7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/02/2024, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe
Size 1.2MB
Sample240208-p8nb5afc23
SHA256 7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e
MD5 5461f51412ba389355735f619f5fc0d5
SHA1 ad547430fc35d31a3e1878a3fb6618fe9aa8b115
SHA512 e051d5d14db9118119a475f69100504430d6d6374b0f01dcf8d1bac8743c6c823fedf4d875e5f90810ba28a27b150b669294de6d1f102b737780627037083e6e
SSDEEP 24576:mTbBv5rUSvFMOCiRNouSY4GVTePBGa6mXcqIAXiAZfzI6i:YBVNMO155RLAXiAZ0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 37 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	bnsllwmu.icm
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	BNSLLW~1.EXE

Executes dropped EXE 18 IoCs

pid	Process
4388	bnsllwmu.icm
808	BNSLLW~1.EXE
1988	BNSLLW~1.EXE
1604	BNSLLW~1.EXE
1072	BNSLLW~1.EXE
936	BNSLLW~1.EXE
3320	BNSLLW~1.EXE
1592	BNSLLW~1.EXE
436	BNSLLW~1.EXE
4240	BNSLLW~1.EXE
3300	BNSLLW~1.EXE
1464	BNSLLW~1.EXE
4404	BNSLLW~1.EXE
764	BNSLLW~1.EXE
3320	BNSLLW~1.EXE
5072	BNSLLW~1.EXE
212	BNSLLW~1.EXE
3480	BNSLLW~1.EXE

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	bnsllwmu.icm
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\logs = "C:\\Users\\Admin\\qclr\\BNSLLW~1.EXE C:\\Users\\Admin\\qclr\\ahikbr.dat"	BNSLLW~1.EXE

Suspicious use of SetThreadContext 21 IoCs

description	pid	Process	procid_target
PID 4388 set thread context of 384	4388	bnsllwmu.icm	102
PID 384 set thread context of 1164	384	RegSvcs.exe	79
PID 384 set thread context of 4500	384	RegSvcs.exe	104
PID 808 set thread context of 1664	808	BNSLLW~1.EXE	109
PID 4500 set thread context of 3548	4500	verifiergui.exe	15
PID 1988 set thread context of 3964	1988	BNSLLW~1.EXE	116
PID 1604 set thread context of 4592	1604	BNSLLW~1.EXE	123
PID 1072 set thread context of 1576	1072	BNSLLW~1.EXE	127
PID 936 set thread context of 1628	936	BNSLLW~1.EXE	131
PID 3320 set thread context of 3164	3320	BNSLLW~1.EXE	135
PID 1592 set thread context of 2372	1592	BNSLLW~1.EXE	139
PID 436 set thread context of 4436	436	BNSLLW~1.EXE	143
PID 4240 set thread context of 4072	4240	BNSLLW~1.EXE	147
PID 3300 set thread context of 4056	3300	BNSLLW~1.EXE	153
PID 1464 set thread context of 2580	1464	BNSLLW~1.EXE	157
PID 4404 set thread context of 2064	4404	BNSLLW~1.EXE	163
PID 764 set thread context of 3784	764	BNSLLW~1.EXE	167
PID 3320 set thread context of 2508	3320	BNSLLW~1.EXE	171
PID 5072 set thread context of 4512	5072	BNSLLW~1.EXE	175
PID 212 set thread context of 4852	212	BNSLLW~1.EXE	181
PID 3480 set thread context of 4616	3480	BNSLLW~1.EXE	185

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4516	1664	WerFault.exe	109
1628	3964	WerFault.exe	116
556	4072	WerFault.exe	147
2208	2580	WerFault.exe	157
220	4512	WerFault.exe	175
2552	4616	WerFault.exe	185

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4496	ipconfig.exe
4296	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	verifiergui.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	bnsllwmu.icm
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings	BNSLLW~1.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
384	RegSvcs.exe
384	RegSvcs.exe
384	RegSvcs.exe
384	RegSvcs.exe
384	RegSvcs.exe
384	RegSvcs.exe
384	RegSvcs.exe
384	RegSvcs.exe
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4500	verifiergui.exe
4500	verifiergui.exe
4500	verifiergui.exe
4500	verifiergui.exe
4500	verifiergui.exe
4500	verifiergui.exe
4500	verifiergui.exe
4500	verifiergui.exe
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm
4388	bnsllwmu.icm

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
384	RegSvcs.exe
1164	7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe
1164	7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe
4500	verifiergui.exe
4500	verifiergui.exe
4500	verifiergui.exe
4500	verifiergui.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE
Token: SeShutdownPrivilege	3548	Explorer.EXE
Token: SeCreatePagefilePrivilege	3548	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3964	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1720	1164	7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe	85
PID 1164 wrote to memory of 1720	1164	7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe	85
PID 1164 wrote to memory of 1720	1164	7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe	85
PID 1720 wrote to memory of 1200	1720	WScript.exe	91
PID 1720 wrote to memory of 1200	1720	WScript.exe	91
PID 1720 wrote to memory of 1200	1720	WScript.exe	91
PID 1720 wrote to memory of 1824	1720	WScript.exe	93
PID 1720 wrote to memory of 1824	1720	WScript.exe	93
PID 1720 wrote to memory of 1824	1720	WScript.exe	93
PID 1200 wrote to memory of 4496	1200	cmd.exe	95
PID 1200 wrote to memory of 4496	1200	cmd.exe	95
PID 1200 wrote to memory of 4496	1200	cmd.exe	95
PID 1824 wrote to memory of 4388	1824	cmd.exe	96
PID 1824 wrote to memory of 4388	1824	cmd.exe	96
PID 1824 wrote to memory of 4388	1824	cmd.exe	96
PID 1720 wrote to memory of 2208	1720	WScript.exe	99
PID 1720 wrote to memory of 2208	1720	WScript.exe	99
PID 1720 wrote to memory of 2208	1720	WScript.exe	99
PID 4388 wrote to memory of 2136	4388	bnsllwmu.icm	101
PID 4388 wrote to memory of 2136	4388	bnsllwmu.icm	101
PID 4388 wrote to memory of 2136	4388	bnsllwmu.icm	101
PID 4388 wrote to memory of 384	4388	bnsllwmu.icm	102
PID 4388 wrote to memory of 384	4388	bnsllwmu.icm	102
PID 4388 wrote to memory of 384	4388	bnsllwmu.icm	102
PID 4388 wrote to memory of 384	4388	bnsllwmu.icm	102
PID 4388 wrote to memory of 384	4388	bnsllwmu.icm	102
PID 4388 wrote to memory of 384	4388	bnsllwmu.icm	102
PID 2208 wrote to memory of 4296	2208	cmd.exe	103
PID 2208 wrote to memory of 4296	2208	cmd.exe	103
PID 2208 wrote to memory of 4296	2208	cmd.exe	103
PID 1164 wrote to memory of 4500	1164	7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe	104
PID 1164 wrote to memory of 4500	1164	7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe	104
PID 1164 wrote to memory of 4500	1164	7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe	104
PID 4388 wrote to memory of 1128	4388	bnsllwmu.icm	105
PID 4388 wrote to memory of 1128	4388	bnsllwmu.icm	105
PID 4388 wrote to memory of 1128	4388	bnsllwmu.icm	105
PID 1128 wrote to memory of 808	1128	WScript.exe	106
PID 1128 wrote to memory of 808	1128	WScript.exe	106
PID 1128 wrote to memory of 808	1128	WScript.exe	106
PID 808 wrote to memory of 1576	808	BNSLLW~1.EXE	108
PID 808 wrote to memory of 1576	808	BNSLLW~1.EXE	108
PID 808 wrote to memory of 1576	808	BNSLLW~1.EXE	108
PID 808 wrote to memory of 1664	808	BNSLLW~1.EXE	109
PID 808 wrote to memory of 1664	808	BNSLLW~1.EXE	109
PID 808 wrote to memory of 1664	808	BNSLLW~1.EXE	109
PID 808 wrote to memory of 1664	808	BNSLLW~1.EXE	109
PID 808 wrote to memory of 2620	808	BNSLLW~1.EXE	113
PID 808 wrote to memory of 2620	808	BNSLLW~1.EXE	113
PID 808 wrote to memory of 2620	808	BNSLLW~1.EXE	113
PID 2620 wrote to memory of 1988	2620	WScript.exe	114
PID 2620 wrote to memory of 1988	2620	WScript.exe	114
PID 2620 wrote to memory of 1988	2620	WScript.exe	114
PID 1988 wrote to memory of 4212	1988	BNSLLW~1.EXE	115
PID 1988 wrote to memory of 4212	1988	BNSLLW~1.EXE	115
PID 1988 wrote to memory of 4212	1988	BNSLLW~1.EXE	115
PID 1988 wrote to memory of 3964	1988	BNSLLW~1.EXE	116
PID 1988 wrote to memory of 3964	1988	BNSLLW~1.EXE	116
PID 1988 wrote to memory of 3964	1988	BNSLLW~1.EXE	116
PID 1988 wrote to memory of 3964	1988	BNSLLW~1.EXE	116
PID 4500 wrote to memory of 3884	4500	verifiergui.exe	119
PID 4500 wrote to memory of 3884	4500	verifiergui.exe	119
PID 4500 wrote to memory of 3884	4500	verifiergui.exe	119
PID 1988 wrote to memory of 3320	1988	BNSLLW~1.EXE	120
PID 1988 wrote to memory of 3320	1988	BNSLLW~1.EXE	120

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3548
- C:\Users\Admin\AppData\Local\Temp\7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe
  "C:\Users\Admin\AppData\Local\Temp\7f5afd30f7eb7858f4d31dc758fdf58927e9547446a50125216b0486f2295e2e.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\qecw.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig /release
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1200
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:4496
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bnsllwmu.icm ahikbr.dat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\bnsllwmu.icm
        
        bnsllwmu.icm ahikbr.dat
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4388
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        6⤵
        
        PID:2136
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        6⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:384
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        6⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        8⤵
        
        PID:1576
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        8⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 72
        9⤵
        Program crash
        
        PID:4516
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        8⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        10⤵
        
        PID:4212
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        10⤵
        Suspicious use of UnmapMainImage
        
        PID:3964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 12
        11⤵
        Program crash
        
        PID:1628
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        10⤵
        Checks computer location settings
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:1604
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        12⤵
        
        PID:728
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        12⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        12⤵
        Checks computer location settings
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:1072
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        14⤵
        
        PID:1196
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        14⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        14⤵
        Checks computer location settings
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:936
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        16⤵
        
        PID:400
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        16⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        16⤵
        Checks computer location settings
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:3320
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        18⤵
        
        PID:4812
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        18⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        18⤵
        Checks computer location settings
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:1592
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        20⤵
        
        PID:2960
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        20⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        20⤵
        Checks computer location settings
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:436
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        22⤵
        
        PID:4328
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        22⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        22⤵
        Checks computer location settings
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:4240
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        24⤵
        
        PID:4844
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        24⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 80
        25⤵
        Program crash
        
        PID:556
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        24⤵
        Checks computer location settings
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:3300
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        26⤵
        
        PID:2536
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        26⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        26⤵
        Checks computer location settings
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:1464
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        28⤵
        
        PID:2308
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        28⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 80
        29⤵
        Program crash
        
        PID:2208
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        28⤵
        Checks computer location settings
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:4404
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        30⤵
        
        PID:936
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        30⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        30⤵
        Checks computer location settings
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:764
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        32⤵
        
        PID:1428
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        32⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        32⤵
        Checks computer location settings
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        33⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:3320
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        34⤵
        
        PID:1564
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        34⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        34⤵
        Checks computer location settings
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        35⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:5072
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        36⤵
        
        PID:1156
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        36⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 80
        37⤵
        Program crash
        
        PID:220
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        36⤵
        Checks computer location settings
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        37⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:212
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        38⤵
        
        PID:3796
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        38⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        38⤵
        Checks computer location settings
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        39⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Modifies registry class
        
        PID:3480
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        40⤵
        
        PID:3784
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        40⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 80
        41⤵
        Program crash
        
        PID:2552
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
        40⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\BNSLLW~1.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
        41⤵
        
        PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig /renew
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /renew
        5⤵
        Gathers network information
        
        PID:4296
- - C:\Windows\SysWOW64\verifiergui.exe
    "C:\Windows\SysWOW64\verifiergui.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Program Files\Mozilla Firefox\Firefox.exe
      "C:\Program Files\Mozilla Firefox\Firefox.exe"
      4⤵
      PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1664 -ip 1664
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3964 -ip 3964
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4072 -ip 4072
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2580 -ip 2580
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4512 -ip 4512
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4616 -ip 4616
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ahikbr.dat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ahikbr.dat
Size 24.3MB
SHA256 8af68c683611de6c72617abfb0072d62fb38aa1928cb4e144946f129c138c972
MD5 238bbf48b65fee6d5a5b0aff8e161376
SHA1 f4c84e345b15e0b21723216ed64054805b778f3b
SHA512 682e3bf41e126b63bb66ff0d99e4843d6476a3ee72ab3590363bbcf8720e4b1347e6bc65441a6ed345dd7599fe57dd9f5ebcc755ef01fa7511f4f507b218adac
SSDEEP 98304:NlPl8lQlKlWlQlvl4lllHl0l3ljlslQl3l/lWl2lWl+lWl0lJl6l7lKl3lzl3lAC:Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

axvds.docx

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\axvds.docx
Size 502B
SHA256 fb1e0ba8bd7d2448023076abe74ddc8f8b936904020f5ea5d0a528e99d769916
MD5 09e800efa32af4962a33fed5f15e1064
SHA1 44ea70b75c67f3fa7a4cb8fb4a240b364eea43db
SHA512 07a939550310f8d516c47caf2532ab08cb1a1722969339d5199cd0966a315d211ce896363157bb5cf38b6cf86bb30ac99b64af94892d4eeb7e2b8f2b715619f2
MD5 SHA1 SHA512

Submit Download

bnsllwmu.icm

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bnsllwmu.icm
Size 925KB
SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
MD5 0adb9b817f1df7807576c2d7068dd931
SHA1 4a1b94a9a5113106f40cd8ea724703734d15f118
SHA512 883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
SSDEEP 24576:fYgAon+KfqNbXD2XJ2PH1ddATgs/u2kaCB+l:f37+KSbq5e1diEnHaCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

cekpx.mp3

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\cekpx.mp3
Size 629B
SHA256 f06cd4198cade50806d6edf088f676bda23d7f94b4bc5e6c4c4babd854811939
MD5 2a2cf7c4f04ffc06f03112e7c6458c7c
SHA1 cbe6d0898247060e3bb27e3eb4bcf5abeba23c8c
SHA512 443b906bf155ee9f2d1734aadc1d8caaf79e903045f03876fbb87fd346eb174ad2fdc907cc14316289aa3d0fede8aaf511ab368b56a6564ae3c60882b8d2b453
MD5 SHA1 SHA512

Submit Download

ctspjfu.mp3

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ctspjfu.mp3
Size 531B
SHA256 d3853d4b74666c1780f2dc0b61e97f8a4c05bc35e7b61e0c8e1fd7454a4c8a37
MD5 2290de2f56760a0e0a0854b0e506d6ad
SHA1 eb3489bb43bb9c8557eae78ae0ecb1925fdcfa74
SHA512 4571c5c16119b62ab7f3b916344e61ad06cf207de00f6a52020a3a4c931736a7c70bc58ec28a7b939990819b4c4110410ad1f2fb8fbc4a3985d497dfb7c2597b
MD5 SHA1 SHA512

Submit Download

epmt.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\epmt.jpg
Size 542B
SHA256 efeb75aed11438d4af8fda5d11f95507d19d327b627169a32f76ba7733f2d0e1
MD5 2c987d1cfe1b0fa28b5aa33a36d45e55
SHA1 99d129af4ecfed9b17162b595fa0f89beb4aeb15
SHA512 76c794a795bd3234c257e4dad9f99cc702da25578c1b923e24038ba2fdcb14bd72e1b108238ef2fad260721591fb916b36c645178ce192c54b4d108750b39a69
MD5 SHA1 SHA512

Submit Download

fsdlvccgmw.pdf

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\fsdlvccgmw.pdf
Size 619B
SHA256 7f89322435eabea77da130f514935a64e22fe2faf171dfac2062b0780508a617
MD5 a24dbc88ad0980e03c2d8b39c6d1b90f
SHA1 0877566c23bb5f4d4b980b0a88ed0a4bb58aa800
SHA512 d3eae886f853ef1e95da13a7d5aa0e336e13de0cb6e2d14d464c9417c73d9c779555e05d132cbb991130881daf99930ea1e1a97f69c3928b6281c10fa71e88ab
MD5 SHA1 SHA512

Submit Download

gvinrp.pdf

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\gvinrp.pdf
Size 585B
SHA256 61f356b27484984002684413b1294c210d33354ecc3ccd60e17f5b87364a84a6
MD5 675c7482a54514a1c65c4f850f07d3be
SHA1 b5f97c9040cfb2869d828f75e7dc1aaf5ba3d9d3
SHA512 88adac489c5108f27825b084d16f8a42154c63b89bf6ba9dee74fef9d3ae74f646bd720311265237bc27c1c16056d481b94a223e676b91ff16bbeb5ff1f2c18e
MD5 SHA1 SHA512

Submit Download

hsxb.pdf

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\hsxb.pdf
Size 538B
SHA256 f2de2d1f9a663c511fd92ddf3c36269bddfdd73d2d28be5398a7ce2f53568856
MD5 e93fa5acc1e099eb88ae57cb6fdd5e11
SHA1 57f6b17f8a41720683024b5795983ed9ce479aad
SHA512 e5e31150dce68dbf9b3d995d4dc8761587a92749986450abfa948fac41687ec8305ad82c612ab5dbb7bddd298fed30fed75b58b3c91aeffb99a67d8230fb7d40
MD5 SHA1 SHA512

Submit Download

japtwdxe.mp2

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\japtwdxe.mp2
Size 538B
SHA256 978650a1dc07e9e93f6f1e8f20ed6982980d93dedfb2667d9aa12291e448eca4
MD5 ee6d134b18eed989e90fa1ee58f9a69e
SHA1 443b36e06aa07b9841b3f8a479429663880b481f
SHA512 3702ca3209114451f79cb14e451087912a8cdfcd936e4fad2bc4784eb965bdd7fba01463798889698559c54ed35998b485890500f0ef52b1ddd0e3b8c7b4afe4
MD5 SHA1 SHA512

Submit Download

jkikpuqwnn.bin

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\jkikpuqwnn.bin
Size 636B
SHA256 dd2ed2389cbd7d5fec65748e42531a854c3a79f13f8cbd95e260ad905acaf9ed
MD5 aa11cdb0e02746c0f68642d69bc26244
SHA1 9b5b127a22da7dba0797b70f1b4e1b5f2bfed891
SHA512 afbf56cc5232c81446cc9d7972ed6eacf4ee6df1ae2519702192299ba3ca0f0ac2a5cb9cd953a3a015d8574601e2acbfedc263851ed02d3b23ac847ded3e8c63
MD5 SHA1 SHA512

Submit Download

jqdkj.wpp

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\jqdkj.wpp
Size 493KB
SHA256 e6b60ebc124275173583ee66c41328098cba758e1a4b463befc85d0cbad426c8
MD5 cf31eee135d3b6a986b6deb8de5e4b09
SHA1 d465fe130e67883c5e0b4cb6d1d5c1450f950059
SHA512 4d793b368925b62da61ff3a23a63a7cfb614918259bdea650e18ecef693e90fc365bc1c1c8c2cc8bd5cd2b765cc6a66d490a31d145842de918842ea218870509
SSDEEP 6144:RspK9ZZhMW487o+d252yudrlDJx7MomrVWAUhxoRVCIgHGjrQnrH3:RNBF/7fNyu5lFxRsWA3TCnmPQnT3
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsjtcabpk.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\jsjtcabpk.exe
Size 590B
SHA256 56072fe0d3437e106347916f97738f47f52bc92d1202b96b2f51e6a49bc8e1f9
MD5 38dcbb2dd02d50ab66b97148500dfb5a
SHA1 65a60ad141d6e8257a16c48a8112dc98613c75b1
SHA512 7de74365887856b0288ae7084be8ec4e8a87c9009af8a13254cfbf52c594545fc0149341ca871991152e11d1056a59f3a7893a163bf98e0a0c3180ee4705ad0b
MD5 SHA1 SHA512

Submit Download

kqulin.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kqulin.dll
Size 549B
SHA256 2d49e92cef939f08f0560710c2c7b784055ea52bd8a4d8d59d071780e8f334ae
MD5 c555202a3f312ac27abbd0bc9b976096
SHA1 fb51b04fe64c47a6d2ecc7be4f8d69973770109a
SHA512 4892e2d22a3e67b734b95b44f5a6143c23dfba751a821a824a713c093f0e321c9b32d863ebf86985fa59837ff79435720f0fd75078c5661c651eb4fb94fcaaa4
MD5 SHA1 SHA512

Submit Download

kshtn.msc

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kshtn.msc
Size 542B
SHA256 fb517237050f420a28dfbd6971b9fcb711e82655425c9b2cfec21c03dbf54b28
MD5 8790493f0f716de407d73597f9433599
SHA1 f51c9db88d20ce4e849f3b716e4fa296104148a9
SHA512 1f5f57e6a0cbdbb09386eefffc4d4aff7f4bedb12b5d0e00cc39877ba6394095d6ddf578a6893e97b622a48f526a958c2c5f3b3af4e561c1f2fae497b72add36
MD5 SHA1 SHA512

Submit Download

lmjtb.msc

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\lmjtb.msc
Size 508B
SHA256 4104cc8abf027dc66dbad831e5444925adb96d79eba9d1b926a2f942f57f1225
MD5 6419bac9f78ce89a565a1f44182b2fce
SHA1 12fa82d340c0c73594a6bbb6cd9b835a7ad899e4
SHA512 56ec4da3a45f5d3d0b0c1102d84d7d9183e207692290be073b43a38cd40ecb48e1126913228f51bb300cda04f7a4dba2a563b2c539ebeed9749695682515a145
MD5 SHA1 SHA512

Submit Download

mcnwhfvv.ppt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcnwhfvv.ppt
Size 502B
SHA256 2c151f51690d6c7436053cfbe7a9d44bb9be7059efcb7f7ec2b969693308d8cf
MD5 bde20faba42aef1b89f9474ff65e88c2
SHA1 d5d40e9881c4e60e0ab26e5bfc95877f4efacfc2
SHA512 83b5315e3bdf3c1d81aec3b25fabdd34f668916033cf150e3ceae17a34fc77474386bb250fbbba321a52a4bd79c2b0f0bc0c80b4a786e7a7defa019803890f98
MD5 SHA1 SHA512

Submit Download

mveblbamd.docx

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\mveblbamd.docx
Size 583B
SHA256 a012d328a6f88f36e35250a6e8ddff4a2a0f85e13dbcb92d49db843c98058508
MD5 de9b2ec9607d658e2767199f3193341b
SHA1 53255fcb3cb51597d42238b0b238902d618c349d
SHA512 bd59cdb8c1f03cdd5d691f0d4992b2e98b445656bebb9ac04e24463ff2358bdfa18c066f0a9a8b8450142002a62d1e39b7fd11ad949e1711b6f30a793b5ab093
MD5 SHA1 SHA512

Submit Download

nkdrin.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nkdrin.dll
Size 582B
SHA256 5ab19cc184c001dbb155f02d7c55c3b0819472532272d68408eb11a0580e2c53
MD5 88d984a1082d180b31acb23095329cb4
SHA1 355ee5fd3d0f24de3c75087931f6ba2a54053278
SHA512 0d32e5dacf37dc6c7329f6fc6766df956b79a9f113984a95cbe8d9e8dcf81bb9d3de1addceb466c685f73fb09a3a93cbd7cde725815b7ad8a844f7df5c5c1f4d
MD5 SHA1 SHA512

Submit Download

palwd.docx

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\palwd.docx
Size 525B
SHA256 fcd7c038cc69726c21d34ed215e53ac93a63c8bb8ae7c1f29d4ac965d0205e8f
MD5 294b9eca94edb136f3858934e7d33ec3
SHA1 790d0e81621a9996cfaf9c4029207edd775fc76f
SHA512 741c98bead48ce7d3fd31c3d2d4c7a2e387072b9e5101d25190baf3d329da194fef203f124cfa61837086d31c4ca268632ce9c9f01c7a2ca1814e62a18b12057
MD5 SHA1 SHA512

Submit Download

phslbdf.ppt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\phslbdf.ppt
Size 533B
SHA256 f8e9509351d65dd38608bbe1c4775d6512afa6ab31ef4d9fc8d56a6026c27610
MD5 91bde4811a88bf46b9bae24263e1ae09
SHA1 705af5f9266755e79c767432b1be7820322c97ab
SHA512 9b5a854873bf7f4e95fdf76eea8d3010c51d09889a6f431ea62b04512683c93c115cfaace07b1e5a87a34bb96b14e1536b6130a87795e57a974afec5f5d88303
MD5 SHA1 SHA512

Submit Download

ppco.3gp

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ppco.3gp
Size 600B
SHA256 8ad7d51f9c182623bdb6d9ca7ea3b565e5d14e52874efbde9f4aca0e1cb519f0
MD5 5800e32dc958644fbe36aca80d095dc4
SHA1 b9647a8dba96b8c61190fc6fd2fbb304fb0c51f0
SHA512 b1d2be1fd25205d9e00dd77292a90bee07cc8164eeb408e3cc7f75e44f56891d3129bebd095b71e9f777cb60a59d5b50532dc91b4bb09293c7654ad1dc3e3239
MD5 SHA1 SHA512

Submit Download

qbqbpsbrbg.mp3

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\qbqbpsbrbg.mp3
Size 632B
SHA256 4e167d5983f33fe0ca13260d2cb24987c5583ee07bebaf9fb29f1de717bd3cad
MD5 f27ed7634a772dec73495873e1ce34e8
SHA1 b6f74d95da531635f97c0251079e07a2d0381f26
SHA512 6ac1990d3249eb07bae349ac32aeb69b041b0a49ee90fa022f5fa86005ea2c73ee0013d73ba4dcb62d75e74da85f0cfe4813f9acf7eb18ec6b02773b52ba2cb1
MD5 SHA1 SHA512

Submit Download

qecw.vbe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\qecw.vbe
Size 62KB
SHA256 2dd84247cb3704bbb4cda658d295821c030cbaa899d23e2217976008fd60dfbe
MD5 1e16b0b77a25387cd2a9a3ade8feb063
SHA1 09753d427128027aaeeb6da28725baafeeb52c2b
SHA512 719a28d9e6a3043b82a4445ef82ba38de72f9e7425dda15f37837ca31e451f58739fe137d1c11db3c66cbd75215b7462cc1e2a03c14586241704ff6d24209a6b
SSDEEP 48:266666666666666666666z55555555555555555559d0d0d0d0d0d0d0d0d0d0dq:KHHFItr/3dd
MD5 SHA1 SHA512 SSDEEP

Submit Download

rajpuaaehe.jpg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rajpuaaehe.jpg
Size 508B
SHA256 53caa6b12e9aca684662ce833b1807fe9c1c140804aa291d8c7b7102af3fe7d9
MD5 84281dd9adb8e92270a051ac97a9bbd7
SHA1 3764f82ead6a088eeea83621fd7dc9338852992f
SHA512 f967ad21988d5a4affa35f9b94a042f065049f9de70fe02ab7e32adcc76012fb8e9cc9adb130cafa4748d09b35a8aed305e8d7af49fc9779cfc5b7af9fe3c25c
MD5 SHA1 SHA512

Submit Download

rjqfbnjd.mp2

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rjqfbnjd.mp2
Size 626B
SHA256 e193e8e48d9d8ff48a64a9a20f3e9b7d67d2fd2673d53b67781438c6d62cdf16
MD5 0a01f6b4dd2a556eaafc52078196a0e7
SHA1 a5f5a789765594d75534e5a1b028c910496fc329
SHA512 d6de2b913c2a0f22815b6fac1ed3aa71c55616f85d28720000b91dc16cb515747dd2a036531005dcd20f4b71ae2612a7becc897ce4589bb36ad8e308b1484364
MD5 SHA1 SHA512

Submit Download

rrlspuatnl.mp2

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rrlspuatnl.mp2
Size 35KB
SHA256 efe4b5587a466bd1dfe53a717557a70e0b89aad9d1d8567b21e7315a576c122b
MD5 4c3299eb5799a811d8c903a6f6575aef
SHA1 6ab11611f4032abae8644a539b18851dfb03beeb
SHA512 d77cc16fdd2524b6bc99e76637cdd720cbbf63f73b0bacbf32d1f1c2a79021397a624dc4e85bec28b2c91ea46465a7450f9c3b07d2d419f99732cf7f4d9269e2
SSDEEP 768:sQqK+BZfvG5gUq8yYqxpw7tDHREGCIt9dRpIBLup94shu:sQWZfSxqHuhzpAup94shu
MD5 SHA1 SHA512 SSDEEP

Submit Download

rrlspuatnl.mp2

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rrlspuatnl.mp2
Size 35KB
SHA256 67bcaaf49e8a38a1d403ba038553fc08f7ac144283a320654f2264f3350519b9
MD5 9e5bbcf62171bfd206d69c5f38359892
SHA1 bf5230c42045ab25f30ff57f39f0c534c1c4f9db
SHA512 913510d4d29f3a71e4f667c9ee987e029e5cb0783f4300e60bbce375c65b30ceb47e8e668e3012b22f17822ca161aeed209d698a09d7c01827ac899cfcd6caf4
SSDEEP 768:sQqK+BZfvG5gUq8yYqxpw7tDHREGCIt9dRpIBLup94uhb:sQWZfSxqHuhzpAup94uhb
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs
Size 197B
SHA256 1c01c926e7f73063168df5567bd0576001b56a0a7f56493e8dde424edd8d944e
MD5 c408780e0cdb52a95fb5c69e02b9b692
SHA1 894ab790c78cac9fc25441d9faa6c07fcbb47a3c
SHA512 6b64d3b16942b2a1fb5a3df168fd654b7522b1a055505b75f4f72e4fdfa7d5e698da17cd22b1bd732d03883e8c48eb4f64210276e7494c0186aabfb98e71a02d
MD5 SHA1 SHA512

Submit Download

sncgmlce.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\sncgmlce.dll
Size 566B
SHA256 0dd2c151459695a4cc03364334d57c32c2e21ee0f029d83c77e4130e3df63c04
MD5 bfef3c2efd334f2a245d50ff595d425a
SHA1 b28c1380cd15582c18ae5a7a032068c7ccf58e58
SHA512 3031a086f2079ee5d42818f9a790d37b073380941fb8f19b36c1e57f88500c6312640f6911122c71c4854fa9135cf27d7351dc16dfc4308d2503dca79cb3515b
MD5 SHA1 SHA512

Submit Download

tinawksol.icm

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\tinawksol.icm
Size 650B
SHA256 95d8b0673a80e2b4c731ea126ab4684b54224bb2f4b9f98079293d680d5e5444
MD5 7b5198e97b6a11b01d788a4ec8db2112
SHA1 8c1a373a3bd97455e8a870e70e09dce381b3f6f4
SHA512 ff58f54c2efc9a3d19b6fbfa6af43a0132c0994fbebfcf4d49391f6581fae98ba8c4736031c779b2c6678f8e827b57d83438f43727e41888580d0c8aedd8c657
MD5 SHA1 SHA512

Submit Download

uhkpqm.icm

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\uhkpqm.icm
Size 507B
SHA256 cba3b0beda8f714209bf41f8638e5e223caff090e8265eb68d98685289a8e1a5
MD5 8dd48ba456a088544e95100a7cb3c316
SHA1 7099d6f26fe56b6c308e1ebabaaabfb97fa4c62a
SHA512 aea4f492f51d799df0e56a49598604d1deaaa11c13e366b2e46068c57101ab550e4b64bd0ec4b01a5fc3360fa16297987b28dab247e7bf9c99e1ba8437ba7e81
MD5 SHA1 SHA512

Submit Download

ujfl.msc

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ujfl.msc
Size 545B
SHA256 bf15dd2c4e0bdd1b9aad13d4abfa483dc16cdeed07324ec0f4348980074a0911
MD5 43455a0e051a2cf5eb28db5073c01123
SHA1 bfd093ceaa19b8dcb7b59853121541d56d474864
SHA512 0c80026f6f6603e4587bd23e2c3d3f82d6f210c5c46809851d55f308411a2b60b381749b2d6de67b8c0b382762232b0afd03ccad2522204900bda4bb285a8136
MD5 SHA1 SHA512

Submit Download

urrorojlra.icm

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\urrorojlra.icm
Size 509B
SHA256 fca7f1a7bdaca23d59471c836922b4e66a6631743f0a86bc6c6d4c73fbda7c78
MD5 8e49f15cf0550ac1e92ab55dd188ad06
SHA1 e5de8bc945a19a2b77565307509439f2661087cb
SHA512 d3a993ba28b335206b068953cd294dfadc3ff894ce48a9233beabfd1c9cdbe81dda56d42d4415ae9511ad9681c8bc02a19f575fb87780e77f7f7d05704a7d27c
MD5 SHA1 SHA512

Submit Download

utcdibjs.ppt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\utcdibjs.ppt
Size 643B
SHA256 45f89e14171f2189e0c137af71d385c9c7aeccf240363c081c2b585e3e0e8a3b
MD5 053e5a6e01b33a0b6cdb9267030e6a47
SHA1 c6f5bd25b362a785538a838290ecf7941b4b4a8d
SHA512 7070b8948fe7f3da4750592bae0a48c96e3c222a1b12d4ff50ee8abd6128e3d22980ef541c3718326ba3832bf0c68fcb99e8c8c6e412e1d15872da78a47bd154
MD5 SHA1 SHA512

Submit Download

viqugiusat.dat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\viqugiusat.dat
Size 545B
SHA256 8fbe57b8642f7473cba46b90f6060dbec5b8f7723f615dad4e71cbf7047e7262
MD5 227e83ed67136aa693578f5a0084495d
SHA1 1bd46cdf8f28909ac770af2eb5878523e2521b9a
SHA512 fc2dfade6b495946f4b78261e6ec6ebe0042938836ca3239a1049e6da4c7733a26cb4d9c89ab932994696c5055beb5234dca8eed9e7d98ac338f24e84f77e84e
MD5 SHA1 SHA512

Submit Download

wxsoeafc.icm

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\wxsoeafc.icm
Size 544B
SHA256 f2fdba8a91b3ad3de43163fedbbb2d2bd8ba2fe518153f6595d637c74fa7f55d
MD5 f8ac3dc5b72a946349b084205e6050d2
SHA1 c635bd0eff92f26ac68ee403e3a32049da6129b2
SHA512 0c3a2fcd93a7591f234dc313d486dcc811a5e9c18dbb7d43ba55120623b2d5c6fa311badb172281ee0a973a8a0a467f70ed0944b0de3a00f0f692936ba178643
MD5 SHA1 SHA512

Submit Download

ahikbr.dat

Path C:\Users\Admin\qclr\ahikbr.dat
Size 7.3MB
SHA256 76090cd894e7838e44ba110cb8892fd6ed47901ce056bf256e8725891c7d65a2
MD5 48c7e277d71ef4270955388eaee4e12f
SHA1 058c4420e109b459dc906d70a24e30053e254f8c
SHA512 bee1d7f3807769bb3122b3ab3fc60e6c671cb25b747a26642fd00cbb3d24a11c3f5c0c87dbad668732e5eaee6609a14c4662bb24130aa867c3f3b34872de5403
SSDEEP 98304:NlPl8lQlKlWlQlvl4lllHl0l3ljlslQl3l/lWl2lWl+lWl0lJl6l7lKl3lzl3lAB:H
MD5 SHA1 SHA512 SSDEEP

Submit Download

ahikbr.dat

Path C:\Users\Admin\qclr\ahikbr.dat
Size 7.8MB
SHA256 6f021ea427462b12e3d0f4223568c2539db2b0372ee24ec5603085da5cd57303
MD5 b0c6f17b111e0a7887e030d96838b5da
SHA1 0614d9beef752195b2f3194ea088aab4a19bc2fb
SHA512 214c62bdf5e18e0675b1b07e60ee82b7bd6e960e833703087c41c8f7572d1ae58020feffa8d25912d6187ad545413d3a3235e59239aa983c3243440a2ff684fc
SSDEEP 98304:NlPl8lQlKlWlQlvl4lllHl0l3ljlslQl3l/lWl2lWl+lWl0lJl6l7lKl3lzl3lAC:U
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-203-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/384-196-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/384-197-0x0000000001100000-0x000000000144A000-memory.dmp

Download

memory/1164-199-0x0000000006070000-0x00000000068F4000-memory.dmp

Download

memory/1164-202-0x0000000006070000-0x00000000068F4000-memory.dmp

Download

memory/1576-555-0x0000000001660000-0x00000000019AA000-memory.dmp

Download

memory/1628-631-0x00000000019E0000-0x0000000001D2A000-memory.dmp

Download

memory/1628-859-0x00000000019E0000-0x0000000001D2A000-memory.dmp

Download

memory/2064-1394-0x0000000000ED0000-0x000000000121A000-memory.dmp

Download

memory/2064-1166-0x0000000000ED0000-0x000000000121A000-memory.dmp

Download

memory/2372-784-0x00000000018F0000-0x0000000001C3A000-memory.dmp

Download

memory/2372-783-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2372-1012-0x00000000018F0000-0x0000000001C3A000-memory.dmp

Download

memory/2508-1549-0x0000000001880000-0x0000000001BCA000-memory.dmp

Download

memory/2508-1319-0x0000000001880000-0x0000000001BCA000-memory.dmp

Download

memory/3164-707-0x00000000012C0000-0x000000000160A000-memory.dmp

Download

memory/3548-477-0x0000000002590000-0x000000000263C000-memory.dmp

Download

memory/3548-315-0x0000000002590000-0x000000000263C000-memory.dmp

Download

memory/3548-316-0x0000000002590000-0x000000000263C000-memory.dmp

Download

memory/3784-1242-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3784-1243-0x0000000001140000-0x000000000148A000-memory.dmp

Download

memory/3784-1471-0x0000000001140000-0x000000000148A000-memory.dmp

Download

memory/4056-1014-0x0000000000F50000-0x000000000129A000-memory.dmp

Download

memory/4056-1013-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4436-861-0x0000000001610000-0x000000000195A000-memory.dmp

Download

memory/4436-1090-0x0000000001610000-0x000000000195A000-memory.dmp

Download

memory/4500-314-0x0000000002F90000-0x0000000003034000-memory.dmp

Download

memory/4500-205-0x0000000000F40000-0x0000000000F7B000-memory.dmp

Download

memory/4500-475-0x0000000002F90000-0x0000000003034000-memory.dmp

Download

memory/4500-398-0x0000000000F40000-0x0000000000F7B000-memory.dmp

Download

memory/4500-200-0x0000000000F40000-0x0000000000F7B000-memory.dmp

Download

memory/4500-201-0x0000000000F40000-0x0000000000F7B000-memory.dmp

Download

memory/4500-204-0x0000000003140000-0x000000000348A000-memory.dmp

Download

memory/4592-478-0x0000000001700000-0x0000000001A4A000-memory.dmp

Download

memory/4592-476-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4592-479-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4852-1472-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4852-1473-0x0000000000A80000-0x0000000000DCA000-memory.dmp

Download