b3c27c4c4db1ee499afb4de38367c45d4c1a00c3878fc3ba3061a44f5fbc27da

Resubmissions

21-07-2024 15:04

240721-sfz21atgld 8

17-06-2024 07:34

240617-jd8fxsvaqn 7

Analysis

max time kernel
1814s
max time network
1818s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RewAdIs Launcheri v0.5.7z
Size

1.9MB
MD5

c9075fe0bf2a613729809e0f709ac9d4
SHA1

02483c3b660090260640c544ed2e4e84c2bcbeba
SHA256

b3c27c4c4db1ee499afb4de38367c45d4c1a00c3878fc3ba3061a44f5fbc27da
SHA512

b34484a8c241c71ac24ec1e6d41cbf87448797a7b8d8ea73d9d87438f51cf0edc313c726ea13a90812322d95bb2a12c45c7e7baee8bf2019b1e145a5c3417dbd
SSDEEP

49152:RNggqbXi6oGltowwuc3aYmQImqkLnEqety14/1rozJm:RWFoGYTqIEqC710zJm

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2212	7z2401-x64.exe
1684	RewAdIs_Launcher_v05.exe
1916	7zG.exe

Loads dropped DLL 11 IoCs

pid	Process
1196	Process not Found
1196	Process not Found
1196	Process not Found
2212	7z2401-x64.exe
2212	7z2401-x64.exe
2212	7z2401-x64.exe
1196	Process not Found
1196	Process not Found
1916	7zG.exe
1328	chrome.exe
1328	chrome.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2401-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000016d4e-47.dat	autoit_exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2401-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2401-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2401-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2401-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2401-x64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1624	chrome.exe
1624	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1620	7zG.exe
Token: 35	1620	7zG.exe
Token: SeSecurityPrivilege	1620	7zG.exe
Token: SeSecurityPrivilege	1620	7zG.exe
Token: SeRestorePrivilege	1916	7zG.exe
Token: 35	1916	7zG.exe
Token: SeSecurityPrivilege	1916	7zG.exe
Token: SeSecurityPrivilege	1916	7zG.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe
Token: SeShutdownPrivilege	1624	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1620	7zG.exe
1684	RewAdIs_Launcher_v05.exe
1684	RewAdIs_Launcher_v05.exe
1684	RewAdIs_Launcher_v05.exe
1684	RewAdIs_Launcher_v05.exe
1684	RewAdIs_Launcher_v05.exe
1684	RewAdIs_Launcher_v05.exe
1916	7zG.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
284	msdt.exe
1624	chrome.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
1684	RewAdIs_Launcher_v05.exe
1684	RewAdIs_Launcher_v05.exe
1684	RewAdIs_Launcher_v05.exe
1684	RewAdIs_Launcher_v05.exe
1684	RewAdIs_Launcher_v05.exe
1684	RewAdIs_Launcher_v05.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe
1624	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2604	AcroRd32.exe
2604	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2332	3056	cmd.exe	29
PID 3056 wrote to memory of 2332	3056	cmd.exe	29
PID 3056 wrote to memory of 2332	3056	cmd.exe	29
PID 2332 wrote to memory of 2792	2332	rundll32.exe	30
PID 2332 wrote to memory of 2792	2332	rundll32.exe	30
PID 2332 wrote to memory of 2792	2332	rundll32.exe	30
PID 2792 wrote to memory of 2604	2792	rundll32.exe	32
PID 2792 wrote to memory of 2604	2792	rundll32.exe	32
PID 2792 wrote to memory of 2604	2792	rundll32.exe	32
PID 2792 wrote to memory of 2604	2792	rundll32.exe	32
PID 1684 wrote to memory of 352	1684	RewAdIs_Launcher_v05.exe	43
PID 1684 wrote to memory of 352	1684	RewAdIs_Launcher_v05.exe	43
PID 1684 wrote to memory of 352	1684	RewAdIs_Launcher_v05.exe	43
PID 1684 wrote to memory of 2740	1684	RewAdIs_Launcher_v05.exe	45
PID 1684 wrote to memory of 2740	1684	RewAdIs_Launcher_v05.exe	45
PID 1684 wrote to memory of 2740	1684	RewAdIs_Launcher_v05.exe	45
PID 1684 wrote to memory of 2744	1684	RewAdIs_Launcher_v05.exe	47
PID 1684 wrote to memory of 2744	1684	RewAdIs_Launcher_v05.exe	47
PID 1684 wrote to memory of 2744	1684	RewAdIs_Launcher_v05.exe	47
PID 1624 wrote to memory of 1992	1624	chrome.exe	52
PID 1624 wrote to memory of 1992	1624	chrome.exe	52
PID 1624 wrote to memory of 1992	1624	chrome.exe	52
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1964	1624	chrome.exe	54
PID 1624 wrote to memory of 1528	1624	chrome.exe	55
PID 1624 wrote to memory of 1528	1624	chrome.exe	55
PID 1624 wrote to memory of 1528	1624	chrome.exe	55

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\RewAdIs Launcheri v0.5.7z"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RewAdIs Launcheri v0.5.7z
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RewAdIs Launcheri v0.5.7z
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RewAdIs Launcheri v0.5.7z"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2604

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap19790:100:7zEvent23745
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1620

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Beni oku.txt
1⤵
PID:448

C:\Users\Admin\Desktop\7z2401-x64.exe
"C:\Users\Admin\Desktop\7z2401-x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:2212

C:\Users\Admin\Desktop\RewAdIs_Launcher_v05.exe
"C:\Users\Admin\Desktop\RewAdIs_Launcher_v05.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl https://raw.githubusercontent.com/TROguz/ndx/main/pc --ssl-no-revoke -o ndx
  2⤵
  PID:352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del ndx
  2⤵
  PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del
  2⤵
  PID:2744

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap5287:98:7zEvent8326
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef44e9758,0x7fef44e9768,0x7fef44e9778
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:2
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:1
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2356 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1404 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:2
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1284 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3308 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:8
  2⤵
  - Loads dropped DLL
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3364 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3080 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2472 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2968 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2400 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2764 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:3580
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f927688,0x13f927698,0x13f9276a8
    3⤵
    PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3320 --field-trial-handle=1196,i,16798045106759752125,626160299709002106,131072 /prefetch:1
  2⤵
  PID:3692

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1688

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2004

C:\Windows\System32\msdt.exe
"C:\Windows\System32\msdt.exe" -skip TRUE -path C:\Windows\diagnostics\system\networking -ep NetworkDiagnosticsNetworkMiniMap
1⤵
- Suspicious use of FindShellTrayWindow
PID:284

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
PID:948
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jbrv4dao.cmdline"
  2⤵
  PID:3016
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBEBE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBEBD.tmp"
    3⤵
    PID:2828

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
PID:3080
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l5kd1b3e.cmdline"
  2⤵
  PID:3172
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA14.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCA13.tmp"
    3⤵
    PID:3204

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x550
1⤵
PID:2072

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\.rsrc\2057\string.txt
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061707.000\NetworkDiagnostics.0.debugreport.xml

Filesize
63KB

MD5
4ca39e63bc9d94bf32051803c4e5d0d9

SHA1
c83251afef02be710b23b476484604504e5fa391

SHA256
5add7495db24cec8d5cc697c85d6cbd44481bebcf6c5f64bff069cfc8f28b73e

SHA512
4263c9b0219e701c30b8e047d51c82fec25fc1320b8b236f5a1a67cf2e59a46d7051cca32de2295aab206c00d3180dce98bf9cd230642d9f7c116332b403505a

Download Submit
C:\Users\Admin\AppData\Local\ElevatedDiagnostics\460911090\2024061707.000\NetworkDiagnostics.1.debugreport.xml

Filesize
5KB

MD5
58e69a39c2ff97e57425c3f68bcc91f0

SHA1
faa60561463245adb04f630537f595d657f03f88

SHA256
d4bb621826279f266d882f8cfd31c4c3b9c923938f6613cd404b9ee32314f47b

SHA512
4b890af5dea7d32a797ec3613227c808a05ce1bfe0ce3b67b9b7c45c7867754b174a16c4d9066f771d44d67b735f64b6a1d296645a800a456022c72a4e0cd17b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
7eddcf9e06173696e988fd1af1709ae7

SHA1
5b0265daaafb93e06c74284f8f40602521685984

SHA256
a1c02740e2d17a13374869f5fe4abc23484b5d6317b60323de545f302762b6cc

SHA512
18a3cb43156bdaee1565012269c1daaa342c6115644dfaa608144fa6b7175d784dcdd30613bd7948e367e59afc6f6e700b970b5c84cb36dba5e3e9f57c854bb7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
924a139650eb0bd7378f8be8abd7604b

SHA1
c40e0dee69e6240854e778a43848fc0a3d9f2f3b

SHA256
ba6f9236458aaf81b5d8572402d553f050dc8a67f968357043f3b2be42a8287e

SHA512
f23dfa9610c12bde8a1d0b509727de683c9703504a90629be6be34703203d9f26069f1e482b5a6585e8b98fd744cb77005117a1bd6d9f0c51fcc248810d40309

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
938087570a568e0aa9127efcbe27f63f

SHA1
34f637797f43d25d22479bc9d31a130c34571eee

SHA256
1157bc840977de373cb15ac0a16ccfb8603a34572dfc7aa7b265f396e3ffce7d

SHA512
af4ed912db63ed641d5429aa5e0ed97c5373adb09882721a20e152c827f420b271c8c5bb9d6df2f36d3602532768213544f734f4445597de9bdfd4b3737a366c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
04f3b9f2ee7b856c88ebaf1692825b53

SHA1
80fb1ad3b2ca0bb7d4127fc7fe0f492bdf8aa641

SHA256
2fbf646c34823081b367e302be56adc44c8181a474975b3d1f3ec3cddec5b172

SHA512
6cdb1df38d270ff17caf59e5e9b078690c0db98a14b3f5ecc056ea321e46ff54b7c34aac75ba949ae0ea57e83160ac0781ae161a719e0072bfecdd92d99d3d1d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
140KB

MD5
719f66694f5d0ce4fc7a9977d2f0b013

SHA1
b401c6836f616789bd7c240a786d1aa5b7786835

SHA256
91f122cf30f792840076ce7dffbb8aac416ed6a4498d863f060f024012c56796

SHA512
7144180752d16eaaf5a23c2e7ebeff36b9bfee7778805c0e183fa3bdd303c3f1f2efa0277112d5c7b52c5d8dd7fce10933d342330210838b01755d4bd610ab8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a651ef13-5fbb-4818-bf90-098cbd624a8b.tmp

Filesize
140KB

MD5
b40832ffa880ace6c2e49a391f69aca8

SHA1
e7ead5a21ba90102170e03b5fa29cb2dec7cf438

SHA256
54f41e8c4f8559f3d8439e3a341eb38481ad1d7e46e3282c2cc4e7be03936187

SHA512
feb0ec5ce437744a9c496ef35ebb8eae7c9bf541fb93c072e6228ce0352a3637528c7f561bdd73a9ccf9e14bce3cadce54c1213b0bfc9a011fdf8f65b1e66b41

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBEBE.tmp

Filesize
1KB

MD5
5aab69c07c184e956744ec1c776b4743

SHA1
ce7e5003bc7ac3967ece83202de8328858ef0955

SHA256
7781388ed7bbd27d7d2279e2136453494c1483c8be2a6e55879650d8eac4fedb

SHA512
59e955b73c6c5764daadfacd78cfb3e92ba363763dc740638607c88faf4559d8ca51325961f1d81d7280de3b0c5e312d9f4a5df965246971c157f4713e398bd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESCA14.tmp

Filesize
1KB

MD5
d9cd4cc46f7fb9df03b1941f1c876f56

SHA1
8bcfda483f3838051f5beb334da5646254d9bd42

SHA256
c13088569a8b682abb8aea52050fb7d7ce71814f3167c43aa3effde927eb45d4

SHA512
1c8b92795f3d6f6f2ee5ec17567717528188908ed62e939491142959e6ba55f59b679a3c27d9924ddf075ebc30c86a6846e891bbd9903a420a19688bb0bacb19

Download Submit
C:\Users\Admin\AppData\Local\Temp\jbrv4dao.dll

Filesize
3KB

MD5
f93782c292b1efd866cf05ae580e6656

SHA1
8af03dd4b8a466eadfcbc046c44f1852f9c31b8a

SHA256
8278b91a001f96761da7621d9378933e883bb73ca313f4f320c73457e5904f05

SHA512
58f736ee95f87d393d2ec9173a0dc8530f3b831735009b42a0b9d560a07e0a58fb524a41e6e470dba33afcf680e9189cd7e9220aad0200d2a290da21f569151d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jbrv4dao.pdb

Filesize
11KB

MD5
9dc75c79acc5a3565b53ed9921cf6f7f

SHA1
17b67c6e9efae06505d0c76e2b29556feb196edb

SHA256
1eec2b83276a01f419bd468fec09e1ce62d7123229053532288fe11611e0725a

SHA512
cc0a31b95975764f1b1df42024cfe521e76d1f7ac45ca1653f776f7d62aedcdd58d119cdc7c00c1f9d31cea12d1e9a492e1b2b73cd648e1f23a10ccfa77160ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\l5kd1b3e.dll

Filesize
3KB

MD5
747eefdc1882866dd4f1ceb4677ca60a

SHA1
b3b26e63ab99febb90cf1bb0f5e1276920b7820d

SHA256
ab7c06af0aea3a4042e73d59f993b4545d92d5ccc629e8a049d9bc63704516ae

SHA512
c599d88b4a0feb666dae2a48c58e97a88254552cc0929e325680cb519dee1636ce401204b810216ffb1b403609a43a227d69be62870bdba37412cbf5d0f66d99

Download Submit
C:\Users\Admin\AppData\Local\Temp\l5kd1b3e.pdb

Filesize
11KB

MD5
fe25746ed795d163c8baa19ec7eb59cd

SHA1
fa5a8a86d929236967e5367a10e166fba616a47a

SHA256
8b7ea52df2b373231ff493601296e0e91f1e6f3a926388bf0bcaa660e14762a0

SHA512
2608e2fa7cc1d3d9f1698e0a5b9b3946218d3a58311514c08965be5b68aca6b86a006ab86fccedb3431cef96601b9e25bfb219ad2f29db729c4275b2b51ec59a

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0f05ba0fbfa255c448eb52a3fe0d91b5

SHA1
0569ac12767b31790928e5bd4fc988d2619d43a6

SHA256
d1f834ef3ab0f162753d5098a057f473f4a1b2c0d6772eab8cc75d714d6a5bdd

SHA512
5144ef8447747e183b88af99bccceb75a565a4d92a972687846d506d24fc7e0a5793659c5697f12a4bb03843f319d66fa49505c2f26f09186b33c2a24cf2ab8b

Download Submit
C:\Users\Admin\Desktop\.rsrc\0\RCDATA\SCRIPT

Filesize
42KB

MD5
92b2146a8f87db04644a7a884b676dbe

SHA1
788bf37ea5befa777260004ed3176b45abb91d13

SHA256
c35ac09849d740f8548a35b5cf5ec748c960c8ed236752c567b4512b404bd971

SHA512
fd382af7cb13b3135e9fed3a5a4ac622e70b04af80634ba54182c2a7cbb3ea8398f6eee793926777d8a3826bd7805d22cdda6acc7a5ec0c17bc288d739205201

Download Submit
C:\Users\Admin\Desktop\.rsrc\2057\string.txt

Filesize
9KB

MD5
eeb1e302dbd55565f07fdc7f3fcecc36

SHA1
d523f19d0b9888175a8d255d8f3123bb7eb44761

SHA256
964b61fbb844e557f03cb383b6a28a99c7dff2982beacb4b699fee70fef9e505

SHA512
52b9ce2e4be73a37c5ac7647fa23beff64aad85fde0d35989c81d878bf293c7ed449456bb3831e69598e1ca7c734d95d594fa77887968d3fc085e79a677c5b9e

Download Submit
C:\Users\Admin\Desktop\7z2401-x64.exe

Filesize
1.5MB

MD5
de644b4e1086f1315c422f359133543b

SHA1
54be86d121879b0e5d86604297c57a926d665fa8

SHA256
17a507cce4066c4be7db53d64d9a9e11dfecfd4f2411393690506e591b5895cd

SHA512
714d41254352d91834a4b648d613e9b4452b93b097b5781ec5bf3ec7c310a489d3a1c409b2f0a6946822b96f6943b579910d26a5f4324b320d485e856dbdcb1a

Download Submit
C:\Users\Admin\Desktop\Beni oku.txt

Filesize
96B

MD5
11404cd38ee4d3c09f68dc272b79756c

SHA1
af14a99d926f18e60133e2fc93cfe7f24087f34b

SHA256
02a12b1140441109b60546afa8b48cef9e18781ee3040aadb057e479271473dc

SHA512
575f26c661f27c85606d4ce3086ebc8daeda88c458f1f77676111cff98975a36862a57a5f5bd8906bd0c2533d6c36f80237b09c564a772af41c68b67268eb6f3

Download Submit
C:\Windows\TEMP\SDIAG_c568221f-3809-4d60-b5cb-3345ed681151\NetworkDiagnosticsTroubleshoot.ps1

Filesize
23KB

MD5
1d192ce36953dbb7dc7ee0d04c57ad8d

SHA1
7008e759cb47bf74a4ea4cd911de158ef00ace84

SHA256
935a231924ae5d4a017b0c99d4a5f3904ef280cea4b3f727d365283e26e8a756

SHA512
e864ac74e9425a6c7f1be2bbc87df9423408e16429cb61fa1de8875356226293aa07558b2fafdd5d0597254474204f5ba181f4e96c2bc754f1f414748f80a129

Download Submit
C:\Windows\TEMP\SDIAG_c568221f-3809-4d60-b5cb-3345ed681151\StartDPSService.ps1

Filesize
567B

MD5
a660422059d953c6d681b53a6977100e

SHA1
0c95dd05514d062354c0eecc9ae8d437123305bb

SHA256
d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813

SHA512
26f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523

Download Submit
C:\Windows\TEMP\SDIAG_c568221f-3809-4d60-b5cb-3345ed681151\UtilityFunctions.ps1

Filesize
52KB

MD5
2f7c3db0c268cf1cf506fe6e8aecb8a0

SHA1
fb35af6b329d60b0ec92e24230eafc8e12b0a9f9

SHA256
886a625f71e0c35e5722423ed3aa0f5bff8d120356578ab81a64de2ab73d47f3

SHA512
322f2b1404a59ee86c492b58d56b8a6ed6ebc9b844a8c38b7bb0b0675234a3d5cfc9f1d08c38c218070e60ce949aa5322de7a2f87f952e8e653d0ca34ff0de45

Download Submit
C:\Windows\TEMP\SDIAG_c568221f-3809-4d60-b5cb-3345ed681151\UtilitySetConstants.ps1

Filesize
2KB

MD5
0c75ae5e75c3e181d13768909c8240ba

SHA1
288403fc4bedaacebccf4f74d3073f082ef70eb9

SHA256
de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f

SHA512
8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b

Download Submit
C:\Windows\TEMP\SDIAG_c568221f-3809-4d60-b5cb-3345ed681151\en-US\LocalizationData.psd1

Filesize
5KB

MD5
dc9be0fdf9a4e01693cfb7d8a0d49054

SHA1
74730fd9c9bd4537fd9a353fe4eafce9fcc105e6

SHA256
944186cd57d6adc23a9c28fc271ed92dd56efd6f3bb7c9826f7208ea1a1db440

SHA512
92ad96fa6b221882a481b36ff2b7114539eb65be46ee9e3139e45b72da80aac49174155483cba6254b10fff31f0119f07cbc529b1b69c45234c7bb61766aad66

Download Submit
C:\Windows\Temp\SDIAG_0be0c825-9718-4557-b72d-703d491daaff\DiagPackage.diagpkg

Filesize
152KB

MD5
c9fb87fa3460fae6d5d599236cfd77e2

SHA1
a5bf8241156e8a9d6f34d70d467a9b5055e087e7

SHA256
cde728c08a4e50a02fcff35c90ee2b3b33ab24c8b858f180b6a67bfa94def35f

SHA512
f4f0cb1b1c823dcd91f6cfe8d473c41343ebf7ed0e43690eecc290e37cee10c20a03612440f1169eef08cc8059aaa23580aa76dd86c1704c4569e8139f9781b3

Download Submit
C:\Windows\Temp\SDIAG_0be0c825-9718-4557-b72d-703d491daaff\result\results.xsl

Filesize
47KB

MD5
310e1da2344ba6ca96666fb639840ea9

SHA1
e8694edf9ee68782aa1de05470b884cc1a0e1ded

SHA256
67401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c

SHA512
62ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244

Download Submit
C:\Windows\Temp\SDIAG_c568221f-3809-4d60-b5cb-3345ed681151\DiagPackage.dll

Filesize
478KB

MD5
4dae3266ab0bdb38766836008bf2c408

SHA1
1748737e777752491b2a147b7e5360eda4276364

SHA256
d2ff079b3f9a577f22856d1be0217376f140fcf156e3adf27ebe6149c9fd225a

SHA512
91fb8abd1832d785cd5a20da42c5143cd87a8ef49196c06cfb57a7a8de607f39543e8a36be9207842a992769b1c3c55d557519e59063f1f263b499f01887b01b

Download Submit
C:\Windows\Temp\SDIAG_c568221f-3809-4d60-b5cb-3345ed681151\en-US\DiagPackage.dll.mui

Filesize
13KB

MD5
1ccc67c44ae56a3b45cc256374e75ee1

SHA1
bbfc04c4b0220ae38fa3f3e2ea52b7370436ed1f

SHA256
030191d10ffb98cecd3f09ebdc606c768aaf566872f718303592fff06ba51367

SHA512
b67241f4ad582e50a32f0ecf53c11796aef9e5b125c4be02511e310b85bdfa3796579bbf3f0c8fe5f106a5591ec85e66d89e062b792ea38ca29cb3b03802f6c6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCBEBD.tmp

Filesize
652B

MD5
332173b557f64a93bebefba92b435d95

SHA1
e257797d03333c00b147926ee4b59150096a0dc8

SHA256
35d52e477c008b7bdc8b7810624389b5d9dc0a6ae37c8c6dc68b7e1343d29fb2

SHA512
76e1c2a21cd64b2b64a1ec50cd640b2622bef9fadce25e59c1dac3a5482b0d8054701da063bc77cc83c33ead73cdc2b6c342dd1391ff4ba951638a3630711e11

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCCA13.tmp

Filesize
652B

MD5
b8b4101879f412d8e687abcb7a499386

SHA1
6bd756c8dbbabf17efa1e45c70c4da87286ea7f4

SHA256
c83ac22273a16f9c9e85f206d2c8434f25c45af14ebd06c1cc7b54c7e8344df0

SHA512
c9f85551e3063b1414153daf66ca773506099e37c7d022027bd794b9b235ae8a1e57c47950854a528997f7582efb10d04e5ce58d415d8f8820577aa5e39d00a8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jbrv4dao.0.cs

Filesize
1007B

MD5
bac2724be827ee042ff2b312050aa844

SHA1
ca34fd2feb835c8746ad1bec6de9a24cc1368595

SHA256
6901eb7b1a34580f7ae741d2a0d09bfa0e85e0b2cbd945d961291e6f4a02bd33

SHA512
3e7b6d91ed41007b471c93015c7c8900c7141766d7a83b394fabceac93f91cb4b37ed06abc3371f96b314355aa4facf9e0214d7dfcb7faa0018db02ad0a970aa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jbrv4dao.cmdline

Filesize
309B

MD5
6cb9678a97b64925a07ac68c0603d6d8

SHA1
22a3291e277a9b861d69f65bc18f4acc3623e7b5

SHA256
e838e91730e0aa85f4935ba6c5d2d6e6c783261a6efaedb1f0f884c75d41134a

SHA512
eb0a46cf9b20b2160c213e2571cd61a021efc75f64d14865839750c02a9a33481dcfb319dffd7a838c87a8f1293e333f1455d7aa4cf1101ccd23e98b9f450a2e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\l5kd1b3e.cmdline

Filesize
309B

MD5
b10f728708eb56f963c5d1d7260d1aee

SHA1
7fb4f5366cc3a08d7ac2632e1fbc2a70df2b0c82

SHA256
83ed32c7896187dded136c590d586beda107eb08fd83a83dd6271ac45c1d15bc

SHA512
78702a94da6cbc635609f52afe58884635f8c72f84833f20c045ca08bd415ee1512958011ec20dd1245c7424f90b1e84696e93476fccf7f1f801965846835df4

Download Submit
\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
956d826f03d88c0b5482002bb7a83412

SHA1
560658185c225d1bd274b6a18372fd7de5f336af

SHA256
f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

SHA512
6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

Download Submit
\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
325164288f23ccfff4891b050bf4a43e

SHA1
c6a2ded962d39a62da3878408fe0e3354938f81d

SHA256
1af1b530f6295207f719697184d4ab5587e2f11586da4564ce352a743e7b8ccb

SHA512
ce7765a689b15c85ee95394422a9a93d36ca803b89246edfdfcf86969b1227b52e99e7e029e5e52741f3bb41c0b8b7463e92e9f4ef7439a40e1cb70c79cade3c

Download Submit
\Program Files\7-Zip\7zFM.exe

Filesize
929KB

MD5
6156ebaea891ddbfcb1187f628ec7577

SHA1
778fd5d5dec21f95c5aa554567e06da8295b9a47

SHA256
4853947e14bf30ab40702c34f80fb113c45619a73f89a938f2284c786e35c9fe

SHA512
ed166095ceb46ff77e1081263aea03cb97b5d244a7e4060b6b37c847fd496a7e577f297846414ff130e01484f44f9da2566e2572c6cd69e9b419c311799a511a

Download Submit
\Program Files\7-Zip\7zG.exe

Filesize
682KB

MD5
780f46e18996e23a6bdc80b21618938d

SHA1
2278065b8324efa4a8d92f6b015bc58d5319f26c

SHA256
b126a83eeab06947c6babf0be8e469274585218ffc2dab5a6d650e5dbc4e58be

SHA512
a6c6ba2ccfc9dc6d813423ad04945fe664140d8c28906e1f4f59f8b300ff553a0747e0d7ab22ef4bb727b038f8282fe013a494fb9799f7a2c59445fd19124d4b

Download Submit
\Users\Admin\Desktop\RewAdIs_Launcher_v05.exe

Filesize
1.2MB

MD5
053487a5f68d7bb1a8fb36d07edef428

SHA1
799a6e4be54ad869319011380df12b6368024f08

SHA256
6c957cd9581d6c18df39a3b458ff6ac4d8b388cb7b66fb97ba4d314334493029

SHA512
f07722d73238226d04dad7f54b99c2f28f045d08b39d0e6133bd84a8d7316b6a84c07a2dfd2f1953c91744a036ed96f7944d8d0b638a9e7a264761096e31f18a

Download Submit
memory/948-772-0x0000000002160000-0x0000000002168000-memory.dmp

Filesize
32KB

Download
memory/3080-1184-0x00000000023D0000-0x00000000023D8000-memory.dmp

Filesize
32KB

Download