formbook | 1b39d6bf218028dfe7bc8254a3b1682804e9bf05b8298c708c318236f64ad986

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-en
submitted
15-09-2021 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44696d252000850d3ea71d9ae238aedc.exe
Size

1.0MB
MD5

44696d252000850d3ea71d9ae238aedc
SHA1

1fb61a1df500f9025641526cb4013d555b129a84
SHA256

1b39d6bf218028dfe7bc8254a3b1682804e9bf05b8298c708c318236f64ad986
SHA512

e1115a0a70b6d532633c1c60733a2aebbdc9e14863deaec7f6e15604c20f9f3ce3d36132ec2b814a4c774b25a6c4c8ccad4003724b98abead2be3f752b9d6314

Score

10^/10

formbook vtkz evasion persistence rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

vtkz

http://www.luxuriousshoestop.com/vtkz/

Decoy

todaynewsbuzz.com

bootwish.com

michelleortegawrites.com

tutorialme.com

daretoplaygames.com

telefonepantalla.com

advisorsoncall.life

marketingloisirs.com

cremationmtzionil.com

lgbtsuccess.com

cassandrawind.com

globaltradepay.com

thecafeart.com

starmobilehome.com

ugotshot.com

c03eeniom.store

afcerd.com

eleyhexs.com

utmmarhitzfil.com

saudiisrael.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2160-95-0x000000000041EBC0-mapping.dmp	formbook
behavioral1/memory/2160-93-0x0000000000400000-0x000000000042E000-memory.dmp	formbook
behavioral1/memory/2304-133-0x0000000000070000-0x000000000009E000-memory.dmp	formbook

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Nirsoft 14 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe	Nirsoft
\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe	Nirsoft
\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe	Nirsoft
\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe	Nirsoft
\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe	Nirsoft
\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe	Nirsoft
\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe	Nirsoft
\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe	Nirsoft

Executes dropped EXE 5 IoCs

Processes:

AdvancedRun.exeAdvancedRun.exe36C95A71.exeAdvancedRun.exeAdvancedRun.exe

pid process

868 AdvancedRun.exe
1884 AdvancedRun.exe
1336 36C95A71.exe
2360 AdvancedRun.exe
2488 AdvancedRun.exe
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

36C95A71.exe44696d252000850d3ea71d9ae238aedc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	36C95A71.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	36C95A71.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	44696d252000850d3ea71d9ae238aedc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	44696d252000850d3ea71d9ae238aedc.exe

Drops startup file 2 IoCs

Processes:

44696d252000850d3ea71d9ae238aedc.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe	44696d252000850d3ea71d9ae238aedc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe	44696d252000850d3ea71d9ae238aedc.exe

Loads dropped DLL 10 IoCs

Processes:

44696d252000850d3ea71d9ae238aedc.exeAdvancedRun.exe36C95A71.exeAdvancedRun.exe

pid	process
1956	44696d252000850d3ea71d9ae238aedc.exe
1956	44696d252000850d3ea71d9ae238aedc.exe
868	AdvancedRun.exe
868	AdvancedRun.exe
1956	44696d252000850d3ea71d9ae238aedc.exe
1956	44696d252000850d3ea71d9ae238aedc.exe
1336	36C95A71.exe
1336	36C95A71.exe
2360	AdvancedRun.exe
2360	AdvancedRun.exe

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

44696d252000850d3ea71d9ae238aedc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	44696d252000850d3ea71d9ae238aedc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	44696d252000850d3ea71d9ae238aedc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe = "0"	44696d252000850d3ea71d9ae238aedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	44696d252000850d3ea71d9ae238aedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	44696d252000850d3ea71d9ae238aedc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	44696d252000850d3ea71d9ae238aedc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	44696d252000850d3ea71d9ae238aedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	44696d252000850d3ea71d9ae238aedc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\2FDD6624\svchost.exe = "0"	44696d252000850d3ea71d9ae238aedc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\44696d252000850d3ea71d9ae238aedc.exe = "0"	44696d252000850d3ea71d9ae238aedc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

44696d252000850d3ea71d9ae238aedc.exe36C95A71.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\36C95A71 = "C:\\Users\\Public\\Documents\\2FDD6624\\svchost.exe"	44696d252000850d3ea71d9ae238aedc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\36C95A71 = "C:\\Users\\Public\\Documents\\2FDD6624\\svchost.exe"	36C95A71.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

44696d252000850d3ea71d9ae238aedc.exe36C95A71.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	44696d252000850d3ea71d9ae238aedc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	36C95A71.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	36C95A71.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	44696d252000850d3ea71d9ae238aedc.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

44696d252000850d3ea71d9ae238aedc.exe36C95A71.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	44696d252000850d3ea71d9ae238aedc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	44696d252000850d3ea71d9ae238aedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	36C95A71.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	36C95A71.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

44696d252000850d3ea71d9ae238aedc.exeaspnet_compiler.exewscript.exe

description	pid	process	target process
PID 1956 set thread context of 2160	1956	44696d252000850d3ea71d9ae238aedc.exe	aspnet_compiler.exe
PID 2160 set thread context of 1276	2160	aspnet_compiler.exe	Explorer.EXE
PID 2304 set thread context of 1276	2304	wscript.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2336 1956 WerFault.exe 44696d252000850d3ea71d9ae238aedc.exe

pid	pid_target	process	target process
2336	1956	WerFault.exe	44696d252000850d3ea71d9ae238aedc.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

AdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exeaspnet_compiler.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeWerFault.exeAdvancedRun.exeAdvancedRun.exewscript.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
868	AdvancedRun.exe
868	AdvancedRun.exe
1884	AdvancedRun.exe
1884	AdvancedRun.exe
1628	powershell.exe
1912	powershell.exe
696	powershell.exe
2160	aspnet_compiler.exe
2160	aspnet_compiler.exe
1132	powershell.exe
1564	powershell.exe
1684	powershell.exe
1660	powershell.exe
1544	powershell.exe
2336	WerFault.exe
2336	WerFault.exe
2336	WerFault.exe
2336	WerFault.exe
2336	WerFault.exe
2336	WerFault.exe
2336	WerFault.exe
2360	AdvancedRun.exe
2360	AdvancedRun.exe
2488	AdvancedRun.exe
2488	AdvancedRun.exe
2304	wscript.exe
2304	wscript.exe
2612	powershell.exe
2696	powershell.exe
2748	powershell.exe
2640	powershell.exe
2672	powershell.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe
2304	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Explorer.EXEWerFault.exe

pid process

1276 Explorer.EXE
2336 WerFault.exe
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

aspnet_compiler.exewscript.exe

pid process

2160 aspnet_compiler.exe
2160 aspnet_compiler.exe
2160 aspnet_compiler.exe
2304 wscript.exe
2304 wscript.exe

pid	process
2160	aspnet_compiler.exe
2160	aspnet_compiler.exe
2160	aspnet_compiler.exe
2304	wscript.exe
2304	wscript.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

AdvancedRun.exeAdvancedRun.exe44696d252000850d3ea71d9ae238aedc.exepowershell.exepowershell.exepowershell.exeaspnet_compiler.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeWerFault.exeAdvancedRun.exeAdvancedRun.exewscript.exeExplorer.EXE36C95A71.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	868	AdvancedRun.exe
Token: SeImpersonatePrivilege	868	AdvancedRun.exe
Token: SeDebugPrivilege	1884	AdvancedRun.exe
Token: SeImpersonatePrivilege	1884	AdvancedRun.exe
Token: SeDebugPrivilege	1956	44696d252000850d3ea71d9ae238aedc.exe
Token: SeDebugPrivilege	696	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	2160	aspnet_compiler.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	2336	WerFault.exe
Token: SeDebugPrivilege	2360	AdvancedRun.exe
Token: SeImpersonatePrivilege	2360	AdvancedRun.exe
Token: SeDebugPrivilege	2488	AdvancedRun.exe
Token: SeImpersonatePrivilege	2488	AdvancedRun.exe
Token: SeDebugPrivilege	2304	wscript.exe
Token: SeShutdownPrivilege	1276	Explorer.EXE
Token: SeDebugPrivilege	1336	36C95A71.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeShutdownPrivilege	1276	Explorer.EXE
Token: SeShutdownPrivilege	1276	Explorer.EXE
Token: SeShutdownPrivilege	1276	Explorer.EXE

Suspicious use of FindShellTrayWindow 56 IoCs

Processes:

Explorer.EXE

pid	process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of SendNotifyMessage 52 IoCs

Processes:

Explorer.EXE

pid	process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

44696d252000850d3ea71d9ae238aedc.exeAdvancedRun.exeExplorer.EXE36C95A71.exeAdvancedRun.exe

description	pid	process	target process
PID 1956 wrote to memory of 868	1956	44696d252000850d3ea71d9ae238aedc.exe	AdvancedRun.exe
PID 1956 wrote to memory of 868	1956	44696d252000850d3ea71d9ae238aedc.exe	AdvancedRun.exe
PID 1956 wrote to memory of 868	1956	44696d252000850d3ea71d9ae238aedc.exe	AdvancedRun.exe
PID 1956 wrote to memory of 868	1956	44696d252000850d3ea71d9ae238aedc.exe	AdvancedRun.exe
PID 868 wrote to memory of 1884	868	AdvancedRun.exe	AdvancedRun.exe
PID 868 wrote to memory of 1884	868	AdvancedRun.exe	AdvancedRun.exe
PID 868 wrote to memory of 1884	868	AdvancedRun.exe	AdvancedRun.exe
PID 868 wrote to memory of 1884	868	AdvancedRun.exe	AdvancedRun.exe
PID 1956 wrote to memory of 696	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 696	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 696	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 696	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1544	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1544	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1544	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1544	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1684	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1684	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1684	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1684	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1912	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1912	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1912	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1912	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1628	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1628	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1628	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1628	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1336	1956	44696d252000850d3ea71d9ae238aedc.exe	36C95A71.exe
PID 1956 wrote to memory of 1336	1956	44696d252000850d3ea71d9ae238aedc.exe	36C95A71.exe
PID 1956 wrote to memory of 1336	1956	44696d252000850d3ea71d9ae238aedc.exe	36C95A71.exe
PID 1956 wrote to memory of 1336	1956	44696d252000850d3ea71d9ae238aedc.exe	36C95A71.exe
PID 1956 wrote to memory of 1132	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1132	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1132	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1132	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1660	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1660	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1660	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1660	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1564	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1564	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1564	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 1564	1956	44696d252000850d3ea71d9ae238aedc.exe	powershell.exe
PID 1956 wrote to memory of 2160	1956	44696d252000850d3ea71d9ae238aedc.exe	aspnet_compiler.exe
PID 1956 wrote to memory of 2160	1956	44696d252000850d3ea71d9ae238aedc.exe	aspnet_compiler.exe
PID 1956 wrote to memory of 2160	1956	44696d252000850d3ea71d9ae238aedc.exe	aspnet_compiler.exe
PID 1956 wrote to memory of 2160	1956	44696d252000850d3ea71d9ae238aedc.exe	aspnet_compiler.exe
PID 1956 wrote to memory of 2160	1956	44696d252000850d3ea71d9ae238aedc.exe	aspnet_compiler.exe
PID 1956 wrote to memory of 2160	1956	44696d252000850d3ea71d9ae238aedc.exe	aspnet_compiler.exe
PID 1956 wrote to memory of 2160	1956	44696d252000850d3ea71d9ae238aedc.exe	aspnet_compiler.exe
PID 1276 wrote to memory of 2304	1276	Explorer.EXE	wscript.exe
PID 1276 wrote to memory of 2304	1276	Explorer.EXE	wscript.exe
PID 1276 wrote to memory of 2304	1276	Explorer.EXE	wscript.exe
PID 1276 wrote to memory of 2304	1276	Explorer.EXE	wscript.exe
PID 1956 wrote to memory of 2336	1956	44696d252000850d3ea71d9ae238aedc.exe	WerFault.exe
PID 1956 wrote to memory of 2336	1956	44696d252000850d3ea71d9ae238aedc.exe	WerFault.exe
PID 1956 wrote to memory of 2336	1956	44696d252000850d3ea71d9ae238aedc.exe	WerFault.exe
PID 1956 wrote to memory of 2336	1956	44696d252000850d3ea71d9ae238aedc.exe	WerFault.exe
PID 1336 wrote to memory of 2360	1336	36C95A71.exe	AdvancedRun.exe
PID 1336 wrote to memory of 2360	1336	36C95A71.exe	AdvancedRun.exe
PID 1336 wrote to memory of 2360	1336	36C95A71.exe	AdvancedRun.exe
PID 1336 wrote to memory of 2360	1336	36C95A71.exe	AdvancedRun.exe
PID 2360 wrote to memory of 2488	2360	AdvancedRun.exe	AdvancedRun.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

44696d252000850d3ea71d9ae238aedc.exe36C95A71.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	44696d252000850d3ea71d9ae238aedc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	36C95A71.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\44696d252000850d3ea71d9ae238aedc.exe
"C:\Users\Admin\AppData\Local\Temp\44696d252000850d3ea71d9ae238aedc.exe"
2⤵
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1956

C:\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868

C:\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe" /SpecialRun 4101d8 868
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\44696d252000850d3ea71d9ae238aedc.exe" -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\44696d252000850d3ea71d9ae238aedc.exe" -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe" -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe" -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\44696d252000850d3ea71d9ae238aedc.exe" -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1336

C:\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360

C:\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe" /SpecialRun 4101d8 2360
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe" -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe" -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\2FDD6624\svchost.exe" -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe" -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\2FDD6624\svchost.exe" -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\2FDD6624\svchost.exe" -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\44696d252000850d3ea71d9ae238aedc.exe" -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\2FDD6624\svchost.exe" -Force
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 1296
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
3⤵
PID:2568

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Bypass User Account Control

T1088

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
3a617cc9c9a9a58294956b9b79a1c633

SHA1
e37ff732ab15217a00fc41513042d8cff8f33654

SHA256
ceda82d879b3fe080da7653d58d840ab7035f448fee2c07b821cf8eb22b1c66f

SHA512
08702389bf88889a91d865d24a5b23285a0850fb0826c1f2be3fdf08f6886a2485d6227f0a2b73c703481667eaa4cb3481c746908aabf8b054194fbf1ed71e8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
3a617cc9c9a9a58294956b9b79a1c633

SHA1
e37ff732ab15217a00fc41513042d8cff8f33654

SHA256
ceda82d879b3fe080da7653d58d840ab7035f448fee2c07b821cf8eb22b1c66f

SHA512
08702389bf88889a91d865d24a5b23285a0850fb0826c1f2be3fdf08f6886a2485d6227f0a2b73c703481667eaa4cb3481c746908aabf8b054194fbf1ed71e8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
3a617cc9c9a9a58294956b9b79a1c633

SHA1
e37ff732ab15217a00fc41513042d8cff8f33654

SHA256
ceda82d879b3fe080da7653d58d840ab7035f448fee2c07b821cf8eb22b1c66f

SHA512
08702389bf88889a91d865d24a5b23285a0850fb0826c1f2be3fdf08f6886a2485d6227f0a2b73c703481667eaa4cb3481c746908aabf8b054194fbf1ed71e8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
3a617cc9c9a9a58294956b9b79a1c633

SHA1
e37ff732ab15217a00fc41513042d8cff8f33654

SHA256
ceda82d879b3fe080da7653d58d840ab7035f448fee2c07b821cf8eb22b1c66f

SHA512
08702389bf88889a91d865d24a5b23285a0850fb0826c1f2be3fdf08f6886a2485d6227f0a2b73c703481667eaa4cb3481c746908aabf8b054194fbf1ed71e8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
3a617cc9c9a9a58294956b9b79a1c633

SHA1
e37ff732ab15217a00fc41513042d8cff8f33654

SHA256
ceda82d879b3fe080da7653d58d840ab7035f448fee2c07b821cf8eb22b1c66f

SHA512
08702389bf88889a91d865d24a5b23285a0850fb0826c1f2be3fdf08f6886a2485d6227f0a2b73c703481667eaa4cb3481c746908aabf8b054194fbf1ed71e8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
3a617cc9c9a9a58294956b9b79a1c633

SHA1
e37ff732ab15217a00fc41513042d8cff8f33654

SHA256
ceda82d879b3fe080da7653d58d840ab7035f448fee2c07b821cf8eb22b1c66f

SHA512
08702389bf88889a91d865d24a5b23285a0850fb0826c1f2be3fdf08f6886a2485d6227f0a2b73c703481667eaa4cb3481c746908aabf8b054194fbf1ed71e8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
3a617cc9c9a9a58294956b9b79a1c633

SHA1
e37ff732ab15217a00fc41513042d8cff8f33654

SHA256
ceda82d879b3fe080da7653d58d840ab7035f448fee2c07b821cf8eb22b1c66f

SHA512
08702389bf88889a91d865d24a5b23285a0850fb0826c1f2be3fdf08f6886a2485d6227f0a2b73c703481667eaa4cb3481c746908aabf8b054194fbf1ed71e8e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe
MD5
44696d252000850d3ea71d9ae238aedc

SHA1
1fb61a1df500f9025641526cb4013d555b129a84

SHA256
1b39d6bf218028dfe7bc8254a3b1682804e9bf05b8298c708c318236f64ad986

SHA512
e1115a0a70b6d532633c1c60733a2aebbdc9e14863deaec7f6e15604c20f9f3ce3d36132ec2b814a4c774b25a6c4c8ccad4003724b98abead2be3f752b9d6314

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe
MD5
44696d252000850d3ea71d9ae238aedc

SHA1
1fb61a1df500f9025641526cb4013d555b129a84

SHA256
1b39d6bf218028dfe7bc8254a3b1682804e9bf05b8298c708c318236f64ad986

SHA512
e1115a0a70b6d532633c1c60733a2aebbdc9e14863deaec7f6e15604c20f9f3ce3d36132ec2b814a4c774b25a6c4c8ccad4003724b98abead2be3f752b9d6314

Download Submit
\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
\Users\Admin\AppData\Local\Temp\2950e03e-6129-461e-b424-dc0afbd0b232\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
\Users\Admin\AppData\Local\Temp\e5557620-e0fa-49a5-9ab7-ee769192fd14\AdvancedRun.exe
MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe
MD5
44696d252000850d3ea71d9ae238aedc

SHA1
1fb61a1df500f9025641526cb4013d555b129a84

SHA256
1b39d6bf218028dfe7bc8254a3b1682804e9bf05b8298c708c318236f64ad986

SHA512
e1115a0a70b6d532633c1c60733a2aebbdc9e14863deaec7f6e15604c20f9f3ce3d36132ec2b814a4c774b25a6c4c8ccad4003724b98abead2be3f752b9d6314

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36C95A71.exe
MD5
44696d252000850d3ea71d9ae238aedc

SHA1
1fb61a1df500f9025641526cb4013d555b129a84

SHA256
1b39d6bf218028dfe7bc8254a3b1682804e9bf05b8298c708c318236f64ad986

SHA512
e1115a0a70b6d532633c1c60733a2aebbdc9e14863deaec7f6e15604c20f9f3ce3d36132ec2b814a4c774b25a6c4c8ccad4003724b98abead2be3f752b9d6314

Download Submit
memory/696-103-0x00000000023A1000-0x00000000023A2000-memory.dmp

Filesize
4KB

Download
memory/696-67-0x0000000000000000-mapping.dmp

Download
memory/696-102-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/696-109-0x00000000023A2000-0x00000000023A4000-memory.dmp

Filesize
8KB

Download
memory/868-60-0x00000000754C1000-0x00000000754C3000-memory.dmp

Filesize
8KB

Download
memory/868-58-0x0000000000000000-mapping.dmp

Download
memory/1132-98-0x00000000022B0000-0x0000000002EFA000-memory.dmp

Filesize
12.3MB

Download
memory/1132-117-0x00000000022B0000-0x0000000002EFA000-memory.dmp

Filesize
12.3MB

Download
memory/1132-82-0x0000000000000000-mapping.dmp

Download
memory/1132-111-0x00000000022B0000-0x0000000002EFA000-memory.dmp

Filesize
12.3MB

Download
memory/1276-167-0x0000000006B60000-0x0000000006C69000-memory.dmp

Filesize
1.0MB

Download
memory/1276-114-0x0000000004AF0000-0x0000000004C02000-memory.dmp

Filesize
1.1MB

Download
memory/1336-85-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/1336-83-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/1336-79-0x0000000000000000-mapping.dmp

Download
memory/1544-110-0x00000000022C0000-0x0000000002F0A000-memory.dmp

Filesize
12.3MB

Download
memory/1544-68-0x0000000000000000-mapping.dmp

Download
memory/1564-101-0x0000000002310000-0x0000000002F5A000-memory.dmp

Filesize
12.3MB

Download
memory/1564-86-0x0000000000000000-mapping.dmp

Download
memory/1564-115-0x0000000002310000-0x0000000002F5A000-memory.dmp

Filesize
12.3MB

Download
memory/1628-73-0x0000000000000000-mapping.dmp

Download
memory/1628-105-0x00000000020E1000-0x00000000020E2000-memory.dmp

Filesize
4KB

Download
memory/1628-94-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/1628-106-0x00000000020E2000-0x00000000020E4000-memory.dmp

Filesize
8KB

Download
memory/1660-84-0x0000000000000000-mapping.dmp

Download
memory/1660-96-0x0000000002300000-0x0000000002F4A000-memory.dmp

Filesize
12.3MB

Download
memory/1660-99-0x0000000002300000-0x0000000002F4A000-memory.dmp

Filesize
12.3MB

Download
memory/1684-116-0x0000000002330000-0x0000000002F7A000-memory.dmp

Filesize
12.3MB

Download
memory/1684-113-0x0000000002330000-0x0000000002F7A000-memory.dmp

Filesize
12.3MB

Download
memory/1684-69-0x0000000000000000-mapping.dmp

Download
memory/1884-64-0x0000000000000000-mapping.dmp

Download
memory/1912-104-0x00000000025E1000-0x00000000025E2000-memory.dmp

Filesize
4KB

Download
memory/1912-100-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/1912-107-0x00000000025E2000-0x00000000025E4000-memory.dmp

Filesize
8KB

Download
memory/1912-71-0x0000000000000000-mapping.dmp

Download
memory/1956-55-0x0000000000D50000-0x0000000000DC2000-memory.dmp

Filesize
456KB

Download
memory/1956-53-0x00000000010B0000-0x00000000010B1000-memory.dmp

Filesize
4KB

Download
memory/1956-54-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1956-97-0x0000000000AC0000-0x0000000000AC3000-memory.dmp

Filesize
12KB

Download
memory/2160-112-0x0000000000180000-0x0000000000194000-memory.dmp

Filesize
80KB

Download
memory/2160-93-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2160-95-0x000000000041EBC0-mapping.dmp

Download
memory/2160-108-0x0000000000A10000-0x0000000000D13000-memory.dmp

Filesize
3.0MB

Download
memory/2304-134-0x0000000002150000-0x0000000002453000-memory.dmp

Filesize
3.0MB

Download
memory/2304-132-0x0000000000730000-0x0000000000756000-memory.dmp

Filesize
152KB

Download
memory/2304-133-0x0000000000070000-0x000000000009E000-memory.dmp

Filesize
184KB

Download
memory/2304-125-0x0000000000000000-mapping.dmp

Download
memory/2304-166-0x0000000000510000-0x00000000005A3000-memory.dmp

Filesize
588KB

Download
memory/2336-118-0x0000000000000000-mapping.dmp

Download
memory/2336-135-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2360-121-0x0000000000000000-mapping.dmp

Download
memory/2488-128-0x0000000000000000-mapping.dmp

Download
memory/2568-131-0x0000000000000000-mapping.dmp

Download
memory/2612-153-0x0000000002460000-0x00000000030AA000-memory.dmp

Filesize
12.3MB

Download
memory/2612-136-0x0000000000000000-mapping.dmp

Download
memory/2612-150-0x0000000002460000-0x00000000030AA000-memory.dmp

Filesize
12.3MB

Download
memory/2612-151-0x0000000002460000-0x00000000030AA000-memory.dmp

Filesize
12.3MB

Download
memory/2640-137-0x0000000000000000-mapping.dmp

Download
memory/2640-158-0x00000000023F0000-0x000000000303A000-memory.dmp

Filesize
12.3MB

Download
memory/2640-162-0x00000000023F0000-0x000000000303A000-memory.dmp

Filesize
12.3MB

Download
memory/2640-159-0x00000000023F0000-0x000000000303A000-memory.dmp

Filesize
12.3MB

Download
memory/2672-138-0x0000000000000000-mapping.dmp

Download
memory/2672-165-0x0000000002440000-0x000000000308A000-memory.dmp

Filesize
12.3MB

Download
memory/2672-164-0x0000000002440000-0x000000000308A000-memory.dmp

Filesize
12.3MB

Download
memory/2672-161-0x0000000002440000-0x000000000308A000-memory.dmp

Filesize
12.3MB

Download
memory/2696-154-0x0000000001CF0000-0x0000000001CF1000-memory.dmp

Filesize
4KB

Download
memory/2696-157-0x0000000001CF2000-0x0000000001CF4000-memory.dmp

Filesize
8KB

Download
memory/2696-156-0x0000000001CF1000-0x0000000001CF2000-memory.dmp

Filesize
4KB

Download
memory/2696-140-0x0000000000000000-mapping.dmp

Download
memory/2748-160-0x00000000023C0000-0x000000000300A000-memory.dmp

Filesize
12.3MB

Download
memory/2748-163-0x00000000023C0000-0x000000000300A000-memory.dmp

Filesize
12.3MB

Download
memory/2748-155-0x00000000023C0000-0x000000000300A000-memory.dmp

Filesize
12.3MB

Download
memory/2748-143-0x0000000000000000-mapping.dmp

Download