glupteba | ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-1703_x64
resource
win10-20231129-en
resource tags

arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
submitted
09-12-2023 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe
Size

241KB
MD5

6a7f1d6b656986b23120479adf5d5e85
SHA1

734b89414a6724e35e87dd7f64927b11ef7cd1c7
SHA256

ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6
SHA512

d370cbd145bf7425c1b6e8f2acf7f4cdb659f02d2d90d424c09e41db2ada0b8d45791dbd014efcb79b43c5ae24431f704f95e4b317fe28d523bfd0610b3c32d5
SSDEEP

3072:Q5LuTt1bjOsS+pgfoYG8X/PlsCOVppgURcgM/HIf8WP:+LuTt1bjx5YxlPuppgpg9k0

Malware Config

Extracted

Family

smokeloader

Version

2022

http://onualituyrs.org/

http://sumagulituyo.org/

http://snukerukeutit.org/

http://lightseinsteniki.org/

http://liuliuoumumy.org/

http://stualialuyastrelia.net/

http://kumbuyartyty.net/

http://criogetikfenbut.org/

http://tonimiuyaytre.org/

http://tyiuiunuewqy.org/

http://humydrole.com/tmp/index.php

http://trunk-co.ru/tmp/index.php

http://weareelight.com/tmp/index.php

http://pirateking.online/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32

Extracted

Family

redline

Botnet

LogsDiller Cloud (Bot: @logsdillabot)

57.128.155.22:20154

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

lumma

http://opposesicknessopw.pw/api

Signatures

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2D74.exe	family_zgrat_v1
C:\Users\Admin\AppData\Local\Temp\2D74.exe	family_zgrat_v1
behavioral1/memory/4496-19-0x00000000008E0000-0x0000000000DF4000-memory.dmp	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2296-179-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2296-182-0x0000000002DE0000-0x00000000036CB000-memory.dmp	family_glupteba
behavioral1/memory/2296-340-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2296-900-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/4280-1650-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2256-2403-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2256-2415-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2256-2419-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2256-2423-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4404-31-0x0000000000930000-0x0000000000946000-memory.dmp	family_raccoon_v2
behavioral1/memory/4404-32-0x0000000000400000-0x000000000085E000-memory.dmp	family_raccoon_v2
behavioral1/memory/2296-177-0x00000000029D0000-0x0000000002DD1000-memory.dmp	family_raccoon_v2

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4756-59-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

87CF.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\87CF.exe = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	87CF.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

38A1.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 38A1.exe
Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

2620 netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	38A1.exe

pid	process
2620	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

38A1.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	38A1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	38A1.exe

Deletes itself 1 IoCs

Processes:

pid process

3432

pid	process
3432

Executes dropped EXE 13 IoCs

Processes:

2D74.exe3005.exe38A1.exe3AD5.exe7D5E.exe87CF.exe9388.exe9388.tmp87CF.execsrss.exeinjector.exewindefender.exewindefender.exe

pid	process
4496	2D74.exe
4404	3005.exe
196	38A1.exe
4708	3AD5.exe
1604	7D5E.exe
2296	87CF.exe
2216	9388.exe
1316	9388.tmp
4280	87CF.exe
2256	csrss.exe
1252	injector.exe
4940	windefender.exe
4068	windefender.exe

Loads dropped DLL 5 IoCs

Processes:

regsvr32.exe2D74.exe9388.tmp

pid process

4032 regsvr32.exe
4496 2D74.exe
1316 9388.tmp
1316 9388.tmp
1316 9388.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4032	regsvr32.exe
4496	2D74.exe
1316	9388.tmp
1316	9388.tmp
1316	9388.tmp

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\38A1.exe	themida
behavioral1/memory/196-48-0x0000000000B80000-0x0000000001412000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\38A1.exe	themida

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
C:\Windows\windefender.exe	upx
behavioral1/memory/4940-2411-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
C:\Windows\windefender.exe	upx
behavioral1/memory/4068-2416-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/4068-2424-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

87CF.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\87CF.exe = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	87CF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	87CF.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3700703602-3792238236-1515753225-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3700703602-3792238236-1515753225-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3700703602-3792238236-1515753225-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

csrss.exe87CF.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3700703602-3792238236-1515753225-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3700703602-3792238236-1515753225-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	87CF.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

38A1.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 38A1.exe
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	38A1.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exeschtasks.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	schtasks.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

38A1.exe

pid process

196 38A1.exe

pid	process
196	38A1.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

3AD5.exe2D74.exe

description	pid	process	target process
PID 4708 set thread context of 4756	4708	3AD5.exe	AppLaunch.exe
PID 4496 set thread context of 4200	4496	2D74.exe	RegSvcs.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

87CF.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 87CF.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	87CF.exe

Drops file in Program Files directory 5 IoCs

Processes:

9388.tmp

description	ioc	process
File created	C:\Program Files (x86)\Voicemeeter\uninstall\unins000.dat	9388.tmp
File created	C:\Program Files (x86)\Voicemeeter\uninstall\is-QRBPQ.tmp	9388.tmp
File created	C:\Program Files (x86)\Voicemeeter\stuff\is-VREMQ.tmp	9388.tmp
File created	C:\Program Files (x86)\Voicemeeter\stuff\is-5K871.tmp	9388.tmp
File created	C:\Program Files (x86)\Voicemeeter\stuff\is-0H6KA.tmp	9388.tmp

Drops file in Windows directory 4 IoCs

Processes:

csrss.exe87CF.exe

description	ioc	process
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	87CF.exe
File created	C:\Windows\rss\csrss.exe	87CF.exe
File created	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3156 sc.exe

pid	process
3156	sc.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

7D5E.execa98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7D5E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7D5E.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7D5E.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

936 schtasks.exe
516 schtasks.exe

pid	process
936	schtasks.exe
516	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exewindefender.exe87CF.exeschtasks.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	87CF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	87CF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	schtasks.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	schtasks.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	87CF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	87CF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	87CF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	87CF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	87CF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	schtasks.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	87CF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	87CF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	schtasks.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	87CF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	87CF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time"	87CF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	87CF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2002 = "Cabo Verde Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	87CF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	87CF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	87CF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	schtasks.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	87CF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	87CF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe

pid	process
1316	ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe
1316	ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432
3432

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3432
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe7D5E.exe

pid process

1316 ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe
1604 7D5E.exe
3432
3432
3432
3432

pid	process
3432

Suspicious use of AdjustPrivilegeToken 58 IoCs

Processes:

AppLaunch.exe38A1.exepowershell.exe87CF.exepowershell.exeschtasks.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeDebugPrivilege	4756	AppLaunch.exe
Token: SeDebugPrivilege	196	38A1.exe
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeDebugPrivilege	2296	87CF.exe
Token: SeImpersonatePrivilege	2296	87CF.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeDebugPrivilege	936	schtasks.exe
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeSystemEnvironmentPrivilege	2256	csrss.exe
Token: SeSecurityPrivilege	3156	sc.exe
Token: SeSecurityPrivilege	3156	sc.exe
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432
Token: SeShutdownPrivilege	3432
Token: SeCreatePagefilePrivilege	3432

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

9388.tmp

pid process

3432
3432
1316 9388.tmp
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

3432
3432

pid	process
3432
3432
1316	9388.tmp

pid	process
3432
3432

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3AD5.exeregsvr32.exe2D74.exe9388.exe87CF.exe87CF.exe

description	pid	process	target process
PID 3432 wrote to memory of 4496	3432		2D74.exe
PID 3432 wrote to memory of 4496	3432		2D74.exe
PID 3432 wrote to memory of 4496	3432		2D74.exe
PID 3432 wrote to memory of 4404	3432		3005.exe
PID 3432 wrote to memory of 4404	3432		3005.exe
PID 3432 wrote to memory of 4404	3432		3005.exe
PID 3432 wrote to memory of 196	3432		38A1.exe
PID 3432 wrote to memory of 196	3432		38A1.exe
PID 3432 wrote to memory of 196	3432		38A1.exe
PID 3432 wrote to memory of 4708	3432		3AD5.exe
PID 3432 wrote to memory of 4708	3432		3AD5.exe
PID 3432 wrote to memory of 4708	3432		3AD5.exe
PID 4708 wrote to memory of 760	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 760	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 760	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 816	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 816	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 816	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 4756	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 4756	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 4756	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 4756	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 4756	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 4756	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 4756	4708	3AD5.exe	AppLaunch.exe
PID 4708 wrote to memory of 4756	4708	3AD5.exe	AppLaunch.exe
PID 3432 wrote to memory of 3136	3432		regsvr32.exe
PID 3432 wrote to memory of 3136	3432		regsvr32.exe
PID 3136 wrote to memory of 4032	3136	regsvr32.exe	regsvr32.exe
PID 3136 wrote to memory of 4032	3136	regsvr32.exe	regsvr32.exe
PID 3136 wrote to memory of 4032	3136	regsvr32.exe	regsvr32.exe
PID 4496 wrote to memory of 4200	4496	2D74.exe	RegSvcs.exe
PID 4496 wrote to memory of 4200	4496	2D74.exe	RegSvcs.exe
PID 4496 wrote to memory of 4200	4496	2D74.exe	RegSvcs.exe
PID 4496 wrote to memory of 4200	4496	2D74.exe	RegSvcs.exe
PID 4496 wrote to memory of 4200	4496	2D74.exe	RegSvcs.exe
PID 4496 wrote to memory of 4200	4496	2D74.exe	RegSvcs.exe
PID 4496 wrote to memory of 4200	4496	2D74.exe	RegSvcs.exe
PID 4496 wrote to memory of 4200	4496	2D74.exe	RegSvcs.exe
PID 4496 wrote to memory of 4200	4496	2D74.exe	RegSvcs.exe
PID 3432 wrote to memory of 1604	3432		7D5E.exe
PID 3432 wrote to memory of 1604	3432		7D5E.exe
PID 3432 wrote to memory of 1604	3432		7D5E.exe
PID 3432 wrote to memory of 2296	3432		87CF.exe
PID 3432 wrote to memory of 2296	3432		87CF.exe
PID 3432 wrote to memory of 2296	3432		87CF.exe
PID 3432 wrote to memory of 2216	3432		9388.exe
PID 3432 wrote to memory of 2216	3432		9388.exe
PID 3432 wrote to memory of 2216	3432		9388.exe
PID 3432 wrote to memory of 3060	3432		explorer.exe
PID 3432 wrote to memory of 3060	3432		explorer.exe
PID 3432 wrote to memory of 3060	3432		explorer.exe
PID 3432 wrote to memory of 3060	3432		explorer.exe
PID 2216 wrote to memory of 1316	2216	9388.exe	9388.tmp
PID 2216 wrote to memory of 1316	2216	9388.exe	9388.tmp
PID 2216 wrote to memory of 1316	2216	9388.exe	9388.tmp
PID 3432 wrote to memory of 3764	3432		explorer.exe
PID 3432 wrote to memory of 3764	3432		explorer.exe
PID 3432 wrote to memory of 3764	3432		explorer.exe
PID 2296 wrote to memory of 5012	2296	87CF.exe	powershell.exe
PID 2296 wrote to memory of 5012	2296	87CF.exe	powershell.exe
PID 2296 wrote to memory of 5012	2296	87CF.exe	powershell.exe
PID 4280 wrote to memory of 4040	4280	87CF.exe	powershell.exe
PID 4280 wrote to memory of 4040	4280	87CF.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3700703602-3792238236-1515753225-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3700703602-3792238236-1515753225-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe
"C:\Users\Admin\AppData\Local\Temp\ca98d07b7f33a359140e2f75f04bf2caf7c5d9b1720bc063f05a10d1434ceea6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1316

C:\Users\Admin\AppData\Local\Temp\2D74.exe
C:\Users\Admin\AppData\Local\Temp\2D74.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
2⤵
PID:4200

C:\Users\Admin\AppData\Local\Temp\3005.exe
C:\Users\Admin\AppData\Local\Temp\3005.exe
1⤵
- Executes dropped EXE
PID:4404

C:\Users\Admin\AppData\Local\Temp\3AD5.exe
C:\Users\Admin\AppData\Local\Temp\3AD5.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:760

C:\Users\Admin\AppData\Local\Temp\38A1.exe
C:\Users\Admin\AppData\Local\Temp\38A1.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:196

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\44F7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3136

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\44F7.dll
2⤵
- Loads dropped DLL
PID:4032

C:\Users\Admin\AppData\Local\Temp\7D5E.exe
C:\Users\Admin\AppData\Local\Temp\7D5E.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1604

C:\Users\Admin\AppData\Local\Temp\87CF.exe
C:\Users\Admin\AppData\Local\Temp\87CF.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Users\Admin\AppData\Local\Temp\87CF.exe
"C:\Users\Admin\AppData\Local\Temp\87CF.exe"
2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4280

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
PID:4924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
4⤵
PID:4288

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Drops file in System32 directory
- Creates scheduled task(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
4⤵
- Executes dropped EXE
PID:1252

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
4⤵
- Creates scheduled task(s)
PID:516

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
4⤵
- Executes dropped EXE
PID:4940

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
5⤵
PID:1312

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Users\Admin\AppData\Local\Temp\9388.exe
C:\Users\Admin\AppData\Local\Temp\9388.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216

C:\Users\Admin\AppData\Local\Temp\is-HC0I9.tmp\9388.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HC0I9.tmp\9388.tmp" /SL5="$E002E,7457838,54272,C:\Users\Admin\AppData\Local\Temp\9388.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:1316

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3060

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3764

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
1⤵
- Modifies Windows Firewall
PID:2620

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2D74.exe

Filesize
5.1MB

MD5
7f4f98a26d4835578f46224112cc6a15

SHA1
c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0

SHA256
c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276

SHA512
c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2D74.exe

Filesize
5.1MB

MD5
7f4f98a26d4835578f46224112cc6a15

SHA1
c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0

SHA256
c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276

SHA512
c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3005.exe

Filesize
237KB

MD5
22a51b329fa194d51f68705a25d7396d

SHA1
aada03d8b7f1e28dbf6d72c1503981ccc5bb94da

SHA256
82857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742

SHA512
0d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821

Download Submit
C:\Users\Admin\AppData\Local\Temp\3005.exe

Filesize
237KB

MD5
22a51b329fa194d51f68705a25d7396d

SHA1
aada03d8b7f1e28dbf6d72c1503981ccc5bb94da

SHA256
82857c5bbab91ba9c66bcd07c9f25c1b140e94fa892e97cc97db82fe06439742

SHA512
0d9a8a6b1df054a84bea0c4d38fd3c702f95c7d372bf2255c29611aec38fca5c81b972a2d45135a6488ba313d5674cf5e60e5bc7bdc888bb3524739e473ff821

Download Submit
C:\Users\Admin\AppData\Local\Temp\38A1.exe

Filesize
3.0MB

MD5
f4cb9c8b7e02e8084008cd61e1899390

SHA1
af1a95a823a8c24cab9d8e8aaf46d69b3612dd4b

SHA256
a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e

SHA512
e808e95a5f57a13e61f8b77502f0f01c7faf66f2663d4de0b61a308f39520da8d649f32ed886edf446eefd88cf324854bcca059f8c0a6f46148388242e6b65b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\38A1.exe

Filesize
3.0MB

MD5
f4cb9c8b7e02e8084008cd61e1899390

SHA1
af1a95a823a8c24cab9d8e8aaf46d69b3612dd4b

SHA256
a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e

SHA512
e808e95a5f57a13e61f8b77502f0f01c7faf66f2663d4de0b61a308f39520da8d649f32ed886edf446eefd88cf324854bcca059f8c0a6f46148388242e6b65b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\3AD5.exe

Filesize
439KB

MD5
b51bc8f85b7ba047b35022f505066b72

SHA1
4dd8e61f706c3057995a447d8f1c0c08f8ce6d9a

SHA256
fd7e4e6d5b75b5479a9c38e601d6cd2a89c33e65887e6fae2ca6b16735a32757

SHA512
7b00852c88bfee57e89415508e0c209faea3733402a6aafb9f87dccde21fe7af9f8f9b9717e6acad9be3c58a6d1d079331e1bb72faae3ce02ca98295966ac3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\3AD5.exe

Filesize
439KB

MD5
b51bc8f85b7ba047b35022f505066b72

SHA1
4dd8e61f706c3057995a447d8f1c0c08f8ce6d9a

SHA256
fd7e4e6d5b75b5479a9c38e601d6cd2a89c33e65887e6fae2ca6b16735a32757

SHA512
7b00852c88bfee57e89415508e0c209faea3733402a6aafb9f87dccde21fe7af9f8f9b9717e6acad9be3c58a6d1d079331e1bb72faae3ce02ca98295966ac3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\44F7.dll

Filesize
3.0MB

MD5
18356cbd55de61190244f9be22cf2f6d

SHA1
98510c90b004e98090a1462bf056fa916f1f2e0a

SHA256
fdf19145c1592639e437eeca85b1538afb20835d0c87684378089fd03bc6d0f8

SHA512
5c043e414428d03a71f61512b2f18a5b1392296830c21d00276ad03578c7614456615cdf8bf96a8201925bd5520cdddd6b1dfeb1dd93c1f649d7a4a89a14fdbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7D5E.exe

Filesize
241KB

MD5
5b99b67a7256dca2cc36b886c333f8aa

SHA1
fd4073ea96e5b5aed2e709cb7b44855901803ad2

SHA256
5c5ef78a105907ffb85410503db509b5161773f16a08dfe0a6f797b09b4e5655

SHA512
49f2f3b96794911a42b7500321777135766b8a2ea2b0ef44e8ec66a5a4aba5cf32ee6556d777f9dbce687ac1968f99010382c04adaff19a979aca9f9d82f1313

Download Submit
C:\Users\Admin\AppData\Local\Temp\7D5E.exe

Filesize
241KB

MD5
5b99b67a7256dca2cc36b886c333f8aa

SHA1
fd4073ea96e5b5aed2e709cb7b44855901803ad2

SHA256
5c5ef78a105907ffb85410503db509b5161773f16a08dfe0a6f797b09b4e5655

SHA512
49f2f3b96794911a42b7500321777135766b8a2ea2b0ef44e8ec66a5a4aba5cf32ee6556d777f9dbce687ac1968f99010382c04adaff19a979aca9f9d82f1313

Download Submit
C:\Users\Admin\AppData\Local\Temp\87CF.exe

Filesize
4.1MB

MD5
621a7b3d8819af7f75576ccbd8bfd1bd

SHA1
6c5025dbe94f60439064d3bc41d4475a5d5f6bcd

SHA256
a81478024d186f659d11ce0423b7b3236fee0193a5f1f13532163fb8c58468a8

SHA512
6b3afc1044ad1bb1dc6af487d7e8f1d5f8f10872d1db462b3594abb46d99a64a1b093798deef93324660c08abd6daa9060e3cd1746aac13475337374e6232d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\87CF.exe

Filesize
4.1MB

MD5
621a7b3d8819af7f75576ccbd8bfd1bd

SHA1
6c5025dbe94f60439064d3bc41d4475a5d5f6bcd

SHA256
a81478024d186f659d11ce0423b7b3236fee0193a5f1f13532163fb8c58468a8

SHA512
6b3afc1044ad1bb1dc6af487d7e8f1d5f8f10872d1db462b3594abb46d99a64a1b093798deef93324660c08abd6daa9060e3cd1746aac13475337374e6232d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\87CF.exe

Filesize
4.1MB

MD5
621a7b3d8819af7f75576ccbd8bfd1bd

SHA1
6c5025dbe94f60439064d3bc41d4475a5d5f6bcd

SHA256
a81478024d186f659d11ce0423b7b3236fee0193a5f1f13532163fb8c58468a8

SHA512
6b3afc1044ad1bb1dc6af487d7e8f1d5f8f10872d1db462b3594abb46d99a64a1b093798deef93324660c08abd6daa9060e3cd1746aac13475337374e6232d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\9388.exe

Filesize
7.4MB

MD5
9dc9fad74729c20b39ee57e6ac80a6b3

SHA1
184657d9b99199e61ab75e3cee8787b0466bc30a

SHA256
fb4cdee746683e23ae7117623f87276a1718f4470a88d068c1eddd37babddfff

SHA512
5fe62d7de808a7cee7dc2c1418d14815b9a862f33d41b7428e52420cb20e234c7cbc28611165caa542c6c91f08d7223b07d694968e378be9149fbe485d2a450a

Download Submit
C:\Users\Admin\AppData\Local\Temp\9388.exe

Filesize
7.4MB

MD5
9dc9fad74729c20b39ee57e6ac80a6b3

SHA1
184657d9b99199e61ab75e3cee8787b0466bc30a

SHA256
fb4cdee746683e23ae7117623f87276a1718f4470a88d068c1eddd37babddfff

SHA512
5fe62d7de808a7cee7dc2c1418d14815b9a862f33d41b7428e52420cb20e234c7cbc28611165caa542c6c91f08d7223b07d694968e378be9149fbe485d2a450a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kzrkat1g.vjz.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HC0I9.tmp\9388.tmp

Filesize
687KB

MD5
f448d7f4b76e5c9c3a4eaff16a8b9b73

SHA1
31808f1ffa84c954376975b7cdb0007e6b762488

SHA256
7233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49

SHA512
f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HC0I9.tmp\9388.tmp

Filesize
687KB

MD5
f448d7f4b76e5c9c3a4eaff16a8b9b73

SHA1
31808f1ffa84c954376975b7cdb0007e6b762488

SHA256
7233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49

SHA512
f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4

Download Submit
C:\Users\Admin\AppData\Roaming\wcddbdc

Filesize
241KB

MD5
5b99b67a7256dca2cc36b886c333f8aa

SHA1
fd4073ea96e5b5aed2e709cb7b44855901803ad2

SHA256
5c5ef78a105907ffb85410503db509b5161773f16a08dfe0a6f797b09b4e5655

SHA512
49f2f3b96794911a42b7500321777135766b8a2ea2b0ef44e8ec66a5a4aba5cf32ee6556d777f9dbce687ac1968f99010382c04adaff19a979aca9f9d82f1313

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
5cae50a720e1a601839d5c06361cef85

SHA1
6519c85d0f616235059144e9a16d840384d68832

SHA256
70ec60a3b70d47bcb416573e5c91a1eedde6dd7861ccc5911d857467b440d062

SHA512
60d403437020b09bcd23c354f79649142defe72b49a7ecd8d24112b764b9ea3737d9bb496626b5426a83c677e882600406cee41ac2cfdde5c34748d4801a869e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
586d117f1769a74de639eec241c70538

SHA1
f5f01dda48141283a29dad01682aeb94e58297cc

SHA256
ba456f13f674ed266918504997fd79834ab5c001a7b79f1aff1317799b7827a5

SHA512
d8d81b84c7f17f486b8a2e1fddc986e910d5edcca3f2cc8e6b33fda1bbdfd64b0697b5852ee3f19c9e60bba55aa0f5ca4c0a1ea75142fefab6c722d566715934

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
ca76c6867b2f8a9672412e68acb0d913

SHA1
49816dd216df5ff58207872ecb9370cd892f99d6

SHA256
ad8156c12d2223bea656a40d4bcd822eb8a25a19bdf9890d03b1e695ae6372b3

SHA512
7375971308186a27b37bb7cfe7ca087323b774ee009764dae56de7a25ff9830c8a2d9ba8ea034fa1f33328353ae11d76fd3136f7217357ceec431591375ef532

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
9e7074080da5f5c7604eedc0dbcfe6ec

SHA1
c6084144c310e84a61c06ec9db99bb5117bd0322

SHA256
a98a42670d19bd9497671ad0a1682a016e47314ce86228ef7177085295bdc30b

SHA512
bbb1984c45053ff74cc604b5f448fb58174c235d885c3c99620f105e089004a036c0595a970032b435a0c42234c6a8a24758f7dced012f732f33d86dcb67ac45

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
dbcb4b1117d00d0bcc829a3f337c2b31

SHA1
c5a1f0d3b9751d870c421401d2026613fa7ccae4

SHA256
35f59f5e0217c2164656e0931870a43d0f8842b207af1abd38f6996f2a2b06cd

SHA512
4f05e3361d61d84aa0048aa643d24b6f5bfe43e566b6d292fb944f29b4c8143382f2976e2f8e4580ba65088504ea175b52c716fe49e28982d33334b10cf69ccf

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
621a7b3d8819af7f75576ccbd8bfd1bd

SHA1
6c5025dbe94f60439064d3bc41d4475a5d5f6bcd

SHA256
a81478024d186f659d11ce0423b7b3236fee0193a5f1f13532163fb8c58468a8

SHA512
6b3afc1044ad1bb1dc6af487d7e8f1d5f8f10872d1db462b3594abb46d99a64a1b093798deef93324660c08abd6daa9060e3cd1746aac13475337374e6232d24

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
621a7b3d8819af7f75576ccbd8bfd1bd

SHA1
6c5025dbe94f60439064d3bc41d4475a5d5f6bcd

SHA256
a81478024d186f659d11ce0423b7b3236fee0193a5f1f13532163fb8c58468a8

SHA512
6b3afc1044ad1bb1dc6af487d7e8f1d5f8f10872d1db462b3594abb46d99a64a1b093798deef93324660c08abd6daa9060e3cd1746aac13475337374e6232d24

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
\Users\Admin\AppData\Local\Temp\44F7.dll

Filesize
3.0MB

MD5
18356cbd55de61190244f9be22cf2f6d

SHA1
98510c90b004e98090a1462bf056fa916f1f2e0a

SHA256
fdf19145c1592639e437eeca85b1538afb20835d0c87684378089fd03bc6d0f8

SHA512
5c043e414428d03a71f61512b2f18a5b1392296830c21d00276ad03578c7614456615cdf8bf96a8201925bd5520cdddd6b1dfeb1dd93c1f649d7a4a89a14fdbe

Download Submit
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
\Users\Admin\AppData\Local\Temp\is-FUA22.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-FUA22.tmp\_isetup\_isdecmp.dll

Filesize
19KB

MD5
3adaa386b671c2df3bae5b39dc093008

SHA1
067cf95fbdb922d81db58432c46930f86d23dded

SHA256
71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

SHA512
bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

Download Submit
\Users\Admin\AppData\Local\Temp\is-FUA22.tmp\_isetup\_isdecmp.dll

Filesize
19KB

MD5
3adaa386b671c2df3bae5b39dc093008

SHA1
067cf95fbdb922d81db58432c46930f86d23dded

SHA256
71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

SHA512
bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

Download Submit
memory/196-55-0x0000000008030000-0x000000000813A000-memory.dmp

Filesize
1.0MB

Download
memory/196-49-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/196-160-0x00000000746E0000-0x00000000748A2000-memory.dmp

Filesize
1.8MB

Download
memory/196-39-0x0000000077330000-0x0000000077400000-memory.dmp

Filesize
832KB

Download
memory/196-58-0x0000000007FA0000-0x0000000007FEB000-memory.dmp

Filesize
300KB

Download
memory/196-158-0x0000000000B80000-0x0000000001412000-memory.dmp

Filesize
8.6MB

Download
memory/196-54-0x0000000008C70000-0x0000000009276000-memory.dmp

Filesize
6.0MB

Download
memory/196-56-0x0000000007EC0000-0x0000000007ED2000-memory.dmp

Filesize
72KB

Download
memory/196-110-0x0000000009630000-0x0000000009680000-memory.dmp

Filesize
320KB

Download
memory/196-171-0x0000000077330000-0x0000000077400000-memory.dmp

Filesize
832KB

Download
memory/196-37-0x0000000000B80000-0x0000000001412000-memory.dmp

Filesize
8.6MB

Download
memory/196-173-0x00000000746E0000-0x00000000748A2000-memory.dmp

Filesize
1.8MB

Download
memory/196-175-0x0000000077330000-0x0000000077400000-memory.dmp

Filesize
832KB

Download
memory/196-38-0x00000000746E0000-0x00000000748A2000-memory.dmp

Filesize
1.8MB

Download
memory/196-40-0x0000000077330000-0x0000000077400000-memory.dmp

Filesize
832KB

Download
memory/196-43-0x00000000746E0000-0x00000000748A2000-memory.dmp

Filesize
1.8MB

Download
memory/196-57-0x0000000007F60000-0x0000000007F9E000-memory.dmp

Filesize
248KB

Download
memory/196-42-0x0000000077330000-0x0000000077400000-memory.dmp

Filesize
832KB

Download
memory/196-46-0x0000000077B74000-0x0000000077B75000-memory.dmp

Filesize
4KB

Download
memory/196-162-0x0000000077330000-0x0000000077400000-memory.dmp

Filesize
832KB

Download
memory/196-209-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/196-41-0x00000000746E0000-0x00000000748A2000-memory.dmp

Filesize
1.8MB

Download
memory/196-48-0x0000000000B80000-0x0000000001412000-memory.dmp

Filesize
8.6MB

Download
memory/1316-5-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download
memory/1316-2-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/1316-3-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download
memory/1316-665-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1316-1-0x00000000009F0000-0x0000000000AF0000-memory.dmp

Filesize
1024KB

Download
memory/1604-164-0x00000000009D0000-0x0000000000AD0000-memory.dmp

Filesize
1024KB

Download
memory/1604-169-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download
memory/1604-167-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/1604-203-0x0000000000400000-0x000000000085F000-memory.dmp

Filesize
4.4MB

Download
memory/2216-664-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2216-202-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2216-213-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2256-2403-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2256-2415-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2256-2419-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2256-2423-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2296-182-0x0000000002DE0000-0x00000000036CB000-memory.dmp

Filesize
8.9MB

Download
memory/2296-177-0x00000000029D0000-0x0000000002DD1000-memory.dmp

Filesize
4.0MB

Download
memory/2296-340-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2296-900-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2296-179-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3060-218-0x0000000000AB0000-0x0000000000B1B000-memory.dmp

Filesize
428KB

Download
memory/3060-222-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3432-195-0x0000000002AF0000-0x0000000002B06000-memory.dmp

Filesize
88KB

Download
memory/3432-4-0x0000000000B30000-0x0000000000B46000-memory.dmp

Filesize
88KB

Download
memory/3764-263-0x0000000000120000-0x000000000012C000-memory.dmp

Filesize
48KB

Download
memory/4032-77-0x0000000004BD0000-0x0000000004CD4000-memory.dmp

Filesize
1.0MB

Download
memory/4032-354-0x00000000062A0000-0x0000000006398000-memory.dmp

Filesize
992KB

Download
memory/4032-78-0x0000000004BD0000-0x0000000004CD4000-memory.dmp

Filesize
1.0MB

Download
memory/4032-333-0x0000000004CE0000-0x000000000619D000-memory.dmp

Filesize
20.7MB

Download
memory/4032-75-0x0000000002B50000-0x0000000002B56000-memory.dmp

Filesize
24KB

Download
memory/4032-152-0x0000000010000000-0x00000000102FF000-memory.dmp

Filesize
3.0MB

Download
memory/4032-72-0x0000000010000000-0x00000000102FF000-memory.dmp

Filesize
3.0MB

Download
memory/4032-76-0x0000000004AA0000-0x0000000004BC1000-memory.dmp

Filesize
1.1MB

Download
memory/4032-381-0x0000000029880000-0x00000000298D3000-memory.dmp

Filesize
332KB

Download
memory/4032-378-0x0000000002A60000-0x0000000002A72000-memory.dmp

Filesize
72KB

Download
memory/4032-80-0x0000000004BD0000-0x0000000004CD4000-memory.dmp

Filesize
1.0MB

Download
memory/4032-346-0x00000000062A0000-0x0000000006398000-memory.dmp

Filesize
992KB

Download
memory/4032-332-0x0000000004BD0000-0x0000000004CD4000-memory.dmp

Filesize
1.0MB

Download
memory/4032-338-0x00000000061A0000-0x0000000006299000-memory.dmp

Filesize
996KB

Download
memory/4068-2424-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4068-2416-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4200-105-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4200-95-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4200-97-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4200-100-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4280-1650-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4404-104-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/4404-31-0x0000000000930000-0x0000000000946000-memory.dmp

Filesize
88KB

Download
memory/4404-32-0x0000000000400000-0x000000000085E000-memory.dmp

Filesize
4.4MB

Download
memory/4404-30-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/4496-101-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/4496-23-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4496-85-0x0000000007530000-0x00000000076C2000-memory.dmp

Filesize
1.6MB

Download
memory/4496-103-0x0000000005A1B000-0x0000000005A1F000-memory.dmp

Filesize
16KB

Download
memory/4496-84-0x00000000061D0000-0x00000000063F8000-memory.dmp

Filesize
2.2MB

Download
memory/4496-96-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4496-93-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4496-24-0x0000000005690000-0x000000000569A000-memory.dmp

Filesize
40KB

Download
memory/4496-91-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/4496-74-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/4496-22-0x0000000005870000-0x000000000590C000-memory.dmp

Filesize
624KB

Download
memory/4496-20-0x0000000005BD0000-0x00000000060CE000-memory.dmp

Filesize
5.0MB

Download
memory/4496-21-0x00000000056D0000-0x0000000005762000-memory.dmp

Filesize
584KB

Download
memory/4496-18-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/4496-19-0x00000000008E0000-0x0000000000DF4000-memory.dmp

Filesize
5.1MB

Download
memory/4496-102-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4496-94-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4496-98-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4756-83-0x000000000B810000-0x000000000B876000-memory.dmp

Filesize
408KB

Download
memory/4756-63-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/4756-220-0x0000000073C50000-0x000000007433E000-memory.dmp

Filesize
6.9MB

Download
memory/4756-125-0x000000000D090000-0x000000000D252000-memory.dmp

Filesize
1.8MB

Download
memory/4756-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4756-64-0x000000000B580000-0x000000000B590000-memory.dmp

Filesize
64KB

Download
memory/4756-126-0x000000000DB70000-0x000000000E09C000-memory.dmp

Filesize
5.2MB

Download
memory/4940-2411-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download