dcrat | d2682ee0fe9e5bf429b7bea89d32cf417c3b684429dbff5e060b07e7335aaa76

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

6.3MB
MD5

c67cb967230036816fd0cbbfd96959c6
SHA1

d2fe988a302dce4bc0f34a1003a623f96a06b250
SHA256

d2682ee0fe9e5bf429b7bea89d32cf417c3b684429dbff5e060b07e7335aaa76
SHA512

2f51046e44bdfa470f676071c69da8c05d50d8f79e748748f25ac13ec53d346f1c3988148000fea3ece38623fd629d1b3dcc943006e80b7bee95da7f1f42920c
SSDEEP

196608:GHqO3grg0lAc4G+JCJjsP8BXkf/hmzJzFYngA13jvHKvj4:GHzCOc4G+oB0BmdFY31zq

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdcc
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
payload_url
http://brusuax.com/dl/build2.exe

http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detected Djvu ransomware 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4088-449-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4088-450-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4088-446-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4088-464-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2524-474-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2524-472-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2524-471-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1416-336-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5104-434-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5104-482-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

6F64.exe

description pid process target process

PID 1596 created 3008 1596 6F64.exe sihost.exe
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3704 netsh.exe

description	pid	process	target process
PID 1596 created 3008	1596	6F64.exe	sihost.exe

pid	process
3704	netsh.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EB5B.exe466E.exetmp.exensi4EBE.tmp

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	EB5B.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	466E.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	nsi4EBE.tmp

Executes dropped EXE 27 IoCs

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exeInstallSetup9.exeinjector.exeBroomSetup.exensi4EBE.tmpd21cbe21e38b385a41a68c5e6dd32f4c.execsrss.exewindefender.exewindefender.exeB268.exeEB5B.exeEB5B.exeEB5B.exeEB5B.exe2FC7.exe37E7.exe466E.exeInstallSetup3.exeapril.exeapril.tmpc53cfff621a84792162f70e790980e38.exewebsocketconnectionroutine.exewebsocketconnectionroutine.exec53cfff621a84792162f70e790980e38.exe6F64.exe6F64.exe

pid	process
3076	d21cbe21e38b385a41a68c5e6dd32f4c.exe
704	InstallSetup9.exe
2596	injector.exe
3112	BroomSetup.exe
2680	nsi4EBE.tmp
1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe
5104	csrss.exe
2596	injector.exe
2428	windefender.exe
556	windefender.exe
3068	B268.exe
3168	EB5B.exe
4088	EB5B.exe
3120	EB5B.exe
2524	EB5B.exe
2508	2FC7.exe
2468	37E7.exe
536	466E.exe
2112	InstallSetup3.exe
804	april.exe
1544	april.tmp
1004	c53cfff621a84792162f70e790980e38.exe
3084	websocketconnectionroutine.exe
4500	websocketconnectionroutine.exe
2564	c53cfff621a84792162f70e790980e38.exe
2544	6F64.exe
1596	6F64.exe

Loads dropped DLL 27 IoCs

Processes:

InstallSetup9.exensi4EBE.tmpapril.tmp6F64.exe

pid	process
704	InstallSetup9.exe
704	InstallSetup9.exe
2680	nsi4EBE.tmp
2680	nsi4EBE.tmp
704	InstallSetup9.exe
1544	april.tmp
1544	april.tmp
1544	april.tmp
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe
1596	6F64.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3420 icacls.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3420	icacls.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
C:\Windows\windefender.exe	upx
C:\Windows\windefender.exe	upx
behavioral2/memory/2428-408-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/556-440-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.execsrss.exeEB5B.exe6F64.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\306a151b-8ac5-4d49-982f-b4bb923c5c0b\\EB5B.exe\" --AutoStart"	EB5B.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Uninstall Information = "C:\\Users\\Admin\\AppData\\Roaming\\Uninstall Information\\6F64.exe"	6F64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 8 IoCs

Processes:

Conhost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	Conhost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	Conhost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

EB5B.exeEB5B.exe

description pid process target process

PID 3168 set thread context of 4088 3168 EB5B.exe EB5B.exe
PID 3120 set thread context of 2524 3120 EB5B.exe EB5B.exe

description	pid	process	target process
PID 3168 set thread context of 4088	3168	EB5B.exe	EB5B.exe
PID 3120 set thread context of 2524	3120	EB5B.exe	EB5B.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exec53cfff621a84792162f70e790980e38.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File opened (read-only)	\??\VBoxMiniRdrDN	c53cfff621a84792162f70e790980e38.exe

Drops file in Windows directory 4 IoCs

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File created	C:\Windows\rss\csrss.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2492 sc.exe

pid	process
2492	sc.exe

Detects Pyinstaller 2 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\6F64.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\6F64.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4988 2680 WerFault.exe nsi4EBE.tmp
2796 2524 WerFault.exe EB5B.exe
1472 2508 WerFault.exe 2FC7.exe

pid	pid_target	process	target process
4988	2680	WerFault.exe	nsi4EBE.tmp
2796	2524	WerFault.exe	EB5B.exe
1472	2508	WerFault.exe	2FC7.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

injector.exeB268.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	injector.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	injector.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	injector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B268.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B268.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	B268.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

nsi4EBE.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nsi4EBE.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nsi4EBE.tmp

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4788 schtasks.exe
960 schtasks.exe
4880 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4904 timeout.exe

pid	process
4788	schtasks.exe
960	schtasks.exe
4880	schtasks.exe

pid	process
4904	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exeConhost.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2432 = "Cuba Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2842 = "Saratov Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

injector.exepowershell.exed21cbe21e38b385a41a68c5e6dd32f4c.exensi4EBE.tmpConhost.exed21cbe21e38b385a41a68c5e6dd32f4c.exepowershell.exe

pid	process
2596	injector.exe
2596	injector.exe
376	powershell.exe
376	powershell.exe
3076	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3076	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2680	nsi4EBE.tmp
2680	nsi4EBE.tmp
1392	Conhost.exe
1392	Conhost.exe
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
2140	powershell.exe
2140	powershell.exe
3456
3456

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

injector.exeB268.exe

pid process

2596 injector.exe
3068 B268.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exed21cbe21e38b385a41a68c5e6dd32f4c.exeConhost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	376	powershell.exe
Token: SeDebugPrivilege	3076	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeImpersonatePrivilege	3076	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeDebugPrivilege	1392	Conhost.exe
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeSystemEnvironmentPrivilege	5104	csrss.exe
Token: SeSecurityPrivilege	2492	sc.exe
Token: SeSecurityPrivilege	2492	sc.exe
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456
Token: SeShutdownPrivilege	3456
Token: SeCreatePagefilePrivilege	3456

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

april.tmp

pid process

1544 april.tmp
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

BroomSetup.exe

pid process

3112 BroomSetup.exe

pid	process
1544	april.tmp

pid	process
3112	BroomSetup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

tmp.exeInstallSetup9.exeBroomSetup.execmd.exed21cbe21e38b385a41a68c5e6dd32f4c.exed21cbe21e38b385a41a68c5e6dd32f4c.exeConhost.execsrss.exewindefender.execmd.exensi4EBE.tmp

description	pid	process	target process
PID 2836 wrote to memory of 3076	2836	tmp.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 2836 wrote to memory of 3076	2836	tmp.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 2836 wrote to memory of 3076	2836	tmp.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 2836 wrote to memory of 704	2836	tmp.exe	InstallSetup9.exe
PID 2836 wrote to memory of 704	2836	tmp.exe	InstallSetup9.exe
PID 2836 wrote to memory of 704	2836	tmp.exe	InstallSetup9.exe
PID 2836 wrote to memory of 2596	2836	tmp.exe	injector.exe
PID 2836 wrote to memory of 2596	2836	tmp.exe	injector.exe
PID 2836 wrote to memory of 2596	2836	tmp.exe	injector.exe
PID 704 wrote to memory of 3112	704	InstallSetup9.exe	BroomSetup.exe
PID 704 wrote to memory of 3112	704	InstallSetup9.exe	BroomSetup.exe
PID 704 wrote to memory of 3112	704	InstallSetup9.exe	BroomSetup.exe
PID 704 wrote to memory of 2680	704	InstallSetup9.exe	nsi4EBE.tmp
PID 704 wrote to memory of 2680	704	InstallSetup9.exe	nsi4EBE.tmp
PID 704 wrote to memory of 2680	704	InstallSetup9.exe	nsi4EBE.tmp
PID 3112 wrote to memory of 2268	3112	BroomSetup.exe	cmd.exe
PID 3112 wrote to memory of 2268	3112	BroomSetup.exe	cmd.exe
PID 3112 wrote to memory of 2268	3112	BroomSetup.exe	cmd.exe
PID 2268 wrote to memory of 2412	2268	cmd.exe	chcp.com
PID 2268 wrote to memory of 2412	2268	cmd.exe	chcp.com
PID 2268 wrote to memory of 2412	2268	cmd.exe	chcp.com
PID 2268 wrote to memory of 4788	2268	cmd.exe	schtasks.exe
PID 2268 wrote to memory of 4788	2268	cmd.exe	schtasks.exe
PID 2268 wrote to memory of 4788	2268	cmd.exe	schtasks.exe
PID 3076 wrote to memory of 376	3076	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 3076 wrote to memory of 376	3076	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 3076 wrote to memory of 376	3076	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1416 wrote to memory of 1392	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	Conhost.exe
PID 1416 wrote to memory of 1392	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	Conhost.exe
PID 1416 wrote to memory of 1392	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	Conhost.exe
PID 1416 wrote to memory of 4648	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	Conhost.exe
PID 1416 wrote to memory of 4648	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	Conhost.exe
PID 4648 wrote to memory of 3704	4648	Conhost.exe	netsh.exe
PID 4648 wrote to memory of 3704	4648	Conhost.exe	netsh.exe
PID 1416 wrote to memory of 2140	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1416 wrote to memory of 2140	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1416 wrote to memory of 2140	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1416 wrote to memory of 2344	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1416 wrote to memory of 2344	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1416 wrote to memory of 2344	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1416 wrote to memory of 5104	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	csrss.exe
PID 1416 wrote to memory of 5104	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	csrss.exe
PID 1416 wrote to memory of 5104	1416	d21cbe21e38b385a41a68c5e6dd32f4c.exe	csrss.exe
PID 5104 wrote to memory of 4940	5104	csrss.exe	powershell.exe
PID 5104 wrote to memory of 4940	5104	csrss.exe	powershell.exe
PID 5104 wrote to memory of 4940	5104	csrss.exe	powershell.exe
PID 5104 wrote to memory of 1600	5104	csrss.exe	powershell.exe
PID 5104 wrote to memory of 1600	5104	csrss.exe	powershell.exe
PID 5104 wrote to memory of 1600	5104	csrss.exe	powershell.exe
PID 5104 wrote to memory of 3684	5104	csrss.exe	powershell.exe
PID 5104 wrote to memory of 3684	5104	csrss.exe	powershell.exe
PID 5104 wrote to memory of 3684	5104	csrss.exe	powershell.exe
PID 5104 wrote to memory of 2596	5104	csrss.exe	injector.exe
PID 5104 wrote to memory of 2596	5104	csrss.exe	injector.exe
PID 2428 wrote to memory of 2392	2428	windefender.exe	cmd.exe
PID 2428 wrote to memory of 2392	2428	windefender.exe	cmd.exe
PID 2428 wrote to memory of 2392	2428	windefender.exe	cmd.exe
PID 2392 wrote to memory of 2492	2392	cmd.exe	sc.exe
PID 2392 wrote to memory of 2492	2392	cmd.exe	sc.exe
PID 2392 wrote to memory of 2492	2392	cmd.exe	sc.exe
PID 3456 wrote to memory of 3068	3456		B268.exe
PID 3456 wrote to memory of 3068	3456		B268.exe
PID 3456 wrote to memory of 3068	3456		B268.exe
PID 2680 wrote to memory of 1664	2680	nsi4EBE.tmp	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3008
- C:\Windows\system32\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  PID:4204

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
  "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:376
- - C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
    "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:4648
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:3704
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2140
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:2344
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Manipulates WinMonFS driver.
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:4940
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:2692
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:960
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2596
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:4880
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2428
- C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2268
- - C:\Users\Admin\AppData\Local\Temp\nsi4EBE.tmp
    C:\Users\Admin\AppData\Local\Temp\nsi4EBE.tmp
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 2332
      4⤵
      Program crash
      PID:4988
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsi4EBE.tmp" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      PID:1664
- C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
  2⤵
  PID:2596

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
1⤵
- Creates scheduled task(s)
PID:4788

C:\Windows\SysWOW64\chcp.com
chcp 1251
1⤵
PID:2412

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:556

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
1⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
1⤵
- Suspicious use of WriteProcessMemory
PID:2392

C:\Users\Admin\AppData\Local\Temp\B268.exe
C:\Users\Admin\AppData\Local\Temp\B268.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2680 -ip 2680
1⤵
PID:1044

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
1⤵
- Delays execution with timeout.exe
PID:4904

C:\Users\Admin\AppData\Local\Temp\EB5B.exe
C:\Users\Admin\AppData\Local\Temp\EB5B.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:4088
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Local\306a151b-8ac5-4d49-982f-b4bb923c5c0b" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2⤵
  - Modifies file permissions
  PID:3420
- C:\Users\Admin\AppData\Local\Temp\EB5B.exe
  "C:\Users\Admin\AppData\Local\Temp\EB5B.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3120

C:\Users\Admin\AppData\Local\Temp\EB5B.exe
C:\Users\Admin\AppData\Local\Temp\EB5B.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3168

C:\Users\Admin\AppData\Local\Temp\EB5B.exe
"C:\Users\Admin\AppData\Local\Temp\EB5B.exe" --Admin IsNotAutoStart IsNotTask
1⤵
- Executes dropped EXE
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 592
  2⤵
  - Program crash
  PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2524 -ip 2524
1⤵
PID:1504

C:\Users\Admin\AppData\Local\Temp\2FC7.exe
C:\Users\Admin\AppData\Local\Temp\2FC7.exe
1⤵
- Executes dropped EXE
PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 1152
  2⤵
  - Program crash
  PID:1472

C:\Users\Admin\AppData\Local\Temp\37E7.exe
C:\Users\Admin\AppData\Local\Temp\37E7.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2508 -ip 2508
1⤵
PID:4412

C:\Users\Admin\AppData\Local\Temp\466E.exe
C:\Users\Admin\AppData\Local\Temp\466E.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:536
- C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe"
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe
  "C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe"
  2⤵
  - Executes dropped EXE
  PID:1004
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe
    "C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe"
    3⤵
    - Executes dropped EXE
    - Checks for VirtualBox DLLs, possible anti-VM trick
    PID:2564
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3644
- C:\Users\Admin\AppData\Local\Temp\april.exe
  "C:\Users\Admin\AppData\Local\Temp\april.exe"
  2⤵
  - Executes dropped EXE
  PID:804

C:\Users\Admin\AppData\Local\Temp\is-D89RP.tmp\april.tmp
"C:\Users\Admin\AppData\Local\Temp\is-D89RP.tmp\april.tmp" /SL5="$7014E,7683695,54272,C:\Users\Admin\AppData\Local\Temp\april.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1544
- C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe
  "C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe" -i
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe
  "C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe" -s
  2⤵
  - Executes dropped EXE
  PID:4500

C:\Users\Admin\AppData\Local\Temp\6F64.exe
C:\Users\Admin\AppData\Local\Temp\6F64.exe
1⤵
- Executes dropped EXE
PID:2544
- C:\Users\Admin\AppData\Local\Temp\6F64.exe
  C:\Users\Admin\AppData\Local\Temp\6F64.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\ObjectSerialization64\ObjectSerialization64.exe

Filesize
156KB

MD5
38ae548f3f407a8db8ac82d70adb1324

SHA1
8297f5cef1c64c7d9a13d7a0fc1e5105949d364c

SHA256
ed625645bd87dd259f1b6bcc79efe417fff726c6ddd18ee2fa8a01330f262f8d

SHA512
0c8265a9bab5626369e3f761c40dc7b49253a11388dc9e4584cef42bbf6dc7dcef2c29f4cf6fd0028978bd733bf03f1a8f1794315c133aa1133608a8a460b091

Download Submit
C:\ProgramData\mozglue.dll

Filesize
100KB

MD5
ff8c522ff9fa916dc987cea17ad668c4

SHA1
96333f78b7069ae6abc7f2c9ba36c3bba20cbced

SHA256
c210c20ae1dab5b951e86d9f612bc7d5cd19b78823372a312c87360a3cdcf203

SHA512
944ca5b9ac5e84bfddfbacc5b913592ac07cfa0e8d41271737e0c65182b2f8365644902fa747019a90c259327832da0e494b07c6b4d641e3268287866c0f52ee

Download Submit
C:\ProgramData\mozglue.dll

Filesize
84KB

MD5
b40a6c128ef54e053857f0e404c0239a

SHA1
4a258c2bc23869f5fcd70175343606b6c3318893

SHA256
f0cbcf53492af79b37890f1e642ac47c024fb5052cef1eda786667330748e23e

SHA512
bc558e944ec5c97d59f3e4a7328a995e5f7157ab3e52e618f4c73c91f49ff73401ef5688e6ffdd15bbf6b8bb211910acf90813c61723633ba3e7a186bbc5c8b6

Download Submit
C:\ProgramData\nss3.dll

Filesize
169KB

MD5
a66fc3779e97174829c9770d5413d668

SHA1
b8979b0eeec8223c6e114d1766214ae8ac9e02fa

SHA256
62244d1bd53f5f6429cbe94c753db7f2f49e7c8604b2f71cc26f8b5aacf281a9

SHA512
322f6fd74d80bc735f84dbce02b7cc2c8e5352682c2095b2b40a9f60f75b9f6952c6c9f886fb7805c514dc334d3cf09918cec7134da41c26cac3229276d5ec13

Download Submit
C:\Users\Admin\AppData\Local\306a151b-8ac5-4d49-982f-b4bb923c5c0b\EB5B.exe

Filesize
79KB

MD5
36e56acae3de478dcb28a91478e059a8

SHA1
82603097e862f86fcc50838e67d0479077e883f8

SHA256
19e15ae5207dd93473c5641b9ad5486da7920821fa633f1667fd0fb73f1ccf2b

SHA512
2d1774e628da5c941e8360394f2f3deaef59d073df187f8f031da38edea993fac1bacbf92a89382a9837c1d213a469a4e371956e871b3198fd227454fdb8ba00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a6ea7bfcd3aac150c0caef765cb52281

SHA1
037dc22c46a0eb0b9ad4c74088129e387cffe96b

SHA256
f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9

SHA512
c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
21KB

MD5
9ab30019ac8ac1abcd14c69f07f10dc5

SHA1
74f449a33686129f3b6d672b51aaf416512161ae

SHA256
9bde679fcce61b22f34968511c734cedc6e0e39e2b7525f89fb42e179bc53810

SHA512
57e2d20fdce48f9fd35b08f719c3dac37218c9e5830da0dffb30611f93249ce0cc0b126e88968526c6157657d7f8d23659c6d41a4c16ca648ec933605d8e33b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2FC7.exe

Filesize
200KB

MD5
de52c7b16fb36ea4ec123c9ba8060bd3

SHA1
38a48f2288c99fd1f1cf4b5bdb7882fd352a1327

SHA256
e6d0fc068c4256adcf726ff42d379eac379bb77fc67f9ad2ad7bd200e7de7189

SHA512
978f4b12a431beab610b410982c53718471bb1d4a137daafe376559ec1c6c76d4ccb9b4bdba69170e47851be378b151713e48326eaf90df88ba6aadbfddda721

Download Submit
C:\Users\Admin\AppData\Local\Temp\2FC7.exe

Filesize
121KB

MD5
61afe8e4c5e0fc0d3163b2c7690626bf

SHA1
ce134a393317fd265883996b5dbd79d5f9670c14

SHA256
c41fa164e8d60544291304b12aaabe27791085f004b6c236e46aad1997634257

SHA512
df7ca6357d727176db5ae7b6bf4e832df113c3c2d095ff17920d79cbff592eb69dc9e52fb5294e08ddcc35e6c0b1c98de4ffdb50cb0feb51d5ebbcc3b40674bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\37E7.exe

Filesize
183KB

MD5
7d50ec40ca04ea3a61c6bc73d79d71f5

SHA1
c7054493aad1ed947d49c3927a4260eab3ebc586

SHA256
f7a88bd6e791bc5222963531db10164d25dd3fdd2f92bac81ef56782b8a75476

SHA512
20ab89faeef02d59a0fb2ae05b6ca21cf2571cc0b0b88442dfed115ecbab8699f3eecd9a10c8b1f6af4386c60624ec44a0aaa8d986639383b19c746dccf3fc85

Download Submit
C:\Users\Admin\AppData\Local\Temp\37E7.exe

Filesize
124KB

MD5
73aae07eec9383e9de354320b5a65e36

SHA1
7710785f4216a7a83e7dfd8a8bbdf92db1aa0332

SHA256
b54ad964e91cf7d4982ec5e0ef52492254df0aba09583217ff458557fb533281

SHA512
cdc21570ea8a9de8910f3ab4a53746daca23ed52967ddb97a7faf120a05003250b803071b9cdfea91890e5de4e5d22bb2be8c2babe057857fa3bb9849f4f8039

Download Submit
C:\Users\Admin\AppData\Local\Temp\466E.exe

Filesize
265KB

MD5
aa0b4fd0477acca4307f70037c1a0d72

SHA1
1480d0d6637120ef71bafd4830442cdd34bddb44

SHA256
e9d39bbf8527ce766393d9b06d3632cd966e3997bd45bc328762b33e25b890b4

SHA512
edeb349ae127e800ed30c550c5c9b07e590a9c50aa99524365d938e682893d5bd87b2316809f4565cee4ff67b56328fa9492c63b7862f76bcf47c6b0c6f4f3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\466E.exe

Filesize
136KB

MD5
763482d37cf892686a6b01ea8a681dcc

SHA1
4ea64a18470edf6a848323c01fc92d546c14d36e

SHA256
531fb0eedab252361cb462b59dde00d895fd238febd450670e5f776c896bb2de

SHA512
0b0cff2b4f256926228dd09bf9d0719ac41faa8b63ff05afdc0149ab4c78aaa304358943d45901891a059c6c4db66041377a159835a8a43ce71c80d30898f660

Download Submit
C:\Users\Admin\AppData\Local\Temp\6F64.exe

Filesize
249KB

MD5
7cbfca4c3d5296bfcf1a851737e7a706

SHA1
ec8ef72141f9b3e1d5488b680d1b3d2ec542e5f7

SHA256
485752a215c456e26a8b9b932f1747667eaece1bf6a596144c74058b197fe173

SHA512
183a9cc16de9782ca75ff10c6b72785a417b51b3277e5b0d26e8e1fec5b865363a9403268347d6167fb1a94dbb8e2a6e12ea79f4bbe2b11cf7f7c4af91fe5cfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\6F64.exe

Filesize
288KB

MD5
768aa295387062a720bd58077e2e819e

SHA1
ce4a8622dd8339e1447268c31efdd8ff380866bd

SHA256
92b6359999497d2a71b82ee957f5d6692f46107afb51d2fa7f39dae8a1994994

SHA512
0f08cc2017d59397079eb5e4584ed25a6484a425d29d561e38eca18735a6882c53fa2f56bc3532fda97a2f5bb22881a07a5926bf36f27695970529ba33bf5e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\B268.exe

Filesize
5KB

MD5
5383b6b544b19425a708fd0755a0b736

SHA1
58efdf1ea7a837e97a49f1136761a543fbcbb993

SHA256
dd9c70813e9b7d9287104e16a4da4b65b29a1857f7ebf6d8bee81065305d06d4

SHA512
759f2177c769689558e768f4587a67e7921c0837128d3f4125ee3d178db6111bc05c3ba1987e2c37a4a86d50f5d8b9be2b9266b341f9d0ef54152a785f1c60b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\B268.exe

Filesize
60KB

MD5
cbb23e7c0add1e48c284becb893e92b5

SHA1
2161e8466f06b6674b088173f8df4cb6c372ce42

SHA256
bd94b162a3c921ed92eab47192c50a34999829268c1fdd4f1345687d64172c22

SHA512
6a2b3e03353fba67da78dd975a5d364c2c72dbab0bf6451d4ae65c520d9ea8de1f1e059da066f15af88409a99ee0c32a4634e01bcda2e34849a3f5e6235f274e

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

Filesize
267KB

MD5
f17a0c47ef8f383ccc2e894543d3d562

SHA1
ee807a63b2d9ddbd5e820aaff43a63cf65733b4a

SHA256
8669375ac66539612a0fb6e20682a483e865463135972434cfa52d7aa7a19196

SHA512
a6b877bc2cc2b17c89618dad8561da0e717a6ccd9b77ab5eab686633db41b91cce5278d8cd4b46504021a3ae29f984f05fe9d421b9c54b61ac79e160344eeac3

Download Submit
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

Filesize
354KB

MD5
c3be76ad957dca4cb1216f00bf9f8fd9

SHA1
e95854ec651c2c03d6814305c9e0e00cc10d3047

SHA256
eb2d65737cd6bf04c43753ed0d1a8bfae9ffa8141d0679aa889595ca25f9897d

SHA512
c30c45f7467eb9ad0b373f7affea08118315fe429c1b1b137debed07aa09a4a628f0f71174e303c4ac347680203648c2595dec5b697162fd9abb348a36c38c6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB5B.exe

Filesize
106KB

MD5
2f694aa55e9f8f8a18be7c2893917c15

SHA1
ff93997c79ce7202842d2aef7e51c194552a4f79

SHA256
89d6bbc35768d1b2f938697dc49367f3bd517edc82222f37e72b138cbcbf1234

SHA512
dc1dad7f40c18c0c9d7e797933d04d21f515d4bd138675a345be9761333f30adf5f9bd6dde715470a9237c0cded0940807de3d1b38aa6f4b1f484902c6508763

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB5B.exe

Filesize
292KB

MD5
d286c306003952479155f54e1ef79d0c

SHA1
823b40f4787a6b108b9a9f8d65edaa6824a7252a

SHA256
3887dac1aa5bebb581a029a1a28f2c5d1472a748435d77956c1e7a2ac0849eb5

SHA512
4e016599c95c33ae60167577ea397e65ad4f5b8c5a048657fcbb91182e4557cd5fecdcc932e1e446d6b3ad03e78f331f1c36fd5d03b7afc14fcb6bae5252ec2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB5B.exe

Filesize
149KB

MD5
8b903f95997279be269933aa1d93012a

SHA1
56b62bf596b6351060bdf18677b3db032e98e88e

SHA256
9c7e2d2f5166008f2061be6c55a00e3b15e9285c477792f972994e6859dcbb97

SHA512
abb465770c802fd35c4e7ab0ea155147392fe4f0a7dc052a93e285625bc426b67ddbf7409ae4ac2f67fa4fcaba1921e8dcb5ab3844d26f260fe35b2fc2fb27f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB5B.exe

Filesize
146KB

MD5
d1caaec194817ea72df7528ffb38fcd1

SHA1
30f0a700c60c81da7ebd9d6a593c03898ec470da

SHA256
8b9cadece93ff9e44a222629f06375fd984ad2fa3669d14db9f061133765eda1

SHA512
d1c13975068adcf5063dea323e41f494f121b510c1e9ffb7d22bd04871009529721705c872c23ac736a6462bf3b8b313c60f7b94bc89ebd523ba453753557206

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB5B.exe

Filesize
89KB

MD5
4207be4f837f3fb69f383d55992c49c4

SHA1
bbf16204e22bde1849f085b306d24b038c9299b2

SHA256
87f45f8e948773b6663f11c64412758ce06fe3b44c60c93cd8bcafbdee0f0062

SHA512
9f5be154cbcf48e842a319163751ef7b828cb003ee6d809ada7f442a1d99e717494813c68949a4bf4e9bb121f8ebc98f5db9c77dd9cb14f767bf42c92bda1e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe

Filesize
116KB

MD5
3019146747ef67c3708135736dc6837f

SHA1
b28f514e98d21b47c1ebc328393ce5fb82658021

SHA256
53100b8cb7217db40846e5de20460f02647fc8f1790184779972815ac7a1de4f

SHA512
e7d13ce668ce53ccf89e4ae70a9a9489bb2afba92c5527c67d7c9c456361c2b196e0816e3a4d5f88e8afc87f3e6e7539bf661e88c59f886fa380f7a0035b7318

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup3.exe

Filesize
329KB

MD5
a6eee3275d68f6bbef4dceda7cebd362

SHA1
efa4b49dc1c93f297640cfdffb1202bc2519bbf4

SHA256
0673cb4da597a447fcf125bb2bf67f2ec1eb254d674200e97097a3605dc09891

SHA512
62146fea69cec97b194f1f100ade99491dabc045d73502e8f9d200220dd8c1daed7a32fa054b0faf2ab24500c59f07c3521000e40d8f6339b72d7e0f659ca6b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

Filesize
392KB

MD5
f08b02a4d8639798695b182bc84f7ccd

SHA1
30b8658d1dec8cc3a0304024810fc397eba2710d

SHA256
8b7ff81c0586cc66a826ca1414c2f37f55feb6e5c7f710922f22f2216a95cbe9

SHA512
d96a17700b0432179f9b9541d59d50ba8c4193e0fb7a8e21a790cfb77aa2073d324e5029f329f42fcd4e1d9493836208db61d0e7ebe528c0ca62850b8871dc43

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

Filesize
557KB

MD5
28a0ec355ac14f3db4ce84d97ef89a11

SHA1
c14c427107a3a3cfb3043f0b72f6ffac1e9e772a

SHA256
d5d8b00980f08d0aa7e63e6ee12f9b744b7e91b930d8c4314f5e5487b55aca3a

SHA512
9e09b9a9e940378d897691716f3b014aff28cd14c48a5a90ca9e077301c39c2e23aaddf68e985e4ba3fdd7cfae542e7a80e429f9981fce7298d48b761892f383

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

Filesize
394KB

MD5
95ea0a3d9850b0f52d34c933a7ba3f80

SHA1
09bdb799f892b11c665ef9b47ba279e94afd0e47

SHA256
48bd371e8aeec368cfda19a01f07573b7e8857c6bc116e5b03f49ec0abb1f41e

SHA512
f2fb6f3f669e05081f7196c2cdc8fb79d4952c73322847c24ed227c8523be765db261cbcc0294009bb83170e7a6e44eef522fdc8e4954e28654212e3c569d41c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r21n4anr.mrl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\april.exe

Filesize
284KB

MD5
b4c2747df6c092d7de98ebb9bbebf9e3

SHA1
20c27637ef89a33d5b6f82e6557c342a6b9ecbbc

SHA256
fb4948af594fa07161441db338004034fa7e8543a48903625ab37051487be2bb

SHA512
ff83530c3baede040ea8148f04bb147c7ef29b2f39170256eaa5daccdbc48ad2012c882c2c9e62a906a669e12ed699b9dd6ede1b913bd6ccf9b7c22c8b9309aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\april.exe

Filesize
226KB

MD5
5e0d5a055a254de461709aea9a7c0eb4

SHA1
a3e7e85685c8476ec76abfd2e57d22be89ec4c19

SHA256
9fd7ce084798e8533ab2c40a7b7c6558bcd67c6d60f7c2a8b5d43dd1865a3cc5

SHA512
dd1a031e8e04f9c4836cb1108079a41d80f7721725da4da982ae803eafdb230173c008e48fd1d68a7bcc905bfd17951293be029993c1a9ea548276de3cba184e

Download Submit
C:\Users\Admin\AppData\Local\Temp\april.exe

Filesize
196KB

MD5
5ecaae9e8fa4f0158ae3aa30620fd888

SHA1
4cc9d2291a075e1c3612b2a77ad7091759be983e

SHA256
9a589b21f2fb75936c93bc595f177f9b242b4fa02406f1e0d43524e0fcfa5d80

SHA512
46dc80f9f3e81774dfd75614d82cab9884a37611c483b2e35a3742467447012a493da96dd5c36170c99f216226c15a03e90b7ab069bd37ed3edcb167a5f53b75

Download Submit
C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe

Filesize
403KB

MD5
c44873f001c6415bfee710ea7de51497

SHA1
bf130e9fc4105e1094ad874abce2c55d9a80bbf6

SHA256
797780dc217ac19da96470635a39b13bad24ce435baa6430d89b4e56b942a823

SHA512
e5ee28c5f1cc07513732719787167a4cba95bc021f1c88bcf5d59782d6717257d6c3daeca0fbd7101319fdc7cc8c21d88875806041deae508b851c64e97b60a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe

Filesize
226KB

MD5
6be21bfa19b3e7a4f7ace9620de731a1

SHA1
543ac6624c4724e9c132a212e4565f059a5e29c9

SHA256
e0fc31e922ac2e1378c6fc1798aab2411595c0c66f66b74873fdb2b17116411c

SHA512
d9649b3686803f411ea7ce568f9a12c220a31533765986c4e7feff3f47883e837ca5440159aadecb683362be3183ab5e52896e1743a7207fe247c413aaae6a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe

Filesize
220KB

MD5
439fbe3d1ac9570ccc60cbd140b8e752

SHA1
cd520e3069a43ab7ffcc6c5766759261c03af2e1

SHA256
e114b460b8c19fee0842c429513800af2bccb670a2c0c97404fcbb2f123664f7

SHA512
638b62b5be7fc865700f593a61b90545d047539060dc9f67f6ae388134b79ebb23d9ea5a03a7d8d4d3a97a9da44e2beabb977eeb93d1f990acd22eda1a6eae02

Download Submit
C:\Users\Admin\AppData\Local\Temp\c53cfff621a84792162f70e790980e38.exe

Filesize
149KB

MD5
460d5dfd449f679877aefe375ec1d653

SHA1
f5d9874bd7e4baf94cb180df62c2f549588f95c4

SHA256
1369a2fb14cfea84af044a0325d0708c8f63e4bee593a6c3723e2f3000fc13f3

SHA512
1b923c767b29eca75f43a549fd50b62fe189916f995cb4993483f27a7edff62bee02fddc556d31d1ab1ff6416c5461897f937e11f8960bccb65894fc47e9e5fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
68KB

MD5
4b5d43e63cbdbe5c7e1b10de0b9cf6cd

SHA1
6a651a3e83dc1bab8309ad6f7f1165bf9b6fb365

SHA256
5139dc77e37c331ba0dd640e016801562e4afe3f685e52e784656efc76a9fd0d

SHA512
fa6f5837f6a403c3f14f238e985d82a5f5cd76e4580e0ddc551bfd91c940488525a3e82a54b0ea5eaa180e422b21b6390a9d6689c65da5675111c422d46ffefc

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
24KB

MD5
f3d84a2b94085ea828a8ffabfb05d840

SHA1
e6f34182685819496d43111af588291a0c04fc4f

SHA256
fa4a6993bf729300a54b14f5349708ddf7aa63a69c30595487ac5ef0a599d66a

SHA512
c77a330a02a5d9989b59fb8778371fb19b0402e42d67ab507dd41085982821a442ae14b43a2d5a50061e09e04557f3408a4bab072f950995ac2ebd8997a12d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
190KB

MD5
2679c4fb52ea5bbd63bf61df1bbede11

SHA1
3e8ffccaa8ef565ed37d4ca87ec837c26313181c

SHA256
249c413a39b0712a280c08effc68e853a7e4e5076090236546f2d091762f2388

SHA512
8e6a6344be4db19a0071cd019a9cbddfb0147710a7cd8f244cdd6c6259af388c8b22b7cee33849306551876493485031c3fdc79cdfbde9e2e8481281fd046ef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
374KB

MD5
632b7b44d5f185443b448f1b21b144d4

SHA1
fc9baa39c1a6c88b199c69fae838f4783c20d6c8

SHA256
a8f1aa3875a91af37c58c4947c84770244036103b3ff3785c7623eb3a9dbd2ee

SHA512
6df7d88f31901a85b9b9260338d4eb3f2e74ea714fa7b135e0a4750af486f803fa27a04efd80ffbc7d6fc132000f801b7face151502aeac2adaca0cf85155570

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
376KB

MD5
03c52d3ed8e7effd09e9430f85d4ab4b

SHA1
f5a699cb5e89ae7eccd9bcd351b00f4358aa09f4

SHA256
8b817c5a04263176e5f0da9800c14bc877754b4a0c968cb74874f35754897812

SHA512
0c3524769f573513887b86fdd32ec1c67287a2c142785e3dd3e2766ee291f08cdc4bb3c4c081803810e7d5172bf8355c52139879cd15cc70d5aa95cda4ba0693

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
464KB

MD5
d3b8904fba3af8b5d50f34da780163c0

SHA1
240205d0eeab882d0d140b2c4abe9c1b67c88da3

SHA256
b456876acb3d010f8e469a3793fafcda9d463d642d4c8a7e5532d0a32040f50d

SHA512
aac21a9cf01ff65466627e69d7623ff7e433a7a9aeb6a5b942380348a288d1dfe7bd5a2403f393aab918ca7da7ca1e9248bc03d02286ab6e645117e972c41724

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D89RP.tmp\april.tmp

Filesize
199KB

MD5
0fcd3a531fdcad5d378113c0addda2ec

SHA1
946f837fcbd4e15ad6ac6a46fe3feb23acb03c27

SHA256
0a3faed8656ff7730db2aec56e29d9a3b7d24a37cc9db9a357042b77be89d1ec

SHA512
2b70172a2f8a9720e524e9da76b45d15efffd7b3026315fddb04001d6ad18a0e03e1b5e1a3c8c65d66eb5879e34acbfabe3b7ea1f67e73cbb337d26abcf85f8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D89RP.tmp\april.tmp

Filesize
202KB

MD5
88f696b38949ff3d1155098cc138242c

SHA1
7c91ebf1786466fe581043f6d901dfc00a56c60d

SHA256
b068957c9919e48b47ea0ce16087497c4e7ab10663bda574f0c22d3232ad9b5f

SHA512
bc52fcbbf985534d8770c56b5b58b03bc6573d54dd5c657527f97b1301882c1f5e6bd7a521af8aea1173ec5a420d22ec86a5dc325d55e4010db23805c25cc9e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QMPV5.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QMPV5.tmp\_isetup\_isdecmp.dll

Filesize
19KB

MD5
3adaa386b671c2df3bae5b39dc093008

SHA1
067cf95fbdb922d81db58432c46930f86d23dded

SHA256
71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

SHA512
bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg4A77.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi4EBE.tmp

Filesize
153KB

MD5
aa8766c8edcca0b2815a57a42baa00f0

SHA1
fe4276472d3bf5a521bfe34dbbb645453d030763

SHA256
6300a44a63c0e5e22412c9f50378ddfbd46622af702828c462d2a471b74ca02a

SHA512
e40b20e30009344b4421ccc204b9e649dd976c5decd3df58bacf8a2a03304b895235d7a1151c4dd1cd9c1c9b44a94649d9159b7230043be6765de2514c772f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi4EBE.tmp

Filesize
139KB

MD5
0b89393094f8ba55ba3a38b8b0480e6e

SHA1
dc173f1a12b2f406eccbb97ac764e7a9b6ed7b4b

SHA256
33ecdd4000eabfd7b7e3418fce05ce0b4b5cbd0f0c185fae2fba76c5d3407d04

SHA512
73db3d622bc29cb5170dbc5fb9628231a0902a85053fdee81c1521743e678d2e12f5292884448efc7f1e7de69bc40b78e63875a3022054d879c83eb62f22fffc

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe

Filesize
171KB

MD5
4d1a4b3096f4a39f3a91df2f6efd43c6

SHA1
af7b52300363fa6f5ce8b5f99f753a9b1e0af94f

SHA256
ca5b5e71addd8a56460eefad5cd368a5f6aca71b7a2d6dcfb312f45d1ae6e20b

SHA512
d7cc6cf36fa0da5c22b531f7b3f58cbbcc206aaa47d40ebc0256fa5ede758fa7f636f9b70fa8077664067c8cbd3b38633ef2ca1e2e8e349b3b05c3cec1f8afd7

Download Submit
C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe

Filesize
166KB

MD5
8d5ce70868bff9af15f3096e7a5ae8b3

SHA1
d61742d612f05c19adae43487bbb69cb9b679390

SHA256
a59816a504e0731de7bc7fbacf44b42af4e506b001248f1791f754e16c87dbad

SHA512
933664992a7e9245614081b2307429f5f1571a91011a414196d9f5fa63d9b7e557a01982789191e40002f6891203864850c9b2ec75270f434b7afe8cfb6c1b7f

Download Submit
C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe

Filesize
99KB

MD5
0a59fdefaf26c0021a20bf29e577f3d4

SHA1
69853645ae125482a3b2f7ef391e6439cdc5699c

SHA256
3eb0022655d2dedae7c0780abf04ee77d0dc090637a372e206aaae4d17972758

SHA512
8e9da131cda1dfc4e28681b5813ee68e15e13630f41004ff56f38a4594bfb6552ca434f4981bef633813a553669760783dcef66a6321c04748f793565dd5c8df

Download Submit
C:\Users\Admin\AppData\Local\WebSocket connection routine\websocketconnectionroutine.exe

Filesize
159KB

MD5
5bed09cb766ca85605a61118415d0644

SHA1
6d2d9cb5d831e0594123975194a4cc63b1c574ba

SHA256
fc145db642d3f685073dba44c931b5dfafa55e2c7e90632ee2adea49809655fa

SHA512
84bad610340130320cb43717612afb041fbffd65aadc3f250df12605f849f72174a5a7f644241221a0a72929d38da419292bef8251dfab89fe90d47df3b30304

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Task.bat

Filesize
128B

MD5
11bb3db51f701d4e42d3287f71a6a43e

SHA1
63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

SHA256
6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

SHA512
907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
221fda026dcff73859237abb95c6c5e9

SHA1
08b9a8f94d010567b9849b90f6d95659a1b4aff2

SHA256
1cfb5710995e17d527e091eeafab0827e7901bd89eaf5839d46dd975f303016b

SHA512
2a308cfacf0aba73668034a25a025e89fa9391d240482a3250113a9fde0a7147b2aae8317099ab19feabd4c88158339fab2f8004ea59f91d01667bdedba51f65

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
adefe2e8d1a080c4c2f512ee26fff772

SHA1
c9b4612922a968fdf9629a0b4b846c243712597f

SHA256
2fbd5e575db3c2d62b582c3ca67ff4ee5adb5cf32b05053c4d6d078c97b65f7d

SHA512
831854af3a6dc29c274b5d2c4cb1dd81fc171173670f0c305c50d0b8ed62d4ec4f55199e3f1cc17eb64a6f0b64b97fe576f9ed23a24afefb455f0027877ac514

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
1870781fb6f74a97c03d7b6c2f2d0fe9

SHA1
f83a587e8e6b8a3231ce5881435e893a5a8b52a0

SHA256
e33611f1d37b26062e475b4d913c7c7ef97cb39c2b0c5c696d57be026621a54d

SHA512
8e769295efaac6095c0c0f435447ded1d14437385d51085aa834249711c44ba591f28af9c921d6b14f2084b6963a970ae51303b1489ae8787745f4d26d74f1f2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
f3fc50fb821eb0755d4bfd32563c23e6

SHA1
165824e8cc430c9bc43c2ea72b4b81a99768dcf5

SHA256
c1e310823f73200d2667626eabadbdb6e1e1aa7c95bebfc422ff06e05479c177

SHA512
bfd22e6f129432e23dae7b00890ae3d57aaa256df8f117a37fbefac15106777fefb0ec0c079ab45e223cb08faa3ebce8824aba41dfa2de0206d5ecfb1f20242c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
deee6485137bd0f0902c595de0be348b

SHA1
525f47d93747914ed37d1f7ad99a686483cc9e9a

SHA256
b0fb62fc2286f36df26b1e2f59cc63073f4a228031880c1f04aa6c0b44bdb65a

SHA512
1845937d6e77db9a95194d676bfd9a963959e0069aa0034e38e2311e27f244dd366bd349b60089d9b0bfe65a659e47fb276e64f93a5b5dda214cc9014f4ac5f6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
dc51c316ef2e126cfe97c290a69f594e

SHA1
a20b4fe6cdbe7a0c236c47d75612f8477fb7e810

SHA256
26b539f51b9da9a0fb8e493e338a4dd2a8698eeabf64ac0b39be962a30994203

SHA512
c340dbda05b317972a520834055f94bb00580ea28836840b80a379c42a60c35df3ee5bbb75f63efbe2a77b306bac18d5506418bbd6c571be9a107efd0ed0146e

Download Submit
C:\Windows\rss\csrss.exe

Filesize
66KB

MD5
53f03fc8d25221871619c5844b3cd912

SHA1
f37caf5b9855c04f959ad2290fff88a282ca01c2

SHA256
8421047b9ddeba90f03de3bd7e831acc12fb1c3ba8b3a75b5b9d363f2179c5e1

SHA512
9dcb4e4a736036a45cd938cff487563dee1137eacce730017ef227236f97f3cf484dd55a1a191703bb5594601bf9441f4e422067d15e54127570644a0dfaf43a

Download Submit
C:\Windows\rss\csrss.exe

Filesize
27KB

MD5
80665f921eb693c888e40c67d12f827a

SHA1
303a9dea7a99b322c0cb3ecce9c1ca486fd712e7

SHA256
76531c163d3a515d98116f63cd28b21da2e2e854a2f7692e96cf5dc4d43ba71d

SHA512
3ce96da15d764a0c7327c11c6b3e122dd7b96c4fd75fc1fa1243875f5d892dbd1ecce212d7c644dbe7360f0cdb3921bf10081f4f0d5fe0045b0b533c6cb13b42

Download Submit
C:\Windows\windefender.exe

Filesize
119KB

MD5
04ecf2db059943e4e4169948bcbcbd98

SHA1
645271b8cd802fa596b2a563c43f2456b4aac06a

SHA256
1af62ae564ae390b4fc02743f0914042654ee75f928097dc6263ee1cd03dd482

SHA512
c72a76414b411dc0f740e18bf1896a9ed0e1cc18bb562825436ff96fa3ffec95ec0fd62e29b1dfd159d208a7714e4e21e25be5ec4a655f2b8448f404e1381d6c

Download Submit
C:\Windows\windefender.exe

Filesize
45KB

MD5
dd417acfc16de7f5e2ba8a5ff0570053

SHA1
440f86070d8c80b17ca813079829630f31a02f63

SHA256
c5bfcf18e69ca92a61054ade1f0911f936eaa1770df9910b9cf2ac5c2922e564

SHA512
b8c92324555bff2a4cbcbf725d5d478b2d6618047d00a7f90e4c83a4b6a8d9de050fec4ac06d58860a92de609766d1e8dde7463307b12dd36a3e991d87b0faec

Download Submit
C:\Windows\windefender.exe

Filesize
50KB

MD5
59b91425af41c212bfc69031483a4c8c

SHA1
151458d9b55903e404d909ad97cd2ef8b397f102

SHA256
ac5bd6235471c867238e83c1cea8097f661f8be62b638d41eef9748b64dc51e9

SHA512
83e8d11a06e912494dafcc5cd5a3f4e84837979038abe398a2750fb31ce1f177b9007c59da15e40cde811f12e0e1a0a3f3f258a8525ee705e1167d0516604847

Download Submit
memory/376-100-0x0000000007FB0000-0x0000000007FBA000-memory.dmp

Filesize
40KB

Download
memory/376-66-0x0000000006200000-0x0000000006266000-memory.dmp

Filesize
408KB

Download
memory/376-86-0x0000000071F30000-0x0000000071F7C000-memory.dmp

Filesize
304KB

Download
memory/376-82-0x0000000008300000-0x000000000897A000-memory.dmp

Filesize
6.5MB

Download
memory/376-83-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

Filesize
104KB

Download
memory/376-81-0x0000000007C00000-0x0000000007C76000-memory.dmp

Filesize
472KB

Download
memory/376-80-0x0000000007A90000-0x0000000007AD4000-memory.dmp

Filesize
272KB

Download
memory/376-79-0x0000000006930000-0x000000000697C000-memory.dmp

Filesize
304KB

Download
memory/376-78-0x00000000068E0000-0x00000000068FE000-memory.dmp

Filesize
120KB

Download
memory/376-99-0x0000000007EC0000-0x0000000007F63000-memory.dmp

Filesize
652KB

Download
memory/376-61-0x0000000001800000-0x0000000001836000-memory.dmp

Filesize
216KB

Download
memory/376-77-0x0000000006410000-0x0000000006764000-memory.dmp

Filesize
3.3MB

Download
memory/376-98-0x0000000001860000-0x0000000001870000-memory.dmp

Filesize
64KB

Download
memory/376-72-0x0000000006270000-0x00000000062D6000-memory.dmp

Filesize
408KB

Download
memory/376-103-0x0000000008010000-0x000000000801E000-memory.dmp

Filesize
56KB

Download
memory/376-97-0x0000000007EA0000-0x0000000007EBE000-memory.dmp

Filesize
120KB

Download
memory/376-109-0x0000000072D40000-0x00000000734F0000-memory.dmp

Filesize
7.7MB

Download
memory/376-101-0x0000000008070000-0x0000000008106000-memory.dmp

Filesize
600KB

Download
memory/376-102-0x0000000007FD0000-0x0000000007FE1000-memory.dmp

Filesize
68KB

Download
memory/376-62-0x0000000001860000-0x0000000001870000-memory.dmp

Filesize
64KB

Download
memory/376-65-0x0000000005A30000-0x0000000005A52000-memory.dmp

Filesize
136KB

Download
memory/376-64-0x0000000005B60000-0x0000000006188000-memory.dmp

Filesize
6.2MB

Download
memory/376-63-0x0000000001860000-0x0000000001870000-memory.dmp

Filesize
64KB

Download
memory/376-87-0x0000000071410000-0x0000000071764000-memory.dmp

Filesize
3.3MB

Download
memory/376-85-0x0000000007E60000-0x0000000007E92000-memory.dmp

Filesize
200KB

Download
memory/376-60-0x0000000072D40000-0x00000000734F0000-memory.dmp

Filesize
7.7MB

Download
memory/376-84-0x000000007F940000-0x000000007F950000-memory.dmp

Filesize
64KB

Download
memory/376-104-0x0000000008020000-0x0000000008034000-memory.dmp

Filesize
80KB

Download
memory/376-105-0x0000000008110000-0x000000000812A000-memory.dmp

Filesize
104KB

Download
memory/376-106-0x0000000008060000-0x0000000008068000-memory.dmp

Filesize
32KB

Download
memory/556-440-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1392-171-0x0000000007890000-0x00000000078A4000-memory.dmp

Filesize
80KB

Download
memory/1392-116-0x0000000072D40000-0x00000000734F0000-memory.dmp

Filesize
7.7MB

Download
memory/1392-134-0x0000000071F30000-0x0000000071F7C000-memory.dmp

Filesize
304KB

Download
memory/1392-136-0x000000007F4E0000-0x000000007F4F0000-memory.dmp

Filesize
64KB

Download
memory/1392-137-0x0000000071410000-0x0000000071764000-memory.dmp

Filesize
3.3MB

Download
memory/1392-181-0x0000000072D40000-0x00000000734F0000-memory.dmp

Filesize
7.7MB

Download
memory/1392-147-0x0000000007500000-0x00000000075A3000-memory.dmp

Filesize
652KB

Download
memory/1392-165-0x0000000007840000-0x0000000007851000-memory.dmp

Filesize
68KB

Download
memory/1392-123-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/1392-117-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/1416-112-0x0000000002AA0000-0x0000000002E99000-memory.dmp

Filesize
4.0MB

Download
memory/1416-113-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1416-336-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2140-210-0x000000007F430000-0x000000007F440000-memory.dmp

Filesize
64KB

Download
memory/2140-187-0x0000000072D40000-0x00000000734F0000-memory.dmp

Filesize
7.7MB

Download
memory/2140-209-0x0000000071F30000-0x0000000071F7C000-memory.dmp

Filesize
304KB

Download
memory/2140-188-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/2428-408-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2524-474-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2524-471-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2524-472-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2596-132-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2596-51-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2596-58-0x00000000004E0000-0x00000000005E0000-memory.dmp

Filesize
1024KB

Download
memory/2596-50-0x0000000000480000-0x000000000048B000-memory.dmp

Filesize
44KB

Download
memory/2680-148-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2680-128-0x0000000000980000-0x0000000000A80000-memory.dmp

Filesize
1024KB

Download
memory/2680-396-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2680-55-0x0000000000740000-0x000000000075C000-memory.dmp

Filesize
112KB

Download
memory/2680-129-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2680-426-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2680-285-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2680-56-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2680-54-0x0000000000980000-0x0000000000A80000-memory.dmp

Filesize
1024KB

Download
memory/2836-26-0x0000000074710000-0x0000000074EC0000-memory.dmp

Filesize
7.7MB

Download
memory/2836-1-0x0000000000390000-0x00000000009DA000-memory.dmp

Filesize
6.3MB

Download
memory/2836-0-0x0000000074710000-0x0000000074EC0000-memory.dmp

Filesize
7.7MB

Download
memory/3068-436-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3076-45-0x00000000029D0000-0x0000000002DD2000-memory.dmp

Filesize
4.0MB

Download
memory/3076-135-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3076-57-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/3076-115-0x00000000029D0000-0x0000000002DD2000-memory.dmp

Filesize
4.0MB

Download
memory/3076-49-0x0000000002DE0000-0x00000000036CB000-memory.dmp

Filesize
8.9MB

Download
memory/3112-37-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/3112-114-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/3112-227-0x0000000000400000-0x00000000008E2000-memory.dmp

Filesize
4.9MB

Download
memory/3456-435-0x0000000002560000-0x0000000002576000-memory.dmp

Filesize
88KB

Download
memory/3456-130-0x0000000000410000-0x0000000000426000-memory.dmp

Filesize
88KB

Download
memory/4088-450-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4088-449-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4088-446-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4088-464-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5104-434-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5104-397-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5104-482-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5104-467-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download