739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27/08/2023, 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe
Size

536KB
MD5

35c62921f6d6b930053b6cbb32d48a24
SHA1

15ba18d0e71a05fa47c149d9427f05c10236cd2f
SHA256

739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316
SHA512

cb7c3ea83fb8b22fae94b2fa9e7e19cea101dd24815c2729cf2465dbe484740df75c2a9680700c0f94aa24ba37c32a40625a8252b0aaaa6a0cea2a8e82b0323c
SSDEEP

12288:2Qab4j0WxHHxvgZ5Debn9XdvVYf8tn5+qqheFgOkx2LIa:Tvj0oxv2Dezv/tx3yOkx2LF

Score

10^/10

upx vmprotect

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1252 created 424	1252	Explorer.EXE	6

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\YX2QcVV.sys	AtBroker.exe
File opened for modification	C:\Windows\system32\drivers\Wo7eaL2dGzeciB.sys	AtBroker.exe
File opened for modification	C:\Windows\system32\drivers\DtDRWts0Vf0.sys	AtBroker.exe
File opened for modification	C:\Windows\system32\drivers\vwmuHknmAWy.qhc	AtBroker.exe
File opened for modification	C:\Windows\system32\drivers\JpdQMmnyiUAYZ.sys	AtBroker.exe
File opened for modification	C:\Windows\system32\drivers\tZLu7dlHkbOZk.pfx	AtBroker.exe
File opened for modification	C:\Windows\system32\drivers\wDO2kI5UoJrNlp.bhk	AtBroker.exe
File opened for modification	C:\Windows\system32\drivers\Yf8dCuih7Mwp.sys	AtBroker.exe
File opened for modification	C:\Windows\system32\drivers\xXfvC9ynfm5v.lkb	AtBroker.exe

Deletes itself 1 IoCs

pid	Process
528	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3000	AtBroker.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2228-0-0x00000000011E0000-0x00000000012E2000-memory.dmp	upx
behavioral1/memory/2228-54-0x00000000011E0000-0x00000000012E2000-memory.dmp	upx
behavioral1/memory/2228-71-0x00000000011E0000-0x00000000012E2000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	114.114.114.114

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000a00000001603e-190.dat	vmprotect
behavioral1/files/0x001800000001603e-309.dat	vmprotect
behavioral1/files/0x002600000001603e-423.dat	vmprotect
behavioral1/files/0x003400000001603e-535.dat	vmprotect

Drops file in System32 directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173	AtBroker.exe
File opened for modification	C:\Windows\system32\N1XHocVuNbZ.sys	AtBroker.exe
File opened for modification	C:\Windows\system32\T19SXzmlP4C0.sys	AtBroker.exe
File opened for modification	C:\Windows\system32\92HvMrwVtyW.sys	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	AtBroker.exe
File created	C:\Windows\system32\ \Windows\System32\pqphn8.sys	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475	AtBroker.exe
File opened for modification	C:\Windows\system32\PcRmMhKjtSdw.oly	AtBroker.exe
File opened for modification	C:\Windows\system32\MWwPhR4PJF.tmt	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3	AtBroker.exe
File opened for modification	C:\Windows\system32\pZVXyjXoQ1yYs.ngp	AtBroker.exe
File opened for modification	C:\Windows\system32\9F0SyW7uHoSR.sys	AtBroker.exe
File opened for modification	C:\Windows\system32\IB4nx07PcXcM.cev	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	AtBroker.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173	AtBroker.exe

Drops file in Program Files directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Yyk2CJ6K15.sys	AtBroker.exe
File opened for modification	C:\Program Files\Reference Assemblies\lib\6c48df89.js	AtBroker.exe
File opened for modification	C:\Program Files\Microsoft Games\4d58a181.html	Explorer.EXE
File opened for modification	C:\Program Files\Windows NT\5cd0c3a2.js	Dwm.exe
File opened for modification	C:\Program Files\FwIQQGfk4IJK.sys	AtBroker.exe
File opened for modification	C:\Program Files\nWZG2C34ciKOn.sys	AtBroker.exe
File opened for modification	C:\Program Files\BefMoylT3Bcyve.sys	AtBroker.exe
File opened for modification	C:\Program Files\Microsoft Games\manifest.json	Explorer.EXE
File opened for modification	C:\Program Files\Microsoft Games\3de08134.js	Explorer.EXE
File opened for modification	C:\Program Files\Reference Assemblies\3de07fbc.js	AtBroker.exe
File opened for modification	C:\Program Files\Microsoft Games\5cd0c1ce.js	Explorer.EXE
File opened for modification	C:\Program Files\Windows NT\lib\6c48e43d.js	Dwm.exe
File opened for modification	C:\Program Files\OW0EI8nPsJAS.sys	AtBroker.exe
File opened for modification	C:\Program Files\Reference Assemblies\5cd0bf9a.js	AtBroker.exe
File opened for modification	C:\Program Files\Windows NT\3de0826c.js	Dwm.exe
File opened for modification	C:\Program Files\Windows NT\4d58a307.html	Dwm.exe
File opened for modification	C:\Program Files\KoXql96xaJ1.bmc	AtBroker.exe
File opened for modification	C:\Program Files (x86)\OQr71ws7YuS.sys	AtBroker.exe
File opened for modification	C:\Program Files (x86)\ZjZGcwQuA7o.hxy	AtBroker.exe
File opened for modification	C:\Program Files\pTA8gRd6QlGD.ggf	AtBroker.exe
File opened for modification	C:\Program Files\Reference Assemblies\manifest.json	AtBroker.exe
File opened for modification	C:\Program Files\Reference Assemblies\4d589fab.html	AtBroker.exe
File opened for modification	C:\Program Files\KaFnr5IUkY91.dit	AtBroker.exe
File opened for modification	C:\Program Files (x86)\UI0dmM5TyzS214.sys	AtBroker.exe
File opened for modification	C:\Program Files (x86)\qgtfkuagmXpC2.sys	AtBroker.exe
File opened for modification	C:\Program Files (x86)\6AMMVVB59bsU.llf	AtBroker.exe
File opened for modification	C:\Program Files (x86)\YYefQhqIAX7v.fzv	AtBroker.exe
File opened for modification	C:\Program Files (x86)\dExP0A3ji1.krc	AtBroker.exe
File opened for modification	C:\Program Files\hddzsob8cnxT07.imx	AtBroker.exe
File opened for modification	C:\Program Files\Microsoft Games\lib\6c48e21b.js	Explorer.EXE
File opened for modification	C:\Program Files\Windows NT\manifest.json	Dwm.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\AtBroker.exe	Explorer.EXE
File created	C:\Windows\X6BRPgf.sys	AtBroker.exe
File opened for modification	C:\Windows\CMRFzpRdgl.ifh	AtBroker.exe
File opened for modification	C:\Windows\37NIk64f0KqSB.sys	AtBroker.exe
File opened for modification	C:\Windows\AtBroker.exe	Explorer.EXE
File opened for modification	C:\Windows\wDZoScteKDL.sys	AtBroker.exe
File opened for modification	C:\Windows\MAd0rQf4CDa.esk	AtBroker.exe
File opened for modification	C:\Windows\JdEzLh6SlAz9.sys	AtBroker.exe
File opened for modification	C:\Windows\b9Q2Xv7HHgV8.sys	AtBroker.exe
File opened for modification	C:\Windows\ZwcOHG2D6M6vfJ.suw	AtBroker.exe
File opened for modification	C:\Windows\kEE0uNLPDhDmJh.hsq	AtBroker.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2708	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0016000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AtBroker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	AtBroker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	AtBroker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	AtBroker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1BF6B86B-D6D2-495F-9785-454A9C0E1484}\WpadDecision = "0"	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mspaint.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mspaint.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mspaint.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	AtBroker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1BF6B86B-D6D2-495F-9785-454A9C0E1484}	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-ea-6c-4f-76-d5	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	AtBroker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4e-ea-6c-4f-76-d5\WpadDecision = "0"	AtBroker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	AtBroker.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0016000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mspaint.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	AtBroker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mspaint.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	AtBroker.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mspaint.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	AtBroker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mspaint.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	AtBroker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	AtBroker.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	AtBroker.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1BF6B86B-D6D2-495F-9785-454A9C0E1484}\WpadDecisionReason = "1"	AtBroker.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	AtBroker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	AtBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\119C04403FE19897A57923E5BF4C48FDB28EAA53	AtBroker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\119C04403FE19897A57923E5BF4C48FDB28EAA53\Blob = 0f00000001000000200000004fb7a9b5718fe867241e6c7f80c39c41dd4d2023278550f0f8ae86e6850d5c82030000000100000014000000119c04403fe19897a57923e5bf4c48fdb28eaa5320000000010000004402000030820240308201a9a003020102020100300d06092a864886f70d01010b05003044310b300906035504061302434e3135303306035504030c2c4d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479205632301e170d3233303832373136343733375a170d3234303832363136343733375a3044310b300906035504061302434e3135303306035504030c2c4d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747920563230819f300d06092a864886f70d010101050003818d0030818902818100b49f85cdcdb160477bfb059d31305d99e6e995a20657ecc594c89b0410b86549b7f9022c5d0949bf74d6a427b6e108e28e171edb2584e7bcdb93f03826ca57f7fb6a889c7941a5a6cac6e3f5f5de4a1ff734b2fce225d27f72cb035bf8379642cc06f9621018856a2ecc5512cd0aad8b039788b9b379afce415e9d950be634c30203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e0416041430e690f967a1987f5ec6618f8da7c5f773a9e228300d06092a864886f70d01010b050003818100681cedc1bd929c6fb354925a6bc490cb39544e3733730edae44b5a0082b9eaa8822d25aa363733a245a13e314872ed6df336220ad980db1dd2f4ec04b3de6d5573530a2481640d0cebbb3bfef7353d5710e7b6f853e699b81bfd3dbedf0779000292fc34d05a1e4fbdf9234947177d82e40aa47a8e6512a9c0fdb6d3fd11de78	AtBroker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\119C04403FE19897A57923E5BF4C48FDB28EAA53\Blob = 14000000010000001400000030e690f967a1987f5ec6618f8da7c5f773a9e228030000000100000014000000119c04403fe19897a57923e5bf4c48fdb28eaa530f00000001000000200000004fb7a9b5718fe867241e6c7f80c39c41dd4d2023278550f0f8ae86e6850d5c8220000000010000004402000030820240308201a9a003020102020100300d06092a864886f70d01010b05003044310b300906035504061302434e3135303306035504030c2c4d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479205632301e170d3233303832373136343733375a170d3234303832363136343733375a3044310b300906035504061302434e3135303306035504030c2c4d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747920563230819f300d06092a864886f70d010101050003818d0030818902818100b49f85cdcdb160477bfb059d31305d99e6e995a20657ecc594c89b0410b86549b7f9022c5d0949bf74d6a427b6e108e28e171edb2584e7bcdb93f03826ca57f7fb6a889c7941a5a6cac6e3f5f5de4a1ff734b2fce225d27f72cb035bf8379642cc06f9621018856a2ecc5512cd0aad8b039788b9b379afce415e9d950be634c30203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e0416041430e690f967a1987f5ec6618f8da7c5f773a9e228300d06092a864886f70d01010b050003818100681cedc1bd929c6fb354925a6bc490cb39544e3733730edae44b5a0082b9eaa8822d25aa363733a245a13e314872ed6df336220ad980db1dd2f4ec04b3de6d5573530a2481640d0cebbb3bfef7353d5710e7b6f853e699b81bfd3dbedf0779000292fc34d05a1e4fbdf9234947177d82e40aa47a8e6512a9c0fdb6d3fd11de78	AtBroker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\119C04403FE19897A57923E5BF4C48FDB28EAA53\Blob = 190000000100000010000000dbc7d65d00086ec76b8d6ae5d94ce67a0f00000001000000200000004fb7a9b5718fe867241e6c7f80c39c41dd4d2023278550f0f8ae86e6850d5c82030000000100000014000000119c04403fe19897a57923e5bf4c48fdb28eaa5314000000010000001400000030e690f967a1987f5ec6618f8da7c5f773a9e22820000000010000004402000030820240308201a9a003020102020100300d06092a864886f70d01010b05003044310b300906035504061302434e3135303306035504030c2c4d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f72697479205632301e170d3233303832373136343733375a170d3234303832363136343733375a3044310b300906035504061302434e3135303306035504030c2c4d6963726f736f66742041757468656e7469636f646528746d2920526f6f7420417574686f7269747920563230819f300d06092a864886f70d010101050003818d0030818902818100b49f85cdcdb160477bfb059d31305d99e6e995a20657ecc594c89b0410b86549b7f9022c5d0949bf74d6a427b6e108e28e171edb2584e7bcdb93f03826ca57f7fb6a889c7941a5a6cac6e3f5f5de4a1ff734b2fce225d27f72cb035bf8379642cc06f9621018856a2ecc5512cd0aad8b039788b9b379afce415e9d950be634c30203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e0416041430e690f967a1987f5ec6618f8da7c5f773a9e228300d06092a864886f70d01010b050003818100681cedc1bd929c6fb354925a6bc490cb39544e3733730edae44b5a0082b9eaa8822d25aa363733a245a13e314872ed6df336220ad980db1dd2f4ec04b3de6d5573530a2481640d0cebbb3bfef7353d5710e7b6f853e699b81bfd3dbedf0779000292fc34d05a1e4fbdf9234947177d82e40aa47a8e6512a9c0fdb6d3fd11de78	AtBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe
2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
3000	AtBroker.exe
2088	mspaint.exe
3000	AtBroker.exe
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE
3000	AtBroker.exe
1252	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1252	Explorer.EXE

Suspicious behavior: LoadsDriver 59 IoCs

pid	Process
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found
468	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe
Token: SeTcbPrivilege	2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe
Token: SeDebugPrivilege	2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe
Token: SeDebugPrivilege	1252	Explorer.EXE
Token: SeTcbPrivilege	1252	Explorer.EXE
Token: SeDebugPrivilege	1252	Explorer.EXE
Token: SeDebugPrivilege	1252	Explorer.EXE
Token: SeDebugPrivilege	1252	Explorer.EXE
Token: SeIncBasePriorityPrivilege	2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe
Token: SeDebugPrivilege	1252	Explorer.EXE
Token: SeDebugPrivilege	3000	AtBroker.exe
Token: SeDebugPrivilege	3000	AtBroker.exe
Token: SeDebugPrivilege	3000	AtBroker.exe
Token: SeDebugPrivilege	3000	AtBroker.exe
Token: SeDebugPrivilege	3000	AtBroker.exe
Token: SeDebugPrivilege	3000	AtBroker.exe
Token: SeBackupPrivilege	3000	AtBroker.exe
Token: SeDebugPrivilege	3000	AtBroker.exe
Token: SeDebugPrivilege	3000	AtBroker.exe
Token: SeDebugPrivilege	1252	Explorer.EXE
Token: SeBackupPrivilege	1252	Explorer.EXE
Token: SeDebugPrivilege	1180	Dwm.exe
Token: SeBackupPrivilege	1180	Dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1252	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1252	2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe	14
PID 2228 wrote to memory of 1252	2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe	14
PID 2228 wrote to memory of 1252	2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe	14
PID 1252 wrote to memory of 3000	1252	Explorer.EXE	28
PID 1252 wrote to memory of 3000	1252	Explorer.EXE	28
PID 1252 wrote to memory of 3000	1252	Explorer.EXE	28
PID 1252 wrote to memory of 3000	1252	Explorer.EXE	28
PID 1252 wrote to memory of 3000	1252	Explorer.EXE	28
PID 1252 wrote to memory of 3000	1252	Explorer.EXE	28
PID 1252 wrote to memory of 3000	1252	Explorer.EXE	28
PID 1252 wrote to memory of 3000	1252	Explorer.EXE	28
PID 1252 wrote to memory of 424	1252	Explorer.EXE	6
PID 1252 wrote to memory of 424	1252	Explorer.EXE	6
PID 1252 wrote to memory of 424	1252	Explorer.EXE	6
PID 1252 wrote to memory of 424	1252	Explorer.EXE	6
PID 1252 wrote to memory of 424	1252	Explorer.EXE	6
PID 2228 wrote to memory of 528	2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe	29
PID 2228 wrote to memory of 528	2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe	29
PID 2228 wrote to memory of 528	2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe	29
PID 2228 wrote to memory of 528	2228	739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe	29
PID 528 wrote to memory of 2708	528	cmd.exe	31
PID 528 wrote to memory of 2708	528	cmd.exe	31
PID 528 wrote to memory of 2708	528	cmd.exe	31
PID 528 wrote to memory of 2708	528	cmd.exe	31
PID 3000 wrote to memory of 2088	3000	AtBroker.exe	34
PID 3000 wrote to memory of 2088	3000	AtBroker.exe	34
PID 3000 wrote to memory of 2088	3000	AtBroker.exe	34
PID 3000 wrote to memory of 2088	3000	AtBroker.exe	34
PID 3000 wrote to memory of 2088	3000	AtBroker.exe	34
PID 3000 wrote to memory of 2088	3000	AtBroker.exe	34
PID 3000 wrote to memory of 2088	3000	AtBroker.exe	34
PID 3000 wrote to memory of 2088	3000	AtBroker.exe	34
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14
PID 3000 wrote to memory of 1252	3000	AtBroker.exe	14

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424
- C:\Windows\AtBroker.exe
  "C:\Windows\AtBroker.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe"
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe
  "C:\Users\Admin\AppData\Local\Temp\739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\739a38ab9a9ff169ad806fe52affb72995ce8944d2e9a42dfd91e41bffcec316.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:528
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2708

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEE38.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEE5A.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF0CE.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Windows\37NIk64f0KqSB.sys

Filesize
415KB

MD5
9a3ed61f49118554ed954814c2660946

SHA1
6af0670605fa88b949bd24abbd5b17e7e61b6d37

SHA256
8ab06902bc15dfd0a12dd53c618a1db57be45dbf4b7969631acb5f111b21a966

SHA512
917c2ce2d53a1ddc1e68bd6d1790dcf34105d6f4c850fe2310950d0da808a137401e1ee868fa20060977ede8af2baa260ecf4ab7f824c8531d8666821c279c54

Download Submit
C:\Windows\AtBroker.exe

Filesize
34KB

MD5
23566f9723771108d2e6cd768ac27407

SHA1
16ad110630ee630ac2eae687a0b75bf30e61c320

SHA256
fac0293dd1061b151e779bf4b245e6652c951fedebc602a166156dfbd38b5d67

SHA512
ead09862f4a9e9092e1c7c191d3cf40a77f082cc6177f08ce1851789fa54713f147ba826a493e1d8f69d605a70f517948192755841db8e205e7c8ca40bc27260

Download Submit
C:\Windows\AtBroker.exe

Filesize
34KB

MD5
23566f9723771108d2e6cd768ac27407

SHA1
16ad110630ee630ac2eae687a0b75bf30e61c320

SHA256
fac0293dd1061b151e779bf4b245e6652c951fedebc602a166156dfbd38b5d67

SHA512
ead09862f4a9e9092e1c7c191d3cf40a77f082cc6177f08ce1851789fa54713f147ba826a493e1d8f69d605a70f517948192755841db8e205e7c8ca40bc27260

Download Submit
C:\Windows\AtBroker.exe

Filesize
34KB

MD5
23566f9723771108d2e6cd768ac27407

SHA1
16ad110630ee630ac2eae687a0b75bf30e61c320

SHA256
fac0293dd1061b151e779bf4b245e6652c951fedebc602a166156dfbd38b5d67

SHA512
ead09862f4a9e9092e1c7c191d3cf40a77f082cc6177f08ce1851789fa54713f147ba826a493e1d8f69d605a70f517948192755841db8e205e7c8ca40bc27260

Download Submit
C:\Windows\JdEzLh6SlAz9.sys

Filesize
447KB

MD5
d805ae1e26e9068171902ff6221d0d66

SHA1
afdd11e40a0ac8829bddc2b63543bfde41c67844

SHA256
2bc45fdfb6ddbee6218adae5efa995fdc06fe5e59698a01024256215c9abb00a

SHA512
26c587b17e00ad94241553d23251606d13fe65451466c848f3ac204f7839ff1e9aac9c066124e41ebb1094e56240f7046260beb66a9ef026276c995efd6c4abb

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4fee3a094d822dbc508dc53de73c72c5

SHA1
6eafd48b9008c10060217705e15b775415db62ba

SHA256
66e6d07900fa518494590fcca8e194e5913ca69746a91073cd478dfcc2210444

SHA512
5358cc56921bcc9307c7d876aede2e1355607044305cbbf4b7f1aef4b2e4f2aec6bdfc8612ffbfeae9a06a19e01732581f3b40638c9b160064a904b593e1ebb0

Download Submit
C:\Windows\b9Q2Xv7HHgV8.sys

Filesize
415KB

MD5
64bc1983743c584a9ad09dacf12792e5

SHA1
0f14098f523d21f11129c4df09451413ddff6d61

SHA256
057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5

SHA512
9ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c

Download Submit
C:\Windows\wDZoScteKDL.sys

Filesize
447KB

MD5
d15f5f23df8036bd5089ce8d151b0e0d

SHA1
4066ff4d92ae189d92fcdfb8c11a82cc9db56bb2

SHA256
f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520

SHA512
feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9

Download Submit
memory/424-128-0x0000000000800000-0x0000000000828000-memory.dmp

Filesize
160KB

Download
memory/424-58-0x0000000000720000-0x0000000000741000-memory.dmp

Filesize
132KB

Download
memory/424-72-0x0000000000800000-0x0000000000828000-memory.dmp

Filesize
160KB

Download
memory/1180-3361-0x0000000000150000-0x0000000000153000-memory.dmp

Filesize
12KB

Download
memory/1252-3351-0x0000000008C40000-0x0000000008CEC000-memory.dmp

Filesize
688KB

Download
memory/1252-380-0x0000000004080000-0x0000000004081000-memory.dmp

Filesize
4KB

Download
memory/1252-242-0x0000000001F80000-0x0000000002126000-memory.dmp

Filesize
1.6MB

Download
memory/1252-2-0x0000000002A40000-0x0000000002A43000-memory.dmp

Filesize
12KB

Download
memory/1252-3352-0x0000000003E30000-0x0000000003E31000-memory.dmp

Filesize
4KB

Download
memory/1252-1-0x0000000002A40000-0x0000000002A43000-memory.dmp

Filesize
12KB

Download
memory/1252-3350-0x0000000003E10000-0x0000000003E13000-memory.dmp

Filesize
12KB

Download
memory/1252-181-0x0000000003F90000-0x0000000003F91000-memory.dmp

Filesize
4KB

Download
memory/1252-69-0x0000000003A50000-0x0000000003AC9000-memory.dmp

Filesize
484KB

Download
memory/1252-36-0x0000000006ED0000-0x0000000006FC7000-memory.dmp

Filesize
988KB

Download
memory/1252-35-0x0000000006ED0000-0x0000000006FC7000-memory.dmp

Filesize
988KB

Download
memory/1252-23-0x0000000004D50000-0x0000000004E43000-memory.dmp

Filesize
972KB

Download
memory/1252-31-0x0000000003F80000-0x0000000003F83000-memory.dmp

Filesize
12KB

Download
memory/1252-25-0x0000000003F50000-0x0000000003F51000-memory.dmp

Filesize
4KB

Download
memory/1252-5-0x0000000002A40000-0x0000000002A43000-memory.dmp

Filesize
12KB

Download
memory/1252-122-0x0000000006ED0000-0x0000000006FC7000-memory.dmp

Filesize
988KB

Download
memory/1252-363-0x0000000004080000-0x0000000004081000-memory.dmp

Filesize
4KB

Download
memory/1252-166-0x0000000001F80000-0x0000000002126000-memory.dmp

Filesize
1.6MB

Download
memory/1252-4-0x0000000003A50000-0x0000000003AC9000-memory.dmp

Filesize
484KB

Download
memory/1252-306-0x0000000003F90000-0x0000000003F91000-memory.dmp

Filesize
4KB

Download
memory/1252-243-0x0000000003F90000-0x0000000003F91000-memory.dmp

Filesize
4KB

Download
memory/1252-289-0x0000000003F90000-0x0000000003F91000-memory.dmp

Filesize
4KB

Download
memory/1252-155-0x0000000003F90000-0x0000000003F91000-memory.dmp

Filesize
4KB

Download
memory/2088-149-0x0000000001F80000-0x0000000002126000-memory.dmp

Filesize
1.6MB

Download
memory/2088-135-0x00000000000E0000-0x000000000027C000-memory.dmp

Filesize
1.6MB

Download
memory/2088-239-0x0000000001F80000-0x0000000002126000-memory.dmp

Filesize
1.6MB

Download
memory/2228-0-0x00000000011E0000-0x00000000012E2000-memory.dmp

Filesize
1.0MB

Download
memory/2228-54-0x00000000011E0000-0x00000000012E2000-memory.dmp

Filesize
1.0MB

Download
memory/2228-71-0x00000000011E0000-0x00000000012E2000-memory.dmp

Filesize
1.0MB

Download
memory/3000-197-0x0000000001E40000-0x0000000001E6E000-memory.dmp

Filesize
184KB

Download
memory/3000-206-0x0000000005760000-0x000000000592A000-memory.dmp

Filesize
1.8MB

Download
memory/3000-157-0x0000000001D60000-0x0000000001D6F000-memory.dmp

Filesize
60KB

Download
memory/3000-151-0x0000000003100000-0x00000000031B7000-memory.dmp

Filesize
732KB

Download
memory/3000-148-0x0000000003B80000-0x0000000003C2C000-memory.dmp

Filesize
688KB

Download
memory/3000-146-0x0000000003B80000-0x0000000003C2C000-memory.dmp

Filesize
688KB

Download
memory/3000-136-0x0000000005760000-0x000000000592A000-memory.dmp

Filesize
1.8MB

Download
memory/3000-134-0x0000000005760000-0x000000000592A000-memory.dmp

Filesize
1.8MB

Download
memory/3000-133-0x0000000001E40000-0x0000000001E6E000-memory.dmp

Filesize
184KB

Download
memory/3000-132-0x0000000001E40000-0x0000000001E6E000-memory.dmp

Filesize
184KB

Download
memory/3000-131-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/3000-130-0x0000000003100000-0x00000000031B7000-memory.dmp

Filesize
732KB

Download
memory/3000-129-0x0000000001D60000-0x0000000001D6F000-memory.dmp

Filesize
60KB

Download
memory/3000-126-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/3000-127-0x0000000000440000-0x000000000050B000-memory.dmp

Filesize
812KB

Download
memory/3000-973-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-1337-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-1458-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-1591-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-1832-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-1929-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-2062-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-2171-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-2244-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-2413-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-2524-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-2645-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-2706-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-2755-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-2837-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-2880-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-2950-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-3095-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-3180-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-3289-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-3338-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/3000-3339-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/3000-3348-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3000-125-0x0000000000800000-0x0000000000828000-memory.dmp

Filesize
160KB

Download
memory/3000-123-0x0000000037AD0000-0x0000000037AE0000-memory.dmp

Filesize
64KB

Download
memory/3000-56-0x000007FEBE870000-0x000007FEBE880000-memory.dmp

Filesize
64KB

Download
memory/3000-57-0x0000000000440000-0x000000000050B000-memory.dmp

Filesize
812KB

Download
memory/3000-53-0x0000000000440000-0x000000000050B000-memory.dmp

Filesize
812KB

Download
memory/3000-41-0x0000000000150000-0x0000000000213000-memory.dmp

Filesize
780KB

Download