fabookie | 886f06675a3f75b987efb924796ce9f79f06c4b4cd0cd605936d973fb259b1e5

Analysis

max time kernel
151s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2024 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

6.6MB
MD5

0cac858764ebbec083494171646d8ca0
SHA1

5ac15584853da1168e137564b8011beecd67f113
SHA256

886f06675a3f75b987efb924796ce9f79f06c4b4cd0cd605936d973fb259b1e5
SHA512

dc271bc3bec277fedff4fc31e858e70867bedcb05c123d5043622deb822010036ffa5b47f7dfee4380f94884fba6f998edc733653b8b3f964d99d02d75d9f849
SSDEEP

196608:hAxVkOe3XMLW4/olI3QVlYPedMSa1wftbE/m8/S9h:hi25CAeQV/+0t8/Sb

Score

10^/10

fabookie glupteba stealc discovery dropper evasion loader persistence spyware stealer

Malware Config

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Signatures

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral2/memory/3784-143-0x0000000003170000-0x00000000032A1000-memory.dmp	family_fabookie
behavioral2/memory/3784-163-0x0000000003170000-0x00000000032A1000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 11 IoCs

resource	yara_rule
behavioral2/memory/400-164-0x0000000002E20000-0x000000000370B000-memory.dmp	family_glupteba
behavioral2/memory/400-165-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/400-166-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/400-188-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/400-191-0x0000000002E20000-0x000000000370B000-memory.dmp	family_glupteba
behavioral2/memory/400-214-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/400-226-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3048-234-0x0000000002E60000-0x000000000374B000-memory.dmp	family_glupteba
behavioral2/memory/3048-235-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3048-270-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/3048-335-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2564	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	nsi18F4.tmp

Executes dropped EXE 7 IoCs

pid	Process
400	31839b57a4f11171d6abc8bbc4451ee4.exe
2728	InstallSetup7.exe
3784	rty25.exe
4360	BroomSetup.exe
2368	nsi18F4.tmp
3048	31839b57a4f11171d6abc8bbc4451ee4.exe
2332	csrss.exe

Loads dropped DLL 4 IoCs

pid	Process
2728	InstallSetup7.exe
2728	InstallSetup7.exe
2368	nsi18F4.tmp
2368	nsi18F4.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
116	2368	WerFault.exe	94
1932	400	WerFault.exe	90
3792	400	WerFault.exe	90
4628	400	WerFault.exe	90
4292	400	WerFault.exe	90
4972	400	WerFault.exe	90
1396	400	WerFault.exe	90
3248	400	WerFault.exe	90
3744	400	WerFault.exe	90
3952	400	WerFault.exe	90
1408	400	WerFault.exe	90
3964	400	WerFault.exe	90
2984	400	WerFault.exe	90
4840	400	WerFault.exe	90
4344	400	WerFault.exe	90
724	400	WerFault.exe	90
2156	400	WerFault.exe	90
4080	400	WerFault.exe	90
2748	400	WerFault.exe	90
5032	400	WerFault.exe	90
3456	3048	WerFault.exe	156
3436	3048	WerFault.exe	156
384	3048	WerFault.exe	156
1864	3048	WerFault.exe	156
404	3048	WerFault.exe	156
4112	3048	WerFault.exe	156
1964	3048	WerFault.exe	156
2276	3048	WerFault.exe	156
1508	3048	WerFault.exe	156

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsi18F4.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsi18F4.tmp

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1416	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3376	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2368	nsi18F4.tmp
2368	nsi18F4.tmp
2064	powershell.exe
2064	powershell.exe
400	31839b57a4f11171d6abc8bbc4451ee4.exe
400	31839b57a4f11171d6abc8bbc4451ee4.exe
1416	powershell.exe
1416	powershell.exe
3048	31839b57a4f11171d6abc8bbc4451ee4.exe
3048	31839b57a4f11171d6abc8bbc4451ee4.exe
3048	31839b57a4f11171d6abc8bbc4451ee4.exe
3048	31839b57a4f11171d6abc8bbc4451ee4.exe
3048	31839b57a4f11171d6abc8bbc4451ee4.exe
3048	31839b57a4f11171d6abc8bbc4451ee4.exe
3048	31839b57a4f11171d6abc8bbc4451ee4.exe
3048	31839b57a4f11171d6abc8bbc4451ee4.exe
3048	31839b57a4f11171d6abc8bbc4451ee4.exe
3048	31839b57a4f11171d6abc8bbc4451ee4.exe
388	powershell.exe
388	powershell.exe
388	powershell.exe
4020	powershell.exe
4020	powershell.exe
4020	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	400	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeImpersonatePrivilege	400	31839b57a4f11171d6abc8bbc4451ee4.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	388	powershell.exe
Token: SeDebugPrivilege	4020	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4360	BroomSetup.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 400	1496	tmp.exe	90
PID 1496 wrote to memory of 400	1496	tmp.exe	90
PID 1496 wrote to memory of 400	1496	tmp.exe	90
PID 1496 wrote to memory of 2728	1496	tmp.exe	91
PID 1496 wrote to memory of 2728	1496	tmp.exe	91
PID 1496 wrote to memory of 2728	1496	tmp.exe	91
PID 1496 wrote to memory of 3784	1496	tmp.exe	92
PID 1496 wrote to memory of 3784	1496	tmp.exe	92
PID 2728 wrote to memory of 4360	2728	InstallSetup7.exe	93
PID 2728 wrote to memory of 4360	2728	InstallSetup7.exe	93
PID 2728 wrote to memory of 4360	2728	InstallSetup7.exe	93
PID 2728 wrote to memory of 2368	2728	InstallSetup7.exe	94
PID 2728 wrote to memory of 2368	2728	InstallSetup7.exe	94
PID 2728 wrote to memory of 2368	2728	InstallSetup7.exe	94
PID 4360 wrote to memory of 2144	4360	BroomSetup.exe	95
PID 4360 wrote to memory of 2144	4360	BroomSetup.exe	95
PID 4360 wrote to memory of 2144	4360	BroomSetup.exe	95
PID 2144 wrote to memory of 2276	2144	cmd.exe	99
PID 2144 wrote to memory of 2276	2144	cmd.exe	99
PID 2144 wrote to memory of 2276	2144	cmd.exe	99
PID 2144 wrote to memory of 1416	2144	cmd.exe	100
PID 2144 wrote to memory of 1416	2144	cmd.exe	100
PID 2144 wrote to memory of 1416	2144	cmd.exe	100
PID 2368 wrote to memory of 416	2368	nsi18F4.tmp	108
PID 2368 wrote to memory of 416	2368	nsi18F4.tmp	108
PID 2368 wrote to memory of 416	2368	nsi18F4.tmp	108
PID 416 wrote to memory of 3376	416	cmd.exe	111
PID 416 wrote to memory of 3376	416	cmd.exe	111
PID 416 wrote to memory of 3376	416	cmd.exe	111
PID 400 wrote to memory of 2064	400	31839b57a4f11171d6abc8bbc4451ee4.exe	152
PID 400 wrote to memory of 2064	400	31839b57a4f11171d6abc8bbc4451ee4.exe	152
PID 400 wrote to memory of 2064	400	31839b57a4f11171d6abc8bbc4451ee4.exe	152
PID 3048 wrote to memory of 1416	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	179
PID 3048 wrote to memory of 1416	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	179
PID 3048 wrote to memory of 1416	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	179
PID 3048 wrote to memory of 888	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	183
PID 3048 wrote to memory of 888	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	183
PID 888 wrote to memory of 2564	888	cmd.exe	185
PID 888 wrote to memory of 2564	888	cmd.exe	185
PID 3048 wrote to memory of 388	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	187
PID 3048 wrote to memory of 388	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	187
PID 3048 wrote to memory of 388	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	187
PID 3048 wrote to memory of 4020	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	191
PID 3048 wrote to memory of 4020	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	191
PID 3048 wrote to memory of 4020	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	191
PID 3048 wrote to memory of 2332	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	193
PID 3048 wrote to memory of 2332	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	193
PID 3048 wrote to memory of 2332	3048	31839b57a4f11171d6abc8bbc4451ee4.exe	193

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 488
    3⤵
    - Program crash
    PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 224
    3⤵
    - Program crash
    PID:3792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 508
    3⤵
    - Program crash
    PID:4628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 612
    3⤵
    - Program crash
    PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 716
    3⤵
    - Program crash
    PID:4972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 736
    3⤵
    - Program crash
    PID:1396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 748
    3⤵
    - Program crash
    PID:3248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 716
    3⤵
    - Program crash
    PID:3744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 772
    3⤵
    - Program crash
    PID:3952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 664
    3⤵
    - Program crash
    PID:1408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 820
    3⤵
    - Program crash
    PID:3964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 884
    3⤵
    - Program crash
    PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 896
    3⤵
    - Program crash
    PID:4840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 856
    3⤵
    - Program crash
    PID:4344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 816
    3⤵
    - Program crash
    PID:724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 912
    3⤵
    - Program crash
    PID:2156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 792
    3⤵
    - Program crash
    PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 940
    3⤵
    - Program crash
    PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 708
    3⤵
    - Program crash
    PID:5032
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 452
      4⤵
      Program crash
      PID:3456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 468
      4⤵
      Program crash
      PID:3436
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 472
      4⤵
      Program crash
      PID:384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 652
      4⤵
      Program crash
      PID:1864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 696
      4⤵
      Program crash
      PID:404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 696
      4⤵
      Program crash
      PID:4112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 696
      4⤵
      Program crash
      PID:1964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 732
      4⤵
      Program crash
      PID:2276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 696
      4⤵
      Program crash
      PID:1508
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:888
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:2564
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:388
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4020
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      PID:2332
- C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2144
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:2276
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
        5⤵
        Creates scheduled task(s)
        
        PID:1416
- - C:\Users\Admin\AppData\Local\Temp\nsi18F4.tmp
    C:\Users\Admin\AppData\Local\Temp\nsi18F4.tmp
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsi18F4.tmp" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:416
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:3376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 2336
      4⤵
      Program crash
      PID:116
- C:\Users\Admin\AppData\Local\Temp\rty25.exe
  "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
  2⤵
  - Executes dropped EXE
  PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2368 -ip 2368
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 400 -ip 400
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 400 -ip 400
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 400 -ip 400
1⤵
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 400 -ip 400
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 400 -ip 400
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 400 -ip 400
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 400 -ip 400
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 400 -ip 400
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 400 -ip 400
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 400 -ip 400
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 400 -ip 400
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 400 -ip 400
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 400 -ip 400
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 400 -ip 400
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 400 -ip 400
1⤵
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 400
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 400 -ip 400
1⤵
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 400 -ip 400
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 400 -ip 400
1⤵
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3048 -ip 3048
1⤵
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3048 -ip 3048
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3048 -ip 3048
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3048 -ip 3048
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3048 -ip 3048
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3048 -ip 3048
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3048 -ip 3048
1⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3048 -ip 3048
1⤵
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3048 -ip 3048
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
dc6730fbd90bfb2b229e148224a73701

SHA1
7d4faaa5eb343c889d4241dbef1451ed495d1684

SHA256
59060f7c1e5cd42b7241cee71c95110ec9ecc07fd5de7e2ea8890d6affd033ca

SHA512
b5e042fa7b3ef8309af1b8bddcd63814fa0271471202762511845deb7514f15dd2199a618f16c5ae069e368890b2c8f7c39fc31a0724403caecef412e6bef98f

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

Filesize
4.7MB

MD5
5e94f0f6265f9e8b2f706f1d46bbd39e

SHA1
d0189cba430f5eea07efe1ab4f89adf5ae2453db

SHA256
50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503

SHA512
473dfa66a36feed9b29a43245074141478327ce22ba7cce512599379dcb783b4d665e2d65c5e9750b988c7ed8f6c3349a7a12d4b8b57c89840eee6ca6e1a30cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe

Filesize
2.1MB

MD5
e68b44d7bc0b1b01ecd4ec981cc1edb6

SHA1
9850bb4a0cff9c28b03acf921d36db971d2a42d6

SHA256
f7762cab28706d4a12687d7e7150de263452b8fca0b83ccf0873580bee878502

SHA512
7395f068677a56b8cb5c75aeb29d1de851b57fa092e5d7228c17554f9160339daad4ef29b3becd389c27fb176c8f665b3e1d9ba85374cd6af7e16a266c3c9ab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe

Filesize
2.1MB

MD5
429802065832cd03bdfbae9f2bfdcc5f

SHA1
742298e214ef522c36c979343ae65a873b7b50e2

SHA256
5c6b53353358eb93a0a9ca5ee2c9c4adcdf7f1d60d043d176ce10ef2ffc2d783

SHA512
6676dbc5bd1a08c45ab830461f235911567db8071929589818f1602f2235c241a2bf5c8d659047bd1c96a29e518a97d4cd33be907dfd0ea5b5d4d6fee0d9f9cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1buyx03.115.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse1019.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi18F4.tmp

Filesize
207KB

MD5
99308188985617fc0ae97b13cfb260c8

SHA1
70a1c399a9d6abd0e33fa9e8793065972c223852

SHA256
811c656dd2c2c40ba14e6699ecaf4c83f0068c3af8e092fd6f6ef4b3f2dc2b48

SHA512
341c723fd55f523badea0d1d797927cf652d5454551e69d67dbad929d08b591f0fb05429bac3d768188e6ba676d8d66cd50a191f6516580eb7f89f6580594419

Download Submit
C:\Users\Admin\AppData\Local\Temp\rty25.exe

Filesize
369KB

MD5
766f223bfc10876ac9d479a69ae2146f

SHA1
89dac02805d1527e18b1e7a4b11cec3749086528

SHA256
149e5c04e1aa481ff8438ba6f2734195a01853ecbd109063b3a1101bf5102002

SHA512
cb8cf96263116ba840a1eec81811274b00b3ad5de9f46062b991538dc8ebadac0a7cfbc804deecaab4ef38a0cd30c99ce83e4e025078a7f581c05eb5f181b4df

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Task.bat

Filesize
128B

MD5
11bb3db51f701d4e42d3287f71a6a43e

SHA1
63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

SHA256
6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

SHA512
907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
dceac5713bf278478dd100799d203ce4

SHA1
2dfe7cbbac09692d08ae08d1336f9f7ef683f607

SHA256
f66fc7ce57828a3c43d674b81eb4f55c76338038400a41d91c5173be1192dd23

SHA512
99e17ddafb5a497d3d64ebe3c60bdf55810a9d15a07d364608c2c8665455c30fe01c8049b474236046a50747fbc91de463b79ee8ccbd7192e0d1fb41fd131f13

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
ce106b38a02846510b0c46023f17bd42

SHA1
d31b254bd0278a68a806322c83a72772663c917a

SHA256
5f340ae7438879c0db88af0f8bb9b64bf72f172fe4a62848dc57d432f50faed7

SHA512
cd800266912e49e7f90475859d3f43fa10c8ee33caadccdec9113f832eb75339a84d661b2ba4ac8b10a91ad43cd00c6fad6038226a4f4ca4128a539e5890081f

Download Submit
memory/400-187-0x0000000002A20000-0x0000000002E19000-memory.dmp

Filesize
4.0MB

Download
memory/400-188-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/400-162-0x0000000002A20000-0x0000000002E19000-memory.dmp

Filesize
4.0MB

Download
memory/400-191-0x0000000002E20000-0x000000000370B000-memory.dmp

Filesize
8.9MB

Download
memory/400-214-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/400-166-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/400-165-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/400-164-0x0000000002E20000-0x000000000370B000-memory.dmp

Filesize
8.9MB

Download
memory/400-226-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1416-265-0x0000000007030000-0x0000000007041000-memory.dmp

Filesize
68KB

Download
memory/1416-252-0x0000000004760000-0x0000000004770000-memory.dmp

Filesize
64KB

Download
memory/1416-238-0x0000000004760000-0x0000000004770000-memory.dmp

Filesize
64KB

Download
memory/1416-269-0x0000000073260000-0x0000000073A10000-memory.dmp

Filesize
7.7MB

Download
memory/1416-237-0x0000000073260000-0x0000000073A10000-memory.dmp

Filesize
7.7MB

Download
memory/1416-249-0x00000000054D0000-0x0000000005824000-memory.dmp

Filesize
3.3MB

Download
memory/1416-250-0x0000000005B20000-0x0000000005B6C000-memory.dmp

Filesize
304KB

Download
memory/1416-239-0x0000000004760000-0x0000000004770000-memory.dmp

Filesize
64KB

Download
memory/1416-253-0x00000000722C0000-0x000000007230C000-memory.dmp

Filesize
304KB

Download
memory/1416-254-0x00000000743E0000-0x0000000074734000-memory.dmp

Filesize
3.3MB

Download
memory/1416-266-0x0000000007080000-0x0000000007094000-memory.dmp

Filesize
80KB

Download
memory/1416-264-0x0000000006D00000-0x0000000006DA3000-memory.dmp

Filesize
652KB

Download
memory/1496-30-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/1496-0-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/1496-1-0x0000000000750000-0x0000000000DF6000-memory.dmp

Filesize
6.6MB

Download
memory/2064-220-0x0000000007B50000-0x0000000007B6A000-memory.dmp

Filesize
104KB

Download
memory/2064-217-0x0000000007AF0000-0x0000000007AFE000-memory.dmp

Filesize
56KB

Download
memory/2064-173-0x00000000054A0000-0x0000000005506000-memory.dmp

Filesize
408KB

Download
memory/2064-184-0x0000000005DF0000-0x0000000006144000-memory.dmp

Filesize
3.3MB

Download
memory/2064-185-0x0000000006370000-0x000000000638E000-memory.dmp

Filesize
120KB

Download
memory/2064-186-0x0000000006430000-0x000000000647C000-memory.dmp

Filesize
304KB

Download
memory/2064-172-0x0000000005400000-0x0000000005422000-memory.dmp

Filesize
136KB

Download
memory/2064-171-0x0000000005650000-0x0000000005C78000-memory.dmp

Filesize
6.2MB

Download
memory/2064-190-0x0000000006910000-0x0000000006954000-memory.dmp

Filesize
272KB

Download
memory/2064-169-0x0000000002A80000-0x0000000002AB6000-memory.dmp

Filesize
216KB

Download
memory/2064-193-0x0000000002FF0000-0x0000000003000000-memory.dmp

Filesize
64KB

Download
memory/2064-194-0x00000000076E0000-0x0000000007756000-memory.dmp

Filesize
472KB

Download
memory/2064-195-0x0000000007DE0000-0x000000000845A000-memory.dmp

Filesize
6.5MB

Download
memory/2064-196-0x0000000007790000-0x00000000077AA000-memory.dmp

Filesize
104KB

Download
memory/2064-197-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/2064-198-0x0000000007960000-0x0000000007992000-memory.dmp

Filesize
200KB

Download
memory/2064-199-0x00000000743F0000-0x000000007443C000-memory.dmp

Filesize
304KB

Download
memory/2064-200-0x0000000072270000-0x00000000725C4000-memory.dmp

Filesize
3.3MB

Download
memory/2064-210-0x0000000007940000-0x000000000795E000-memory.dmp

Filesize
120KB

Download
memory/2064-211-0x00000000079A0000-0x0000000007A43000-memory.dmp

Filesize
652KB

Download
memory/2064-212-0x0000000007A80000-0x0000000007A8A000-memory.dmp

Filesize
40KB

Download
memory/2064-213-0x0000000007BB0000-0x0000000007C46000-memory.dmp

Filesize
600KB

Download
memory/2064-170-0x0000000002FF0000-0x0000000003000000-memory.dmp

Filesize
64KB

Download
memory/2064-216-0x0000000073260000-0x0000000073A10000-memory.dmp

Filesize
7.7MB

Download
memory/2064-215-0x0000000007A90000-0x0000000007AA1000-memory.dmp

Filesize
68KB

Download
memory/2064-174-0x0000000005D80000-0x0000000005DE6000-memory.dmp

Filesize
408KB

Download
memory/2064-218-0x0000000007B10000-0x0000000007B24000-memory.dmp

Filesize
80KB

Download
memory/2064-168-0x0000000073260000-0x0000000073A10000-memory.dmp

Filesize
7.7MB

Download
memory/2064-221-0x0000000007B40000-0x0000000007B48000-memory.dmp

Filesize
32KB

Download
memory/2064-224-0x0000000073260000-0x0000000073A10000-memory.dmp

Filesize
7.7MB

Download
memory/2368-137-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2368-56-0x0000000000950000-0x0000000000A50000-memory.dmp

Filesize
1024KB

Download
memory/2368-62-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2368-57-0x0000000000890000-0x00000000008AC000-memory.dmp

Filesize
112KB

Download
memory/2368-156-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2368-111-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2368-138-0x0000000000950000-0x0000000000A50000-memory.dmp

Filesize
1024KB

Download
memory/2368-141-0x0000000000890000-0x00000000008AC000-memory.dmp

Filesize
112KB

Download
memory/2368-58-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/3048-270-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3048-233-0x0000000002A50000-0x0000000002E52000-memory.dmp

Filesize
4.0MB

Download
memory/3048-335-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3048-235-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3048-234-0x0000000002E60000-0x000000000374B000-memory.dmp

Filesize
8.9MB

Download
memory/3784-143-0x0000000003170000-0x00000000032A1000-memory.dmp

Filesize
1.2MB

Download
memory/3784-142-0x0000000002F30000-0x000000000303C000-memory.dmp

Filesize
1.0MB

Download
memory/3784-29-0x00007FF6690C0000-0x00007FF669124000-memory.dmp

Filesize
400KB

Download
memory/3784-163-0x0000000003170000-0x00000000032A1000-memory.dmp

Filesize
1.2MB

Download
memory/4360-107-0x0000000000400000-0x00000000008E2000-memory.dmp

Filesize
4.9MB

Download
memory/4360-132-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/4360-39-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download