agenttesla | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

max time kernel
199s
max time network
303s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13/08/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Text Document mod.exe
Size 8KB
Sample240813-2dvtyazbph
SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
MD5 69994ff2f00eeca9335ccd502198e05b
SHA1 b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA512 ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
SSDEEP 96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1604
127.0.0.1:22253
eu-central-7075.packetriot.net:6606
eu-central-7075.packetriot.net:7707
eu-central-7075.packetriot.net:8808
eu-central-7075.packetriot.net:1604
eu-central-7075.packetriot.net:22253

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Extracted

Family

amadey

Version

4.41

Botnet

cd33f9

http://193.176.158.185

Attributes

install_dir
fed0c9a4d3
install_file
Hkbsse.exe
strings_key
a2163aef710017f5548e7e730af53cca
url_paths
/B0kf3CbAbR/index.php

rc4.plain

Extracted

Family

redline

185.215.113.9:12617

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.blooming.com.my
Port
587
Username
[email protected]
Password
THL191282

Extracted

Family

nanocore

Version

1.2.2.0

blackangel.hopto.org:54984

Mutex

f71cda30-fa3d-4402-acaf-cf2c8c816f12

Attributes

activate_away_mode
true
backup_connection_host
blackangel.hopto.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-04-20T19:45:18.703376436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f71cda30-fa3d-4402-acaf-cf2c8c816f12
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
blackangel.hopto.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.synergyinnovationsgroup.com
Port
587
Username
[email protected]
Password
C@p-Y8BoHc#?
Email to
[email protected]

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

193.117.208.148:7800

Extracted

Family

redline

Botnet

147.45.44.73:6282

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000100000002aa57-483.dat	family_redline
behavioral2/memory/1632-489-0x00000000009D0000-0x0000000000A22000-memory.dmp	family_redline
behavioral2/files/0x000200000002a5c1-1069.dat	family_redline
behavioral2/memory/1852-1074-0x00000000008D0000-0x0000000000922000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000200000002a5c0-1059.dat	family_sectoprat
behavioral2/memory/1204-1064-0x0000000000C60000-0x0000000000D26000-memory.dmp	family_sectoprat

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4108-639-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000100000002a99c-8.dat	family_asyncrat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\127.0.6533.120\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2948	powershell.exe
3348	powershell.exe
6436	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
1696	stub.exe
4956	Mke%20Fallen.exe
2764	Mke%20Fallen.exe
1676	vmtoolsd.exe
2260	build2.exe
4200	vmtoolsd.exe
1472	svchost.exe
4740	vmtoolsd.exe
3524	vmtoolsd.exe
1888	l2.exe
4296	keylogger.exe
3224	Hkbsse.exe
2400	networks_profile.exe
2100	networks_profile.exe
4504	backdoor.exe
4804	vmtoolsd.exe
3016	vmtoolsd.exe
2116	vmtoolsd.exe
3556	vmtoolsd.exe
3944	Hkbsse.exe
2336	oobeldr.exe
2740	vmtoolsd.exe
2628	carrier.exe
4964	wahost.exe
1496	regasm.exe
2376	vmtoolsd.exe
2172	sihost.exe
3728	winiti.exe
1448	GoogleUpdate.exe
4444	GoogleUpdate.exe
4516	vmtoolsd.exe
2080	sahost.exe
1236	GoogleUpdate.exe
1548	GoogleUpdateComRegisterShell64.exe
4796	GoogleUpdateComRegisterShell64.exe
2860	GoogleUpdateComRegisterShell64.exe
1632	cookie250.exe
1280	GoogleUpdate.exe
2412	GoogleUpdate.exe
3940	GoogleUpdate.exe
3984	out_test_sig.exe
1944	TTF.exe
1948	T9.exe
4588	vmtoolsd.exe
2436	c7.exe
3700	mservice64.exe
1744	T7.exe
1316	wahost.exe
4020	nano.exe
4336	request.exe
1056	vmtoolsd.exe
4108	regasm.exe
5088	1111.exe
2624	sahost.exe
1300	vmtoolsd.exe
3208	microsoft.exe
240	microsoft.exe
780	msvcservice.exe
5192	vmtoolsd.exe
5864	vmtoolsd.exe
5940	vmtoolsd.exe
6108	vmtoolsd.exe
6096	127.0.6533.120_chrome_installer.exe
3852	setup.exe

Loads dropped DLL 64 IoCs

pid	Process
2100	networks_profile.exe
2100	networks_profile.exe
2100	networks_profile.exe
2100	networks_profile.exe
2100	networks_profile.exe
2100	networks_profile.exe
1448	GoogleUpdate.exe
4444	GoogleUpdate.exe
1236	GoogleUpdate.exe
1548	GoogleUpdateComRegisterShell64.exe
1236	GoogleUpdate.exe
4796	GoogleUpdateComRegisterShell64.exe
1236	GoogleUpdate.exe
2860	GoogleUpdateComRegisterShell64.exe
1236	GoogleUpdate.exe
1280	GoogleUpdate.exe
2412	GoogleUpdate.exe
3940	GoogleUpdate.exe
3940	GoogleUpdate.exe
2412	GoogleUpdate.exe
2172	sihost.exe
2172	sihost.exe
2172	sihost.exe
2172	sihost.exe
2172	sihost.exe
2172	sihost.exe
2172	sihost.exe
692	GoogleUpdate.exe
200	GoogleUpdate.exe
200	GoogleUpdate.exe
5676	chrome.exe
568	chrome.exe
5676	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
1220	chrome.exe
5576	chrome.exe
5576	chrome.exe
1220	chrome.exe
720	chrome.exe
2380	chrome.exe
720	chrome.exe
2380	chrome.exe
3704	chrome.exe
3704	chrome.exe
4752	chrome.exe
4752	chrome.exe
1852	chrome.exe
1852	chrome.exe
1664	chrome.exe
1664	chrome.exe
6156	chrome.exe
6156	chrome.exe
6252	chrome.exe
6252	chrome.exe
6308	chrome.exe
6308	chrome.exe
6628	chrome.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000200000002a5a9-968.dat	upx
behavioral2/memory/5200-996-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/files/0x000300000002a5ba-1014.dat	upx
behavioral2/memory/692-1019-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/5200-1542-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Subsystem = "C:\\Program Files (x86)\\SCSI Subsystem\\scsiss.exe"	microsoft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	request.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Subsystem = "C:\\Program Files (x86)\\SCSI Subsystem\\scsiss.exe"	nano.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nano.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	microsoft.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
5	raw.githubusercontent.com
130	pastebin.com
148	pastebin.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org
55	ip-api.io
70	ip-api.io

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6948	powercfg.exe
4380	powercfg.exe
4660	powercfg.exe
2368	powercfg.exe
6092	powercfg.exe
3336	powercfg.exe
400	powercfg.exe
2332	powercfg.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vmtoolsd.exe	Mke%20Fallen.exe
File created	C:\Windows\SysWOW64\Mke%20Fallen.exe	Mke%20Fallen.exe
File opened for modification	C:\Windows\SysWOW64\Mke%20Fallen.exe	Mke%20Fallen.exe
File created	C:\Windows\SysWOW64\vmtoolsd.exe	Mke%20Fallen.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5820	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2172	sihost.exe
5820	wab.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 4060	1948	T9.exe	196
PID 1944 set thread context of 1240	1944	TTF.exe	200
PID 4964 set thread context of 1316	4964	wahost.exe	202
PID 1744 set thread context of 3920	1744	T7.exe	204
PID 1496 set thread context of 4108	1496	regasm.exe	212
PID 2080 set thread context of 2624	2080	sahost.exe	219
PID 3208 set thread context of 240	3208	microsoft.exe	222
PID 2172 set thread context of 5820	2172	sihost.exe	251
PID 1480 set thread context of 2848	1480	microsoft.exe	327
PID 3456 set thread context of 5492	3456	pimer_bbbcontents7.exe	269
PID 2592 set thread context of 6420	2592	WE.exe	440
PID 1480 set thread context of 6580	1480	U.exe	312
PID 2848 set thread context of 6800	2848	microsoft.exe	328
PID 6872 set thread context of 6528	6872	66b5d9d3adbaa_defaultr.exe	335
PID 5124 set thread context of 4900	5124	66af4e35e761b_doz.exe	345

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdate.exe	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_vi.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_de.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_uk.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\vk_swiftshader.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe	127.0.6533.120_chrome_installer.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdateOnDemand.exe	winiti.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\id.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_ca.dll	winiti.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\127.0.6533.120\127.0.6533.120_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\resources.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_zh-CN.dll	winiti.exe
File created	C:\Program Files (x86)\SCSI Subsystem\scsiss.exe	microsoft.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\127.0.6533.120.manifest	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_mr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\nl.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\psmachine_64.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdateCore.exe	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_pl.dll	winiti.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\icudtl.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\vi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_bn.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_de.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_sk.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\SCSI Subsystem\scsiss.exe	nano.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_sl.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\lt.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\sk.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_fil.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_gu.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_tr.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_ar.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_hu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_it.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\chrome_proxy.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\vulkan-1.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_hu.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_ml.dll	winiti.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\VisualElements\SmallLogoCanary.png	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_gu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_ms.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\ko.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_sr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\gu.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_th.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\fr.pak	setup.exe
File created	C:\Program Files (x86)\SCSI Subsystem\scsiss.exe	nano.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\el.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_tr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\libGLESv2.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_iw.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\psmachine.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\chrome_200_percent.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_ko.dll	winiti.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\ro.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdate.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_am.dll	winiti.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Tasks\Hkbsse.job	build2.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6432	sc.exe
5148	sc.exe
4072	sc.exe
5480	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000100000002a9a6-98.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 32 IoCs

pid	pid_target	Process	procid_target
3256	2260	WerFault.exe	89
4636	2260	WerFault.exe	89
3864	2260	WerFault.exe	89
2924	2260	WerFault.exe	89
1476	2260	WerFault.exe	89
1744	2260	WerFault.exe	89
4024	2260	WerFault.exe	89
2784	2260	WerFault.exe	89
3196	2260	WerFault.exe	89
1664	2260	WerFault.exe	89
4512	3224	WerFault.exe	125
1408	3224	WerFault.exe	125
3180	3224	WerFault.exe	125
2852	3224	WerFault.exe	125
1448	3224	WerFault.exe	125
1352	3224	WerFault.exe	125
1508	3224	WerFault.exe	125
4588	3224	WerFault.exe	125
3212	3224	WerFault.exe	125
3816	3224	WerFault.exe	125
1116	3224	WerFault.exe	125
4104	3224	WerFault.exe	125
1444	3944	WerFault.exe	150
4204	5368	WerFault.exe	244
6448	5492	WerFault.exe	269
6924	3224	WerFault.exe	125
6604	5756	WerFault.exe	326
5696	6760	WerFault.exe	355
6404	3224	WerFault.exe	125
5132	2096	WerFault.exe	391
1788	3224	WerFault.exe	125
3504	3224	WerFault.exe	125

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keylogger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winiti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	out_test_sig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meetings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateOnDemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TTF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pimer_bbbcontents7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookie250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvcservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Teamview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mke%20Fallen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	U.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1sesc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	request.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nano.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66b5d9d3adbaa_defaultr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Extension.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mailer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mke%20Fallen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Documents.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1280	GoogleUpdate.exe
692	GoogleUpdate.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
112	netsh.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1111.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1111.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pimer_bbbcontents7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pimer_bbbcontents7.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
1684	timeout.exe
6536	timeout.exe
6824	timeout.exe
4512	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
7112	systeminfo.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133680618914661645"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.122\\goopdate.dll,-3000"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc\CurVer\ = "GoogleUpdate.PolicyStatusSvc.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\PROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\ = "Google Update Legacy On Demand"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\ProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ = "Google Update Core Class"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2732F2FE-BCF7-4CE1-8ABD-951329519827}\InprocHandler32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CE63743-3E8B-463F-90D8-0274D20FCEBB}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CE63743-3E8B-463F-90D8-0274D20FCEBB}	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ = "IPolicyStatus2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ = "IApp2"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.122\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2732F2FE-BCF7-4CE1-8ABD-951329519827}\InprocHandler32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0\win32\ = "C:\\Program Files\\Google\\Chrome\\Application\\127.0.6533.120\\elevation_service.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods\ = "12"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ = "IProcessLauncher"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ = "IRegistrationUpdateHook"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ = "IAppVersion"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CE63743-3E8B-463F-90D8-0274D20FCEBB}\ = "PSFactoryBuffer"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\ = "4"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2732F2FE-BCF7-4CE1-8ABD-951329519827}\InprocHandler32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1\CLSID\ = "{E225E692-4B47-4777-9BED-4FD7FE257F0E}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ProgID	GoogleUpdate.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	cookie250.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	cookie250.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5960	schtasks.exe
3708	schtasks.exe
1748	schtasks.exe
2976	schtasks.exe
5324	schtasks.exe
768	schtasks.exe
6500	schtasks.exe
5328	schtasks.exe
4656	schtasks.exe
1052	schtasks.exe
3356	schtasks.exe
1044	schtasks.exe
4380	schtasks.exe
1836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
2628	carrier.exe
2628	carrier.exe
2628	carrier.exe
1448	GoogleUpdate.exe
1448	GoogleUpdate.exe
1448	GoogleUpdate.exe
1448	GoogleUpdate.exe
1448	GoogleUpdate.exe
1448	GoogleUpdate.exe
1944	TTF.exe
1944	TTF.exe
1944	TTF.exe
1944	TTF.exe
4964	wahost.exe
4964	wahost.exe
4964	wahost.exe
1316	wahost.exe
1316	wahost.exe
1496	regasm.exe
1496	regasm.exe
1496	regasm.exe
1496	regasm.exe
2080	sahost.exe
2080	sahost.exe
2948	powershell.exe
2948	powershell.exe
1496	regasm.exe
4108	regasm.exe
4108	regasm.exe
2080	sahost.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
3348	powershell.exe
3348	powershell.exe
2080	sahost.exe
2624	sahost.exe
2624	sahost.exe
240	microsoft.exe
240	microsoft.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4020	nano.exe
240	microsoft.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2172	sihost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
240	microsoft.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	New Text Document mod.exe
Token: SeIncBasePriorityPrivilege	4956	Mke%20Fallen.exe
Token: SeDebugPrivilege	1696	stub.exe
Token: SeDebugPrivilege	1472	svchost.exe
Token: SeDebugPrivilege	1472	svchost.exe
Token: SeDebugPrivilege	1448	GoogleUpdate.exe
Token: SeDebugPrivilege	1448	GoogleUpdate.exe
Token: SeDebugPrivilege	1448	GoogleUpdate.exe
Token: SeDebugPrivilege	1944	TTF.exe
Token: SeDebugPrivilege	1948	T9.exe
Token: SeDebugPrivilege	1744	T7.exe
Token: SeDebugPrivilege	4964	wahost.exe
Token: SeDebugPrivilege	1316	wahost.exe
Token: SeDebugPrivilege	1496	regasm.exe
Token: SeDebugPrivilege	3700	mservice64.exe
Token: SeBackupPrivilege	3700	mservice64.exe
Token: SeSecurityPrivilege	3700	mservice64.exe
Token: SeSecurityPrivilege	3700	mservice64.exe
Token: SeSecurityPrivilege	3700	mservice64.exe
Token: SeSecurityPrivilege	3700	mservice64.exe
Token: SeDebugPrivilege	1240	RegAsm.exe
Token: SeBackupPrivilege	1240	RegAsm.exe
Token: SeSecurityPrivilege	1240	RegAsm.exe
Token: SeSecurityPrivilege	1240	RegAsm.exe
Token: SeSecurityPrivilege	1240	RegAsm.exe
Token: SeSecurityPrivilege	1240	RegAsm.exe
Token: SeDebugPrivilege	4060	RegAsm.exe
Token: SeBackupPrivilege	4060	RegAsm.exe
Token: SeSecurityPrivilege	4060	RegAsm.exe
Token: SeSecurityPrivilege	4060	RegAsm.exe
Token: SeSecurityPrivilege	4060	RegAsm.exe
Token: SeSecurityPrivilege	4060	RegAsm.exe
Token: SeDebugPrivilege	2080	sahost.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	4108	regasm.exe
Token: SeDebugPrivilege	4020	nano.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	2624	sahost.exe
Token: SeDebugPrivilege	240	microsoft.exe
Token: SeDebugPrivilege	1632	cookie250.exe
Token: 33	6096	127.0.6533.120_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	6096	127.0.6533.120_chrome_installer.exe
Token: SeDebugPrivilege	5820	wab.exe
Token: 33	5412	GoogleCrashHandler64.exe
Token: SeIncBasePriorityPrivilege	5412	GoogleCrashHandler64.exe
Token: 33	652	GoogleCrashHandler.exe
Token: SeIncBasePriorityPrivilege	652	GoogleCrashHandler.exe
Token: SeDebugPrivilege	2412	GoogleUpdate.exe
Token: SeDebugPrivilege	692	GoogleUpdate.exe
Token: SeDebugPrivilege	1448	GoogleUpdate.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeDebugPrivilege	1204	authenticator.exe
Token: SeDebugPrivilege	1480	U.exe
Token: SeDebugPrivilege	2592	WE.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeShutdownPrivilege	5676	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2260	build2.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2628	carrier.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 1696	3792	New Text Document mod.exe	84
PID 3792 wrote to memory of 1696	3792	New Text Document mod.exe	84
PID 3792 wrote to memory of 1696	3792	New Text Document mod.exe	84
PID 3792 wrote to memory of 4956	3792	New Text Document mod.exe	85
PID 3792 wrote to memory of 4956	3792	New Text Document mod.exe	85
PID 3792 wrote to memory of 4956	3792	New Text Document mod.exe	85
PID 4956 wrote to memory of 3412	4956	Mke%20Fallen.exe	87
PID 4956 wrote to memory of 3412	4956	Mke%20Fallen.exe	87
PID 4956 wrote to memory of 3412	4956	Mke%20Fallen.exe	87
PID 2764 wrote to memory of 1676	2764	Mke%20Fallen.exe	88
PID 2764 wrote to memory of 1676	2764	Mke%20Fallen.exe	88
PID 2764 wrote to memory of 1676	2764	Mke%20Fallen.exe	88
PID 3792 wrote to memory of 2260	3792	New Text Document mod.exe	89
PID 3792 wrote to memory of 2260	3792	New Text Document mod.exe	89
PID 3792 wrote to memory of 2260	3792	New Text Document mod.exe	89
PID 1696 wrote to memory of 3152	1696	stub.exe	91
PID 1696 wrote to memory of 3152	1696	stub.exe	91
PID 1696 wrote to memory of 3152	1696	stub.exe	91
PID 1696 wrote to memory of 1952	1696	stub.exe	93
PID 1696 wrote to memory of 1952	1696	stub.exe	93
PID 1696 wrote to memory of 1952	1696	stub.exe	93
PID 3152 wrote to memory of 3356	3152	cmd.exe	95
PID 3152 wrote to memory of 3356	3152	cmd.exe	95
PID 3152 wrote to memory of 3356	3152	cmd.exe	95
PID 1952 wrote to memory of 1684	1952	cmd.exe	96
PID 1952 wrote to memory of 1684	1952	cmd.exe	96
PID 1952 wrote to memory of 1684	1952	cmd.exe	96
PID 2764 wrote to memory of 4200	2764	Mke%20Fallen.exe	97
PID 2764 wrote to memory of 4200	2764	Mke%20Fallen.exe	97
PID 2764 wrote to memory of 4200	2764	Mke%20Fallen.exe	97
PID 1952 wrote to memory of 1472	1952	cmd.exe	98
PID 1952 wrote to memory of 1472	1952	cmd.exe	98
PID 1952 wrote to memory of 1472	1952	cmd.exe	98
PID 2764 wrote to memory of 4740	2764	Mke%20Fallen.exe	99
PID 2764 wrote to memory of 4740	2764	Mke%20Fallen.exe	99
PID 2764 wrote to memory of 4740	2764	Mke%20Fallen.exe	99
PID 2764 wrote to memory of 3524	2764	Mke%20Fallen.exe	100
PID 2764 wrote to memory of 3524	2764	Mke%20Fallen.exe	100
PID 2764 wrote to memory of 3524	2764	Mke%20Fallen.exe	100
PID 3792 wrote to memory of 1888	3792	New Text Document mod.exe	101
PID 3792 wrote to memory of 1888	3792	New Text Document mod.exe	101
PID 3792 wrote to memory of 1888	3792	New Text Document mod.exe	101
PID 3792 wrote to memory of 4296	3792	New Text Document mod.exe	102
PID 3792 wrote to memory of 4296	3792	New Text Document mod.exe	102
PID 3792 wrote to memory of 4296	3792	New Text Document mod.exe	102
PID 1888 wrote to memory of 4656	1888	l2.exe	107
PID 1888 wrote to memory of 4656	1888	l2.exe	107
PID 1888 wrote to memory of 4656	1888	l2.exe	107
PID 2260 wrote to memory of 3224	2260	build2.exe	125
PID 2260 wrote to memory of 3224	2260	build2.exe	125
PID 2260 wrote to memory of 3224	2260	build2.exe	125
PID 3792 wrote to memory of 2400	3792	New Text Document mod.exe	128
PID 3792 wrote to memory of 2400	3792	New Text Document mod.exe	128
PID 2400 wrote to memory of 2100	2400	networks_profile.exe	130
PID 2400 wrote to memory of 2100	2400	networks_profile.exe	130
PID 3792 wrote to memory of 4504	3792	New Text Document mod.exe	131
PID 3792 wrote to memory of 4504	3792	New Text Document mod.exe	131
PID 3792 wrote to memory of 4504	3792	New Text Document mod.exe	131
PID 2764 wrote to memory of 4804	2764	Mke%20Fallen.exe	133
PID 2764 wrote to memory of 4804	2764	Mke%20Fallen.exe	133
PID 2764 wrote to memory of 4804	2764	Mke%20Fallen.exe	133
PID 2100 wrote to memory of 3128	2100	networks_profile.exe	134
PID 2100 wrote to memory of 3128	2100	networks_profile.exe	134
PID 2100 wrote to memory of 112	2100	networks_profile.exe	135

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Users\Admin\AppData\Local\Temp\a\stub.exe
  "C:\Users\Admin\AppData\Local\Temp\a\stub.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp126A.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1684
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1472
- C:\Users\Admin\AppData\Local\Temp\a\Mke%20Fallen.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Mke%20Fallen.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\a\MKE%20~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3412
- C:\Users\Admin\AppData\Local\Temp\a\build2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\build2.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 772
    3⤵
    - Program crash
    PID:3256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 820
    3⤵
    - Program crash
    PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 876
    3⤵
    - Program crash
    PID:3864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 956
    3⤵
    - Program crash
    PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 960
    3⤵
    - Program crash
    PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1000
    3⤵
    - Program crash
    PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 944
    3⤵
    - Program crash
    PID:4024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 944
    3⤵
    - Program crash
    PID:2784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1136
    3⤵
    - Program crash
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
    "C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 584
      4⤵
      Program crash
      PID:4512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 624
      4⤵
      Program crash
      PID:1408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 580
      4⤵
      Program crash
      PID:3180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 752
      4⤵
      Program crash
      PID:2852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 884
      4⤵
      Program crash
      PID:1448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 928
      4⤵
      Program crash
      PID:1352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 948
      4⤵
      Program crash
      PID:1508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 948
      4⤵
      Program crash
      PID:4588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 616
      4⤵
      Program crash
      PID:3212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1064
      4⤵
      Program crash
      PID:3816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1176
      4⤵
      Program crash
      PID:1116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1188
      4⤵
      Program crash
      PID:4104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 888
      4⤵
      Program crash
      PID:6924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1412
      4⤵
      Program crash
      PID:6404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1476
      4⤵
      Program crash
      PID:1788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1452
      4⤵
      Program crash
      PID:3504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1416
    3⤵
    - Program crash
    PID:1664
- C:\Users\Admin\AppData\Local\Temp\a\l2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\l2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4656
- C:\Users\Admin\AppData\Local\Temp\a\keylogger.exe
  "C:\Users\Admin\AppData\Local\Temp\a\keylogger.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4296
- C:\Users\Admin\AppData\Local\Temp\a\networks_profile.exe
  "C:\Users\Admin\AppData\Local\Temp\a\networks_profile.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\a\networks_profile.exe
    "C:\Users\Admin\AppData\Local\Temp\a\networks_profile.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3128
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:112
- C:\Users\Admin\AppData\Local\Temp\a\backdoor.exe
  "C:\Users\Admin\AppData\Local\Temp\a\backdoor.exe"
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Users\Admin\AppData\Local\Temp\a\carrier.exe
  "C:\Users\Admin\AppData\Local\Temp\a\carrier.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2628
- C:\Users\Admin\AppData\Local\Temp\a\wahost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\wahost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- - C:\Users\Admin\AppData\Local\Temp\a\wahost.exe
    "C:\Users\Admin\AppData\Local\Temp\a\wahost.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- C:\Users\Admin\AppData\Local\Temp\a\regasm.exe
  "C:\Users\Admin\AppData\Local\Temp\a\regasm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1496
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eVoVlc.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eVoVlc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFC9B.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\a\regasm.exe
    "C:\Users\Admin\AppData\Local\Temp\a\regasm.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4108
- C:\Users\Admin\AppData\Local\Temp\a\sihost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\sihost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:2172
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Users\Admin\AppData\Local\Temp\a\sihost.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- C:\Users\Admin\AppData\Local\Temp\a\winiti.exe
  "C:\Users\Admin\AppData\Local\Temp\a\winiti.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3728
- - C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={4611E087-CB70-244B-9202-F605357A02F4}&lang=en&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=CHBF&installdataindex=empty"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:4444
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1236
    - - C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1548
    - - C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4796
    - - C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2860
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMjIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjE1MkE2M0UtMDUzOC00MEY0LTlDOTMtODIxODEwQ0ZGQTE4fSIgdXNlcmlkPSJ7NjI2MUY0MkEtQTYwNi00Mzg0LTlBNzYtNUNFRjQxQjJDMzNBfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0VFM0UzRjkwLUQ3QUYtNEY2NC04RkYwLTQ5NjI3QjE3RTAxQ30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMzcxIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjEyMiIgbGFuZz0iZW4iIGJyYW5kPSJDSEJGIiBjbGllbnQ9IiIgaWlkPSJ7NDYxMUUwODctQ0I3MC0yNDRCLTkyMDItRjYwNTM1N0EwMkY0fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIyMDYzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1280
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={4611E087-CB70-244B-9202-F605357A02F4}&lang=en&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=CHBF&installdataindex=empty" /installsource taggedmi /sessionid "{B152A63E-0538-40F4-9C93-821810CFFA18}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2412
- C:\Users\Admin\AppData\Local\Temp\a\sahost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\sahost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OkNQYfjSk.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OkNQYfjSk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A6.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\a\sahost.exe
    "C:\Users\Admin\AppData\Local\Temp\a\sahost.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\Users\Admin\AppData\Local\Temp\a\cookie250.exe
  "C:\Users\Admin\AppData\Local\Temp\a\cookie250.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\a\out_test_sig.exe
  "C:\Users\Admin\AppData\Local\Temp\a\out_test_sig.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\hyper-v.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6436
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:7112
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-CimInstance -Class Win32_ComputerSystem
    3⤵
    PID:6456
- C:\Users\Admin\AppData\Local\Temp\a\TTF.exe
  "C:\Users\Admin\AppData\Local\Temp\a\TTF.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4400
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3152
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- C:\Users\Admin\AppData\Local\Temp\a\T9.exe
  "C:\Users\Admin\AppData\Local\Temp\a\T9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- C:\Users\Admin\AppData\Local\Temp\a\c7.exe
  "C:\Users\Admin\AppData\Local\Temp\a\c7.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2436
- C:\Users\Admin\AppData\Local\Temp\a\mservice64.exe
  "C:\Users\Admin\AppData\Local\Temp\a\mservice64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3700
- C:\Users\Admin\AppData\Local\Temp\a\T7.exe
  "C:\Users\Admin\AppData\Local\Temp\a\T7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    PID:3920
- C:\Users\Admin\AppData\Local\Temp\a\nano.exe
  "C:\Users\Admin\AppData\Local\Temp\a\nano.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Users\Admin\AppData\Local\Temp\a\request.exe
  "C:\Users\Admin\AppData\Local\Temp\a\request.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4336
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1052
- - C:\Users\Admin\msvcservice.exe
    "C:\Users\Admin\msvcservice.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:780
  - - C:\Windows\SysWOW64\schtasks.exe
      C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4380
- C:\Users\Admin\AppData\Local\Temp\a\1111.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe
  "C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:3208
- - C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe
    "C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious behavior: SetClipboardViewer
    - Suspicious use of AdjustPrivilegeToken
    PID:240
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1832
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4716
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5324
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
    3⤵
    PID:5644
- C:\Users\Admin\AppData\Local\Temp\a\Identifications.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Identifications.exe"
  2⤵
  PID:5008
- C:\Users\Admin\AppData\Local\Temp\a\pimer_bbbcontents7.exe
  "C:\Users\Admin\AppData\Local\Temp\a\pimer_bbbcontents7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:3456
- - C:\Users\Admin\AppData\Local\Temp\a\pimer_bbbcontents7.exe
    "C:\Users\Admin\AppData\Local\Temp\a\pimer_bbbcontents7.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:5492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 1320
      4⤵
      Program crash
      PID:6448
- C:\Users\Admin\AppData\Local\Temp\a\Documents.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Documents.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\a\tc10.exe
  "C:\Users\Admin\AppData\Local\Temp\a\tc10.exe"
  2⤵
  PID:4424
- C:\Users\Admin\AppData\Local\Temp\a\Meetings.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Meetings.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3160
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\1sesc.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\1sesc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5320
- C:\Users\Admin\AppData\Local\Temp\a\Trial.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Trial.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5200
- C:\Users\Admin\AppData\Local\Temp\a\Extension.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Extension.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5556
- C:\Users\Admin\AppData\Local\Temp\a\Mailer.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Mailer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:692
- C:\Users\Admin\AppData\Local\Temp\a\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Setup.exe"
  2⤵
  PID:6008
- C:\Users\Admin\AppData\Local\Temp\a\Teamview.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Teamview.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3204
- C:\Users\Admin\AppData\Local\Temp\a\authenticator.exe
  "C:\Users\Admin\AppData\Local\Temp\a\authenticator.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Users\Admin\AppData\Local\Temp\a\exec.exe
  "C:\Users\Admin\AppData\Local\Temp\a\exec.exe"
  2⤵
  PID:1852
- C:\Users\Admin\AppData\Local\Temp\a\U.exe
  "C:\Users\Admin\AppData\Local\Temp\a\U.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6580
- C:\Users\Admin\AppData\Local\Temp\a\WE.exe
  "C:\Users\Admin\AppData\Local\Temp\a\WE.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6420
- C:\Users\Admin\AppData\Local\Temp\a\66b5d9d3adbaa_defaultr.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b5d9d3adbaa_defaultr.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:6872
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6528
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KFHJJJKKFHID" & exit
      4⤵
      PID:6220
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:6536
- C:\Users\Admin\AppData\Local\Temp\a\66af4e35e761b_doz.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66af4e35e761b_doz.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:5124
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4900
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\JJEGIJEGDBFH" & exit
      4⤵
      PID:6952
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:6824
- C:\Users\Admin\AppData\Local\Temp\a\66b5b75106ac6_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b5b75106ac6_stealc.exe"
  2⤵
  PID:7060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:768
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 1284
      4⤵
      Program crash
      PID:5696
- C:\Users\Admin\AppData\Local\Temp\a\66b0ee142cf8f_PhotosExifEditor.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b0ee142cf8f_PhotosExifEditor.exe"
  2⤵
  PID:6884
- C:\Users\Admin\AppData\Local\Temp\a\66b331646d2cd_123p.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b331646d2cd_123p.exe"
  2⤵
  PID:396
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:6092
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:3336
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:400
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:2332
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "VIFLJRPW"
    3⤵
    - Launches sc.exe
    PID:5480
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "VIFLJRPW" binpath= "C:\ProgramData\xprfjygruytr\etzpikspwykg.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:6432
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:5148
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "VIFLJRPW"
    3⤵
    - Launches sc.exe
    PID:4072
- C:\Users\Admin\AppData\Local\Temp\a\66b837290469c_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b837290469c_vidar.exe"
  2⤵
  PID:4696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3868
- C:\Users\Admin\AppData\Local\Temp\a\66af531b832ee_main.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66af531b832ee_main.exe"
  2⤵
  PID:6784
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6556
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\GDAEBKJDHDAF" & exit
      4⤵
      PID:6664
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:4512
- C:\Users\Admin\AppData\Local\Temp\a\66b4af430a0a1_files.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b4af430a0a1_files.exe"
  2⤵
  PID:6508
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3420
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5456
- C:\Users\Admin\AppData\Local\Temp\a\66b85f47d1f63_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b85f47d1f63_stealc.exe"
  2⤵
  PID:5568
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3484

C:\Windows\SysWOW64\Mke%20Fallen.exe
C:\Windows\SysWOW64\Mke%20Fallen.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:5864
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:5940
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:6108
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5608
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5800
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5952
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:3744
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6116
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:4396
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6764
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6912
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:7048
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5840
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6592
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:4620
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:1468
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6944
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6776
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5972
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6632
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6708
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6004
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:580
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:1636
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6604
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:4940
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:4744
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6772
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6760
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5476
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6676
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6436
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6620
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5592
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5464
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2260 -ip 2260
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2260 -ip 2260
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2260 -ip 2260
1⤵
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2260 -ip 2260
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2260 -ip 2260
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2260 -ip 2260
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2260 -ip 2260
1⤵
PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2260 -ip 2260
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2260 -ip 2260
1⤵
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2260 -ip 2260
1⤵
PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3224 -ip 3224
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3224 -ip 3224
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3224 -ip 3224
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3224 -ip 3224
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3224 -ip 3224
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3224 -ip 3224
1⤵
PID:2148

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 404
  2⤵
  - Program crash
  PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 3224 -ip 3224
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3224 -ip 3224
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3224 -ip 3224
1⤵
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3224 -ip 3224
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3224 -ip 3224
1⤵
PID:4744

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
PID:2336
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3224 -ip 3224
1⤵
PID:2508

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3940
- C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\127.0.6533.120_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\127.0.6533.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui6289.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:6096
- - C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui6289.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    PID:3852
  - - C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.120 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff73ec241f8,0x7ff73ec24204,0x7ff73ec24210
      4⤵
      Drops file in Windows directory
      PID:1780
  - - C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in Windows directory
      PID:5164
    - - C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.120 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff73ec241f8,0x7ff73ec24204,0x7ff73ec24210
        5⤵
        Drops file in Windows directory
        
        PID:5212
- C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleCrashHandler.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:652
- C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleCrashHandler64.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5412
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMjIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjE1MkE2M0UtMDUzOC00MEY0LTlDOTMtODIxODEwQ0ZGQTE4fSIgdXNlcmlkPSJ7NjI2MUY0MkEtQTYwNi00Mzg0LTlBNzYtNUNFRjQxQjJDMzNBfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0FDRTAxOUVFLUU4QzctNDYzMC1CQzZFLUYzQTRBNzU5OEEwM30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC42NTMzLjEyMCIgYXA9Ing2NC1zdGFibGUtc3RhdHNkZWZfMSIgbGFuZz0iZW4iIGJyYW5kPSJDSEJGIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTEiIGlpZD0iezQ2MTFFMDg3LUNCNzAtMjQ0Qi05MjAyLUY2MDUzNTdBMDJGNH0iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2FjbmNkenpnaTMyZXAyZHRiM2Y2YXlxaHppNnFfMTI3LjAuNjUzMy4xMjAvMTI3LjAuNjUzMy4xMjBfY2hyb21lX2luc3RhbGxlci5leGUiIGRvd25sb2FkZWQ9IjEwNjczNzAxNiIgdG90YWw9IjEwNjczNzAxNiIgZG93bmxvYWRfdGltZV9tcz0iMTYxMjUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijk2OSIgZG93bmxvYWRfdGltZV9tcz0iMTczOTEiIGRvd25sb2FkZWQ9IjEwNjczNzAxNiIgdG90YWw9IjEwNjczNzAxNiIgaW5zdGFsbF90aW1lX21zPSIzMzY1NiIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3944 -ip 3944
1⤵
PID:2340

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
- Adds Run key to start application
PID:5272
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1748

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:5368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 472
  2⤵
  - Program crash
  PID:4204

C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
1⤵
- Suspicious use of SetThreadContext
PID:1480
- C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  PID:2848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  PID:5216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5368 -ip 5368
1⤵
PID:6040

C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateOnDemand.exe
"C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateOnDemand.exe" -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3416
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
  2⤵
  - Loads dropped DLL
  PID:200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
    3⤵
    - Loads dropped DLL
    - Checks system information in the registry
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.120 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff980c8e790,0x7ff980c8e79c,0x7ff980c8e7a8
      4⤵
      Loads dropped DLL
      PID:568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1836 /prefetch:2
      4⤵
      Loads dropped DLL
      PID:3216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1400,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1960 /prefetch:11
      4⤵
      Loads dropped DLL
      PID:1220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2192,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2496 /prefetch:13
      4⤵
      Loads dropped DLL
      PID:5576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3052,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3136 /prefetch:1
      4⤵
      Loads dropped DLL
      PID:2380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3060,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      Loads dropped DLL
      PID:720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4280,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      Loads dropped DLL
      PID:4752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4548,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      Loads dropped DLL
      PID:3704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4780,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4768 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:1852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4460,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:1664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5000,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:6156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4772,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:6252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4572,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:6308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5336,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:6628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5380,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5348 /prefetch:9
      4⤵
      PID:6156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=216,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:1236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5496,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:2528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=3616,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4448 /prefetch:11
      4⤵
      PID:3708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4872,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:6600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5684,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4856 /prefetch:14
      4⤵
      PID:6572

C:\Program Files\Google\Chrome\Application\127.0.6533.120\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\127.0.6533.120\elevation_service.exe"
1⤵
PID:2948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5492 -ip 5492
1⤵
PID:6464

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
- Adds Run key to start application
PID:6752
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:768

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:5756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 476
  2⤵
  - Program crash
  PID:6604

C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2848
- C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3224 -ip 3224
1⤵
PID:6884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 5756 -ip 5756
1⤵
PID:6656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 6760 -ip 6760
1⤵
PID:4664

C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
1⤵
PID:6680
- C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  PID:6492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  PID:3476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  PID:6620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  PID:2368
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4380

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:2520
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5328
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1220

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:2096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 480
  2⤵
  - Program crash
  PID:5132

C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
1⤵
PID:4540
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:2368
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:4660
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:4380
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:6948
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:6844
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3224 -ip 3224
1⤵
PID:6596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2096 -ip 2096
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3224 -ip 3224
1⤵
PID:6288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3224 -ip 3224
1⤵
PID:6420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdate.exe

Path C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdate.exe
Size 152KB
SHA256 62f622b022d4d8a52baf02bcf0c163f6fd046265cc4553d2a8b267f8eded4b76
MD5 e4bf1e4d8477fbf8411e274f95a0d528
SHA1 a3ff668cbc56d22fb3b258fabff26bac74a27e21
SHA512 429d99fc7578d07c02b69e6daf7d020cff9baa0098fbd15f05539cb3b78c3ac4a368dee500c4d14b804d383767a7d5e8154e61d4ab002d610abed4d647e14c70
SSDEEP 3072:MAt2Sm2m5oyiTOZQvfSERdX9Zk8AtB+alonPCHwiVSj5j2VR0d54yVIyO5hpGb/7:axwjRsB+BPp
MD5 SHA1 SHA512 SSDEEP

Submit Download

goopdate.dll

Path C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdate.dll
Size 1.9MB
SHA256 6a478176c0e2257485b517c5b549d6a4b9b93264b8ae67f134c8e87571db50ba
MD5 b235a510d74783594b5a50f60d6a841a
SHA1 101395a59c156139786554153e29a72e445776f7
SHA512 78adc152a2b11a750e398f19fc611e27b6a53c6dd0aec959f49d3ac0bc6121901c58a32fca065cc9bbe41fbbc034d4807c8d26d7c9719dcb133073a05687d292
SSDEEP 49152:rjTh5K+JkeTFU3yyi1APXpG+6mDJodTgEOTM9o0Kf7VDh0:315Dkkq3zPd1odYzu
MD5 SHA1 SHA512 SSDEEP

Submit Download

goopdateres_en.dll

Path C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_en.dll
Size 47KB
SHA256 6dcbd0c88d81ffa42a926787cbdecf8042685cc44f0484ef87307f89ec220bcc
MD5 b6fea8f291da55bb35d408040f354250
SHA1 19ed99a4f169467055474454f2b35204f2cd6568
SHA512 1b47352ddc03bb1b6a171e7cf58bfd1e1214a4f9cc04cf8ad58326e17a33b4c639cf23b4f7372b1010021ce3816129ca270d06a2c55ba3a3b001e1587c5ab75a
SSDEEP 384:3i8agyWk9RqtN8hhU1M5G+LNIYi6yZH4h6:S8agyW4wChhaM5GmaYi6yeh6
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\127.0.6533.120\Installer\setup.exe
Size 3.9MB
SHA256 fcdf6ee87d81342d7949eb27d5716de504b0b0c7feb9ade2e24a4f83f2fc4165
MD5 5aa8ebc484fabcfaba8d10170d0b4b59
SHA1 522c14c36b2a515426b0a97c97d9a11b20605fcb
SHA512 fd6f029b11908bf19532b4991cdd02a398d1be1bdbcc4b59adba2ae72a3cf3430b52a94be0b6487844b8b74b094aa91d1f514116ea14ae585ca65382f95c702d
SSDEEP 49152:l+zV7GWhurl7KS43ktYosFRnoAXWgsuW0+UH6qMnzohHixayHjJnS+Ze4GTRBq2J:L5cktYosFRjWgeLHchF
MD5 SHA1 SHA512 SSDEEP

Submit Download

GIJJKF

Path C:\ProgramData\CBGCGDBKEGHI\GIJJKF
Size 160KB
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
SSDEEP 96:bBY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:bBY/tH+bF+UI3iWGVYWNkqp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 697f6eef31b4c62045093734e5693b7c2621c77086f3430950f5174df40c3cc3
MD5 5e21faad58d8d3b0c2039d38eca609f1
SHA1 faa588a96bc2547dcf7d7ee7fe9cabbc7b21ffbc
SHA512 50d67f17a524fe1bd6fda55e24755c8970421105f955a6481aa1ceb844d430ea9dd8836e9f12718b69156d5466f99656a4906ec311b77bf9c7bd48131354c8b4
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d
MD5 505a174e740b3c0e7065c45a78b5cf42
SHA1 38911944f14a8b5717245c8e6bd1d48e58c7df12
SHA512 7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911
SSDEEP 3072:nXm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gYc3FDznFdD9w:nXUMCm4U6q62MEBi99gYc3FHFv0vQ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 605bfb84ca7e1a0b27c44c50500e5fac5e3a5ff747d2d10b7e95d363c2b3314e
MD5 90a68fbbf99108f70d33b0f8232b3dd0
SHA1 bd9942e0a7dda02c2f57c58fb78675fea9051c00
SHA512 2ed0558c04286c4e2337ed8c078907f44d9804c5bdd24777c7a1a8949f8d7d7a68c04ab1af2601a52b58206f23692eec2b41f401dba8bab928d1e2e756aecf8c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 60261698babf3826e4c3e3df12d2eec5c6ac186c8fa1898a9b52fc6d39e47c67
MD5 a4fa7f8412f5b73ee8db584fb39c4a99
SHA1 2ebd5fe2adb1bc4daa64025182f721b96fcf2e33
SHA512 c3f3e50fe7a89e951be94901af2ca7aaf83e0cebb13ee4761446f8ece5307a8df1111932bb006843122343018829305049511efd8dddf689f8e1d60941730370
SSDEEP 192:V2X5FjLp03IlBJ87oe8PRpT/8FHV++/nk3eqw0TFPo6yIsnAdgSK:V2X5FXG4XJ87KXz8F//ktq7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 6633e90d11350b63efe4d1e762f2c77d6c41588fb74c1bbc70acb0b72fe30719
MD5 3aced57b415278ad75a2de726195b772
SHA1 8401f298c5d3ef4b9a40d161150c26ed842492f1
SHA512 a77bdf37ff1b414aa32b442d866f2018dfc3f076e7d91e807c142f0700f9f8bb57c0541e3ae10240613e0995f4e85a25d4c8145f013b0bec2cc5bbf1ba8b5e0d
SSDEEP 384:3DC67pLhLc+eviXI+1kXqKf/pUZNCgVLH2HfSPCrUt5HGize9k:3O67pLhLnMwI+1kXqKf/pUZNCgVLH2H0
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 a049ef25702b9e53cef50863819abeedf5ac7c225bdbec8bcec528c06ed54c43
MD5 56c80798ec695bd0dd93b705bfd937a3
SHA1 a1236df1b371c4fd47e252761332f35c9ff6d04d
SHA512 3bb7747688987988b1e67dfc007e3c6eed8b353b0b159ff5308bf846b07b5dcd87044f27ddc4695d28f953e9c9cf7115f3fdd63cc0cbb75d8a0d7faa84d912f7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 aea84502fad7811c5c7c9d2d25dfe42f7eaa7837c9c74917b086bda94fa707a5
MD5 5d2c0540de551a45acabb22274e45ec1
SHA1 f149809ab97b4a68381160ce6f744eaa78a84739
SHA512 a792e82cc679e4eecf1f4058d02d8aab91d948c88a9ac9cabb5a6f8823568f5bbad51852e385129fc71afb3a22cd3ddace8e11136204cacf649c2cc7ec94191c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

trusted_vault.pb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb
Size 38B
SHA256 f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d
MD5 3433ccf3e03fc35b634cd0627833b0ad
SHA1 789a43382e88905d6eb739ada3a8ba8c479ede02
SHA512 21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 183KB
SHA256 bd875a2666875d8390c350a8d8b4cbe6b7668d51dfddf761d9110b9c343c0c21
MD5 21ea7ef027d0afd8d2a0182e16483152
SHA1 a9049bcb1ae851d3f183adc9b83b177257c4d5a4
SHA512 467e176d09e638b20e0b20dffd10418a5b2613873a84fca6f3ada4322a44c84f2a9a958c88aa30980d18360bf48d7958ad7263e8382aa1914936a31d22d76e96
SSDEEP 3072:oHS56OogYYmXM3yGzreFspTrj+KAqMKeSiDkFGiVcmjnvEBagWSptPvZ9CGq:oHQVY0Vzqgrj+KwtXk0i68nvEBa0ptPm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 101KB
SHA256 4a26104f8b91e3b505ad993a866a0709833f351e2ec94371f424689cce00b6fb
MD5 aba4b742c62993effe29bcac9aa59797
SHA1 3b22e3542838f7531f0b207d8dc5a4ccd4b7e76c
SHA512 022b26cbd1e98c16cfe8281e8f6efd3bc372af719bd9313cb8f6cf57efcdbc2119a08530e96c0ce3b86805b26786a37c9b28fecfaa189fce75e86a704a946160
SSDEEP 1536:OKE4ISHe/zJ9VyFb0NiVcfItyMrjxI67AgEyArGgTc2k7GIyOSPRtZ9R42ts:OKeSiDkFGiVcmjnvEBagWSptPvZ9CGs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 183KB
SHA256 94b6f3ca88a09760d425eb50ac628d479517252a3282b1a6900d83b331c5e372
MD5 4f29886dacc6978a838b8f100eca5075
SHA1 4a6c809bad57dce56dd6c42978fa78c3ed61c285
SHA512 b1b918f52ddfa65182761885e1be8e7ef0ef1d89b9cc019b2f757bf9c54c8ad7e365276fcda8c55aaa4e49008d9c8f38172af5498935b7990df0bfa070339f98
SSDEEP 3072:BHS56OogYYmXM3yGzreFspTrj+KAqMKeSiDkFGiVcmjnvEBagWSptPvZ9CGq:BHQVY0Vzqgrj+KwtXk0i68nvEBa0ptPm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 100KB
SHA256 5f8488033d4f6517cc55920960a155c1f872cca4b19a52623e50231572bdd246
MD5 03bd99725323cb234d772827cf616dc3
SHA1 66838951a62e0ee34e8b4b30ed39e0596460e90a
SHA512 4a7b9ffdf047e23a181f1a7223f49588bd8a39f5298d379dea6cc80896511da502593d5755a0f7d17b382bc076d2630feccda4d6ea568155b97f821abbb901f4
SSDEEP 1536:0KE4ISHe/zJ9VyFb0NiVcfItyMrjxI67AgEyArGgTc2k7GIyOSPRtZ9R42ts:0KeSiDkFGiVcmjnvEBagWSptPvZ9CGs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 186KB
SHA256 b5de31b5159929956cf3708bad1042aa685e47b4ed035921cbccd64bb43681c2
MD5 2d58a272618855d43e32e7674fd1fc31
SHA1 1c49d0a732f71075659c3e3a6926018c375afa6b
SHA512 3e1ce0858b618dec62edde89ecc385655324be9b3e24c02883c20a8a9e3b4be41ee94e4bbbc3d12d7ab4bd5d47b4f56795423e2e834f467dc14c787ce2487f43
SSDEEP 3072:K+HS56OogYYmXM3yGzreFspTrj+KAqMKeSiDkFGiVcmjnvEBagWSptPvZ9CGq:K+HQVY0Vzqgrj+KwtXk0i68nvEBa0ptO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.49.1\Filtering Rules
Size 68KB
SHA256 ae2fd01d2908591e0f39343a5b4a78baa8e7d6cac9d78ba79c502fe0a15ce3ee
MD5 6274a7426421914c19502cbe0fe28ca0
SHA1 e4d1c702ca1b5497a3abcdd9495a5d0758f19ffc
SHA512 bf1287f502013308cdd906f6e42998c422ef1e272b348e66122dc4a4e471d01333b418f48d1bb2198c72845bdc950612597e179e612aaa1ba6cf8d48fb8f0cf5
SSDEEP 1536:5tl3vXzj/oGmZSxdCqbP5PfgJgCR4Kdst6zf2Lu4semcjS:Vvjj/VmZsdCEBwgC2ist6zf4u4TmcjS
MD5 SHA1 SHA512 SSDEEP

Submit Download

U.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\U.exe.log
Size 847B
SHA256 f4d1c038db378dec10e7e2fc81ccc2e2d4b8132ef0d66905e3625a0b0cbbde5f
MD5 ef375f28c91db0202bf7db29c0cbc2ce
SHA1 5a3f5d4ec75a468b908c2eb2b9e6f4b1e76c1017
SHA512 f18141e352fcd253e02cb25fa0cff29ab06dec62bafd5aa80ca48c959d1dba97deae830d01bf521f851a8143b9416747eb170d0cedafa32b59155027c02f244d
MD5 SHA1 SHA512

Submit Download

761892313337

Path C:\Users\Admin\AppData\Local\Temp\761892313337
Size 59KB
SHA256 67c153bb214283e9c6ad115eb6cc4c6a8734dba9f3bccc6df0ac8295a59f500b
MD5 8d69a5c97cec4667f5dd1870b52e1cd6
SHA1 dc454320e0b963383b096d84b369454c0cb00c1e
SHA512 d5cd231444a140fa62824e711867f2b43d7e216b0c7f68a0ef751f707a71a4207257db78cb1bb2da638ca6134fb89ad5c468a1e4b635767b2c880071256eead8
SSDEEP 768:stpyceQyyPhUy9z0DsTxXPWEQqXQLYMIbCUe6BGKNyx39pZJbO4tHv5Oqc:stAPyPhtzXXOrUJbCUe4Nk39pZJZ5Qp
MD5 SHA1 SHA512 SSDEEP

Submit Download

761892313337

Path C:\Users\Admin\AppData\Local\Temp\761892313337
Size 66KB
SHA256 4f421997ea611a4c5bb5d7b32fe3f30cc5029d03660c9dcbd19ed7909bb5a403
MD5 1e56a08b625307e32ec052fe910b1d36
SHA1 0d0931b8228249216f123ae6f54fa051c6c2d18b
SHA512 7c39a0bd7c2ea50255e7ac51b597111ae4c7f6a331a2d29e75f2d6a91e72d437393b7aa104bfa975e727288c185c5499afd5eec4d8b5fdfb62a54039ccb70bbb
SSDEEP 1536:sXotv1EjknACxruw/v6SSSSSSSSSSSSSSSSSsaN+8MNd6YtKaQ36XLOIP8w9V3LA:W61ioUsUK0hzw8txi
MD5 SHA1 SHA512 SSDEEP

Submit Download

9a76e035

Path C:\Users\Admin\AppData\Local\Temp\9a76e035
Size 2.4MB
SHA256 a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646
MD5 a189bfea1dacd415afd90cb8fd9be766
SHA1 d305e3fe68c676b911b30721c6ba4bfcd92949a9
SHA512 a92c2b91c8123d47eba33beb247467234b261292c625356f823652b05e6b685723b289f638a05117a67992983ab128262478b7b80ca13d1400fdec3e01615661
SSDEEP 49152:GpGKNg61sSKiEJhmePQ8ugF6kJsWcEhDTwlZYxTwPI2pS0oRNr2:eWM8Xl1zwLqTnIo2
MD5 SHA1 SHA512 SSDEEP

Submit Download

1sesc.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1sesc.exe
Size 72KB
SHA256 f850edcfc0a41c0296474dc465bfb53d7299f9ebb56737fbb4e6a970cd2e5f13
MD5 c4f4156638ac479952f64a7e95f2f90b
SHA1 895d46fdd02604e99841a1b1daa6c989ccd4d55e
SHA512 109c90d97ddd50c3c5663b0ef87161aeb4b13dc1999851298c70673529b05e05936b124be7046e0637263d8f13f905248ea2b4b08c4271745ded0d796a501ad9
SSDEEP 1536:IpheAoMDZno/tzNDVHnwGjqbfZigjeg9ZWCMb+KR0Nc8QsJq39:qheAoMDZnoyff5e0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmpD7DD.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpD7DD.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\VCRUNTIME140.dll
Size 94KB
SHA256 c865c3366a98431ec3a5959cb5ac3966081a43b82dfcd8bfefafe0146b1508db
MD5 18049f6811fc0f94547189a9e104f5d2
SHA1 dc127fa1ff0aab71abd76b89fc4b849ad3cf43a6
SHA512 38fa01debdb8c5369b3be45b1384434acb09a6afe75a50a31b3f0babb7bc0550261a5376dd7e5beac74234ec1722967a33fc55335b1809c0b64db42f7e56cdf7
SSDEEP 1536:yOHL+4KsAzAfadZw+1Hcx8uIYNU5UEH6Q4ecbjtwp2:yOr/Z+jPYNVEH6Q4ecbjtw
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_ctypes.pyd
Size 124KB
SHA256 4fcf4c9c98b75a07a7779c52e1f7dff715ae8a2f8a34574e9dac66243fb86763
MD5 7322f8245b5c8551d67c337c0dc247c9
SHA1 5f4cb918133daa86631211ae7fa65f26c23fcc98
SHA512 52748b59ce5d488d2a4438548963eb0f2808447c563916e2917d08e5f4aab275e4769c02b63012b3d2606fdb5a8baa9eb5942ba5c5e11b7678f5f4187b82b0c2
SSDEEP 3072:OKUaI6Ys/T8uNJKJEt8VkOpJAfrZv1wmquK1IXBPiV:VS6Yswsd8VkDfrZvmrRhV
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_socket.pyd
Size 78KB
SHA256 fdb14859efee35e105f21a64f7afdf50c399ffa0fa8b7fcc76dae4b345d946cb
MD5 478abd499eefeba3e50cfc4ff50ec49d
SHA1 fe1aae16b411a9c349b0ac1e490236d4d55b95b2
SHA512 475b8d533599991b4b8bfd27464b379d78e51c41f497e81698b4e7e871f82b5f6b2bfec70ec2c0a1a8842611c8c2591133eaef3f7fc4bc7625e18fc4189c914e
SSDEEP 1536:dBM6HuD4Zb7hmyAd9/s+m+prnUivSrpZZ31IXBwZyjhX:IeBHAd9/sb+pDNSrb11IXBw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\base_library.zip
Size 763KB
SHA256 77479f65578cf9710981255a3ad5495d45f8367b2f43c2f0680fce0fed0e90fb
MD5 c6b38adf85add9f9a7ea0b67eea508b4
SHA1 23a398ffdae6047d9777919f7b6200dd2a132887
SHA512 d6abc793a7b6cc6138b50305a8c1cad10fa1628ca01a2284d82222db9bd1569959b05bdf4581d433ff227438131e43eec98bf265e746b17e76b1c9e9e21d447d
SSDEEP 12288:KShiavpJn3DyEfpHN5QcosQNRs54PK4ItijrVwHLfVEhOJ7iStE0r:7hiaTOiQcosQNRs54PK4ItyVwHLfVEhU
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\python39.dll
Size 4.3MB
SHA256 f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366
MD5 1d5e4c20a20740f38f061bdf48aaca4f
SHA1 de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0
SHA512 9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397
SSDEEP 49152:jtWzzUIxSk/gRBDcHIPEh1sGZxMuXG/nP9CmQNTFd/UQtrEB/DRzLnU4Jj/rDgjv:jEUY/U8SSYZ+txquHzMGxwTe
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\select.pyd
Size 28KB
SHA256 d56542143775d02c70ad713ac36f295d473329ef3ad7a2999811d12151512931
MD5 fed3dae56f7c9ea35d2e896fede29581
SHA1 ae5b2ef114138c4d8a6479d6441967c170c5aa23
SHA512 3128c57724b0609cfcaca430568d79b0e6abd13e5bba25295493191532dba24af062d4e0340d0ed68a885c24fbbf36b7a3d650add2f47f7c2364eab6a0b5faff
SSDEEP 384:aWu7drPxT7FAAYeq15MkgIw5oJwhTGHqV+6bTPAr7hCQz1IXmGmDG4y8mzHDkhqH:zYyAU126JwhiHq18Pz1IXmGmDG4yjMhc
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_rffeacjh.kzx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rffeacjh.kzx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

1111.exe

Path C:\Users\Admin\AppData\Local\Temp\a\1111.exe
Size 2.5MB
SHA256 b8df70d0227e4277fa8e1e2efe6f86c4c087f60a68744aa89df83d1cdd15253f
MD5 67846d1862f63942b00eb61e47be2652
SHA1 a018b557975a35fa8c001a43a55d08cef7d426f2
SHA512 5dc36ebb7b3148c23f0e248971d04519587f7da0ff9320a85f64ddf1e9b10e907aa7d88feec725b385e514816c829d375b01f91d4c64d3c0ae6664a9d5906150
SSDEEP 24576:jwda+neGKs33WaOAv48rTlcIN6Khi6UySec31Wnn+heWMKEImx8WtylVJnNtPXXn:f23xASuhKVmU+4WMKM9chFv
MD5 SHA1 SHA512 SSDEEP

Submit Download

66af4e35e761b_doz.exe

Path C:\Users\Admin\AppData\Local\Temp\a\66af4e35e761b_doz.exe
Size 4.5MB
SHA256 0843b763880a4e1b559d29140afff5cd867bcada20eda6db2524d4e5045af114
MD5 c7904602501fb4a18a2ceb29d1c7748b
SHA1 cf51727aab14549d8748ab60876b3915532b08be
SHA512 70512f5498fb5f813bfcfb3383807f3beee8dfceb24156cfa9dab122baf2aa15681b0b9dbcd0e29537d07383656e08a6dd2d2b8328ec2c80488839ba66d08a13
SSDEEP 49152:cr/3+oa7VxrIg3J5h0ib1kAVBe4kmF3k+fthNbLIGivvPucQqppfDNKHoAjc16Nv:cr/+oa7brb3dkMCFPJjDwI716X
MD5 SHA1 SHA512 SSDEEP

Submit Download

66af531b832ee_main.exe

Path C:\Users\Admin\AppData\Local\Temp\a\66af531b832ee_main.exe
Size 4.4MB
SHA256 521d404952876e51d0cf3a4d0d69e30566406a3a129343d5e53d5d7274f4d3dc
MD5 46bb5bf831f8b516b87078f35286a4d6
SHA1 4a6637b3ace0542d5629dfef7ad3b0b5e73e9c01
SHA512 9b8abf0478563a402edff57282c1be0475742f403c07d9b99ca5ff36a5fb7831d2af76bbef046dc9b2b1b084ea287b20040610c44e0ccb7251b9d6e9fb2fda19
SSDEEP 49152:h1B2HjcXLJbDjU+zI0EMnp6a8ZPoMhY+FbmJDXVBRSd2ANZtJjVQRQEdSeN5uzKV:h1B2HILF00fp6a8MmfB5EdS+u+I/Mp
MD5 SHA1 SHA512 SSDEEP

Submit Download

66b0ee142cf8f_PhotosExifEditor.exe

Path C:\Users\Admin\AppData\Local\Temp\a\66b0ee142cf8f_PhotosExifEditor.exe
Size 7.9MB
SHA256 8ef1d24500ab75ee2ebde59ea01df3a168b41d9d7e987ae843c1188ec7dac49f
MD5 677ad736788d93b76ca77717706a8176
SHA1 e5ceecfa05f98c11f58b8844cba4e52850e11009
SHA512 df2b84b37380ef2776d5f4d5179006e5ef0f318928fd040bea7ba4a88808bdf62220cddc3ce7406f30aac1e7ea019d1a994eda2c7fd23038ca0748e078db6700
SSDEEP 49152:Imo7Co7xWaVpuCaqn1FmIV6Oi+eVw3HaRAGx3ycrcj/ushk8JZSjkE5E64Lo8QXs:w/VhZ0CLwEmCPaDy3B51VX
MD5 SHA1 SHA512 SSDEEP

Submit Download

66b331646d2cd_123p.exe

Path C:\Users\Admin\AppData\Local\Temp\a\66b331646d2cd_123p.exe
Size 10.3MB
SHA256 bef765aff3d916d8be504b604c0dc37afe3fd76260fe158508b778b5e4b85ddf
MD5 27b14ad026da76c1111174c6b4ba6aba
SHA1 e55a0aa823a6c91ec602d4e6f283b23858965a08
SHA512 a4f682d6e047c5e3bafc5431d6ddc2a3d6decf47c14ef14ae3a9581cf669db5314bb19b7f9437b9236a28338472e94407dad7745465afb691ffce3548503624f
SSDEEP 196608:tSiB9/zPAW0ILyawlf9Ul33DqL4zDefJglqYnkFTdl434Mfr:tX97fB6iXvkFTf4zj
MD5 SHA1 SHA512 SSDEEP

Submit Download

66b4af430a0a1_files.exe

Path C:\Users\Admin\AppData\Local\Temp\a\66b4af430a0a1_files.exe
Size 6.2MB
SHA256 c4af46f2a357b68ce8e5830d9639e0c9212c61ae5d0fd1bb283812217a14ab72
MD5 f3d8c82810e55bc012bdeb2557ff13b9
SHA1 f899ab6b698678aedc8b24a6d7599114479216fe
SHA512 3e93f06c4fcbe06a904144bb08ec876587b58626c80d9774c0282f67530d3cf0668a9da795899cdc618e6ace6e513b9cd82b7dafa4c09d4fdb0e9b2160dd4f7f
SSDEEP 98304:O7Mc42rKqtx1rLs5Et54d5k0rCs0ZBLzj7xibnsoKbmLe:O7Mc42rKqVbt54dtus0Zhzj7gyb0e
MD5 SHA1 SHA512 SSDEEP

Submit Download

66b5b75106ac6_stealc.exe

Path C:\Users\Admin\AppData\Local\Temp\a\66b5b75106ac6_stealc.exe
Size 6.0MB
SHA256 e7ad5000fcab4b69737e7b206f7ea0fbeeb7f68443e983e924e2710b54c7e5d4
MD5 67d39f0cbbab44b99fffaf3a408b2088
SHA1 ab84d55834c956a7904db0061a9fe145a6e9c783
SHA512 b5ef2c31e80527bf5715db45cb859d79b16ae4361657298173dd666290d14ce3f04e366ef203f00663964c815fa101ef4a42036669412c67ac4daa020f4faab4
SSDEEP 98304:whGngB5QYShcGyafbzArMRYELUzbf9sdA:whGngBuiGZzAgR1L0bf
MD5 SHA1 SHA512 SSDEEP

Submit Download

66b5d9d3adbaa_defaultr.exe

Path C:\Users\Admin\AppData\Local\Temp\a\66b5d9d3adbaa_defaultr.exe
Size 11.1MB
SHA256 b8a5ef9ea9fa588907a197db55c743559460190aa58b227db10d6be75d8bfe39
MD5 45c0d8bedd6bff145cbe1c3064f2cf56
SHA1 5a68f160bde8531f0b38ed8f9c6b19b7e615a905
SHA512 3963adecb4ee013b54c926328fe0d6576d291dcae0ead3f675c38ddb51b2747e0469179fa4903e3237fe2beea7079f67da377f3787b3bd4ddba8694102af0703
SSDEEP 196608:uq5Uz55kDba3q4c1X2usHfdV5bvMzeO/FmwuAf0+OTZ5l3:ur55kPa3qEbHfdVRvI50wnVOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

66b837290469c_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\a\66b837290469c_vidar.exe
Size 9.3MB
SHA256 e603e36cae3f0fa9badbeaeff8fb0becb1ed444776892db76cd8d219e2ba92bd
MD5 dd9a8bbd0b8038552cb57b07a56f0ae2
SHA1 0f4a5f36b7f29f9012f73595594c564b574df9ee
SHA512 1d215eae3e854b04e8fe4d2f3119c9308882f5c2f4125183ca21e034c7be6da0a6549aacb0880900e667cb2ee3b1a29aabef24a17bdec83e1a415038664b2b64
SSDEEP 196608:Jpz9fBq0j8nLcDEWbmuSrparTKQiwiYAwE5H:fHctDHQziYU5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

66b85f47d1f63_stealc.exe

Path C:\Users\Admin\AppData\Local\Temp\a\66b85f47d1f63_stealc.exe
Size 7.0MB
SHA256 4ff955e39fc6b4f0c0a715c3b87b95c47d61df9145e0071061a5070a5c87c855
MD5 f90545447cc1a034b5808ed7fdf73091
SHA1 9bb93d17ff2aa79cd39ba9307f2f2dc907f854f9
SHA512 c3c8670afb7b4bb4b9a2e787577a9dc3bf8564d0795fdb978090ecc97ec00db633303773a1843dceb4cd89a281c96a39cb5a7c231d87382989dff07536a95807
SSDEEP 98304:EOWppv2hgpNk4oGuiauETZj+Sn4vVri/GI:EOWppv2UkTbuE9j+S4Vi/GI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Documents.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Documents.exe
Size 72KB
SHA256 ec76d4d641e6bcfea1c76a81727fe9c525121d782346ee3ec88d87de69f45eae
MD5 cb6b3683ff1df73bda3d32c03ddc8700
SHA1 d28d4af8387aeaefb4e8d5815ae8c82dfb50fbf9
SHA512 6c8234a0836af05f75179746336a730524f5ed74b215d28456e1e8931eb5c619734b7e025a4c3007645e84d8daef9bcd159a68b9587cfcd911f20a29001e448d
SSDEEP 1536:IAUdS9YXxzwA+Y1C6w4REE3Wmc6NfMb+KR0Nc8QsJq39:+cYd5+oCEEic6Nfe0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Extension.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Extension.exe
Size 72KB
SHA256 3c7765451ee006387b6367e75c7a53c2b4e2ad5639ae27ef80755b11a4123fac
MD5 42710df7d572082524e742e5e4f3cab0
SHA1 21abbff0c148012f3863bfcd1dae294c8bc7ec34
SHA512 2eed026168142055d30fbbe5c7c8bcfa43522f82b8b6e8bf795659d3e91c4634ccb557a0a6524256d307e74abc2e3ac4d474dc1f618450d6a71a37d8a2118779
SSDEEP 1536:IQtHHoS+Fu9A+TsSS90ZnWRvJUTqUMb+KR0Nc8QsJq39:Ttnlq+YSSSZWrUje0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Identifications.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Identifications.exe
Size 9.2MB
SHA256 41657910cd010c7e5ebbbfc11a2636fa1868a9bffe78d98b8faa7bd0e9c5c3b8
MD5 5f283d0e9d35b9c56fb2b3514a5c4f86
SHA1 5869ef600ba564ae7bc7db52b9c70375607d51aa
SHA512 b5b78975c6328feb5e1986698174a85ddf722a639234eb6fe80cfccabaa7d0c09678c9465fd6a9586a0a412f2586d9e9d38eb5243626a2b44a8c8512322415b3
SSDEEP 98304:PhkHWcnoeoJETpLcGQF3CRqQh+R3VH+TSBEcDqpK5:pYWQoeo8cGQ3wqQGleTSjq8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mailer.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Mailer.exe
Size 47KB
SHA256 c5bd778d6cb31d3e6970e4df3d5d058bd9f95db7faae9fa55c5854d53b78898b
MD5 07924a75dd7d92d04c18063bea0d0b61
SHA1 12f1fc566c29f2db6548fcbba77daae1ff59fae3
SHA512 c016ff36438146653d3579e994013529d945211f0c9dd2219fb38633bd590be5a1f5065ee125bc7e658086afc3a8b57304a0627dbef969e666dc07cef6ecbd22
SSDEEP 768:Iwe8hnGkbDwaqsMyzzbrHWRAYzuxUbcaUM5lgVl0oAkDB4j8PkKIhSGLPUq3:Iwe8hGEq1y3HWRAOucWf0oF9P3GLsq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Meetings.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Meetings.exe
Size 346KB
SHA256 811326123c9b90d8932c4679c574afd2097496d883edc7ce6b0800afe90abe72
MD5 209ae4a712ada48aa2d5fba027ed58b6
SHA1 68d7a9260aba3859f6a5e59c2283635272ae8d09
SHA512 e2a5726e08ce49caa1a90b8c3596ee1f4cd7e85def75dbf8318b74f062de6bc75a69c9139db0010f3082a48a3f7889aaab289cc2de189ac40acef40e4fb29863
SSDEEP 6144:yTouKrWBEu3/Z2lpGDHU3ykJ3RkJ/T4SUoMyE:yToPWBv/cpGrU3yimxTnCyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mke%20Fallen.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Mke%20Fallen.exe
Size 192KB
SHA256 055f7b2e38401cb201d4b594e7fe205484681495fb2393185910eb80dfaaec20
MD5 eaeb33cc12fd71532fb6156938f46854
SHA1 a9e8a3ce071a58ce801bc4a7d2afe0615b7d3f88
SHA512 459501464c6ae917443ef94cb99d0ac40c3d320ad5d2007a3956c48f64d5cc5ece0c00be9124d0922a256e42d70ad0adc73c3b508bba4b9e2480a97b0e5e8f64
SSDEEP 3072:2POKWROAEATTiczEJToGGhKW9o+SALvH/n2w52YGLHY:2POKWRPTDEJMhKJaf2uyLHY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Setup.exe
Size 72KB
SHA256 554b6beb5ba502b5028c26576265738a4f212db2063d938ba90c89f78daf5481
MD5 55222d629eb6d7d189fa5a28991c7c97
SHA1 7b37a93bf57a9bfb92158bf6b2d4dfe617bc28f0
SHA512 c40d3185d4a8f671d448564c3d70063601ded69e20b5ccba62a0b1de33be9e7e5bb8f74e8c5625bdf6b2f37def20feccb94be85166bd25c0df9d0c3912eb8eac
SSDEEP 1536:IRjQTc27JesMobd9NSPBMb+KR0Nc8QsJq39:HTciJttHSJe0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

T7.exe

Path C:\Users\Admin\AppData\Local\Temp\a\T7.exe
Size 13KB
SHA256 a288d0d898c7729037ab07a8ab05713862a3b74aba2c5fc55ec2cd590d547a7b
MD5 106317cd019b63fde3dc44b2e365d0e6
SHA1 cf8158e8e6433a5ddd81f68558632bbad3d33db6
SHA512 b1eff4c179096157252ae383860862fc53394094d76459d18568b669290c150291f671f8d80f7e741c436466e66cb0db197f79d9a9a9282961b3baa101f9d5a6
SSDEEP 192:blqqChM/KUTOQ4DT7hcGFJy/y/y/yuQ7HsIChl9ozK75MqfD+YCPAe:5qqChMSUr4vuG6uLChczK75MqfhP
MD5 SHA1 SHA512 SSDEEP

Submit Download

T9.exe

Path C:\Users\Admin\AppData\Local\Temp\a\T9.exe
Size 13KB
SHA256 8b2951ff344d2fcaeb0045269c93e0ced5402ff53efe685cde78fba2293e6283
MD5 762e2c938ec4a35e6b67fafb977fd05c
SHA1 2082b2a1b33adcc4aae73cbc072eaac50f72ab7e
SHA512 c688320e12ca1536217282a42c02dd4d19b97d2dc96ea206b1327866fd496f277c21426fe9cb3e894fdf3bd59d0da6f4ab787bfa4e53d010d038e1d3156f9dfc
SSDEEP 192:nlqqChM/KUTOQgDT7hcGFJy/y/y/yuQ7HsIChl9ozK75Mq3DCGpYCMe:lqqChMSUrgvuG6uLChczK75Mq3eGOv
MD5 SHA1 SHA512 SSDEEP

Submit Download

TTF.exe

Path C:\Users\Admin\AppData\Local\Temp\a\TTF.exe
Size 13KB
SHA256 2d187bb4a0d2a51dbe68e4085815167c952803f310c323bfe6f39b2cfc9f6532
MD5 b5fe23cf43111d7500a18d432d1a9307
SHA1 e3b7dc412ce069a4262522b7c8e791278fc130dc
SHA512 54ee18272c9d3e700452a69a7a0d56cd9ab32196878f059e3ab3fbce0558183c5fbc06eae7b7b0def3636ec6747867a138b1350cd8a9a2ec046e704453f4db26
SSDEEP 192:ldZHTyWdt0hqi47BzrbqIwpnvnvONDTWoREN5Mqg/CNe:ZHOouh7y+rqREN5MqcA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Teamview.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Teamview.exe
Size 72KB
SHA256 f326ddac0f73b4addca3cab4ab77ee95777cee572b0eafe1fceb4017f083bd3f
MD5 b45260f399b77d44c118288df45afc6e
SHA1 0a4d4cd555ac4043a768218261ec04aee44d6eb4
SHA512 ec3b223dc08859a4b74f4c7ff5c1bb2c36563327df93bdc5147c838ae43ea1609370aa81f609acc62586701d70876b243b71a22006372c1dc7c98d6098c9d5b4
SSDEEP 1536:IO2UBxjvKVDevkF4kUUHxYphMb+KR0Nc8QsJq39:q2VvPrkUURYphe0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trial.exe

Path C:\Users\Admin\AppData\Local\Temp\a\Trial.exe
Size 47KB
SHA256 5276b39a55cb85f30195a5150dbb2b6407a596adbd3482cb0dc099049bba4224
MD5 8c85fdc958d3299c7cb1fc0a82be0a28
SHA1 4a26a14a230e1285ee3b4e622fe7922292e8cff5
SHA512 5c1e96d4873e8f16e8dd5f7d7e6911ed3410986d55914a453835a0124eb2b3a617890b67b78d2a9de27ebe49e37c01cb16838cdbb178e78af51fd05223a4a1b1
SSDEEP 768:IB93PtkMdRPAowZUEkhwasYseaiqAiwEo03RnD/OjG9o7uQXq3:IH3FpRPAooUuleaiqVwEo0xD/LAuaq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

U.exe

Path C:\Users\Admin\AppData\Local\Temp\a\U.exe
Size 13KB
SHA256 05609085a166cd35855e70c9b9e89372f15e35a21dcf6e0da8a30648b4950f93
MD5 50ab74c3916f51cd30d6d588211148a3
SHA1 cca87dbd37fc9df0e007c3a98ac7d214eee703a7
SHA512 094eb17919dfc550238fa202080136cb3d8298ee518618935c54ee4cab6b0c4e3bb863b9e53b1580d1bbe42b307dc72f0b6f4c47740bbf79de20ded3e4741320
SSDEEP 192:11ZHTyWdt0hqic7BzrbqIwpnvnvONDTWoREN5MqT/CMe:RHOouh7G+rqREN5Mqrh
MD5 SHA1 SHA512 SSDEEP

Submit Download

WE.exe

Path C:\Users\Admin\AppData\Local\Temp\a\WE.exe
Size 13KB
SHA256 afc9edae65579141465dd988495aa73366f942287ac85773f0c630b5bb3e2420
MD5 c3810dc34fb0dd806c01d2a15617e343
SHA1 7e7a1635fff8401c6342ad3c68472b6ef1ed1d1f
SHA512 b8d1bf4fb186bd45faecdd11af29c2d30d97916d6d8ae94f55ca6f6d2d3dd771b6da09b3e56d0517da25232e8e3a72d1a3f4ef0b6dab7be48f020bf327e61893
SSDEEP 192:56ZHTyWdt0hqiP7BzrbqIwpnvnvONDTWoREN5Mq2/CE7e:yHOouh71+rqREN5MqGX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

authenticator.exe

Path C:\Users\Admin\AppData\Local\Temp\a\authenticator.exe
Size 768KB
SHA256 0bb9e107a5f5f9ad838173ebf222107d37cc1f378fa10f46ad5b2914f19f8e72
MD5 1560d6506f8e57432427df2bc4263f12
SHA1 70f83580e72e75f4a1b215abf55d9e07beb683f0
SHA512 e5b0eff2054b6b24efeb9f8df23cd22e307d5fac1669e86b798d8caee2e3c4ea3e4c6213abe868ba44b37b689e5b52d4d3a40fd0167a476c06bc32dded69a202
SSDEEP 12288:rvsXZv8km0OHcbGbvzWHz0Hnquw3y+h0ssFWylkkoAbtEkOwfNqbYS2VbICKMIU6:UfPz0H0Lh0ssFlSjbmk
MD5 SHA1 SHA512 SSDEEP

Submit Download

backdoor.exe

Path C:\Users\Admin\AppData\Local\Temp\a\backdoor.exe
Size 68KB
SHA256 9cc2e2d5feeb360b2ea9a650809468f08e13c0e997ebadf5baa69ae3c27a958e
MD5 698f5896ec35c84909344dc08b7cae67
SHA1 4c3eb447125f74f2eef63e14a5d97a823fa8d4e9
SHA512 2230abef3f2ac7fff21f2af8a1df79a0ab3f7b1153ce696745ff5cef7f677bfe562dc820eb36be8e4819210ffa565d52e3b940f0cad5427d30a3aa05a4bcde2b
SSDEEP 768:VprWOayEeJqYEs4fmZn5gzVwKXlhK2FkHPP3lLuzZPKqcPOI+HhM81+idVNH:Vk7fmDgZhHFkHPP3lLuBZc9AroidVNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path C:\Users\Admin\AppData\Local\Temp\a\build2.exe
Size 481KB
SHA256 e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042
MD5 f9a4f6684d1bf48406a42921aebc1596
SHA1 c9186ff53de4724ede20c6485136b4b2072bb6a6
SHA512 67294a47dfef6aba404939497c403f93318841e9c5ee28b706f7506b5dff2630381e28e86f6dcbfdff2427092a515db1dc0a04e334e7f8de8b0b682269ff88fd
SSDEEP 12288:UHdftnB3Zp+52J9+62HHLhJ3er8XSwW0:UNz3ZwwJ9+7HFnXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

c7.exe

Path C:\Users\Admin\AppData\Local\Temp\a\c7.exe
Size 316KB
SHA256 e00f4b1980537b569386c1e5d37410b11aa74a4f771311cec06d60130d7aa1c5
MD5 819ea2d1b7f70aa3fab1a5eefd8928fd
SHA1 c13b663ec677b95631a845d2627e12d71ca96fdd
SHA512 3e8261f470ddc9a06077ad352fd5d34f3c999f168e7e53b9d5c8c2d4ab9691af89ab208c09767b27519bcf9cd6fdf4e4df949ec219bca4fda1165b178efad113
SSDEEP 6144:q0Waah8pp1DQaymgZuGITFu1Vu3bM3ejGhYKZ9de90lL9ZD/FwOm0wu:qApH7gUGITFUyGh7Z9UGlfqk
MD5 SHA1 SHA512 SSDEEP

Submit Download

carrier.exe

Path C:\Users\Admin\AppData\Local\Temp\a\carrier.exe
Size 13.7MB
SHA256 29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72
MD5 3686d869af7276fa2b6d55d04bd69d0d
SHA1 d830c559d05cd9684d94046f4475e802ce287463
SHA512 438e87d837f0f000eaa8074c64865b8fb70c7bf2dc7046436092c73ce6ff4d867c014cb390414ff1acbdcc8c30458e1fdd855458538d6683a76b50d0cf5afb2a
SSDEEP 393216:/hI2sim6V8lXRa6sUbMY2skzbd16NI7jBr:PScTP6Nkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookie250.exe

Path C:\Users\Admin\AppData\Local\Temp\a\cookie250.exe
Size 304KB
SHA256 f7b57a665ac90377683c434a04b8b6894c369d34fdb03273778a8c9f8fdbb262
MD5 1b099f749669dfe00b4177988018fc40
SHA1 c007e18cbe95b286b146531a01dde05127ebd747
SHA512 87dc26b28cb2c43c788d9ae9ef384b69be52b27500bc23cdc6acc8567e51705d99ef942cdc0b23fa6a7c84d4ddaaa8f05865a8e7bb4ad943ba5deabf7a4105fd
SSDEEP 3072:Oq6EgY6iwrUjdy68KwPMCqJRn7cTAVtAaK0FcZqf7D341eqiOLibBOU:1qY6ihwPIzn7cTAbAqFcZqf7DIfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

exec.exe

Path C:\Users\Admin\AppData\Local\Temp\a\exec.exe
Size 304KB
SHA256 69e4ee0c49e80e9aed263df6c7a62b6896a80972002b3e71b68d7623843c01d3
MD5 7f437ba23ac06e9f17bf831fe4610b7c
SHA1 0131f155fa2aee4a8d3c77cd795988f466eff6d3
SHA512 802ed8bcc7bb2651794cbbd0a0391b931b6f776551457496d9f461f7dea5d9b189bcf388151544934f72164c75d3e91680a053313e0e2f293bef120b8ccb837c
SSDEEP 3072:Eqq6EgY6iRrUjsgMmwPPQhy2qmTAPtkSiihcZqf7D34deqiOLibBO2:EpqY6igwPMXqmTAlkQhcZqf7DInL
MD5 SHA1 SHA512 SSDEEP

Submit Download

keylogger.exe

Path C:\Users\Admin\AppData\Local\Temp\a\keylogger.exe
Size 51KB
SHA256 6054e52edc7112fcecaaf39f37c6bdaa35f98bfaff45d4e01802b9a8bedd2eef
MD5 fbbc99e0b5c7a5f4b76886520f5a4f63
SHA1 361b841c52643792c26868f90e0330ba2ab131ae
SHA512 5de0b99a9d3f7cdee1d9ed8122c62f096b59cca93c9ad4c4eb15da6bb08d5ea07c09f2864e8a841dcc4095e890e47dd595f51c535ab37713f807a151de52cb11
SSDEEP 768:7GXBPxEENGqtiAoga/G5PP3lLuzZPKqkQF/rxa0VeBFt:7GxHGqM5p/qPP3lLuBZkQFE0Vgt
MD5 SHA1 SHA512 SSDEEP

Submit Download

l2.exe

Path C:\Users\Admin\AppData\Local\Temp\a\l2.exe
Size 4.4MB
SHA256 f327c2b5ab1d98f0382a35cd78f694d487c74a7290f1ff7be53f42e23021e599
MD5 af6e384dfabdad52d43cf8429ad8779c
SHA1 c78e8cd8c74ad9d598f591de5e49f73ce3373791
SHA512 b55ba87b275a475e751e13ec9bac2e7f1a3484057844e210168e2256d73d9b6a7c7c7592845d4a3bf8163cf0d479315418a9f3cb8f2f4832af88a06867e3df93
SSDEEP 98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

microsoft.exe

Path C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe
Size 384KB
SHA256 91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d
MD5 27aa8ad8930fa0d076510cfb6573ce74
SHA1 26da6ec9efcd8b95c2d744373532afd12d26bf8f
SHA512 bb1af7c9caf9d05e6bf2ebf3ff8fbada74c0e4fbac04759428da3766110b66a8966081b22c0ffc4dc3a141a0914e552a6fc0a766c037c438546e8d4124f5922f
SSDEEP 6144:6JHf/OboJwboxHcE2Heo6e+qFCKs7cDZGrBKdt7cWZGbpYByPT7lyvIcbSIvF68U:c3VwboxHc8o6epUVKd9cWvByPHly5WIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

mservice64.exe

Path C:\Users\Admin\AppData\Local\Temp\a\mservice64.exe
Size 668KB
SHA256 b0d8f20c0bb09ab90c44281d372e98520c94cecaba6a374be64dc4fdd45f1c89
MD5 c1915f095d3e7b2ad07b5aadc21be2e3
SHA1 9643864f45e15e14e95545cfae9462c977933ba4
SHA512 e1dbd8501409dab0537b9afdb8961c3031280e0968f0dc0bc3339e14af3e1f009bdfa0c5425f62590f1db6c8c33fc65b95da65cacdc83338128a7887676bee13
SSDEEP 6144:RQZ5k+iRrJ4Nt8sWrmWzSbz3V9boYOusHoAljVmA4eXq6X7Af8eeNMqQQRl37qco:6Z51wJ43JrDAJVBVXG1Qd2f
MD5 SHA1 SHA512 SSDEEP

Submit Download

nano.exe

Path C:\Users\Admin\AppData\Local\Temp\a\nano.exe
Size 552KB
SHA256 4bfcba248d79dfd6c2cba52d7c9ee18842f007bfa0e3ba99ababacb4794e8c6e
MD5 1873f27a43f63c02800d6c80014c0235
SHA1 3441bba24453db09fb56e02a9d56cdf775886f07
SHA512 9f2b663afc1cc3dbc8eba3278f61ffb41c19e42f94ee4c8a60eff83c8846b81d34e4ff869b643434a8ad5657c46bd06a712f0598062b62802ba6f0ee6f4fb8f2
SSDEEP 12288:WLV6BtpmkzPLrQIh+ReoSwN+Jp9rQj3SHdEIzqLPxc3hHyOm:EApfzPfQ9RecEp9NzUi3JyL
MD5 SHA1 SHA512 SSDEEP

Submit Download

networks_profile.exe

Path C:\Users\Admin\AppData\Local\Temp\a\networks_profile.exe
Size 6.6MB
SHA256 37c9a26faec0bb21171b3968d2e4254f6ae10ff7ae0d0b1493226685bc5d3b4b
MD5 7306abcf62c8ee10a1692a6a85af9297
SHA1 69900ccc2400e685b981b3654af57c062ffb44e2
SHA512 cd00a60387e06fcc6f14242adb97a54575a49cf1e9b22c74aa5d8bb7617e571fc194049691e4ee0fcff8bdd659b04de62f46d07e2f3330c18ac7035134e183d1
SSDEEP 196608:p+TPoCsXDjDyf6L2WliXYrHW1LIiruQC:2PoCEDVL2ciIrHWRIiS
MD5 SHA1 SHA512 SSDEEP

Submit Download

out_test_sig.exe

Path C:\Users\Admin\AppData\Local\Temp\a\out_test_sig.exe
Size 5.0MB
SHA256 3d37b55464bded5c54903c5328e695d9b08b483e65cf6bdadd4ecf93954dfc9e
MD5 47f2701f1d1f6645baccced737e8e20c
SHA1 56e90cc7888e2cc74916ce10148a10c9261fdf2f
SHA512 1b3f47fa75b041e8a2e144d3e98d103e90ed119b530ab7f7ac61ada3c4cad9abfac93a480b2236f1f6c9093f2ea9529acace77ac15f851450f5e16015735b045
SSDEEP 98304:tPtk042OYyWXqqxx2pC6BGwwsNFkeP9ISfhg:tNy5qxpC6
MD5 SHA1 SHA512 SSDEEP

Submit Download

pimer_bbbcontents7.exe

Path C:\Users\Admin\AppData\Local\Temp\a\pimer_bbbcontents7.exe
Size 5.8MB
SHA256 f7bbd59299cad16b2cb4916738ad1475f61e129763cae617f1f9184f20db1d99
MD5 abb5797dd47bf453358359acf2453551
SHA1 cbce075e182eb636b6935296d80fb185a48a07a3
SHA512 a6885bd39a574c75587476328968d0fb1206ada1b33f575551433b70341d259a3db3fc7b19ef0d6e30c4411c38073e09aa0ad92ebeb1fca9889f37f734d3f9ba
SSDEEP 98304:NBnTaRw5XvCTQsvyuC7qlML4ZRediPxWaNdW/FaJh:NBTaRbTBvyHqlML4adWh2/FU
MD5 SHA1 SHA512 SSDEEP

Submit Download

regasm.exe

Path C:\Users\Admin\AppData\Local\Temp\a\regasm.exe
Size 593KB
SHA256 5f569c72db9c31528daf2e907938b9bb711ea3a050efe5bf5d514dc962c5415c
MD5 f74f2df998219d602185c46107329e82
SHA1 a0f8eeb2e5c712e690923fdaf3b7cefc64f3d63e
SHA512 b28e1eafefaf4f71666bf6c216c8672eb615a5e369bd913b85d99b2774df76ffaa489f145722a93f80f2afcb76eef40e62dcf246793bcf867d696487e9343a9f
SSDEEP 12288:s2yqVxaEUU+U4J6eMt0LYrfZLpiBLpuexkO4G36F2nP:s2yqk++T6ewBrfl0Bsex36
MD5 SHA1 SHA512 SSDEEP

Submit Download

request.exe

Path C:\Users\Admin\AppData\Local\Temp\a\request.exe
Size 307KB
SHA256 8e2fa428fa5e7092d117dadf10529a35f415a0b8fa27cd17607e23dd913ffcdc
MD5 ef8320eace6f753231666c61104bdd49
SHA1 0166aceb79a7d6b4a041fd7595fc1d75404a4419
SHA512 354676c97fe1666920a75fdbffecfd0ac802613572b9e7d0dbc9a1ac24b3c771ca8fa3c1f3375f0a1c90364a07fa22469d2e7eb822196c0a2a1893931b62efe9
SSDEEP 6144:hh9fH2l34HigA2/BDBaBL7cpnBZVCBQrfYQSlyItcJ2+QmmaeIBqk3biuFo480AL:s9jtaeIBqmu
MD5 SHA1 SHA512 SSDEEP

Submit Download

sahost.exe

Path C:\Users\Admin\AppData\Local\Temp\a\sahost.exe
Size 922KB
SHA256 9238f0f88af5a6f80f79c66f502b73ca920522f58128428bc556054963ea6d1c
MD5 d996f588469a7a1af5ababce991b42f5
SHA1 2086f187e1bb96da2fff9b7233bfda8eafc9ae05
SHA512 5a55a0e83c514a7f98a933eb658d72ce3d4fbc371cdaf737b80fa1db75cb77f1a6dc429bd0b852f7ab3985bdba497b475979de67bc43675d4857d235d9baf96b
SSDEEP 12288:tCQZsNPaRtCQjl6dOUSCxwBceIBQpF6Nn5UNTBGSBmMy2hkiRicdX4LDeTc0xtzs:eNDsYdOtTIBQ6NnKiSlRiuEIJR+nLh
MD5 SHA1 SHA512 SSDEEP

Submit Download

sihost.exe

Path C:\Users\Admin\AppData\Local\Temp\a\sihost.exe
Size 649KB
SHA256 e7e5fbeb7606fdcdb246a9df4efaf2896a82cd335babded9231dd990a110628f
MD5 6fe36f5cd0c522ca1241658ec2553db3
SHA1 f197615adff4daace92fd2f0c4f266a6170aa464
SHA512 2b288eab811c12a818d089d419b8e51ee0b3692274010303f968fae82dde99a82c8601621860222c3b365f64fcc6508310e51cf3a954414054822d293d39196b
SSDEEP 12288:BY0bffsWYCGpoTt4wT3eFjtyiyCgchaxpvQfSgYE:BY0zjqgt/T38jty8hs4fPYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

stub.exe

Path C:\Users\Admin\AppData\Local\Temp\a\stub.exe
Size 48KB
SHA256 91fb355fdc173c40fa77f8a252031d6bc32fab91c5e5573da28044494691c820
MD5 a7ed4ba445aa61c4632dd6579c212bf5
SHA1 a81d766d12a6dd8c3cec537387a089650b34e103
SHA512 2a0e0afdecf803657f2d67433399dc3119a3b4221334a9c8d7cb3e3e741457aaa26d2edd32377a102f1c539a4ef065cb5296d4cdfe7657993223e675e3fd4bae
SSDEEP 768:2u62dT9slTJWUhDuzmo2qLGdFx4mMaYc13WOAo0E0brMIYLECgNREeo7Hkc1KXc9:2u62dT9We2ZamecoOA1brM6CgAHkSpdX
MD5 SHA1 SHA512 SSDEEP

Submit Download

tc10.exe

Path C:\Users\Admin\AppData\Local\Temp\a\tc10.exe
Size 72KB
SHA256 62f2c3c1f11c2ac66e9c755dec3ab49a5cf2d732e22a71d44db5a00b564ff913
MD5 dac7ffcb0844646ba715b3df810c70e2
SHA1 68f04f0730c7043d18d1d0d5a85f92f827c7e2af
SHA512 931dfcdcced518338f02852c56e83977e8c2ac75660612206daa6ed88a4bee060926e621d5bc6a73ccb785fe1bc1809bf16713baa9f344f7b8a925a8676daa58
SSDEEP 1536:Iaq4rOzbGrYcsr6eT91KZZCmP4w69BhUYMb+KR0Nc8QsJq39:z9OzbGrLsr6o91jmPPchBe0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

wahost.exe

Path C:\Users\Admin\AppData\Local\Temp\a\wahost.exe
Size 712KB
SHA256 850752cfce58c44ce5d48735f4d53ccc1f8d12b7e1ae00d367d9c42103d9ad99
MD5 14b98daca4a9912ad416eb7c0231cc21
SHA1 58328f022b71c8b3001449e87f91fbad4ac973ea
SHA512 1169760e0245b4b1f2676271e0e56b62db0157a08ada4098d7dfacbf5c1e2d6cac29275c04a2d59471d7a9d9420425c07387c63fd3bc9bc4f91a9b3d5addcb0a
SSDEEP 12288:8HRQpjndCNI+y0vplnoXMPr2oYFoDOuK4MMRqAEqHgKNLg470oKNcOWR5HYhFJba:8HSjdCNN/z2onDOuK4MqqARHlF73ccOS
MD5 SHA1 SHA512 SSDEEP

Submit Download

winiti.exe

Path C:\Users\Admin\AppData\Local\Temp\a\winiti.exe
Size 1.3MB
SHA256 8af777d0f92cef2d9040a634527c3753669235589c23129f09855ad0ebe10c6f
MD5 ebf39794ba6132055e6114d47bc18941
SHA1 214dead1bd716c58709c39a8180551b737048785
SHA512 01e7521af569050acc473fd13c8dd9a781370bd7cefcbc7e953e66ab930f407e9791c9fdb2ab4f368579f16bebb7368bebd2a475351a42d9e2092da0835bffbb
SSDEEP 24576:bsS4c4c1mPDsfb5kMRjrky7BBcJ4yM+Q0OFxpfClsogJKrYEaKwS:LR4ck+b5kMJB7BBcJE+Q0OFvfClxg0YO
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmE0D8.tmp\LangDLL.dll
Size 5KB
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmE0D8.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5676_1476480644\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
MD5 SHA1 SHA512

Submit Download

b4cc9d67-e82a-45a3-9225-d465672a63bd.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5676_1476480644\b4cc9d67-e82a-45a3-9225-d465672a63bd.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp126A.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp126A.tmp.bat
Size 151B
SHA256 5bd43c673fc09423f84e66ddcfb2dfde611e4d1e5287f4a7f2351ee99ee45826
MD5 fe9aaf4b3e5aa5efd154a8fda4baf071
SHA1 15fe844645d513b1f632569a5738b30c09c0cd2e
SHA512 d5181c3771d469a4b265f295425a81cdeead94c501e676ba487018470e0b737a3c74dbe2a4dd0ef3cdfba1c178fad5839304c5d0957a6ea5a9e4d2b8053819d3
MD5 SHA1 SHA512

Submit Download

tmpBAE0.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpBAE0.tmp
Size 40KB
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
SSDEEP 48:2DcnBA+IIBoCVEq8Ma0D0HOlf/6ykwpLf/EUwMHZq10bvJKLkw8s8LKvUf9KVyJJ:uSQCn8MouB6w9f/8iZqmvJKLPeymwil
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpBB7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpBB7F.tmp
Size 128KB
SHA256 912c24cb6c2e2ddbe77ccac50804a40d10283eb755ce2ec111e5ddeb91881ea8
MD5 ebca298cb3fd0e8139f96992051e9f1d
SHA1 3d4eb6c5c63b53830aea4bbb8894e090b36f37a9
SHA512 7d2a35154ef95772e7dd823c75c13b62c6c4254b32cf27a74871e597b798f420f92818f33a23f6bc5bffd9827002162004c6308baf8f2c63ffe05005d3dbbb6c
SSDEEP 192:HnaHR23W/l1jXhP94nPiSRX6dqzVuQZYIY:UR2m/lxhunq63VuQZYIY
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_1373748449\manifest.json
Size 114B
SHA256 0152e17e94788e5c3ff124f2906d1d95dc6f8b894cc27ec114b0e73bf6da54f9
MD5 4c30f6704085b87b66dce75a22809259
SHA1 8953ee0f49416c23caa82cdd0acdacc750d1d713
SHA512 51e2101bcad1cb1820c98b93a0fb860e4c46172ca2f4e6627520eb066692b3957c0d979894e6e0190877b8ae3c97cb041782bf5d8d0bb0bf2814d8c9bb7c37f3
MD5 SHA1 SHA512

Submit Download

memory/240-721-0x0000000006630000-0x000000000663C000-memory.dmp

Download

memory/240-725-0x0000000006690000-0x000000000669E000-memory.dmp

Download

memory/240-716-0x00000000065F0000-0x000000000660A000-memory.dmp

Download

memory/240-696-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/240-699-0x00000000050D0000-0x00000000050DA000-memory.dmp

Download

memory/240-700-0x00000000050E0000-0x00000000050FE000-memory.dmp

Download

memory/240-701-0x0000000005340000-0x000000000534A000-memory.dmp

Download

memory/240-715-0x0000000005AC0000-0x0000000005AD2000-memory.dmp

Download

memory/240-719-0x0000000006610000-0x000000000661E000-memory.dmp

Download

memory/240-720-0x0000000006620000-0x000000000662E000-memory.dmp

Download

memory/240-722-0x0000000006640000-0x0000000006654000-memory.dmp

Download

memory/240-723-0x0000000006650000-0x0000000006660000-memory.dmp

Download

memory/240-727-0x00000000066D0000-0x00000000066E4000-memory.dmp

Download

memory/240-726-0x00000000066A0000-0x00000000066CE000-memory.dmp

Download

memory/240-724-0x0000000006660000-0x0000000006674000-memory.dmp

Download

memory/692-1019-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1204-1064-0x0000000000C60000-0x0000000000D26000-memory.dmp

Download

memory/1316-596-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/1480-1084-0x00000000003B0000-0x00000000003BA000-memory.dmp

Download

memory/1496-225-0x0000000000A20000-0x0000000000ABA000-memory.dmp

Download

memory/1496-226-0x00000000059F0000-0x0000000005A02000-memory.dmp

Download

memory/1496-593-0x0000000006800000-0x0000000006868000-memory.dmp

Download

memory/1632-521-0x00000000069D0000-0x00000000069E2000-memory.dmp

Download

memory/1632-522-0x0000000006A30000-0x0000000006A6C000-memory.dmp

Download

memory/1632-523-0x0000000006BA0000-0x0000000006BEC000-memory.dmp

Download

memory/1632-628-0x0000000007660000-0x00000000076B0000-memory.dmp

Download

memory/1632-489-0x00000000009D0000-0x0000000000A22000-memory.dmp

Download

memory/1632-514-0x0000000005900000-0x0000000005976000-memory.dmp

Download

memory/1632-515-0x0000000006900000-0x000000000691E000-memory.dmp

Download

memory/1632-518-0x0000000006F40000-0x0000000007558000-memory.dmp

Download

memory/1632-520-0x0000000006A90000-0x0000000006B9A000-memory.dmp

Download

memory/1696-43-0x0000000005420000-0x00000000054BC000-memory.dmp

Download

memory/1696-15-0x000000007523E000-0x000000007523F000-memory.dmp

Download

memory/1696-16-0x0000000000530000-0x0000000000542000-memory.dmp

Download

memory/1696-42-0x0000000004FF0000-0x0000000005056000-memory.dmp

Download

memory/1744-589-0x0000000000300000-0x000000000030A000-memory.dmp

Download

memory/1852-1111-0x0000000006AA0000-0x0000000006AEC000-memory.dmp

Download

memory/1852-1074-0x00000000008D0000-0x0000000000922000-memory.dmp

Download

memory/1888-67-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

memory/1888-78-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

memory/1888-77-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

memory/1888-82-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

memory/1944-560-0x00000000002D0000-0x00000000002DA000-memory.dmp

Download

memory/1948-561-0x0000000000E10000-0x0000000000E1A000-memory.dmp

Download

memory/2080-627-0x0000000004B30000-0x0000000004BBC000-memory.dmp

Download

memory/2080-487-0x0000000005790000-0x00000000057AE000-memory.dmp

Download

memory/2080-477-0x00000000007B0000-0x000000000089C000-memory.dmp

Download

memory/2080-625-0x0000000006470000-0x0000000006486000-memory.dmp

Download

memory/2260-93-0x0000000000400000-0x0000000002860000-memory.dmp

Download

memory/2336-228-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

memory/2336-172-0x0000000000400000-0x0000000000BD9000-memory.dmp

Download

memory/2592-1094-0x0000000000340000-0x000000000034A000-memory.dmp

Download

memory/2624-665-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2628-196-0x00007FF9A5E80000-0x00007FF9A6089000-memory.dmp

Download

memory/2628-193-0x00000000709A0000-0x0000000070A75000-memory.dmp

Download

memory/2628-187-0x0000000000400000-0x00000000011C3000-memory.dmp

Download

memory/2948-770-0x00000000076D0000-0x00000000076D8000-memory.dmp

Download

memory/2948-757-0x00000000075D0000-0x00000000075DE000-memory.dmp

Download

memory/2948-741-0x0000000007390000-0x00000000073AA000-memory.dmp

Download

memory/2948-738-0x0000000007010000-0x000000000702E000-memory.dmp

Download

memory/2948-635-0x00000000052A0000-0x00000000058CA000-memory.dmp

Download

memory/2948-634-0x0000000002820000-0x0000000002856000-memory.dmp

Download

memory/2948-742-0x0000000007410000-0x000000000741A000-memory.dmp

Download

memory/2948-650-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Download

memory/2948-729-0x000000006C640000-0x000000006C68C000-memory.dmp

Download

memory/2948-743-0x0000000007620000-0x00000000076B6000-memory.dmp

Download

memory/2948-756-0x00000000075A0000-0x00000000075B1000-memory.dmp

Download

memory/2948-761-0x00000000075E0000-0x00000000075F5000-memory.dmp

Download

memory/2948-763-0x00000000076E0000-0x00000000076FA000-memory.dmp

Download

memory/2948-649-0x00000000059D0000-0x00000000059F2000-memory.dmp

Download

memory/2948-703-0x0000000006020000-0x000000000603E000-memory.dmp

Download

memory/2948-651-0x0000000005B50000-0x0000000005EA7000-memory.dmp

Download

memory/2948-739-0x0000000007040000-0x00000000070E4000-memory.dmp

Download

memory/2948-728-0x0000000006FD0000-0x0000000007004000-memory.dmp

Download

memory/2948-740-0x00000000079B0000-0x000000000802A000-memory.dmp

Download

memory/3208-695-0x0000000000FE0000-0x0000000001046000-memory.dmp

Download

memory/3224-708-0x0000000000400000-0x0000000002860000-memory.dmp

Download

memory/3224-252-0x0000000000400000-0x0000000002860000-memory.dmp

Download

memory/3224-174-0x0000000000400000-0x0000000002860000-memory.dmp

Download

memory/3348-744-0x000000006C640000-0x000000006C68C000-memory.dmp

Download

memory/3456-890-0x0000000005950000-0x0000000005AD6000-memory.dmp

Download

memory/3456-889-0x00000000008B0000-0x0000000000E82000-memory.dmp

Download

memory/3456-891-0x0000000005720000-0x0000000005742000-memory.dmp

Download

memory/3700-717-0x000000000A520000-0x000000000A6E2000-memory.dmp

Download

memory/3700-718-0x000000000AC20000-0x000000000B14C000-memory.dmp

Download

memory/3792-1-0x0000000000DB0000-0x0000000000DB8000-memory.dmp

Download

memory/3792-2-0x00007FF985030000-0x00007FF985AF2000-memory.dmp

Download

memory/3792-3-0x00007FF985030000-0x00007FF985AF2000-memory.dmp

Download

memory/3792-0-0x00007FF985033000-0x00007FF985035000-memory.dmp

Download

memory/3920-611-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3920-612-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3944-709-0x0000000000400000-0x0000000002860000-memory.dmp

Download

memory/3984-777-0x00000000009C0000-0x0000000000A39000-memory.dmp

Download

memory/4060-590-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4108-639-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4964-592-0x00000000063B0000-0x000000000643C000-memory.dmp

Download

memory/4964-582-0x00000000056B0000-0x00000000056BE000-memory.dmp

Download

memory/4964-222-0x0000000005680000-0x0000000005696000-memory.dmp

Download

memory/4964-212-0x00000000051D0000-0x00000000051DA000-memory.dmp

Download

memory/4964-211-0x00000000051F0000-0x0000000005282000-memory.dmp

Download

memory/4964-210-0x00000000056C0000-0x0000000005C66000-memory.dmp

Download

memory/4964-209-0x0000000000790000-0x0000000000844000-memory.dmp

Download

memory/5008-845-0x0000000140000000-0x000000014025B000-memory.dmp

Download

memory/5008-849-0x0000000140000000-0x000000014025B000-memory.dmp

Download

memory/5008-848-0x0000000140000000-0x000000014025B000-memory.dmp

Download

memory/5008-847-0x0000000140000000-0x000000014025B000-memory.dmp

Download

memory/5008-846-0x0000000140000000-0x000000014025B000-memory.dmp

Download

memory/5008-844-0x0000000140000000-0x000000014025B000-memory.dmp

Download

memory/5008-838-0x0000000140000000-0x000000014025B000-memory.dmp

Download

memory/5008-843-0x0000000140000000-0x000000014025B000-memory.dmp

Download

memory/5008-851-0x0000000140000000-0x000000014025B000-memory.dmp

Download

memory/5008-850-0x0000000140000000-0x000000014025B000-memory.dmp

Download

memory/5088-805-0x0000000000400000-0x0000000000C2D000-memory.dmp

Download

memory/5088-775-0x0000000000400000-0x0000000000C2D000-memory.dmp

Download

memory/5088-806-0x0000000000400000-0x0000000000C2D000-memory.dmp

Download

memory/5124-1672-0x0000000000120000-0x00000000005AE000-memory.dmp

Download

memory/5124-1673-0x0000000005070000-0x000000000518A000-memory.dmp

Download

memory/5200-996-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5200-1542-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/5820-864-0x00000000005E0000-0x00000000018F7000-memory.dmp

Download

memory/5820-865-0x00000000005E0000-0x0000000000620000-memory.dmp

Download

memory/6436-1527-0x00000000056F0000-0x0000000005A47000-memory.dmp

Download

memory/6872-1576-0x0000000003590000-0x00000000035AC000-memory.dmp

Download

memory/6872-1575-0x0000000008820000-0x0000000008E54000-memory.dmp

Download

memory/6872-1574-0x0000000006F50000-0x00000000075CA000-memory.dmp

Download

memory/6872-1573-0x0000000000800000-0x0000000001324000-memory.dmp

Download

memory/7060-1760-0x0000000000A30000-0x0000000001040000-memory.dmp

Download

memory/7060-1761-0x0000000005B90000-0x0000000005D06000-memory.dmp

Download