d5a3b7e169be16dfc52cb889aed9f9a25acd2bcfed32ca6d170f3567bf12a361a2c69611cf55e279dc40138ac402088cc7ecd4d5442e3d7aeb142b4

Download Submit
memory/680-114-0x0000000000000000-mapping.dmp

Download
memory/1292-177-0x0000000000000000-mapping.dmp

Download
memory/1296-255-0x0000000000000000-mapping.dmp

Download
memory/1408-178-0x0000000000000000-mapping.dmp

Download
memory/1408-181-0x000002723CB50000-0x000002723CB51000-memory.dmp

Filesize
4KB

Download
memory/1408-195-0x0000027257190000-0x0000027257192000-memory.dmp

Filesize
8KB

Download
memory/1624-124-0x0000000000000000-mapping.dmp

Download
memory/1716-272-0x0000000000000000-mapping.dmp

Download
memory/2088-251-0x0000000000000000-mapping.dmp

Download
memory/2280-227-0x0000000000000000-mapping.dmp

Download
memory/2420-116-0x0000000000000000-mapping.dmp

Download
memory/2720-183-0x0000000000000000-mapping.dmp

Download
memory/2744-188-0x0000000000000000-mapping.dmp

Download
memory/2756-206-0x0000000000000000-mapping.dmp

Download
memory/3152-256-0x0000000000000000-mapping.dmp

Download
memory/3160-200-0x0000000000000000-mapping.dmp

Download
memory/3192-266-0x0000000000000000-mapping.dmp

Download
memory/3312-191-0x0000000001370000-0x0000000001371000-memory.dmp

Filesize
4KB

Download
memory/3312-173-0x0000000000000000-mapping.dmp

Download
memory/3400-121-0x0000000000000000-mapping.dmp

Download
memory/3468-228-0x0000000000000000-mapping.dmp

Download
memory/3468-247-0x000002B4510E0000-0x000002B4510E2000-memory.dmp

Filesize
8KB

Download
memory/3568-166-0x0000000000000000-mapping.dmp

Download
memory/3828-205-0x0000000000000000-mapping.dmp

Download
memory/3896-222-0x0000000000000000-mapping.dmp

Download
memory/4036-202-0x0000000000000000-mapping.dmp

Download
memory/4056-276-0x0000000000000000-mapping.dmp

Download
memory/4056-290-0x00000279A7EF0000-0x00000279A7EF2000-memory.dmp

Filesize
8KB

Download
memory/4072-221-0x0000000000000000-mapping.dmp

Download
memory/4264-280-0x0000000000000000-mapping.dmp

Download
memory/4388-187-0x0000000000000000-mapping.dmp

Download
memory/4444-201-0x0000000000000000-mapping.dmp

Download
memory/4496-138-0x0000000000000000-mapping.dmp

Download
memory/4500-171-0x0000000000000000-mapping.dmp

Download
memory/4544-285-0x0000000000000000-mapping.dmp

Download
memory/4564-216-0x0000000000000000-mapping.dmp

Download
memory/4588-126-0x0000000000000000-mapping.dmp

Download
memory/4632-199-0x0000000000000000-mapping.dmp

Download
memory/4640-198-0x0000000000000000-mapping.dmp

Download
memory/4644-248-0x0000000000000000-mapping.dmp

Download
memory/4656-226-0x0000015D6B6E0000-0x0000015D6B6E1000-memory.dmp

Filesize
4KB

Download
memory/4656-225-0x0000015D6B570000-0x0000015D6B572000-memory.dmp

Filesize
8KB

Download
memory/4656-207-0x0000000000000000-mapping.dmp

Download
memory/4656-215-0x0000015D6B530000-0x0000015D6B532000-memory.dmp

Filesize
8KB

Download
memory/4676-197-0x0000000000000000-mapping.dmp

Download
memory/4688-284-0x0000000000000000-mapping.dmp

Download
memory/4728-230-0x0000000000000000-mapping.dmp

Download
memory/4944-271-0x0000000000000000-mapping.dmp

Download
memory/4948-128-0x0000000000000000-mapping.dmp

Download
memory/4984-239-0x0000000000000000-mapping.dmp

Download
memory/5016-244-0x0000000000000000-mapping.dmp

Download
memory/5032-196-0x0000000000000000-mapping.dmp

Download
memory/5076-203-0x0000000000000000-mapping.dmp

Download
memory/5080-275-0x0000000000000000-mapping.dmp

Download