cybergate | 369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 19:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
Size 508KB
Sample221021-x95a2acce7
SHA256 369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854
MD5 51d78313d1b949ea2e8e5e9849019774
SHA1 e2680897728213ae97799c29b8883820a224efde
SHA512 86d171ffa41d284349d9de69b1d6fb6c4412b588adf017d228e11dbc97681b4610bdd6c03ac092252c530603a5369f6caea342127610b9f128744384abd2fd09
SSDEEP 12288:fEjRKgucf1p+6+dUFgy5U2PhSPV/Mg3aZ:fUUudp+xUF15FPMPV/MWaZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate julijan13.zapto.org persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

2.7 Final

Botnet

julijan13.zapto.org

julijan13.zapto.org:82

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
owned123

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe"	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe"	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe

Executes dropped EXE 2 IoCs

pid	Process
4936	server.exe
2724	server.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1NE6O116-S785-D8MT-6AM4-H158T0D244Q3}	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1NE6O116-S785-D8MT-6AM4-H158T0D244Q3}\StubPath = "c:\\dir\\install\\install\\server.exe Restart"	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3676-141-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/3676-143-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/3676-144-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/3676-146-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/3676-162-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/2724-183-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/2724-182-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/2724-185-0x0000000000400000-0x00000000004B1000-memory.dmp	upx
behavioral2/memory/2724-187-0x0000000000400000-0x00000000004B1000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HD Audio Driver.url	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HD Audio Driver.url	server.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3752 set thread context of 3676	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	86
PID 4936 set thread context of 2724	4936	server.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
2724	server.exe
2724	server.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
Token: SeDebugPrivilege	3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
Token: SeDebugPrivilege	3172	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
Token: SeDebugPrivilege	4936	server.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4928	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	83
PID 3752 wrote to memory of 4928	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	83
PID 3752 wrote to memory of 4928	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	83
PID 4928 wrote to memory of 1492	4928	csc.exe	85
PID 4928 wrote to memory of 1492	4928	csc.exe	85
PID 4928 wrote to memory of 1492	4928	csc.exe	85
PID 3752 wrote to memory of 3676	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	86
PID 3752 wrote to memory of 3676	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	86
PID 3752 wrote to memory of 3676	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	86
PID 3752 wrote to memory of 3676	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	86
PID 3752 wrote to memory of 3676	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	86
PID 3752 wrote to memory of 3676	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	86
PID 3752 wrote to memory of 3676	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	86
PID 3752 wrote to memory of 3676	3752	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	86
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87
PID 3676 wrote to memory of 1748	3676	369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe	87

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:764
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:780
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3576
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4392
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3304
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:3488
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4832
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4420
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3820
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3660
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3504
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3408
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4480
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:4780

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3212

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3092
- C:\Users\Admin\AppData\Local\Temp\369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
  "C:\Users\Admin\AppData\Local\Temp\369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe"
  2⤵
  - Drops startup file
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yqfz7fll.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC70.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBC6F.tmp"
      4⤵
      PID:1492
- - C:\Users\Admin\AppData\Local\Temp\369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
    "C:\Users\Admin\AppData\Local\Temp\369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe"
    3⤵
    - Adds policy Run key to start application
    - Modifies Installed Components in the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe
      "C:\Users\Admin\AppData\Local\Temp\369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854.exe"
      4⤵
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:3172
    - - C:\dir\install\install\server.exe
        
        "C:\dir\install\install\server.exe"
        5⤵
        Executes dropped EXE
        Drops startup file
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6opzq9an.cmdline"
        6⤵
        
        PID:1644
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCBB2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCBB1.tmp"
        7⤵
        
        PID:4216
      - C:\dir\install\install\server.exe
        
        "C:\dir\install\install\server.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2724

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2700

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2516

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2112

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:424

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe e91ca7f0601da43ce287dc7d62fec696 SsW68YYWOkmEVHFYfkP4Gg.0.1.0.0.0
1⤵
PID:2484
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2552

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6opzq9an.dll

Path C:\Users\Admin\AppData\Local\Temp\6opzq9an.dll
Size 13KB
SHA256 68bcc67faffe1d12b774e5c078a9d5d608745e989a24c8b60a864134aae55dc3
MD5 6672e6b5a40adce6fb3dc715145d6d0d
SHA1 2cde699624e0fbc52bcff3fa2143f3d4af11d99d
SHA512 63135b99c721bfe7d48973de4f3abaa5b1694f6d36b5ce5aa30f78466631ca2b9b8b0d7d3286b6b27f7f3eb734f9ab5c3a83b5ee44ecca689276b57b9cdb0c37
SSDEEP 192:VxfYM2DEbOp4S8Fu0hWWZedaEowa+5SD8C4nVzHRMeVkpY:sD58xZiJFV12K
MD5 SHA1 SHA512 SSDEEP

Submit Download

RESBC70.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBC70.tmp
Size 1KB
SHA256 2888fd28df22d0e950eed4b7b24fa0513f6c98f6165607d6fe9fa4b8041fd93d
MD5 18e0ef8162f5e172af69c7f9cf58aba0
SHA1 2714866c746f8a4562c5290f95ce91851f67ef5f
SHA512 f09f0a98e86a64bd1d9c76efa7431cb4b68f0ceaf2a07d75f44ddceb35b0ac2fe2cd250585074db84d22723ea62fd1bf7149a9948f3320698928c9f232aaf655
MD5 SHA1 SHA512

Submit Download

RESCBB2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCBB2.tmp
Size 1KB
SHA256 67ac9614684632ec32821b87a5d6d15948d4aa8a0dbb97dd35be96a5d9f87009
MD5 886aa202b4c4e70ed2ecdd39296fa309
SHA1 44549fd09c91ffce56494becefcd584f4f10f1b1
SHA512 92a5f33114b5f196545bf7227093a8991c7880bb9311f547aa5c80878583d9864a287472301414ef950de77807c82d4efad020818565fe84404c187d2cccd373
MD5 SHA1 SHA512

Submit Download

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 604KB
SHA256 41f4865d26f6a42596e1e98dcd8ed8090dec2c61986f7aeab6275e3be911aedc
MD5 3ebf0ee1a971fe7802556d603f2200e8
SHA1 eca7a7950beb1e6b42b461cdcde2f1f6ab5f32ae
SHA512 bcfa679012d1db80e90ac71e12129fba0249bb18251946c3c7e94f876223566a0e652679bf5cabd3a0b279837b78eb505bd86bca4a0fb65fefde7f0f09e854ed
SSDEEP 12288:1Q4dLOSwCDfJqlE6uGiGSAlVLuBRzXA2oAMHVB66EYAUTS9D/ksSzQRD:fLtwCc26uGi2VCHXSBzTaDMsAQRD
MD5 SHA1 SHA512 SSDEEP

Submit Download

yqfz7fll.dll

Path C:\Users\Admin\AppData\Local\Temp\yqfz7fll.dll
Size 13KB
SHA256 b13539d001d35af5f3238144d310964f60d833bb9618b6089ee89cf3fbc7fec5
MD5 c54e4b1b1a05440cf7254592221e66a8
SHA1 7bf50d7c2930baec4b6a6c37064b498eacdcb50c
SHA512 2e095facaec2d10cf16861b772d4996faa711d18f3a1204028cf839d0ca684a2ad4bb2962ce01e808962c44a094f269596c6257d56969061f27fcc43b24aa1f7
SSDEEP 192:JxfYM2DEbOp4S8Fu0hWWZLdaEowa+5SD8C4ngzGRMeVkp7:ID58xZJJFgk2t
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvcsvc.exe

Path C:\Users\Admin\AppData\Roaming\FlashPlayer\nvcsvc.exe
Size 508KB
SHA256 369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854
MD5 51d78313d1b949ea2e8e5e9849019774
SHA1 e2680897728213ae97799c29b8883820a224efde
SHA512 86d171ffa41d284349d9de69b1d6fb6c4412b588adf017d228e11dbc97681b4610bdd6c03ac092252c530603a5369f6caea342127610b9f128744384abd2fd09
SSDEEP 12288:fEjRKgucf1p+6+dUFgy5U2PhSPV/Mg3aZ:fUUudp+xUF15FPMPV/MWaZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

HD Audio Driver.url

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HD Audio Driver.url
Size 179B
SHA256 a5babfa48c68e5cdfab4ef600174d53c80619cdad9cf434f862d5a98a5c6bd15
MD5 9c2dc682d7e396fad2fc8d988a9bfd88
SHA1 a1abc32f0f8f1636b55d96d85a9b443df762e438
SHA512 a2151cb8592009ea9c149191c50daf4db1543138193c2559b5c9966da6f83a3d2a508638c7ae08e6bb1bfc3540485ad64da7831d43b9d47c221582032a964d40
MD5 SHA1 SHA512

Submit Download

server.exe

Path C:\dir\install\install\server.exe
Size 508KB
SHA256 369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854
MD5 51d78313d1b949ea2e8e5e9849019774
SHA1 e2680897728213ae97799c29b8883820a224efde
SHA512 86d171ffa41d284349d9de69b1d6fb6c4412b588adf017d228e11dbc97681b4610bdd6c03ac092252c530603a5369f6caea342127610b9f128744384abd2fd09
SSDEEP 12288:fEjRKgucf1p+6+dUFgy5U2PhSPV/Mg3aZ:fUUudp+xUF15FPMPV/MWaZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

server.exe

Path C:\dir\install\install\server.exe
Size 508KB
SHA256 369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854
MD5 51d78313d1b949ea2e8e5e9849019774
SHA1 e2680897728213ae97799c29b8883820a224efde
SHA512 86d171ffa41d284349d9de69b1d6fb6c4412b588adf017d228e11dbc97681b4610bdd6c03ac092252c530603a5369f6caea342127610b9f128744384abd2fd09
SSDEEP 12288:fEjRKgucf1p+6+dUFgy5U2PhSPV/Mg3aZ:fUUudp+xUF15FPMPV/MWaZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

server.exe

Path C:\dir\install\install\server.exe
Size 508KB
SHA256 369c2a4357a741482ba8c6c94489c4d50b6f062ec69a9005e549c98ed17c3854
MD5 51d78313d1b949ea2e8e5e9849019774
SHA1 e2680897728213ae97799c29b8883820a224efde
SHA512 86d171ffa41d284349d9de69b1d6fb6c4412b588adf017d228e11dbc97681b4610bdd6c03ac092252c530603a5369f6caea342127610b9f128744384abd2fd09
SSDEEP 12288:fEjRKgucf1p+6+dUFgy5U2PhSPV/Mg3aZ:fUUudp+xUF15FPMPV/MWaZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

6opzq9an.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\6opzq9an.0.cs
Size 15KB
SHA256 b22459425192940bc0efd18ffb630b47e42628049a119ed86ce3440011fb3d87
MD5 6380e4005ffb7325d12e7cbf7945a7ef
SHA1 dfc1ff93be9d22ace6023de20eda6ac79597e98f
SHA512 248565688afcb38a312f9035c5444a39acc20c468f9a462341ff94c980c9072177ca3856f0acbf38e39f412cd6f09a7d4703dc8dabae4bb76b3a1767e784ab4b
SSDEEP 384:jUVBvQQDbNZ8ZmYCZzwTViwMOF/PAaBqLsR/zAfBA+pRxwJYJQ8THZj8e6RUR9R1:Q4Qj+qzIiwM6/PAaBqLsR/zAfBA+pwJA
MD5 SHA1 SHA512 SSDEEP

Submit Download

6opzq9an.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\6opzq9an.cmdline
Size 165B
SHA256 8e0ec6f726dfc16e0eda438519c6df63df99e2d02af1b9fffd32d24815041bec
MD5 1db182075430e4ee752fb36332cb087c
SHA1 e889b6b6ff136fb216b1e7d4dbcde551871311e5
SHA512 bd039dd80556972c7e890a62bcb9d4d6111a3cf4c5456906de2038d0c470848752fc6348e64f9b257db25394c2e331415b1c84c120ffe707f26e2c91b1e013d7
MD5 SHA1 SHA512

Submit Download

CSCBC6F.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCBC6F.tmp
Size 652B
SHA256 c2cfc4f230ecbf64b91adbb4b3029df3b94a5c0eeee404f266ceecd6027e4d54
MD5 32eaeeb35c795eeecdd99b6e84d2d155
SHA1 e7aadb2ad0b84a970050a9e354f5deb15939c852
SHA512 298eb00dd0d55a7df081f9ef9aa2a135e6617379e841286c83ddb2931846f6867de20c125af84fc9acd5d8b555168fafe5be86c12d13f85dfe251e292798a178
MD5 SHA1 SHA512

Submit Download

CSCCBB1.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCCBB1.tmp
Size 652B
SHA256 67be38c26acba5c52a6c9b1b79ce4ae8e67adb0ea1ea1174cf4e95a9cbd44cf8
MD5 0a5406a8b86ef234ef4da3c8d2a029f5
SHA1 cce851e996f9ae218f3e75d5d15790b032e1a64a
SHA512 acf15c872b779a66cca1860bf4692eb1fa6e9e703b5d35e746b9f933ffe76607a54adfb7f90202cb273911d0c4ae0ee3b234150adb9edb28959a658157d2194e
MD5 SHA1 SHA512

Submit Download

yqfz7fll.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yqfz7fll.0.cs
Size 15KB
SHA256 b22459425192940bc0efd18ffb630b47e42628049a119ed86ce3440011fb3d87
MD5 6380e4005ffb7325d12e7cbf7945a7ef
SHA1 dfc1ff93be9d22ace6023de20eda6ac79597e98f
SHA512 248565688afcb38a312f9035c5444a39acc20c468f9a462341ff94c980c9072177ca3856f0acbf38e39f412cd6f09a7d4703dc8dabae4bb76b3a1767e784ab4b
SSDEEP 384:jUVBvQQDbNZ8ZmYCZzwTViwMOF/PAaBqLsR/zAfBA+pRxwJYJQ8THZj8e6RUR9R1:Q4Qj+qzIiwM6/PAaBqLsR/zAfBA+pwJA
MD5 SHA1 SHA512 SSDEEP

Submit Download

yqfz7fll.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yqfz7fll.cmdline
Size 165B
SHA256 a6811bb193e9e9082b9f1a6824dba464d9fffc4c8ffe36a701a0747c27dd21d7
MD5 42986ddb04ca98b7bc7d57065a6e5914
SHA1 bce3797bc179e6147030eae8398b9b1f72329041
SHA512 edd63d24fd341c635078b37fc3ba2ca940854f4668d5fd9cad8c6164a7133a860dea166fe6282d7ab6c04c62c1d4b226290dba02118286d71caa2a6de2d845c8
MD5 SHA1 SHA512

Submit Download

memory/2724-185-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/2724-182-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/2724-188-0x0000000031BD0000-0x0000000031BD9000-memory.dmp

Download

memory/2724-187-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/2724-183-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/2724-186-0x0000000031BD0000-0x0000000031BD9000-memory.dmp

Download

memory/3172-163-0x0000000010470000-0x00000000104CC000-memory.dmp

Download

memory/3172-189-0x0000000010470000-0x00000000104CC000-memory.dmp

Download

memory/3676-156-0x0000000010470000-0x00000000104CC000-memory.dmp

Download

memory/3676-148-0x0000000010410000-0x000000001046C000-memory.dmp

Download

memory/3676-146-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/3676-141-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/3676-144-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/3676-143-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/3676-162-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/3752-145-0x0000000074AC0000-0x0000000075071000-memory.dmp

Download

memory/3752-139-0x0000000074AC0000-0x0000000075071000-memory.dmp

Download

memory/4936-184-0x0000000073020000-0x00000000735D1000-memory.dmp

Download

memory/4936-168-0x0000000073020000-0x00000000735D1000-memory.dmp

Download