amadey | 8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0

Analysis

max time kernel
150s
max time network
161s
platform
windows10_x64
resource
win10v20210410
submitted
18-07-2021 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sonia_5.exe
Size

1014KB
MD5

0c3f670f496ffcf516fe77d2a161a6ee
SHA1

0c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA256

8ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512

bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095

Malware Config

Extracted

Family

amadey

Version

2.31

x-vpn.ug/hfV3vDtt/index.php

Extracted

Family

redline

Botnet

18_7_r

xtarweanda.xyz:80

Extracted

Family

redline

Botnet

ISUS_20.2

45.14.49.91:60919

Extracted

Family

smokeloader

Version

2020

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32

Extracted

Family

vidar

Version

39.6

Botnet

903

https://sslamlssa1.tumblr.com/

Attributes

profile_id
903

Extracted

Family

vidar

Version

39.6

Botnet

865

https://sslamlssa1.tumblr.com/

Attributes

profile_id
865

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

fickerstealer

195.133.40.204:80

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3884-312-0x0000000002F90000-0x00000000038B6000-memory.dmp	family_glupteba
behavioral2/memory/3884-325-0x0000000000400000-0x0000000000DC8000-memory.dmp	family_glupteba
behavioral2/memory/6088-621-0x0000000000400000-0x0000000000DC8000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rUNdlL32.eXe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4188 4260 rUNdlL32.eXe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	4260	rUNdlL32.eXe

RedLine Payload 11 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3680-177-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/3148-178-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
C:\Users\Admin\Documents\cwsdPnZGjAi_FPYO7KEbmqzl.exe	family_redline
C:\Users\Admin\Documents\cwsdPnZGjAi_FPYO7KEbmqzl.exe	family_redline
C:\Users\Admin\Documents\M4JrLlVrDD5Ze8GTRaaUqJoM.exe	family_redline
C:\Users\Admin\Documents\M4JrLlVrDD5Ze8GTRaaUqJoM.exe	family_redline
behavioral2/memory/3148-190-0x0000000000417E32-mapping.dmp	family_redline
behavioral2/memory/3680-189-0x0000000000417E1E-mapping.dmp	family_redline
behavioral2/memory/3680-251-0x0000000004F80000-0x0000000005586000-memory.dmp	family_redline
behavioral2/memory/3148-255-0x0000000005440000-0x0000000005A46000-memory.dmp	family_redline
behavioral2/memory/4376-397-0x0000000000417E22-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Documents\XZAL2G3Sid_XAMpcQ3mKxGuq.exe	family_socelars
C:\Users\Admin\Documents\XZAL2G3Sid_XAMpcQ3mKxGuq.exe	family_socelars

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 5948 created 3884 5948 svchost.exe 3rtWRthgB2W9e8nY9ufdp1kz.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

description	pid	process	target process
PID 5948 created 3884	5948	svchost.exe	3rtWRthgB2W9e8nY9ufdp1kz.exe

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4548-267-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
C:\Users\Admin\AppData\Local\Temp\11111.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\11111.exe	Nirsoft

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4668-275-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4668-285-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral2/memory/4668-277-0x000000000046B76D-mapping.dmp	family_vidar
behavioral2/memory/3956-291-0x0000000000400000-0x00000000009F0000-memory.dmp	family_vidar
behavioral2/memory/3956-290-0x0000000000C60000-0x0000000000CFD000-memory.dmp	family_vidar

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

310 2784 rundll32.exe
Downloads MZ/PE file

flow	pid	process
310	2784	rundll32.exe

Executes dropped EXE 41 IoCs

Processes:

t05xed1fYoSLKLbRya1CgOAv.exeM5xGPs27zaycOiET0g603okC.exeXnLdZGw0yAkFjIzBqmH2ClXN.exeHo_Uqt4TqeQgeYnt9UwymG6s.exeDbHTceg0Mqp20N1luU3yNPN3.exeXZAL2G3Sid_XAMpcQ3mKxGuq.exeIa3oVvJVGMyzwfEjr_thwyqL.exetiSvXhhFN8OEawcis53uKn28.exeDbHTceg0Mqp20N1luU3yNPN3.exedrbux.exeehVKYxj76hiy0hQaVPiTUs5L.exebRv69fCW3deWNFJe_mAzX_3E.exeh5m_E56R52adOkg6cYnKOPXA.exeyP7GpXolJz6ICqw9nxOV6aVI.execwsdPnZGjAi_FPYO7KEbmqzl.exe8_y9Ueco9NkYPa23TSHNKEh2.exenN_hZmjZz8kXJGRDXl_6YINH.exe3rtWRthgB2W9e8nY9ufdp1kz.exeM4JrLlVrDD5Ze8GTRaaUqJoM.exeXnLdZGw0yAkFjIzBqmH2ClXN.exet05xed1fYoSLKLbRya1CgOAv.exe526375241.exejooyu.exejingzhang.exemd8_8eus.exe11111.exeM5xGPs27zaycOiET0g603okC.exejfiag3g_gg.exeh5m_E56R52adOkg6cYnKOPXA.exe11111.exe22222.exe526375241.exejfiag3g_gg.exe1163330601.exe1163330601.exe22222.exedrbux.exe3rtWRthgB2W9e8nY9ufdp1kz.exeehVKYxj76hiy0hQaVPiTUs5L.exedrbux.exe

pid	process
3576	t05xed1fYoSLKLbRya1CgOAv.exe
3948	M5xGPs27zaycOiET0g603okC.exe
2112	XnLdZGw0yAkFjIzBqmH2ClXN.exe
2136	Ho_Uqt4TqeQgeYnt9UwymG6s.exe
2088	DbHTceg0Mqp20N1luU3yNPN3.exe
2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
2328	Ia3oVvJVGMyzwfEjr_thwyqL.exe
2168	tiSvXhhFN8OEawcis53uKn28.exe
2768	DbHTceg0Mqp20N1luU3yNPN3.exe
3856	drbux.exe
2276	ehVKYxj76hiy0hQaVPiTUs5L.exe
3592	bRv69fCW3deWNFJe_mAzX_3E.exe
3944	h5m_E56R52adOkg6cYnKOPXA.exe
3956	yP7GpXolJz6ICqw9nxOV6aVI.exe
744	cwsdPnZGjAi_FPYO7KEbmqzl.exe
3356	8_y9Ueco9NkYPa23TSHNKEh2.exe
2324	nN_hZmjZz8kXJGRDXl_6YINH.exe
3884	3rtWRthgB2W9e8nY9ufdp1kz.exe
1764	M4JrLlVrDD5Ze8GTRaaUqJoM.exe
3680	XnLdZGw0yAkFjIzBqmH2ClXN.exe
3148	t05xed1fYoSLKLbRya1CgOAv.exe
4328	526375241.exe
4356	jooyu.exe
4404	jingzhang.exe
4448	md8_8eus.exe
4548	11111.exe
4668	M5xGPs27zaycOiET0g603okC.exe
5084	jfiag3g_gg.exe
420	h5m_E56R52adOkg6cYnKOPXA.exe
4328	526375241.exe
5112	11111.exe
1344	22222.exe
4376	526375241.exe
4560	jfiag3g_gg.exe
4492	1163330601.exe
3600	1163330601.exe
4684	22222.exe
4864	drbux.exe
6088	3rtWRthgB2W9e8nY9ufdp1kz.exe
5192	ehVKYxj76hiy0hQaVPiTUs5L.exe
5788	drbux.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\Documents\nN_hZmjZz8kXJGRDXl_6YINH.exe	vmprotect
behavioral2/memory/2324-223-0x0000000000400000-0x0000000000651000-memory.dmp	vmprotect
C:\Users\Admin\Documents\nN_hZmjZz8kXJGRDXl_6YINH.exe	vmprotect
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	vmprotect
behavioral2/memory/4448-262-0x0000000000400000-0x00000000005DE000-memory.dmp	vmprotect
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	vmprotect

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

M4JrLlVrDD5Ze8GTRaaUqJoM.execwsdPnZGjAi_FPYO7KEbmqzl.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	M4JrLlVrDD5Ze8GTRaaUqJoM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	M4JrLlVrDD5Ze8GTRaaUqJoM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cwsdPnZGjAi_FPYO7KEbmqzl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cwsdPnZGjAi_FPYO7KEbmqzl.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sonia_5.exeIa3oVvJVGMyzwfEjr_thwyqL.exejingzhang.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	sonia_5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Ia3oVvJVGMyzwfEjr_thwyqL.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	jingzhang.exe

Loads dropped DLL 13 IoCs

Processes:

DbHTceg0Mqp20N1luU3yNPN3.exerundll32.exerUNdlL32.eXeyP7GpXolJz6ICqw9nxOV6aVI.exeM5xGPs27zaycOiET0g603okC.exe1163330601.exerundll32.exe

pid	process
2768	DbHTceg0Mqp20N1luU3yNPN3.exe
4488	rundll32.exe
4104	rUNdlL32.eXe
3956	yP7GpXolJz6ICqw9nxOV6aVI.exe
4668	M5xGPs27zaycOiET0g603okC.exe
4668	M5xGPs27zaycOiET0g603okC.exe
3956	yP7GpXolJz6ICqw9nxOV6aVI.exe
3600	1163330601.exe
3600	1163330601.exe
3600	1163330601.exe
3600	1163330601.exe
3600	1163330601.exe
2784	rundll32.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/3948-221-0x0000000000A60000-0x0000000000A68000-memory.dmp	agile_net

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\cwsdPnZGjAi_FPYO7KEbmqzl.exe	themida
C:\Users\Admin\Documents\cwsdPnZGjAi_FPYO7KEbmqzl.exe	themida
C:\Users\Admin\Documents\M4JrLlVrDD5Ze8GTRaaUqJoM.exe	themida
C:\Users\Admin\Documents\M4JrLlVrDD5Ze8GTRaaUqJoM.exe	themida
behavioral2/memory/744-240-0x00000000003D0000-0x00000000003D1000-memory.dmp	themida
behavioral2/memory/1764-254-0x0000000000DE0000-0x0000000000DE1000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

cwsdPnZGjAi_FPYO7KEbmqzl.exeM4JrLlVrDD5Ze8GTRaaUqJoM.exenN_hZmjZz8kXJGRDXl_6YINH.exemd8_8eus.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cwsdPnZGjAi_FPYO7KEbmqzl.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	M4JrLlVrDD5Ze8GTRaaUqJoM.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nN_hZmjZz8kXJGRDXl_6YINH.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md8_8eus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ipinfo.io
7 ipinfo.io
94 ip-api.com
299 api.ipify.org

flow	ioc
5	ipinfo.io
7	ipinfo.io
94	ip-api.com
299	api.ipify.org

Drops file in System32 directory 2 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 9B0AF6719B5A8BA0	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

cwsdPnZGjAi_FPYO7KEbmqzl.exeM4JrLlVrDD5Ze8GTRaaUqJoM.exe

pid process

744 cwsdPnZGjAi_FPYO7KEbmqzl.exe
1764 M4JrLlVrDD5Ze8GTRaaUqJoM.exe

pid	process
744	cwsdPnZGjAi_FPYO7KEbmqzl.exe
1764	M4JrLlVrDD5Ze8GTRaaUqJoM.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

DbHTceg0Mqp20N1luU3yNPN3.exeXnLdZGw0yAkFjIzBqmH2ClXN.exet05xed1fYoSLKLbRya1CgOAv.exeM5xGPs27zaycOiET0g603okC.exesvchost.exe526375241.exe1163330601.exeehVKYxj76hiy0hQaVPiTUs5L.exe

description	pid	process	target process
PID 2088 set thread context of 2768	2088	DbHTceg0Mqp20N1luU3yNPN3.exe	DbHTceg0Mqp20N1luU3yNPN3.exe
PID 2112 set thread context of 3680	2112	XnLdZGw0yAkFjIzBqmH2ClXN.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 3576 set thread context of 3148	3576	t05xed1fYoSLKLbRya1CgOAv.exe	t05xed1fYoSLKLbRya1CgOAv.exe
PID 3948 set thread context of 4668	3948	M5xGPs27zaycOiET0g603okC.exe	M5xGPs27zaycOiET0g603okC.exe
PID 512 set thread context of 2236	512	svchost.exe	svchost.exe
PID 4328 set thread context of 4376	4328	526375241.exe	526375241.exe
PID 4492 set thread context of 3600	4492	1163330601.exe	1163330601.exe
PID 2276 set thread context of 5192	2276	ehVKYxj76hiy0hQaVPiTUs5L.exe	ehVKYxj76hiy0hQaVPiTUs5L.exe

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\Documents\Ia3oVvJVGMyzwfEjr_thwyqL.exe	autoit_exe
C:\Users\Admin\Documents\Ia3oVvJVGMyzwfEjr_thwyqL.exe	autoit_exe

Drops file in Program Files directory 12 IoCs

Processes:

md8_8eus.exe8_y9Ueco9NkYPa23TSHNKEh2.exe

description	ioc	process
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jingzhang.exe	8_y9Ueco9NkYPa23TSHNKEh2.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	8_y9Ueco9NkYPa23TSHNKEh2.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\file4.exe	8_y9Ueco9NkYPa23TSHNKEh2.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jooyu.exe	8_y9Ueco9NkYPa23TSHNKEh2.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	8_y9Ueco9NkYPa23TSHNKEh2.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	8_y9Ueco9NkYPa23TSHNKEh2.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5052	3592	WerFault.exe	bRv69fCW3deWNFJe_mAzX_3E.exe
4512	3884	WerFault.exe	3rtWRthgB2W9e8nY9ufdp1kz.exe
4748	6088	WerFault.exe	3rtWRthgB2W9e8nY9ufdp1kz.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

DbHTceg0Mqp20N1luU3yNPN3.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DbHTceg0Mqp20N1luU3yNPN3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DbHTceg0Mqp20N1luU3yNPN3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DbHTceg0Mqp20N1luU3yNPN3.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exeM5xGPs27zaycOiET0g603okC.exeyP7GpXolJz6ICqw9nxOV6aVI.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	M5xGPs27zaycOiET0g603okC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	M5xGPs27zaycOiET0g603okC.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	yP7GpXolJz6ICqw9nxOV6aVI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	yP7GpXolJz6ICqw9nxOV6aVI.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4792 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

6052 timeout.exe
5564 timeout.exe
4852 timeout.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

4592 taskkill.exe
5108 taskkill.exe
4544 taskkill.exe

pid	process
4792	schtasks.exe

pid	process
6052	timeout.exe
5564	timeout.exe
4852	timeout.exe

pid	process
4592	taskkill.exe
5108	taskkill.exe
4544	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

3rtWRthgB2W9e8nY9ufdp1kz.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	3rtWRthgB2W9e8nY9ufdp1kz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	3rtWRthgB2W9e8nY9ufdp1kz.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = a0e6ac5a9783d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = d043f99d227cd701	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F}	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d9d6ab3ef07bd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000cf24ade0572c53cad9f1f53d800dbf6f4776ff98fb075b73d4ee21ec4066b00bf67b0bebdcc6d6bf3b420f2230dd29049eacdfd64148f3f5d8b8b3c5bf57	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = e171063ff07bd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = da572e39f07bd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{B4215DC4-435F-4583-AC62-C943BDCB55BD}"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

XZAL2G3Sid_XAMpcQ3mKxGuq.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	XZAL2G3Sid_XAMpcQ3mKxGuq.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

6076 PING.EXE

pid	process
6076	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Ho_Uqt4TqeQgeYnt9UwymG6s.exeDbHTceg0Mqp20N1luU3yNPN3.exedrbux.exe

pid	process
2136	Ho_Uqt4TqeQgeYnt9UwymG6s.exe
2136	Ho_Uqt4TqeQgeYnt9UwymG6s.exe
2136	Ho_Uqt4TqeQgeYnt9UwymG6s.exe
2136	Ho_Uqt4TqeQgeYnt9UwymG6s.exe
2768	DbHTceg0Mqp20N1luU3yNPN3.exe
2768	DbHTceg0Mqp20N1luU3yNPN3.exe
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3856	drbux.exe
3856	drbux.exe
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036
3036

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3036
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

DbHTceg0Mqp20N1luU3yNPN3.exeMicrosoftEdgeCP.exe

pid process

2768 DbHTceg0Mqp20N1luU3yNPN3.exe
5536 MicrosoftEdgeCP.exe
5536 MicrosoftEdgeCP.exe

pid	process
3036

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

XZAL2G3Sid_XAMpcQ3mKxGuq.exeM5xGPs27zaycOiET0g603okC.exeWerFault.exerundll32.exesvchost.exe

description	pid	process
Token: SeCreateTokenPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeAssignPrimaryTokenPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeLockMemoryPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeIncreaseQuotaPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeMachineAccountPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeTcbPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeSecurityPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeTakeOwnershipPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeLoadDriverPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeSystemProfilePrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeSystemtimePrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeProfSingleProcessPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeIncBasePriorityPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeCreatePagefilePrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeCreatePermanentPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeBackupPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeRestorePrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeShutdownPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeDebugPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeAuditPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeSystemEnvironmentPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeChangeNotifyPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeRemoteShutdownPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeUndockPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeSyncAgentPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeEnableDelegationPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeManageVolumePrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeImpersonatePrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeCreateGlobalPrivilege	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: 31	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: 32	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: 33	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: 34	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: 35	2352	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeDebugPrivilege	3948	M5xGPs27zaycOiET0g603okC.exe
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeRestorePrivilege	5052	WerFault.exe
Token: SeBackupPrivilege	5052	WerFault.exe
Token: SeDebugPrivilege	5052	WerFault.exe
Token: SeDebugPrivilege	4488	rundll32.exe
Token: SeDebugPrivilege	512	svchost.exe
Token: SeDebugPrivilege	4488	rundll32.exe
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036
Token: SeCreatePagefilePrivilege	3036
Token: SeShutdownPrivilege	3036

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

3036
3036
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

pid process

3036
3036
3036
3036
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3036
2160 MicrosoftEdge.exe
5536 MicrosoftEdgeCP.exe
5536 MicrosoftEdgeCP.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3036

pid	process
3036
3036

pid	process
3036
3036
3036
3036

pid	process
3036
2160	MicrosoftEdge.exe
5536	MicrosoftEdgeCP.exe
5536	MicrosoftEdgeCP.exe

pid	process
3036

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

sonia_5.exeXnLdZGw0yAkFjIzBqmH2ClXN.exet05xed1fYoSLKLbRya1CgOAv.exeDbHTceg0Mqp20N1luU3yNPN3.exeHo_Uqt4TqeQgeYnt9UwymG6s.exe

description	pid	process	target process
PID 2016 wrote to memory of 3576	2016	sonia_5.exe	t05xed1fYoSLKLbRya1CgOAv.exe
PID 2016 wrote to memory of 3576	2016	sonia_5.exe	t05xed1fYoSLKLbRya1CgOAv.exe
PID 2016 wrote to memory of 3576	2016	sonia_5.exe	t05xed1fYoSLKLbRya1CgOAv.exe
PID 2016 wrote to memory of 3948	2016	sonia_5.exe	M5xGPs27zaycOiET0g603okC.exe
PID 2016 wrote to memory of 3948	2016	sonia_5.exe	M5xGPs27zaycOiET0g603okC.exe
PID 2016 wrote to memory of 3948	2016	sonia_5.exe	M5xGPs27zaycOiET0g603okC.exe
PID 2016 wrote to memory of 2112	2016	sonia_5.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 2016 wrote to memory of 2112	2016	sonia_5.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 2016 wrote to memory of 2112	2016	sonia_5.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 2016 wrote to memory of 2136	2016	sonia_5.exe	Ho_Uqt4TqeQgeYnt9UwymG6s.exe
PID 2016 wrote to memory of 2136	2016	sonia_5.exe	Ho_Uqt4TqeQgeYnt9UwymG6s.exe
PID 2016 wrote to memory of 2136	2016	sonia_5.exe	Ho_Uqt4TqeQgeYnt9UwymG6s.exe
PID 2016 wrote to memory of 2328	2016	sonia_5.exe	Ia3oVvJVGMyzwfEjr_thwyqL.exe
PID 2016 wrote to memory of 2328	2016	sonia_5.exe	Ia3oVvJVGMyzwfEjr_thwyqL.exe
PID 2016 wrote to memory of 2328	2016	sonia_5.exe	Ia3oVvJVGMyzwfEjr_thwyqL.exe
PID 2016 wrote to memory of 2088	2016	sonia_5.exe	DbHTceg0Mqp20N1luU3yNPN3.exe
PID 2016 wrote to memory of 2088	2016	sonia_5.exe	DbHTceg0Mqp20N1luU3yNPN3.exe
PID 2016 wrote to memory of 2088	2016	sonia_5.exe	DbHTceg0Mqp20N1luU3yNPN3.exe
PID 2016 wrote to memory of 2352	2016	sonia_5.exe	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
PID 2016 wrote to memory of 2352	2016	sonia_5.exe	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
PID 2016 wrote to memory of 2352	2016	sonia_5.exe	XZAL2G3Sid_XAMpcQ3mKxGuq.exe
PID 2016 wrote to memory of 2168	2016	sonia_5.exe	tiSvXhhFN8OEawcis53uKn28.exe
PID 2016 wrote to memory of 2168	2016	sonia_5.exe	tiSvXhhFN8OEawcis53uKn28.exe
PID 2112 wrote to memory of 3680	2112	XnLdZGw0yAkFjIzBqmH2ClXN.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 2112 wrote to memory of 3680	2112	XnLdZGw0yAkFjIzBqmH2ClXN.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 2112 wrote to memory of 3680	2112	XnLdZGw0yAkFjIzBqmH2ClXN.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 3576 wrote to memory of 3148	3576	t05xed1fYoSLKLbRya1CgOAv.exe	t05xed1fYoSLKLbRya1CgOAv.exe
PID 3576 wrote to memory of 3148	3576	t05xed1fYoSLKLbRya1CgOAv.exe	t05xed1fYoSLKLbRya1CgOAv.exe
PID 3576 wrote to memory of 3148	3576	t05xed1fYoSLKLbRya1CgOAv.exe	t05xed1fYoSLKLbRya1CgOAv.exe
PID 2088 wrote to memory of 2768	2088	DbHTceg0Mqp20N1luU3yNPN3.exe	DbHTceg0Mqp20N1luU3yNPN3.exe
PID 2088 wrote to memory of 2768	2088	DbHTceg0Mqp20N1luU3yNPN3.exe	DbHTceg0Mqp20N1luU3yNPN3.exe
PID 2088 wrote to memory of 2768	2088	DbHTceg0Mqp20N1luU3yNPN3.exe	DbHTceg0Mqp20N1luU3yNPN3.exe
PID 2088 wrote to memory of 2768	2088	DbHTceg0Mqp20N1luU3yNPN3.exe	DbHTceg0Mqp20N1luU3yNPN3.exe
PID 2088 wrote to memory of 2768	2088	DbHTceg0Mqp20N1luU3yNPN3.exe	DbHTceg0Mqp20N1luU3yNPN3.exe
PID 2088 wrote to memory of 2768	2088	DbHTceg0Mqp20N1luU3yNPN3.exe	DbHTceg0Mqp20N1luU3yNPN3.exe
PID 2136 wrote to memory of 3856	2136	Ho_Uqt4TqeQgeYnt9UwymG6s.exe	drbux.exe
PID 2136 wrote to memory of 3856	2136	Ho_Uqt4TqeQgeYnt9UwymG6s.exe	drbux.exe
PID 2136 wrote to memory of 3856	2136	Ho_Uqt4TqeQgeYnt9UwymG6s.exe	drbux.exe
PID 2016 wrote to memory of 2276	2016	sonia_5.exe	ehVKYxj76hiy0hQaVPiTUs5L.exe
PID 2016 wrote to memory of 2276	2016	sonia_5.exe	ehVKYxj76hiy0hQaVPiTUs5L.exe
PID 2016 wrote to memory of 2276	2016	sonia_5.exe	ehVKYxj76hiy0hQaVPiTUs5L.exe
PID 2016 wrote to memory of 3592	2016	sonia_5.exe	bRv69fCW3deWNFJe_mAzX_3E.exe
PID 2016 wrote to memory of 3592	2016	sonia_5.exe	bRv69fCW3deWNFJe_mAzX_3E.exe
PID 2016 wrote to memory of 3592	2016	sonia_5.exe	bRv69fCW3deWNFJe_mAzX_3E.exe
PID 2016 wrote to memory of 3944	2016	sonia_5.exe	h5m_E56R52adOkg6cYnKOPXA.exe
PID 2016 wrote to memory of 3944	2016	sonia_5.exe	h5m_E56R52adOkg6cYnKOPXA.exe
PID 2016 wrote to memory of 3944	2016	sonia_5.exe	h5m_E56R52adOkg6cYnKOPXA.exe
PID 2016 wrote to memory of 3956	2016	sonia_5.exe	yP7GpXolJz6ICqw9nxOV6aVI.exe
PID 2016 wrote to memory of 3956	2016	sonia_5.exe	yP7GpXolJz6ICqw9nxOV6aVI.exe
PID 2016 wrote to memory of 3956	2016	sonia_5.exe	yP7GpXolJz6ICqw9nxOV6aVI.exe
PID 2016 wrote to memory of 744	2016	sonia_5.exe	cwsdPnZGjAi_FPYO7KEbmqzl.exe
PID 2016 wrote to memory of 744	2016	sonia_5.exe	cwsdPnZGjAi_FPYO7KEbmqzl.exe
PID 2016 wrote to memory of 744	2016	sonia_5.exe	cwsdPnZGjAi_FPYO7KEbmqzl.exe
PID 2016 wrote to memory of 3356	2016	sonia_5.exe	8_y9Ueco9NkYPa23TSHNKEh2.exe
PID 2016 wrote to memory of 3356	2016	sonia_5.exe	8_y9Ueco9NkYPa23TSHNKEh2.exe
PID 2016 wrote to memory of 3356	2016	sonia_5.exe	8_y9Ueco9NkYPa23TSHNKEh2.exe
PID 2112 wrote to memory of 3680	2112	XnLdZGw0yAkFjIzBqmH2ClXN.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 2112 wrote to memory of 3680	2112	XnLdZGw0yAkFjIzBqmH2ClXN.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 2112 wrote to memory of 3680	2112	XnLdZGw0yAkFjIzBqmH2ClXN.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 2112 wrote to memory of 3680	2112	XnLdZGw0yAkFjIzBqmH2ClXN.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 2112 wrote to memory of 3680	2112	XnLdZGw0yAkFjIzBqmH2ClXN.exe	XnLdZGw0yAkFjIzBqmH2ClXN.exe
PID 3576 wrote to memory of 3148	3576	t05xed1fYoSLKLbRya1CgOAv.exe	t05xed1fYoSLKLbRya1CgOAv.exe
PID 3576 wrote to memory of 3148	3576	t05xed1fYoSLKLbRya1CgOAv.exe	t05xed1fYoSLKLbRya1CgOAv.exe
PID 3576 wrote to memory of 3148	3576	t05xed1fYoSLKLbRya1CgOAv.exe	t05xed1fYoSLKLbRya1CgOAv.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1404

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2740

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2852

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2724

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2432

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2424

C:\Users\Admin\AppData\Local\Temp\sonia_5.exe
"C:\Users\Admin\AppData\Local\Temp\sonia_5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\Documents\M5xGPs27zaycOiET0g603okC.exe
"C:\Users\Admin\Documents\M5xGPs27zaycOiET0g603okC.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Users\Admin\Documents\M5xGPs27zaycOiET0g603okC.exe
C:\Users\Admin\Documents\M5xGPs27zaycOiET0g603okC.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im M5xGPs27zaycOiET0g603okC.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\M5xGPs27zaycOiET0g603okC.exe" & del C:\ProgramData\*.dll & exit
4⤵
PID:572

C:\Windows\SysWOW64\taskkill.exe
taskkill /im M5xGPs27zaycOiET0g603okC.exe /f
5⤵
- Kills process with taskkill
PID:5108

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
5⤵
- Delays execution with timeout.exe
PID:6052

C:\Users\Admin\Documents\t05xed1fYoSLKLbRya1CgOAv.exe
"C:\Users\Admin\Documents\t05xed1fYoSLKLbRya1CgOAv.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3576

C:\Users\Admin\Documents\t05xed1fYoSLKLbRya1CgOAv.exe
C:\Users\Admin\Documents\t05xed1fYoSLKLbRya1CgOAv.exe
3⤵
- Executes dropped EXE
PID:3148

C:\Users\Admin\Documents\XnLdZGw0yAkFjIzBqmH2ClXN.exe
"C:\Users\Admin\Documents\XnLdZGw0yAkFjIzBqmH2ClXN.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2112

C:\Users\Admin\Documents\XnLdZGw0yAkFjIzBqmH2ClXN.exe
C:\Users\Admin\Documents\XnLdZGw0yAkFjIzBqmH2ClXN.exe
3⤵
- Executes dropped EXE
PID:3680

C:\Users\Admin\Documents\tiSvXhhFN8OEawcis53uKn28.exe
"C:\Users\Admin\Documents\tiSvXhhFN8OEawcis53uKn28.exe"
2⤵
- Executes dropped EXE
PID:2168

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4548

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:5112

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:1344

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4684

C:\Users\Admin\Documents\XZAL2G3Sid_XAMpcQ3mKxGuq.exe
"C:\Users\Admin\Documents\XZAL2G3Sid_XAMpcQ3mKxGuq.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
3⤵
PID:4180

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
4⤵
- Kills process with taskkill
PID:4592

C:\Users\Admin\Documents\Ia3oVvJVGMyzwfEjr_thwyqL.exe
"C:\Users\Admin\Documents\Ia3oVvJVGMyzwfEjr_thwyqL.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
PID:2328

C:\Users\Admin\AppData\Local\Temp\526375241.exe
C:\Users\Admin\AppData\Local\Temp\526375241.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4328

C:\Users\Admin\AppData\Local\Temp\526375241.exe
C:\Users\Admin\AppData\Local\Temp\526375241.exe
4⤵
- Executes dropped EXE
PID:4376

C:\Users\Admin\AppData\Local\Temp\1163330601.exe
C:\Users\Admin\AppData\Local\Temp\1163330601.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4492

C:\Users\Admin\AppData\Local\Temp\1163330601.exe
C:\Users\Admin\AppData\Local\Temp\1163330601.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3600

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\1163330601.exe"
5⤵
PID:5600

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:4852

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\Documents\Ia3oVvJVGMyzwfEjr_thwyqL.exe & exit
3⤵
PID:5844

C:\Windows\SysWOW64\PING.EXE
ping 0
4⤵
- Runs ping.exe
PID:6076

C:\Users\Admin\Documents\DbHTceg0Mqp20N1luU3yNPN3.exe
"C:\Users\Admin\Documents\DbHTceg0Mqp20N1luU3yNPN3.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2088

C:\Users\Admin\Documents\DbHTceg0Mqp20N1luU3yNPN3.exe
"C:\Users\Admin\Documents\DbHTceg0Mqp20N1luU3yNPN3.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2768

C:\Users\Admin\Documents\Ho_Uqt4TqeQgeYnt9UwymG6s.exe
"C:\Users\Admin\Documents\Ho_Uqt4TqeQgeYnt9UwymG6s.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2136

C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe
"C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3856

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8a643770bf\
4⤵
PID:4728

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8a643770bf\
5⤵
PID:652

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN drbux.exe /TR "C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe" /F
4⤵
- Creates scheduled task(s)
PID:4792

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\ProgramData\ca82a716069a53\cred.dll, Main
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2784

C:\Users\Admin\Documents\cwsdPnZGjAi_FPYO7KEbmqzl.exe
"C:\Users\Admin\Documents\cwsdPnZGjAi_FPYO7KEbmqzl.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:744

C:\Users\Admin\Documents\yP7GpXolJz6ICqw9nxOV6aVI.exe
"C:\Users\Admin\Documents\yP7GpXolJz6ICqw9nxOV6aVI.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3956

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im yP7GpXolJz6ICqw9nxOV6aVI.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\yP7GpXolJz6ICqw9nxOV6aVI.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:4968

C:\Windows\SysWOW64\taskkill.exe
taskkill /im yP7GpXolJz6ICqw9nxOV6aVI.exe /f
4⤵
- Kills process with taskkill
PID:4544

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:5564

C:\Users\Admin\Documents\h5m_E56R52adOkg6cYnKOPXA.exe
"C:\Users\Admin\Documents\h5m_E56R52adOkg6cYnKOPXA.exe"
2⤵
- Executes dropped EXE
PID:3944

C:\Users\Admin\Documents\h5m_E56R52adOkg6cYnKOPXA.exe
"C:\Users\Admin\Documents\h5m_E56R52adOkg6cYnKOPXA.exe" -a
3⤵
- Executes dropped EXE
PID:420

C:\Users\Admin\Documents\bRv69fCW3deWNFJe_mAzX_3E.exe
"C:\Users\Admin\Documents\bRv69fCW3deWNFJe_mAzX_3E.exe"
2⤵
- Executes dropped EXE
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 656
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Users\Admin\Documents\ehVKYxj76hiy0hQaVPiTUs5L.exe
"C:\Users\Admin\Documents\ehVKYxj76hiy0hQaVPiTUs5L.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2276

C:\Users\Admin\Documents\ehVKYxj76hiy0hQaVPiTUs5L.exe
"{path}"
3⤵
- Executes dropped EXE
PID:5192

C:\Users\Admin\Documents\8_y9Ueco9NkYPa23TSHNKEh2.exe
"C:\Users\Admin\Documents\8_y9Ueco9NkYPa23TSHNKEh2.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3356

C:\Program Files (x86)\Company\NewProduct\file4.exe
"C:\Program Files (x86)\Company\NewProduct\file4.exe"
3⤵
PID:4328

C:\Program Files (x86)\Company\NewProduct\jooyu.exe
"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
3⤵
- Executes dropped EXE
PID:4356

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
- Executes dropped EXE
PID:5084

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
- Executes dropped EXE
PID:4560

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:4448

C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
"C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
PID:4404

C:\Windows\SysWOW64\rUNdlL32.eXe
"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
4⤵
- Loads dropped DLL
PID:4104

C:\Users\Admin\Documents\3rtWRthgB2W9e8nY9ufdp1kz.exe
"C:\Users\Admin\Documents\3rtWRthgB2W9e8nY9ufdp1kz.exe"
2⤵
- Executes dropped EXE
PID:3884

C:\Users\Admin\Documents\3rtWRthgB2W9e8nY9ufdp1kz.exe
"C:\Users\Admin\Documents\3rtWRthgB2W9e8nY9ufdp1kz.exe"
3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 1228
4⤵
- Program crash
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 776
3⤵
- Program crash
PID:4512

C:\Users\Admin\Documents\M4JrLlVrDD5Ze8GTRaaUqJoM.exe
"C:\Users\Admin\Documents\M4JrLlVrDD5Ze8GTRaaUqJoM.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1764

C:\Users\Admin\Documents\nN_hZmjZz8kXJGRDXl_6YINH.exe
"C:\Users\Admin\Documents\nN_hZmjZz8kXJGRDXl_6YINH.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2324

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1820

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1224

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1184

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1064

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:676

C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe
C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe
2⤵
- Executes dropped EXE
PID:4864

C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe
C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe
2⤵
- Executes dropped EXE
PID:5788

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:68

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2236

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:4188

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2160

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5536

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4172

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:5948

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4436

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2252

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\file4.exe
MD5
02580709c0e95aba9fdd1fbdf7c348e9

SHA1
c39c2f4039262345121ecee1ea62cc4a124a0347

SHA256
70d1bfb908eab66681a858d85bb910b822cc76377010abd6a77fd5a78904ea15

SHA512
1de4f5c98a1330a75f3ccc8a07e095640aac893a41a41bfa7d0cd7ebc11d22b706dbd91e0eb9a8fe027b6365c0d4cad57ab8f1b130a77ac1b1a4da2c21a34cb5

Download Submit
C:\Program Files (x86)\Company\NewProduct\file4.exe
MD5
02580709c0e95aba9fdd1fbdf7c348e9

SHA1
c39c2f4039262345121ecee1ea62cc4a124a0347

SHA256
70d1bfb908eab66681a858d85bb910b822cc76377010abd6a77fd5a78904ea15

SHA512
1de4f5c98a1330a75f3ccc8a07e095640aac893a41a41bfa7d0cd7ebc11d22b706dbd91e0eb9a8fe027b6365c0d4cad57ab8f1b130a77ac1b1a4da2c21a34cb5

Download Submit
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
MD5
a4c547cfac944ad816edf7c54bb58c5c

SHA1
b1d3662d12a400ada141e24bc014c256f5083eb0

SHA256
2f158fe98389b164103a1c3aac49e10520dfd332559d64a546b65af7ef00cd5f

SHA512
ad5891faee33a7f91c5f699017c2c14448ca6fda23ac10dc449354ce2c3e533383df28678e0d170856400f364a99f9996ad35555be891d2d9ef97d83fdd91bbb

Download Submit
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
MD5
a4c547cfac944ad816edf7c54bb58c5c

SHA1
b1d3662d12a400ada141e24bc014c256f5083eb0

SHA256
2f158fe98389b164103a1c3aac49e10520dfd332559d64a546b65af7ef00cd5f

SHA512
ad5891faee33a7f91c5f699017c2c14448ca6fda23ac10dc449354ce2c3e533383df28678e0d170856400f364a99f9996ad35555be891d2d9ef97d83fdd91bbb

Download Submit
C:\Program Files (x86)\Company\NewProduct\jooyu.exe
MD5
aed57d50123897b0012c35ef5dec4184

SHA1
568571b12ca44a585df589dc810bf53adf5e8050

SHA256
096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

SHA512
ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

Download Submit
C:\Program Files (x86)\Company\NewProduct\jooyu.exe
MD5
aed57d50123897b0012c35ef5dec4184

SHA1
568571b12ca44a585df589dc810bf53adf5e8050

SHA256
096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

SHA512
ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

Download Submit
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
MD5
7a151db96e506bd887e3ffa5ab81b1a5

SHA1
1133065fce3b06bd483b05cca09e519b53f71447

SHA256
288376e11301c8ca3eb52871d09133f0199b911a33b9658579929ef6bac8ea6c

SHA512
33b21b9a3f84a847475c99c642447138344fc53379c40044b50768e5ebe2fa5b5064126678151d86fb4aa47e4b4a8fefd2b20ee126abf11d1c9e56d46a2fbe78

Download Submit
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
MD5
7a151db96e506bd887e3ffa5ab81b1a5

SHA1
1133065fce3b06bd483b05cca09e519b53f71447

SHA256
288376e11301c8ca3eb52871d09133f0199b911a33b9658579929ef6bac8ea6c

SHA512
33b21b9a3f84a847475c99c642447138344fc53379c40044b50768e5ebe2fa5b5064126678151d86fb4aa47e4b4a8fefd2b20ee126abf11d1c9e56d46a2fbe78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4
MD5
d33394b86db2d590028ae542551b5a67

SHA1
200fac7cc75d4da652d0918a6fcbae6f7ca2c5a3

SHA256
4d5ff3d32db0d6e78c27f1de69f614c507a0928d24f1de79360cea58096b3859

SHA512
114ceb2a930baeb652710387734691cf9d56d2f60d1db94d9095151b1f537b7c89f504c96f4591e863c0c218ad200485e97e77c06ebd4e60c33958ce24acf167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
793dbf7348c9823c452a8bf3b8ee5748

SHA1
3a8fd3e70ed844bcaf4c5c6d7945b8c8870403eb

SHA256
a826601367542499b19a09880360de6c102c7dc2b841bf2948ec621e1360b523

SHA512
e0bda31709f657c64c65654d6b19ba1db3514dcba6ffdbe878b5d311bb2e0de65fbf091e88365041eebb9bc8578c0e07d6dd6aca052e28ab344a639e255f8d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
db874eca75295d87a905a7ad6c9bebfc

SHA1
c74613ff426e793375795f542b6b4eecf8d0a5a0

SHA256
2a628d73b43ee084d4e2109783fd314cec4c496f4acc727fd2ffa2c701472197

SHA512
d4d96965a4ab96fbe84c2115bf35722e9e707e280402cc04fe9828bb25936ecfb5f58c6174fc5395a8e8c0cc9620f739be742d2d373d5a5f78b97544538986e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4
MD5
cfb4641e7eb7860c9f7779319236a3e3

SHA1
158d9ee454f77c2f94e6796c40454da7ada3abae

SHA256
f668bf453c4b0afdb990b8503896bb608c97f5989839a2d13fbc6ac1622235dd

SHA512
5db44864675bfe15c9a7f48712e88d4782489b9bbd8873522cd9a4c89e0b94de063cf53cc85b7e45c5ca63cb4362767698c2a2df015d395856dd0a1543ba8ab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
8263252865ea03f451386b519f793016

SHA1
d64c1c0a0910bf80709e043a9345370c22156176

SHA256
02b5c8221b0250e97e949c10de02e8b4f2e0e0afdc6485a82d172ed178023530

SHA512
cc29877a3afb1446b9b8f046d1bc99c969b3a95f9a43cea8195ceabff08f5adac870c10a20c3986a36cfb7cfc9a432e46d7c0b0686ad7cd77e4ec9f5fb1f5c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
aa4000c35172d10f91d535f040359da3

SHA1
355a7c0fa9a46dbd1ce20defc68b13f1dde2c596

SHA256
1b15667581397982ba3e0fd42aa47a9825e28e27be6fca91c4085db3d1d20dac

SHA512
c9561dd8b0ecdf034064fcbb8d0278a12695c7af431bd03f296f74e079510b181390fab25285943421e1ffd1e1dd4ebc84b6937a815c739899ed55a918573e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XnLdZGw0yAkFjIzBqmH2ClXN.exe.log
MD5
7438b57da35c10c478469635b79e33e1

SHA1
5ffcbdfbfd800f67d6d9d6ee46de2eb13fcbb9a5

SHA256
b253c066d4a6604aaa5204b09c1edde92c410b0af351f3760891f5e56c867f70

SHA512
5887796f8ceb1c5ae790caff0020084df49ea8d613b78656a47dc9a569c5c86a9b16ec2ebe0d6f34c5e3001026385bb1282434cc3ffc7bda99427c154c04b45a

Download Submit
C:\Users\Admin\AppData\Local\Temp\11111.exe
MD5
cc0d6b6813f92dbf5be3ecacf44d662a

SHA1
b968c57a14ddada4128356f6e39fb66c6d864d3f

SHA256
0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

SHA512
4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\11111.exe
MD5
cc0d6b6813f92dbf5be3ecacf44d662a

SHA1
b968c57a14ddada4128356f6e39fb66c6d864d3f

SHA256
0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

SHA512
4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\15213686645723710336
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe
MD5
6738c904ba78a2268a8950152a6c7448

SHA1
f2e8d6fdaabbfedd6fca2a7676205756b0c72d3c

SHA256
42054b960727fbd72bde57e8903881e4239e9500f1160ca298e10a1b438698a8

SHA512
150711d55bd9b1157cc477e9791c3d43f8bd43b684383aa14df0382350dc3d4a8bae0de41d1d69c1c8b9709f0cbd92ccb8698fd26434b07eb76935987ef4ba22

Download Submit
C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe
MD5
6738c904ba78a2268a8950152a6c7448

SHA1
f2e8d6fdaabbfedd6fca2a7676205756b0c72d3c

SHA256
42054b960727fbd72bde57e8903881e4239e9500f1160ca298e10a1b438698a8

SHA512
150711d55bd9b1157cc477e9791c3d43f8bd43b684383aa14df0382350dc3d4a8bae0de41d1d69c1c8b9709f0cbd92ccb8698fd26434b07eb76935987ef4ba22

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\Documents\3rtWRthgB2W9e8nY9ufdp1kz.exe
MD5
8b3325e6833db2e9ac7af93cf4159767

SHA1
3beb1d23bb334453e85c43ed4147a47a57965078

SHA256
01ad641682189d7f171b8c7385c561bcf7ed8869fdde48d55e7afda67748be21

SHA512
d819316e4839404a5a3daa07ef54c480a25e891be224b7e44820551adc56bacb62936ec443cecab0381b0b620a53b20cbc82b90f267dc6498de2e266648fc165

Download Submit
C:\Users\Admin\Documents\3rtWRthgB2W9e8nY9ufdp1kz.exe
MD5
8b3325e6833db2e9ac7af93cf4159767

SHA1
3beb1d23bb334453e85c43ed4147a47a57965078

SHA256
01ad641682189d7f171b8c7385c561bcf7ed8869fdde48d55e7afda67748be21

SHA512
d819316e4839404a5a3daa07ef54c480a25e891be224b7e44820551adc56bacb62936ec443cecab0381b0b620a53b20cbc82b90f267dc6498de2e266648fc165

Download Submit
C:\Users\Admin\Documents\8_y9Ueco9NkYPa23TSHNKEh2.exe
MD5
623c88cc55a2df1115600910bbe14457

SHA1
8c7e43140b1558b5ccbfeb978567daf57e3fc44f

SHA256
47bb97567ec946832d0bf77a9f2c4300032d4d7b2293f64fcd25d9b83e7c1178

SHA512
501eab92ffcce75126459c267d06e58fef590fd860be63233630126f6008eb083d3d1f87dd419e1aa311e3eed2bbf9366cf722d55d10d02dff79f8615d4989f6

Download Submit
C:\Users\Admin\Documents\8_y9Ueco9NkYPa23TSHNKEh2.exe
MD5
623c88cc55a2df1115600910bbe14457

SHA1
8c7e43140b1558b5ccbfeb978567daf57e3fc44f

SHA256
47bb97567ec946832d0bf77a9f2c4300032d4d7b2293f64fcd25d9b83e7c1178

SHA512
501eab92ffcce75126459c267d06e58fef590fd860be63233630126f6008eb083d3d1f87dd419e1aa311e3eed2bbf9366cf722d55d10d02dff79f8615d4989f6

Download Submit
C:\Users\Admin\Documents\DbHTceg0Mqp20N1luU3yNPN3.exe
MD5
3eef52f6fbd66e5349726b0650276a38

SHA1
6d3229bdc650789a7f1959a0a7dc5d0fa3be81f3

SHA256
8f27a981e44cc3595009f7e78dde8ed1a13f1404b266d8277dab71237384d2a9

SHA512
e487d02c99dfe409d8e851f1408f96d34876c9471583be96efd294b4b7239998f57ed8501424f4d4a56b0b51ba3a34056078216c44dad6892a0d7cc5443640e0

Download Submit
C:\Users\Admin\Documents\DbHTceg0Mqp20N1luU3yNPN3.exe
MD5
3eef52f6fbd66e5349726b0650276a38

SHA1
6d3229bdc650789a7f1959a0a7dc5d0fa3be81f3

SHA256
8f27a981e44cc3595009f7e78dde8ed1a13f1404b266d8277dab71237384d2a9

SHA512
e487d02c99dfe409d8e851f1408f96d34876c9471583be96efd294b4b7239998f57ed8501424f4d4a56b0b51ba3a34056078216c44dad6892a0d7cc5443640e0

Download Submit
C:\Users\Admin\Documents\DbHTceg0Mqp20N1luU3yNPN3.exe
MD5
3eef52f6fbd66e5349726b0650276a38

SHA1
6d3229bdc650789a7f1959a0a7dc5d0fa3be81f3

SHA256
8f27a981e44cc3595009f7e78dde8ed1a13f1404b266d8277dab71237384d2a9

SHA512
e487d02c99dfe409d8e851f1408f96d34876c9471583be96efd294b4b7239998f57ed8501424f4d4a56b0b51ba3a34056078216c44dad6892a0d7cc5443640e0

Download Submit
C:\Users\Admin\Documents\Ho_Uqt4TqeQgeYnt9UwymG6s.exe
MD5
6738c904ba78a2268a8950152a6c7448

SHA1
f2e8d6fdaabbfedd6fca2a7676205756b0c72d3c

SHA256
42054b960727fbd72bde57e8903881e4239e9500f1160ca298e10a1b438698a8

SHA512
150711d55bd9b1157cc477e9791c3d43f8bd43b684383aa14df0382350dc3d4a8bae0de41d1d69c1c8b9709f0cbd92ccb8698fd26434b07eb76935987ef4ba22

Download Submit
C:\Users\Admin\Documents\Ho_Uqt4TqeQgeYnt9UwymG6s.exe
MD5
6738c904ba78a2268a8950152a6c7448

SHA1
f2e8d6fdaabbfedd6fca2a7676205756b0c72d3c

SHA256
42054b960727fbd72bde57e8903881e4239e9500f1160ca298e10a1b438698a8

SHA512
150711d55bd9b1157cc477e9791c3d43f8bd43b684383aa14df0382350dc3d4a8bae0de41d1d69c1c8b9709f0cbd92ccb8698fd26434b07eb76935987ef4ba22

Download Submit
C:\Users\Admin\Documents\Ia3oVvJVGMyzwfEjr_thwyqL.exe
MD5
0e687f422212f97653f43a1a045f5496

SHA1
d50b435bca3c9a19e7b108d714bc37353f356797

SHA256
6f8e8fdc2d137b0a29682876814135b6cb4d72b064285c5e44b4b6b5a43c3f0c

SHA512
93e2e74ea268de63438cd41ce656c9bf6335e1756251745ceb06baf2a25cf8be11f9628dc49df181a4eec8b44be4fcbe8ba208bde96adbf514ad606e99b9841e

Download Submit
C:\Users\Admin\Documents\Ia3oVvJVGMyzwfEjr_thwyqL.exe
MD5
0e687f422212f97653f43a1a045f5496

SHA1
d50b435bca3c9a19e7b108d714bc37353f356797

SHA256
6f8e8fdc2d137b0a29682876814135b6cb4d72b064285c5e44b4b6b5a43c3f0c

SHA512
93e2e74ea268de63438cd41ce656c9bf6335e1756251745ceb06baf2a25cf8be11f9628dc49df181a4eec8b44be4fcbe8ba208bde96adbf514ad606e99b9841e

Download Submit
C:\Users\Admin\Documents\M4JrLlVrDD5Ze8GTRaaUqJoM.exe
MD5
6a0f452a2dbcd500aa1ef859f1b66449

SHA1
e2e0c72b10142e33dce731c41ced4237f91b0025

SHA256
d8ee1f4d49b316ff7ba218c693a2afafd8ef0e66bc8e00cb9fcfca13e86f6c7e

SHA512
483e90d491cc18b14da3920d960e4cdb9901d880d0c2905057b3c49f2ab5f24133fee5db300a8bca608884e8dc2df23631805bec1a39d4e35c77689f79f81bbc

Download Submit
C:\Users\Admin\Documents\M4JrLlVrDD5Ze8GTRaaUqJoM.exe
MD5
6a0f452a2dbcd500aa1ef859f1b66449

SHA1
e2e0c72b10142e33dce731c41ced4237f91b0025

SHA256
d8ee1f4d49b316ff7ba218c693a2afafd8ef0e66bc8e00cb9fcfca13e86f6c7e

SHA512
483e90d491cc18b14da3920d960e4cdb9901d880d0c2905057b3c49f2ab5f24133fee5db300a8bca608884e8dc2df23631805bec1a39d4e35c77689f79f81bbc

Download Submit
C:\Users\Admin\Documents\M5xGPs27zaycOiET0g603okC.exe
MD5
ff2e4cca98f654a0d87ccb16ca83b916

SHA1
56579266ecbedcbe65ce1beb9174eccc2dc4c07d

SHA256
581684eed64322ad48a61a06b57e73b343c2dabb51248b33a943d0282677546f

SHA512
8807dddc15895d7d6d8434fd1a48f5081286b7b59cdd91a7e29c6fefc2eae46489def6ccbf94600d490fc6de435a8f105f20e8e7715182a989b8de995acc7b9b

Download Submit
C:\Users\Admin\Documents\M5xGPs27zaycOiET0g603okC.exe
MD5
ff2e4cca98f654a0d87ccb16ca83b916

SHA1
56579266ecbedcbe65ce1beb9174eccc2dc4c07d

SHA256
581684eed64322ad48a61a06b57e73b343c2dabb51248b33a943d0282677546f

SHA512
8807dddc15895d7d6d8434fd1a48f5081286b7b59cdd91a7e29c6fefc2eae46489def6ccbf94600d490fc6de435a8f105f20e8e7715182a989b8de995acc7b9b

Download Submit
C:\Users\Admin\Documents\M5xGPs27zaycOiET0g603okC.exe
MD5
ff2e4cca98f654a0d87ccb16ca83b916

SHA1
56579266ecbedcbe65ce1beb9174eccc2dc4c07d

SHA256
581684eed64322ad48a61a06b57e73b343c2dabb51248b33a943d0282677546f

SHA512
8807dddc15895d7d6d8434fd1a48f5081286b7b59cdd91a7e29c6fefc2eae46489def6ccbf94600d490fc6de435a8f105f20e8e7715182a989b8de995acc7b9b

Download Submit
C:\Users\Admin\Documents\XZAL2G3Sid_XAMpcQ3mKxGuq.exe
MD5
5f396405a7b59a50f88500a902a6eed0

SHA1
881e08477363bf59adbea69ea2c005d5f042cd58

SHA256
d2795ef3b6e6be4d8cef9d9a234c58eeabf381775675143b1edd45eaff5a27a5

SHA512
ddd7fda5a5506f6f3528e606632d895afd5f8e5450be1bd22cbb4beffb9711122d385778b8db42fdef804c69c7949a53df1a2d4497a79e6fa4748e014bb4a7e0

Download Submit
C:\Users\Admin\Documents\XZAL2G3Sid_XAMpcQ3mKxGuq.exe
MD5
5f396405a7b59a50f88500a902a6eed0

SHA1
881e08477363bf59adbea69ea2c005d5f042cd58

SHA256
d2795ef3b6e6be4d8cef9d9a234c58eeabf381775675143b1edd45eaff5a27a5

SHA512
ddd7fda5a5506f6f3528e606632d895afd5f8e5450be1bd22cbb4beffb9711122d385778b8db42fdef804c69c7949a53df1a2d4497a79e6fa4748e014bb4a7e0

Download Submit
C:\Users\Admin\Documents\XnLdZGw0yAkFjIzBqmH2ClXN.exe
MD5
637862922ea040811a79adf327863e15

SHA1
cd9f3fa9a64e1f1283121c0d02ec4ecde47a4de5

SHA256
2cbe0812081f1c8676e8fb96d9e4e08e6ac092c38982586030bd7302ed2b9a2d

SHA512
b49a749fa554595b5c85ea778de056378555326cdd2c57a7c1e5d2f3e932730a6375f31247d6c8771838c7c791e097b9b83baf09578feb81b0fb3946796e9e29

Download Submit
C:\Users\Admin\Documents\XnLdZGw0yAkFjIzBqmH2ClXN.exe
MD5
637862922ea040811a79adf327863e15

SHA1
cd9f3fa9a64e1f1283121c0d02ec4ecde47a4de5

SHA256
2cbe0812081f1c8676e8fb96d9e4e08e6ac092c38982586030bd7302ed2b9a2d

SHA512
b49a749fa554595b5c85ea778de056378555326cdd2c57a7c1e5d2f3e932730a6375f31247d6c8771838c7c791e097b9b83baf09578feb81b0fb3946796e9e29

Download Submit
C:\Users\Admin\Documents\XnLdZGw0yAkFjIzBqmH2ClXN.exe
MD5
637862922ea040811a79adf327863e15

SHA1
cd9f3fa9a64e1f1283121c0d02ec4ecde47a4de5

SHA256
2cbe0812081f1c8676e8fb96d9e4e08e6ac092c38982586030bd7302ed2b9a2d

SHA512
b49a749fa554595b5c85ea778de056378555326cdd2c57a7c1e5d2f3e932730a6375f31247d6c8771838c7c791e097b9b83baf09578feb81b0fb3946796e9e29

Download Submit
C:\Users\Admin\Documents\bRv69fCW3deWNFJe_mAzX_3E.exe
MD5
254460bba02a1966f184c2d8852b137c

SHA1
d2fd23e20fc028352c2af355c97106cc3ae7e9db

SHA256
f4d0ba70b8ce4af974e5d181584cea391d9262790eb1876d2d54adea18ec25af

SHA512
ad1da15a84088d8b88770662e45180abe2b8346201e181d9e328f99b1843da73276de97d5b05db3d5faddeef3d3d26747a421349982e883dab15dd571953028e

Download Submit
C:\Users\Admin\Documents\bRv69fCW3deWNFJe_mAzX_3E.exe
MD5
254460bba02a1966f184c2d8852b137c

SHA1
d2fd23e20fc028352c2af355c97106cc3ae7e9db

SHA256
f4d0ba70b8ce4af974e5d181584cea391d9262790eb1876d2d54adea18ec25af

SHA512
ad1da15a84088d8b88770662e45180abe2b8346201e181d9e328f99b1843da73276de97d5b05db3d5faddeef3d3d26747a421349982e883dab15dd571953028e

Download Submit
C:\Users\Admin\Documents\cwsdPnZGjAi_FPYO7KEbmqzl.exe
MD5
4981e563598d96b6fba4942f0c7705a0

SHA1
a6016d17432dc2f018b1d10490ddc1e38062b8ba

SHA256
1a413116ff7d8fc649002d93f2d0d2fc650a46da7d263973a11f3ea57099f04f

SHA512
d2081c4a903038d53cc47223152c85c525b78b33f9076ae7e0dc594e27bc3ad8945092f62676ab6b6ee0c380447f6beed0381bad75fe4c09e3eef8a47213ceb1

Download Submit
C:\Users\Admin\Documents\cwsdPnZGjAi_FPYO7KEbmqzl.exe
MD5
4981e563598d96b6fba4942f0c7705a0

SHA1
a6016d17432dc2f018b1d10490ddc1e38062b8ba

SHA256
1a413116ff7d8fc649002d93f2d0d2fc650a46da7d263973a11f3ea57099f04f

SHA512
d2081c4a903038d53cc47223152c85c525b78b33f9076ae7e0dc594e27bc3ad8945092f62676ab6b6ee0c380447f6beed0381bad75fe4c09e3eef8a47213ceb1

Download Submit
C:\Users\Admin\Documents\ehVKYxj76hiy0hQaVPiTUs5L.exe
MD5
efee9e6e989cea2bc4522238cd6f31f0

SHA1
66b17929221bbf4acf2987b804a0c7c4c839249f

SHA256
81c1473be0c7918526b069ffdb406320073b511167b9455cbde75feadad6fdcb

SHA512
d2269c520bbaeb39a0b41b9b952d021e652aa20a1e7887d0636206d3f169daa16c51dcc731f4dc18974bfd2aea7bcbc6450c0220dd383e60122e611dd7687a29

Download Submit
C:\Users\Admin\Documents\ehVKYxj76hiy0hQaVPiTUs5L.exe
MD5
efee9e6e989cea2bc4522238cd6f31f0

SHA1
66b17929221bbf4acf2987b804a0c7c4c839249f

SHA256
81c1473be0c7918526b069ffdb406320073b511167b9455cbde75feadad6fdcb

SHA512
d2269c520bbaeb39a0b41b9b952d021e652aa20a1e7887d0636206d3f169daa16c51dcc731f4dc18974bfd2aea7bcbc6450c0220dd383e60122e611dd7687a29

Download Submit
C:\Users\Admin\Documents\h5m_E56R52adOkg6cYnKOPXA.exe
MD5
c9fa1e8906a247f5bea95fe6851a8628

SHA1
fe9c10cabd3b0ed8c57327da1b4824b5399a8655

SHA256
673453fec6e11175bf0a749c94594c22a886d2f287e9648b51aa305b17109ffd

SHA512
04549c40afcfd66762a7fb7f7b34bd2a9f91c75cf53552b5a51ab9d92071d6c0bdb17c21866dff4205414cdf86548f1eb4b9a4f9170ac162a3ff898d9636b318

Download Submit
C:\Users\Admin\Documents\h5m_E56R52adOkg6cYnKOPXA.exe
MD5
c9fa1e8906a247f5bea95fe6851a8628

SHA1
fe9c10cabd3b0ed8c57327da1b4824b5399a8655

SHA256
673453fec6e11175bf0a749c94594c22a886d2f287e9648b51aa305b17109ffd

SHA512
04549c40afcfd66762a7fb7f7b34bd2a9f91c75cf53552b5a51ab9d92071d6c0bdb17c21866dff4205414cdf86548f1eb4b9a4f9170ac162a3ff898d9636b318

Download Submit
C:\Users\Admin\Documents\h5m_E56R52adOkg6cYnKOPXA.exe
MD5
c9fa1e8906a247f5bea95fe6851a8628

SHA1
fe9c10cabd3b0ed8c57327da1b4824b5399a8655

SHA256
673453fec6e11175bf0a749c94594c22a886d2f287e9648b51aa305b17109ffd

SHA512
04549c40afcfd66762a7fb7f7b34bd2a9f91c75cf53552b5a51ab9d92071d6c0bdb17c21866dff4205414cdf86548f1eb4b9a4f9170ac162a3ff898d9636b318

Download Submit
C:\Users\Admin\Documents\nN_hZmjZz8kXJGRDXl_6YINH.exe
MD5
4254728c6818364002231d31b9beb13d

SHA1
1d5c8340ae8e0bbfa2fbd5e04289e0305bf2c994

SHA256
a68ff9e9fb8b9b264bfd35ffe2ee9953093d86fc616a41cddda548ccd2e6fc8c

SHA512
71f3eab2332509f20ae5717cf726f29004c99c9513305419909ce56391ac30ca4313489545d3e7ba75b9773603d6c5f3181f3c9238fdeb263437101411df674f

Download Submit
C:\Users\Admin\Documents\nN_hZmjZz8kXJGRDXl_6YINH.exe
MD5
4254728c6818364002231d31b9beb13d

SHA1
1d5c8340ae8e0bbfa2fbd5e04289e0305bf2c994

SHA256
a68ff9e9fb8b9b264bfd35ffe2ee9953093d86fc616a41cddda548ccd2e6fc8c

SHA512
71f3eab2332509f20ae5717cf726f29004c99c9513305419909ce56391ac30ca4313489545d3e7ba75b9773603d6c5f3181f3c9238fdeb263437101411df674f

Download Submit
C:\Users\Admin\Documents\t05xed1fYoSLKLbRya1CgOAv.exe
MD5
fdd20f9a78a2cea297bdb77e5380d8b2

SHA1
aebffaa406c86f8664c7058f4529a1642cbb3d8e

SHA256
1fe0391aeb6d5c7e2b9e9fc02e24f970e5dba480e394ce66b363dfdd38e2ff20

SHA512
631a105cc14bbf8e381d3c43ce1dfa9a9a64815d53caf5c3bcc3e2f43803fad0e6cdff154c5dc0bcfe02aeb55415f2c5c441720b9f184c62a76351daf68466a4

Download Submit
C:\Users\Admin\Documents\t05xed1fYoSLKLbRya1CgOAv.exe
MD5
fdd20f9a78a2cea297bdb77e5380d8b2

SHA1
aebffaa406c86f8664c7058f4529a1642cbb3d8e

SHA256
1fe0391aeb6d5c7e2b9e9fc02e24f970e5dba480e394ce66b363dfdd38e2ff20

SHA512
631a105cc14bbf8e381d3c43ce1dfa9a9a64815d53caf5c3bcc3e2f43803fad0e6cdff154c5dc0bcfe02aeb55415f2c5c441720b9f184c62a76351daf68466a4

Download Submit
C:\Users\Admin\Documents\t05xed1fYoSLKLbRya1CgOAv.exe
MD5
fdd20f9a78a2cea297bdb77e5380d8b2

SHA1
aebffaa406c86f8664c7058f4529a1642cbb3d8e

SHA256
1fe0391aeb6d5c7e2b9e9fc02e24f970e5dba480e394ce66b363dfdd38e2ff20

SHA512
631a105cc14bbf8e381d3c43ce1dfa9a9a64815d53caf5c3bcc3e2f43803fad0e6cdff154c5dc0bcfe02aeb55415f2c5c441720b9f184c62a76351daf68466a4

Download Submit
C:\Users\Admin\Documents\tiSvXhhFN8OEawcis53uKn28.exe
MD5
6b5cd4878fec9628fbfc74a08b0d82e8

SHA1
91d5cad5884a26016facde0b0e4e41f03e223095

SHA256
1ba40bbc732d1868c0d19d40bd5427c7f6299f78f6bbb656c67e737526935329

SHA512
69792cabe12199a32ec8f029f44307942c2920306c0676d3602a576cf61198cd4bde10c502f9722eb5922efad6b60bbb7cd87a785ff6c70d03c0f795c8c36e01

Download Submit
C:\Users\Admin\Documents\tiSvXhhFN8OEawcis53uKn28.exe
MD5
6b5cd4878fec9628fbfc74a08b0d82e8

SHA1
91d5cad5884a26016facde0b0e4e41f03e223095

SHA256
1ba40bbc732d1868c0d19d40bd5427c7f6299f78f6bbb656c67e737526935329

SHA512
69792cabe12199a32ec8f029f44307942c2920306c0676d3602a576cf61198cd4bde10c502f9722eb5922efad6b60bbb7cd87a785ff6c70d03c0f795c8c36e01

Download Submit
C:\Users\Admin\Documents\yP7GpXolJz6ICqw9nxOV6aVI.exe
MD5
5ebacb511f980e09f8ea0dbe60eeb03b

SHA1
7bc86c42875cab18bc9e1fb33627190b72a97bf8

SHA256
bf3d432bdac1fcd574dd6d2543afdc9c5a597abf2d181a593ba2cebaf38836d6

SHA512
e4abbd75b9624329c0142f9a1fcaffd1cec1f87cf39f899b0a4afcebaf78912b5a37f21d1c5713c8defa3bf644a5c34906d238c647641682aee97fb663ab952c

Download Submit
C:\Users\Admin\Documents\yP7GpXolJz6ICqw9nxOV6aVI.exe
MD5
5ebacb511f980e09f8ea0dbe60eeb03b

SHA1
7bc86c42875cab18bc9e1fb33627190b72a97bf8

SHA256
bf3d432bdac1fcd574dd6d2543afdc9c5a597abf2d181a593ba2cebaf38836d6

SHA512
e4abbd75b9624329c0142f9a1fcaffd1cec1f87cf39f899b0a4afcebaf78912b5a37f21d1c5713c8defa3bf644a5c34906d238c647641682aee97fb663ab952c

Download Submit
\Users\Admin\AppData\Local\Temp\AE30.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
memory/68-345-0x0000016F29EC0000-0x0000016F29F30000-memory.dmp

Filesize
448KB

Download
memory/68-326-0x0000016F29E40000-0x0000016F29EB1000-memory.dmp

Filesize
452KB

Download
memory/420-297-0x0000000000000000-mapping.dmp

Download
memory/512-334-0x000002439DF50000-0x000002439DF9B000-memory.dmp

Filesize
300KB

Download
memory/512-320-0x000002439DCE0000-0x000002439DD2C000-memory.dmp

Filesize
304KB

Download
memory/512-327-0x000002439DFC0000-0x000002439E031000-memory.dmp

Filesize
452KB

Download
memory/512-351-0x000002439E200000-0x000002439E270000-memory.dmp

Filesize
448KB

Download
memory/572-452-0x0000000000000000-mapping.dmp

Download
memory/652-299-0x0000000000000000-mapping.dmp

Download
memory/676-371-0x000001443F160000-0x000001443F1D1000-memory.dmp

Filesize
452KB

Download
memory/676-383-0x000001443F400000-0x000001443F470000-memory.dmp

Filesize
448KB

Download
memory/744-283-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/744-238-0x00000000773F0000-0x000000007757E000-memory.dmp

Filesize
1.6MB

Download
memory/744-240-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/744-171-0x0000000000000000-mapping.dmp

Download
memory/1064-377-0x000001BDEAD70000-0x000001BDEADE0000-memory.dmp

Filesize
448KB

Download
memory/1064-347-0x000001BDEA550000-0x000001BDEA5C1000-memory.dmp

Filesize
452KB

Download
memory/1184-387-0x000001D192B10000-0x000001D192B81000-memory.dmp

Filesize
452KB

Download
memory/1184-388-0x000001D192BE0000-0x000001D192C50000-memory.dmp

Filesize
448KB

Download
memory/1224-390-0x000001A59C460000-0x000001A59C4D0000-memory.dmp

Filesize
448KB

Download
memory/1224-389-0x000001A59BE70000-0x000001A59BEE1000-memory.dmp

Filesize
452KB

Download
memory/1344-394-0x0000000000000000-mapping.dmp

Download
memory/1404-385-0x000002923D630000-0x000002923D6A0000-memory.dmp

Filesize
448KB

Download
memory/1404-379-0x000002923D570000-0x000002923D5E1000-memory.dmp

Filesize
452KB

Download
memory/1764-244-0x00000000773F0000-0x000000007757E000-memory.dmp

Filesize
1.6MB

Download
memory/1764-254-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/1764-187-0x0000000000000000-mapping.dmp

Download
memory/1764-284-0x0000000005CD0000-0x0000000005CD1000-memory.dmp

Filesize
4KB

Download
memory/1820-384-0x0000023E337B0000-0x0000023E33821000-memory.dmp

Filesize
452KB

Download
memory/1820-386-0x0000023E338A0000-0x0000023E33910000-memory.dmp

Filesize
448KB

Download
memory/2088-157-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download
memory/2088-120-0x0000000000000000-mapping.dmp

Download
memory/2112-155-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/2112-141-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2112-116-0x0000000000000000-mapping.dmp

Download
memory/2136-150-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/2136-117-0x0000000000000000-mapping.dmp

Download
memory/2136-147-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/2136-146-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/2136-151-0x0000000000960000-0x0000000000961000-memory.dmp

Filesize
4KB

Download
memory/2136-145-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2136-152-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/2136-153-0x00000000012B0000-0x00000000019A1000-memory.dmp

Filesize
6.9MB

Download
memory/2168-214-0x000001CFA82A0000-0x000001CFA8371000-memory.dmp

Filesize
836KB

Download
memory/2168-179-0x000001CFA7E50000-0x000001CFA7EBF000-memory.dmp

Filesize
444KB

Download
memory/2168-122-0x0000000000000000-mapping.dmp

Download
memory/2236-580-0x0000012C43700000-0x0000012C43806000-memory.dmp

Filesize
1.0MB

Download
memory/2236-307-0x00007FF7333C4060-mapping.dmp

Download
memory/2236-317-0x0000012C40B40000-0x0000012C40BB1000-memory.dmp

Filesize
452KB

Download
memory/2236-579-0x0000012C42620000-0x0000012C4263B000-memory.dmp

Filesize
108KB

Download
memory/2276-235-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/2276-167-0x0000000000000000-mapping.dmp

Download
memory/2276-217-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download
memory/2276-201-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/2276-222-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/2276-230-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/2324-223-0x0000000000400000-0x0000000000651000-memory.dmp

Filesize
2.3MB

Download
memory/2324-186-0x0000000000000000-mapping.dmp

Download
memory/2328-119-0x0000000000000000-mapping.dmp

Download
memory/2352-121-0x0000000000000000-mapping.dmp

Download
memory/2424-343-0x0000028DA5540000-0x0000028DA55B1000-memory.dmp

Filesize
452KB

Download
memory/2424-353-0x0000028DA55C0000-0x0000028DA5630000-memory.dmp

Filesize
448KB

Download
memory/2432-348-0x000001498EC80000-0x000001498ECF0000-memory.dmp

Filesize
448KB

Download
memory/2432-336-0x000001498EC00000-0x000001498EC71000-memory.dmp

Filesize
452KB

Download
memory/2724-373-0x000001FF60830000-0x000001FF608A1000-memory.dmp

Filesize
452KB

Download
memory/2724-375-0x000001FF60920000-0x000001FF60990000-memory.dmp

Filesize
448KB

Download
memory/2740-381-0x0000019893FA0000-0x0000019894011000-memory.dmp

Filesize
452KB

Download
memory/2740-382-0x0000019894200000-0x0000019894270000-memory.dmp

Filesize
448KB

Download
memory/2768-156-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2768-158-0x0000000000402F68-mapping.dmp

Download
memory/2784-630-0x0000000000000000-mapping.dmp

Download
memory/2852-314-0x0000025F01570000-0x0000025F015E1000-memory.dmp

Filesize
452KB

Download
memory/2852-340-0x0000025F01BA0000-0x0000025F01C10000-memory.dmp

Filesize
448KB

Download
memory/3036-191-0x00000000006A0000-0x00000000006B7000-memory.dmp

Filesize
92KB

Download
memory/3148-239-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/3148-178-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3148-270-0x0000000005830000-0x0000000005831000-memory.dmp

Filesize
4KB

Download
memory/3148-255-0x0000000005440000-0x0000000005A46000-memory.dmp

Filesize
6.0MB

Download
memory/3148-190-0x0000000000417E32-mapping.dmp

Download
memory/3356-174-0x0000000000000000-mapping.dmp

Download
memory/3576-143-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/3576-148-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/3576-154-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/3576-138-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/3576-114-0x0000000000000000-mapping.dmp

Download
memory/3592-168-0x0000000000000000-mapping.dmp

Download
memory/3592-289-0x0000000000400000-0x00000000009A7000-memory.dmp

Filesize
5.7MB

Download
memory/3592-287-0x00000000009B0000-0x0000000000AFA000-memory.dmp

Filesize
1.3MB

Download
memory/3600-447-0x000000000044003F-mapping.dmp

Download
memory/3600-453-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3680-225-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/3680-229-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/3680-218-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/3680-251-0x0000000004F80000-0x0000000005586000-memory.dmp

Filesize
6.0MB

Download
memory/3680-177-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3680-189-0x0000000000417E1E-mapping.dmp

Download
memory/3856-183-0x00000000015E0000-0x00000000015E1000-memory.dmp

Filesize
4KB

Download
memory/3856-220-0x0000000001AA0000-0x0000000001AA1000-memory.dmp

Filesize
4KB

Download
memory/3856-215-0x0000000001A90000-0x0000000001A91000-memory.dmp

Filesize
4KB

Download
memory/3856-224-0x0000000001AB0000-0x0000000001AB1000-memory.dmp

Filesize
4KB

Download
memory/3856-192-0x00000000019D0000-0x00000000019D1000-memory.dmp

Filesize
4KB

Download
memory/3856-228-0x0000000000E70000-0x0000000001561000-memory.dmp

Filesize
6.9MB

Download
memory/3856-208-0x0000000001A70000-0x0000000001A71000-memory.dmp

Filesize
4KB

Download
memory/3856-161-0x0000000000000000-mapping.dmp

Download
memory/3884-312-0x0000000002F90000-0x00000000038B6000-memory.dmp

Filesize
9.1MB

Download
memory/3884-325-0x0000000000400000-0x0000000000DC8000-memory.dmp

Filesize
9.8MB

Download
memory/3884-188-0x0000000000000000-mapping.dmp

Download
memory/3944-169-0x0000000000000000-mapping.dmp

Download
memory/3948-221-0x0000000000A60000-0x0000000000A68000-memory.dmp

Filesize
32KB

Download
memory/3948-115-0x0000000000000000-mapping.dmp

Download
memory/3948-134-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/3948-207-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/3956-291-0x0000000000400000-0x00000000009F0000-memory.dmp

Filesize
5.9MB

Download
memory/3956-290-0x0000000000C60000-0x0000000000CFD000-memory.dmp

Filesize
628KB

Download
memory/3956-170-0x0000000000000000-mapping.dmp

Download
memory/4104-322-0x0000000000000000-mapping.dmp

Download
memory/4104-330-0x0000000004A20000-0x0000000004B21000-memory.dmp

Filesize
1.0MB

Download
memory/4104-332-0x00000000049A0000-0x00000000049FC000-memory.dmp

Filesize
368KB

Download
memory/4180-366-0x0000000000000000-mapping.dmp

Download
memory/4328-339-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/4328-234-0x0000000000000000-mapping.dmp

Download
memory/4328-261-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/4328-303-0x0000000000000000-mapping.dmp

Download
memory/4328-263-0x0000000000430000-0x00000000004DE000-memory.dmp

Filesize
696KB

Download
memory/4356-237-0x0000000000000000-mapping.dmp

Download
memory/4376-397-0x0000000000417E22-mapping.dmp

Download
memory/4376-414-0x0000000004E80000-0x0000000005486000-memory.dmp

Filesize
6.0MB

Download
memory/4404-243-0x0000000000000000-mapping.dmp

Download
memory/4448-249-0x0000000000000000-mapping.dmp

Download
memory/4448-262-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/4488-302-0x0000000000000000-mapping.dmp

Download
memory/4488-309-0x0000000004980000-0x00000000049DD000-memory.dmp

Filesize
372KB

Download
memory/4488-306-0x0000000004873000-0x0000000004974000-memory.dmp

Filesize
1.0MB

Download
memory/4492-429-0x0000000000000000-mapping.dmp

Download
memory/4544-469-0x0000000000000000-mapping.dmp

Download
memory/4548-267-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4548-257-0x0000000000000000-mapping.dmp

Download
memory/4560-415-0x0000000000000000-mapping.dmp

Download
memory/4592-391-0x0000000000000000-mapping.dmp

Download
memory/4668-275-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4668-285-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4668-277-0x000000000046B76D-mapping.dmp

Download
memory/4684-454-0x0000000000000000-mapping.dmp

Download
memory/4728-274-0x0000000000000000-mapping.dmp

Download
memory/4792-279-0x0000000000000000-mapping.dmp

Download
memory/4852-497-0x0000000000000000-mapping.dmp

Download
memory/4864-395-0x0000000000000000-mapping.dmp

Download
memory/4968-459-0x0000000000000000-mapping.dmp

Download
memory/5084-292-0x0000000000000000-mapping.dmp

Download
memory/5108-456-0x0000000000000000-mapping.dmp

Download
memory/5112-315-0x0000000000000000-mapping.dmp

Download
memory/5192-620-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5192-619-0x0000000000401480-mapping.dmp

Download
memory/5564-495-0x0000000000000000-mapping.dmp

Download
memory/5600-496-0x0000000000000000-mapping.dmp

Download
memory/5788-622-0x0000000000000000-mapping.dmp

Download
memory/5844-489-0x0000000000000000-mapping.dmp

Download
memory/6052-493-0x0000000000000000-mapping.dmp

Download
memory/6076-494-0x0000000000000000-mapping.dmp

Download
memory/6088-621-0x0000000000400000-0x0000000000DC8000-memory.dmp

Filesize
9.8MB

Download
memory/6088-544-0x0000000000000000-mapping.dmp

Download