ec466a69624814b7fc4619b5d7b8e920bf245e1b39e7bfb1b0f033b0c738a76c

Resubmissions

17/03/2023, 22:41

230317-2mcpqacc81 10

17/03/2023, 18:30

230317-w5f7zahe56 10

Analysis

max time kernel
71s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2023, 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

my_pretty_pony.exe
Size

655KB
MD5

8ce8362b176c206ab2f84aa4340d715b
SHA1

bb0c1243924ba11699c0ce701584a892bcb012da
SHA256

ec466a69624814b7fc4619b5d7b8e920bf245e1b39e7bfb1b0f033b0c738a76c
SHA512

df2dd6dc370123c30900da1fa3e7bb5c8f96d277f634470d3af07ff05577105ea82d5ea0134e4cb9864cb2e597f642e97f133c9afeaac325a5d4a3477de3ea93
SSDEEP

12288:QESqJwbBEE+tOinc2xwlqXs4zUmvycM6xgNyJ6DsZuhEP60dIIFazZyun23:QEdYj+jnc21lz/VnxgAJxuOCciZzE

Score

10^/10

evasion persistence spyware stealer upx

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3"	behost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	R07924.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	buuniu.exe

Disables taskbar notifications via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	R07924.exe

Executes dropped EXE 11 IoCs

pid	Process
3244	R07924.exe
4460	buuniu.exe
4184	aehost.exe
4916	aehost.exe
3748	behost.exe
1336	cehost.exe
2556	dehost.exe
2100	behost.exe
4184	behost.exe
1528	R07924.exe
3544	B854.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1844-133-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral2/memory/1844-134-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral2/memory/1844-138-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral2/memory/1844-139-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral2/memory/1844-140-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral2/memory/1844-186-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral2/memory/2100-246-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral2/memory/3748-250-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral2/memory/4184-314-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral2/memory/3748-317-0x0000000000400000-0x0000000000469000-memory.dmp	upx
behavioral2/memory/1844-483-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral2/memory/3748-488-0x0000000000400000-0x0000000000469000-memory.dmp	upx

Adds Run key to start application 2 TTPs 49 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /Q"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /D"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /G"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /j"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /h"	R07924.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /C"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /U"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /b"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /k"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /q"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /z"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /e"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /y"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /n"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /m"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /E"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /c"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /A"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /r"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /V"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /v"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /F"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /u"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /o"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /T"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /Z"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /l"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /s"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /d"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /w"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /H"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /L"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /J"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /Y"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /B"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /a"	buuniu.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run\	R07924.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run\	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /h"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /O"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /p"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /x"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /X"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /P"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /K"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /S"	buuniu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\43D.exe = "C:\\Program Files (x86)\\LP\\D3F7\\43D.exe"	behost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /N"	buuniu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\buuniu = "C:\\Users\\Admin\\buuniu.exe /I"	buuniu.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4252 set thread context of 1844	4252	my_pretty_pony.exe	88
PID 4184 set thread context of 4916	4184	aehost.exe	106
PID 1336 set thread context of 1400	1336	cehost.exe	112

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LP\D3F7\ABFF.exe	behost.exe
File opened for modification	C:\Program Files (x86)\LP\D3F7\B854.tmp	behost.exe
File opened for modification	C:\Program Files (x86)\LP\D3F7\43D.exe	behost.exe
File created	C:\Program Files (x86)\LP\D3F7\43D.exe	behost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery

T1057

pid	Process
4404	tasklist.exe
3232	tasklist.exe
3608	tasklist.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3244	R07924.exe
3244	R07924.exe
3244	R07924.exe
3244	R07924.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
4460	buuniu.exe
1936	taskmgr.exe
1936	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4404	tasklist.exe
Token: SeDebugPrivilege	1936	taskmgr.exe
Token: SeSystemProfilePrivilege	1936	taskmgr.exe
Token: SeCreateGlobalPrivilege	1936	taskmgr.exe
Token: SeSecurityPrivilege	916	msiexec.exe
Token: SeShutdownPrivilege	388	explorer.exe
Token: SeCreatePagefilePrivilege	388	explorer.exe
Token: SeShutdownPrivilege	388	explorer.exe
Token: SeCreatePagefilePrivilege	388	explorer.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1844	my_pretty_pony.exe
3244	R07924.exe
4460	buuniu.exe
2556	dehost.exe
1528	R07924.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 1844	4252	my_pretty_pony.exe	88
PID 4252 wrote to memory of 1844	4252	my_pretty_pony.exe	88
PID 4252 wrote to memory of 1844	4252	my_pretty_pony.exe	88
PID 4252 wrote to memory of 1844	4252	my_pretty_pony.exe	88
PID 4252 wrote to memory of 1844	4252	my_pretty_pony.exe	88
PID 4252 wrote to memory of 1844	4252	my_pretty_pony.exe	88
PID 4252 wrote to memory of 1844	4252	my_pretty_pony.exe	88
PID 4252 wrote to memory of 1844	4252	my_pretty_pony.exe	88
PID 1844 wrote to memory of 3244	1844	my_pretty_pony.exe	89
PID 1844 wrote to memory of 3244	1844	my_pretty_pony.exe	89
PID 1844 wrote to memory of 3244	1844	my_pretty_pony.exe	89
PID 3244 wrote to memory of 4460	3244	R07924.exe	93
PID 3244 wrote to memory of 4460	3244	R07924.exe	93
PID 3244 wrote to memory of 4460	3244	R07924.exe	93
PID 3244 wrote to memory of 4892	3244	R07924.exe	94
PID 3244 wrote to memory of 4892	3244	R07924.exe	94
PID 3244 wrote to memory of 4892	3244	R07924.exe	94
PID 1844 wrote to memory of 4184	1844	my_pretty_pony.exe	95
PID 1844 wrote to memory of 4184	1844	my_pretty_pony.exe	95
PID 1844 wrote to memory of 4184	1844	my_pretty_pony.exe	95
PID 4892 wrote to memory of 4404	4892	cmd.exe	97
PID 4892 wrote to memory of 4404	4892	cmd.exe	97
PID 4892 wrote to memory of 4404	4892	cmd.exe	97
PID 4460 wrote to memory of 4404	4460	buuniu.exe	97
PID 4460 wrote to memory of 4404	4460	buuniu.exe	97
PID 4184 wrote to memory of 4916	4184	aehost.exe	106
PID 4184 wrote to memory of 4916	4184	aehost.exe	106
PID 4184 wrote to memory of 4916	4184	aehost.exe	106
PID 4184 wrote to memory of 4916	4184	aehost.exe	106
PID 4184 wrote to memory of 4916	4184	aehost.exe	106
PID 4184 wrote to memory of 4916	4184	aehost.exe	106
PID 4184 wrote to memory of 4916	4184	aehost.exe	106
PID 4184 wrote to memory of 4916	4184	aehost.exe	106
PID 4184 wrote to memory of 4916	4184	aehost.exe	106
PID 4184 wrote to memory of 4916	4184	aehost.exe	106
PID 1844 wrote to memory of 3748	1844	my_pretty_pony.exe	107
PID 1844 wrote to memory of 3748	1844	my_pretty_pony.exe	107
PID 1844 wrote to memory of 3748	1844	my_pretty_pony.exe	107
PID 1844 wrote to memory of 1336	1844	my_pretty_pony.exe	110
PID 1844 wrote to memory of 1336	1844	my_pretty_pony.exe	110
PID 1844 wrote to memory of 1336	1844	my_pretty_pony.exe	110
PID 1336 wrote to memory of 1400	1336	cehost.exe	112
PID 1336 wrote to memory of 1400	1336	cehost.exe	112
PID 1336 wrote to memory of 1400	1336	cehost.exe	112
PID 1844 wrote to memory of 2556	1844	my_pretty_pony.exe	113
PID 1844 wrote to memory of 2556	1844	my_pretty_pony.exe	113
PID 1844 wrote to memory of 2556	1844	my_pretty_pony.exe	113
PID 3748 wrote to memory of 2100	3748	behost.exe	114
PID 3748 wrote to memory of 2100	3748	behost.exe	114
PID 3748 wrote to memory of 2100	3748	behost.exe	114
PID 3748 wrote to memory of 4184	3748	behost.exe	117
PID 3748 wrote to memory of 4184	3748	behost.exe	117
PID 3748 wrote to memory of 4184	3748	behost.exe	117
PID 3748 wrote to memory of 3544	3748	behost.exe	121
PID 3748 wrote to memory of 3544	3748	behost.exe	121
PID 3748 wrote to memory of 3544	3748	behost.exe	121

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	behost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	behost.exe

C:\Users\Admin\AppData\Local\Temp\my_pretty_pony.exe
"C:\Users\Admin\AppData\Local\Temp\my_pretty_pony.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Users\Admin\AppData\Local\Temp\my_pretty_pony.exe
  my_pretty_pony.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Users\Admin\R07924.exe
    C:\Users\Admin\R07924.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Users\Admin\buuniu.exe
      "C:\Users\Admin\buuniu.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4460
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del R07924.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4404
- - C:\Users\Admin\aehost.exe
    C:\Users\Admin\aehost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Users\Admin\aehost.exe
      aehost.exe
      4⤵
      Executes dropped EXE
      PID:4916
- - C:\Users\Admin\behost.exe
    C:\Users\Admin\behost.exe
    3⤵
    - Modifies security service
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3748
  - - C:\Users\Admin\behost.exe
      C:\Users\Admin\behost.exe startC:\Users\Admin\AppData\Roaming\7F512\3AED3.exe%C:\Users\Admin\AppData\Roaming\7F512
      4⤵
      Executes dropped EXE
      PID:2100
  - - C:\Users\Admin\behost.exe
      C:\Users\Admin\behost.exe startC:\Program Files (x86)\128CD\lvvm.exe%C:\Program Files (x86)\128CD
      4⤵
      Executes dropped EXE
      PID:4184
  - - C:\Program Files (x86)\LP\D3F7\B854.tmp
      "C:\Program Files (x86)\LP\D3F7\B854.tmp"
      4⤵
      Executes dropped EXE
      PID:3544
- - C:\Users\Admin\cehost.exe
    C:\Users\Admin\cehost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\explorer.exe
      00000204*
      4⤵
      PID:1400
- - C:\Users\Admin\dehost.exe
    C:\Users\Admin\dehost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2556
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del my_pretty_pony.exe
    3⤵
    PID:4624
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3608

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1124

C:\Users\Admin\R07924.exe
"C:\Users\Admin\R07924.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1528
- C:\Users\Admin\saiabid.exe
  "C:\Users\Admin\saiabid.exe"
  2⤵
  PID:1636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist&&del R07924.exe
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:3232

C:\Windows\explorer.exe
explorer.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:388

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4680

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\LP\D3F7\43D.exe

Filesize
279KB

MD5
2a583120a51178ee5f8bc2727faaa73e

SHA1
91296d42eeddb285aeea28f5139cadda10f21df7

SHA256
b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

SHA512
003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

Download Submit
C:\Program Files (x86)\LP\D3F7\43D.exe

Filesize
279KB

MD5
2a583120a51178ee5f8bc2727faaa73e

SHA1
91296d42eeddb285aeea28f5139cadda10f21df7

SHA256
b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

SHA512
003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

Download Submit
C:\Program Files (x86)\LP\D3F7\B854.tmp

Filesize
104KB

MD5
0cb09d0443d2eda312058ae1a2fa83c2

SHA1
1888844fcab4269a5c08b5cf122b100e8abb3cb0

SHA256
50a9af2fe05dd06d6ff825bcf2106b64385e7fdf9a06a0a18ac187c4a057503a

SHA512
93bfdc4d14a7ba7cce25d0a83faa29e0efa7932f3024aa82fcc1d606cb9a65e0ebd91942ad9992ce787f639df1748fde9599cb9b676245a17a8198064df2e24c

Download Submit
C:\Program Files (x86)\LP\D3F7\B854.tmp

Filesize
104KB

MD5
0cb09d0443d2eda312058ae1a2fa83c2

SHA1
1888844fcab4269a5c08b5cf122b100e8abb3cb0

SHA256
50a9af2fe05dd06d6ff825bcf2106b64385e7fdf9a06a0a18ac187c4a057503a

SHA512
93bfdc4d14a7ba7cce25d0a83faa29e0efa7932f3024aa82fcc1d606cb9a65e0ebd91942ad9992ce787f639df1748fde9599cb9b676245a17a8198064df2e24c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
0712d1f9b3b1ee672cea9c34f2efce31

SHA1
fe9ce13f428844754a5f946e37b6ed2fba1753b7

SHA256
a527a10cdb5c2bdce52323c56195fc0433af03a3287e6bc49995e9400f936b90

SHA512
45ad6c4dbfc05cb26f90b73d651c9c17f3b407f3778d25a3f2a14039cd5d2239427eb844338e52944c02caec9982ac9393e8b09601d22e7281688dd5b1718a10

Download Submit
C:\Users\Admin\AppData\Roaming\7F512\28CD.F51

Filesize
600B

MD5
234da3a873182ba00f6ca71e819138f8

SHA1
d3bc55cd1b4714e9967c89f22980c405fadfc983

SHA256
2edc5f206718ec4e5e37979bf010977d51a9a284dccc2789916c56d9eeb3202c

SHA512
1354b5be2aabdf9b5636147582524b8550739f085a9697cee18c11fdc9ba9f5f3b72d96918b9f913fa2d312ce667f264595d4812a7395c87b7040870bd76c8ec

Download Submit
C:\Users\Admin\AppData\Roaming\7F512\28CD.F51

Filesize
996B

MD5
fd83858807509eece093c28218ac7785

SHA1
b8c638d4c0d6f02a00be952d8752b5b46a5ee267

SHA256
eba06f37414569af2c9df55ad0da99b796acd4dbcf58c072df61f06f5416c45a

SHA512
91e6384eb26988805b6cc94f21e6afbf175539b8d3dbec85b16686204be013ec17aa7563097712d59e7059233d4664ad2d10b48a9a8e87beedcff0b90660ec81

Download Submit
C:\Users\Admin\AppData\Roaming\7F512\28CD.F51

Filesize
1KB

MD5
6ab5b7a5f3c2d79f7d2335874098dbf8

SHA1
8e04114837fda286b2c9f806fa0bf46be205b329

SHA256
5040a9d1a7fbb5c609c382123e5004282ad11c5277ba4b4702560021d236e529

SHA512
5ec72e690dcfcb1a94c7331678087f182dde6db65f13027c80160a168328dc0ea6d1a7e68ec3e7aa13dbf5ce06eb47455d7951570e8744f2233fd9a99c305fde

Download Submit
C:\Users\Admin\AppData\Roaming\7F512\28CD.F51

Filesize
1KB

MD5
9384d887637c6f288b3ee12ed361a96a

SHA1
c794a9b9972817544353a49fa5ee64f4557cfe99

SHA256
e189878da86eb27d355d5eb108875b0689456384a3947022c9eb0b05a767c076

SHA512
042ffa3fc0f7056f047dc324b750ada7fd14db9b7cb3b95c2aee36d261e1f96566addad42e66b41a5dc3431e14b092ec2508bfe9bf33f19c3cecdba55ed09be3

Download Submit
C:\Users\Admin\AppData\Roaming\7F512\28CD.F51

Filesize
1KB

MD5
fe3b5c2cdca124fea879a69107a7482c

SHA1
b10ac901aa82b14cc05d462957d8f7dff0d0c1c4

SHA256
2884f263378c144b59ce6f227940ec667ea77123e3df14e72649eab010574b98

SHA512
4e2a0cdf6f0a4a1872d1834df70a3b7122cb264ac1953f1adf4cf4aec3598d205a62554b836535026daa1ad35ae155a305b4874f9c0cb49290efeb7d465ed3a0

Download Submit
C:\Users\Admin\R07924.exe

Filesize
188KB

MD5
4f9c5823c5d1255ded151b01c0a58e15

SHA1
2f7018a9211472ddfa5d2f09629bf90adce4676c

SHA256
e38564871dc5952e2d1d22d51e312e3064cf84df95c0420021153cb5c264adcf

SHA512
b5518effbf476d9486a5ddaa65c937e97b10470d533f8e0c9af30956868c032f6bdb524d13a004e4a0d19e9a88b5f3f11ee82e5602b1175092fb36a9959d40ca

Download Submit
C:\Users\Admin\R07924.exe

Filesize
188KB

MD5
4f9c5823c5d1255ded151b01c0a58e15

SHA1
2f7018a9211472ddfa5d2f09629bf90adce4676c

SHA256
e38564871dc5952e2d1d22d51e312e3064cf84df95c0420021153cb5c264adcf

SHA512
b5518effbf476d9486a5ddaa65c937e97b10470d533f8e0c9af30956868c032f6bdb524d13a004e4a0d19e9a88b5f3f11ee82e5602b1175092fb36a9959d40ca

Download Submit
C:\Users\Admin\R07924.exe

Filesize
188KB

MD5
4f9c5823c5d1255ded151b01c0a58e15

SHA1
2f7018a9211472ddfa5d2f09629bf90adce4676c

SHA256
e38564871dc5952e2d1d22d51e312e3064cf84df95c0420021153cb5c264adcf

SHA512
b5518effbf476d9486a5ddaa65c937e97b10470d533f8e0c9af30956868c032f6bdb524d13a004e4a0d19e9a88b5f3f11ee82e5602b1175092fb36a9959d40ca

Download Submit
C:\Users\Admin\aehost.exe

Filesize
129KB

MD5
e2b1704acdf48221cd9be91bae3546c5

SHA1
f53a59b62276f58cf8689768f747e16f53dbd341

SHA256
8b1c13bb2e95f71ed75d8fca7aeefc556ecd377d5d4f6c544d77ac8f74255ca5

SHA512
1b3d8baa981851a79c4f12f3ea2a4d197b3439e76ca723acd578acabd731310d6eeb3a4567a10d48f45192ae9c4cd732eca04c0a7fffa636e7bd364ed1357b53

Download Submit
C:\Users\Admin\aehost.exe

Filesize
129KB

MD5
e2b1704acdf48221cd9be91bae3546c5

SHA1
f53a59b62276f58cf8689768f747e16f53dbd341

SHA256
8b1c13bb2e95f71ed75d8fca7aeefc556ecd377d5d4f6c544d77ac8f74255ca5

SHA512
1b3d8baa981851a79c4f12f3ea2a4d197b3439e76ca723acd578acabd731310d6eeb3a4567a10d48f45192ae9c4cd732eca04c0a7fffa636e7bd364ed1357b53

Download Submit
C:\Users\Admin\aehost.exe

Filesize
129KB

MD5
e2b1704acdf48221cd9be91bae3546c5

SHA1
f53a59b62276f58cf8689768f747e16f53dbd341

SHA256
8b1c13bb2e95f71ed75d8fca7aeefc556ecd377d5d4f6c544d77ac8f74255ca5

SHA512
1b3d8baa981851a79c4f12f3ea2a4d197b3439e76ca723acd578acabd731310d6eeb3a4567a10d48f45192ae9c4cd732eca04c0a7fffa636e7bd364ed1357b53

Download Submit
C:\Users\Admin\behost.exe

Filesize
279KB

MD5
2a583120a51178ee5f8bc2727faaa73e

SHA1
91296d42eeddb285aeea28f5139cadda10f21df7

SHA256
b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

SHA512
003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

Download Submit
C:\Users\Admin\behost.exe

Filesize
279KB

MD5
2a583120a51178ee5f8bc2727faaa73e

SHA1
91296d42eeddb285aeea28f5139cadda10f21df7

SHA256
b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

SHA512
003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

Download Submit
C:\Users\Admin\behost.exe

Filesize
279KB

MD5
2a583120a51178ee5f8bc2727faaa73e

SHA1
91296d42eeddb285aeea28f5139cadda10f21df7

SHA256
b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

SHA512
003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

Download Submit
C:\Users\Admin\behost.exe

Filesize
279KB

MD5
2a583120a51178ee5f8bc2727faaa73e

SHA1
91296d42eeddb285aeea28f5139cadda10f21df7

SHA256
b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

SHA512
003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

Download Submit
C:\Users\Admin\buuniu.exe

Filesize
188KB

MD5
8d2917af1094d9c366c191c4949e6ea8

SHA1
4106b2bed64edc30a75447066d807a868f4dcd39

SHA256
ff5d6bf9497dc18fecd6c55ab7595ae7eb72d90d868ca56f67d432119877df8f

SHA512
994a680c9b5abfee68fa17b2feaa37ee1417b10b09534748998ab910f1d2eae237d4f4087e1ee095aca87c9fe2e3a7ad8566eb6d04e96da0e9d487aaf0ff4bec

Download Submit
C:\Users\Admin\buuniu.exe

Filesize
188KB

MD5
8d2917af1094d9c366c191c4949e6ea8

SHA1
4106b2bed64edc30a75447066d807a868f4dcd39

SHA256
ff5d6bf9497dc18fecd6c55ab7595ae7eb72d90d868ca56f67d432119877df8f

SHA512
994a680c9b5abfee68fa17b2feaa37ee1417b10b09534748998ab910f1d2eae237d4f4087e1ee095aca87c9fe2e3a7ad8566eb6d04e96da0e9d487aaf0ff4bec

Download Submit
C:\Users\Admin\buuniu.exe

Filesize
188KB

MD5
8d2917af1094d9c366c191c4949e6ea8

SHA1
4106b2bed64edc30a75447066d807a868f4dcd39

SHA256
ff5d6bf9497dc18fecd6c55ab7595ae7eb72d90d868ca56f67d432119877df8f

SHA512
994a680c9b5abfee68fa17b2feaa37ee1417b10b09534748998ab910f1d2eae237d4f4087e1ee095aca87c9fe2e3a7ad8566eb6d04e96da0e9d487aaf0ff4bec

Download Submit
C:\Users\Admin\cehost.exe

Filesize
145KB

MD5
56be9270582de0986c72139ea218e121

SHA1
d33b8a2127ccf6b6f42a0c0f266136a376def18c

SHA256
8b40a882fde5ef3df2ec3112142b654c949adf7f559bc1912ad9d08ebb17c257

SHA512
dcee7d3d16e19e5a36a386d097c171ed7761ad4fc626b5d523b9c33f952fa24da733c56fcb8ff440894c3672c468d04cecc001ae9a680a9607347a5f517e6023

Download Submit
C:\Users\Admin\cehost.exe

Filesize
145KB

MD5
56be9270582de0986c72139ea218e121

SHA1
d33b8a2127ccf6b6f42a0c0f266136a376def18c

SHA256
8b40a882fde5ef3df2ec3112142b654c949adf7f559bc1912ad9d08ebb17c257

SHA512
dcee7d3d16e19e5a36a386d097c171ed7761ad4fc626b5d523b9c33f952fa24da733c56fcb8ff440894c3672c468d04cecc001ae9a680a9607347a5f517e6023

Download Submit
C:\Users\Admin\dehost.exe

Filesize
24KB

MD5
7cda5863b933988b7bd1d0c8035dafd9

SHA1
68c64d655d0df1c9974587d12b3b88f5ce1f4cac

SHA256
400cb530f1489c46ada1dedc35b51cb53e8174f5cdda0d086ef593c135e0f216

SHA512
978440c09b70b695fdc171c6e2a7c064aa078d4a300db7f297afde5e3c1cfdf513da01dae967a9a8c524c185432ef87bf922a5cc97a9c8a6d1fd9cc3155e0aea

Download Submit
C:\Users\Admin\dehost.exe

Filesize
24KB

MD5
7cda5863b933988b7bd1d0c8035dafd9

SHA1
68c64d655d0df1c9974587d12b3b88f5ce1f4cac

SHA256
400cb530f1489c46ada1dedc35b51cb53e8174f5cdda0d086ef593c135e0f216

SHA512
978440c09b70b695fdc171c6e2a7c064aa078d4a300db7f297afde5e3c1cfdf513da01dae967a9a8c524c185432ef87bf922a5cc97a9c8a6d1fd9cc3155e0aea

Download Submit
C:\Users\Admin\saiabid.exe

Filesize
188KB

MD5
e1d0960b6cf5ce1684838065b142811e

SHA1
89420e2c8ed22647301411b3a482775264a893b4

SHA256
c92830d7009cb03522f3741e752e09bc6d7f8d176ca6a9d9ab9ff71b95d77e56

SHA512
ce89ef05d2c4e2671ab199e6e0fe79bdfa3c706e4ffea62cad123405476fd10166c7029928840c04c017e50ec1da51cee7607655229f277fdcd551a744a0787d

Download Submit
C:\Users\Admin\saiabid.exe

Filesize
188KB

MD5
e1d0960b6cf5ce1684838065b142811e

SHA1
89420e2c8ed22647301411b3a482775264a893b4

SHA256
c92830d7009cb03522f3741e752e09bc6d7f8d176ca6a9d9ab9ff71b95d77e56

SHA512
ce89ef05d2c4e2671ab199e6e0fe79bdfa3c706e4ffea62cad123405476fd10166c7029928840c04c017e50ec1da51cee7607655229f277fdcd551a744a0787d

Download Submit
memory/388-487-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/1280-499-0x00000278632A0000-0x00000278632C0000-memory.dmp

Filesize
128KB

Download
memory/1280-496-0x0000027862E90000-0x0000027862EB0000-memory.dmp

Filesize
128KB

Download
memory/1280-494-0x0000027862ED0000-0x0000027862EF0000-memory.dmp

Filesize
128KB

Download
memory/1336-224-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1336-226-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1400-225-0x0000000000B00000-0x0000000000B15000-memory.dmp

Filesize
84KB

Download
memory/1844-133-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1844-138-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1844-134-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1844-139-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1844-186-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1844-483-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1844-140-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1936-202-0x0000020C52D30000-0x0000020C52D31000-memory.dmp

Filesize
4KB

Download
memory/1936-214-0x0000020C52D30000-0x0000020C52D31000-memory.dmp

Filesize
4KB

Download
memory/1936-209-0x0000020C52D30000-0x0000020C52D31000-memory.dmp

Filesize
4KB

Download
memory/1936-208-0x0000020C52D30000-0x0000020C52D31000-memory.dmp

Filesize
4KB

Download
memory/1936-210-0x0000020C52D30000-0x0000020C52D31000-memory.dmp

Filesize
4KB

Download
memory/1936-212-0x0000020C52D30000-0x0000020C52D31000-memory.dmp

Filesize
4KB

Download
memory/1936-213-0x0000020C52D30000-0x0000020C52D31000-memory.dmp

Filesize
4KB

Download
memory/1936-211-0x0000020C52D30000-0x0000020C52D31000-memory.dmp

Filesize
4KB

Download
memory/1936-204-0x0000020C52D30000-0x0000020C52D31000-memory.dmp

Filesize
4KB

Download
memory/1936-203-0x0000020C52D30000-0x0000020C52D31000-memory.dmp

Filesize
4KB

Download
memory/2100-246-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3544-447-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3748-488-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3748-250-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/3748-317-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4184-314-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4184-187-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4184-198-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4252-137-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4916-190-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4916-193-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4916-199-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4916-192-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4916-191-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4916-201-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4916-194-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download