pandastealer | 5a2421a99391c5deb961e8f6dbbb5a660531192c2fa279061d6d637bb9656947

Analysis

max time kernel
151s
max time network
145s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe
Size

4.7MB
MD5

337f603c8b740238d363cca78e8687d5
SHA1

a6b9fce6d9bbd232d779b0fbae39a746613e4397
SHA256

5a2421a99391c5deb961e8f6dbbb5a660531192c2fa279061d6d637bb9656947
SHA512

e3ed5235ccc8f8b18e318baf54ebec38b2c6281be08290d2c0ba42fcdb0d4e99eefe2014904a2c75c94efbd7e3d96d0d3ee471c27334ec991f96344a32171cef
SSDEEP

98304:JfyFY1bgUxBPwBwVIJMIcjE0PAK+AV/YbcDklVkH343uKS:JaFYmOPw6VIJMIcjL2wwflKH343tS

Score

10^/10

pandastealer adware discovery persistence stealer

Malware Config

Signatures

Panda Stealer payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00050000000194a3-39.dat	family_pandastealer
behavioral1/files/0x0005000000019820-618.dat	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer

Executes dropped EXE 5 IoCs

pid	Process
2104	sys.exe
1976	tcpsrvc.exe
2724	setup.exe
2876	setup.exe
1652	SlimDrivers.exe

Loads dropped DLL 23 IoCs

pid	Process
2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe
2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe
1976	tcpsrvc.exe
2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe
2724	setup.exe
2724	setup.exe
2724	setup.exe
1976	tcpsrvc.exe
1408	Process not Found
1408	Process not Found
1408	Process not Found
1408	Process not Found
1408	Process not Found
1408	Process not Found
1408	Process not Found
1408	Process not Found
852	Process not Found
852	Process not Found
852	Process not Found
852	Process not Found
1128	MsiExec.exe
1128	MsiExec.exe
1408	Process not Found

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gmjobwuerq = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\nseF53B.tmp.dll\""	tcpsrvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gmjobwuerq = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Windows\\system32\\lnezpwjnwyo.dll\""	regsvr32.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
5	2656	msiexec.exe
7	2656	msiexec.exe
9	2656	msiexec.exe
11	2656	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}	tcpsrvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}\NoExplorer = "1"	tcpsrvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}\NoExplorer = "1"	regsvr32.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count	tcpsrvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	tcpsrvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	tcpsrvc.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zizntvxocguye.exe	tcpsrvc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe	msiexec.exe
File created	C:\Program Files (x86)\SlimDrivers\SlimDrivers.url	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\f77c3bf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77c3bd.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f77c3bd.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC87F.tmp	msiexec.exe
File created	C:\Windows\Installer\{240D57C0-234A-4CAD-B6E7-DFDE6B0B1272}\Icon.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{240D57C0-234A-4CAD-B6E7-DFDE6B0B1272}\Icon.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\f77c3bc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f77c3bc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SlimDrivers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tcpsrvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000016c23-3.dat	nsis_installer_1
behavioral1/files/0x0008000000016c23-3.dat	nsis_installer_2
behavioral1/files/0x0007000000016cab-10.dat	nsis_installer_1
behavioral1/files/0x0007000000016cab-10.dat	nsis_installer_2

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	tcpsrvc.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	tcpsrvc.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434787287"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DF5A46F4-C6B1-6F54-18B7-F4FE37C1C9A3}	tcpsrvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DF5A46F4-C6B1-6F54-18B7-F4FE37C1C9A3}\AppName = "regsvr32.exe"	tcpsrvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3893491-8793-11EF-A5FC-C670A0C1054F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DF5A46F4-C6B1-6F54-18B7-F4FE37C1C9A3}\AppPath = "C:\\Windows\\System32"	tcpsrvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DF5A46F4-C6B1-6F54-18B7-F4FE37C1C9A3}\Policy = "3"	tcpsrvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	tcpsrvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}\ = "revenuestreaming browser enhancer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94F306592838061408E06E374A3C5C1F\0C75D042A432DAC46B7EFDEDB6B02127	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\SourceList\PackageName = "setup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}	tcpsrvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}\ = "revenuestreaming browser enhancer"	tcpsrvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}\InProcServer32\ThreadingModel = "Apartment"	tcpsrvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\Version = "33558522"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\94F306592838061408E06E374A3C5C1F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}\InProcServer32	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\SourceList\Net\1 = "C:\\Program Files (x86)\\Downloaded Installers\\{240D57C0-234A-4CAD-B6E7-DFDE6B0B1272}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}\InProcServer32	tcpsrvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C75D042A432DAC46B7EFDEDB6B02127\Application	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nseF53B.tmp.dll"	tcpsrvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\ProductIcon = "C:\\Windows\\Installer\\{240D57C0-234A-4CAD-B6E7-DFDE6B0B1272}\\Icon.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ABCADA6-5A10-6637-8E99-E50DC7E88038}\InProcServer32\ = "C:\\Windows\\SysWow64\\lnezpwjnwyo.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C75D042A432DAC46B7EFDEDB6B02127	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\ProductName = "SlimDrivers"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\PackageCode = "628DDF39A23AFE540BC23165E3FDFFFF"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C75D042A432DAC46B7EFDEDB6B02127\SourceList\LastUsedSource = "n;1;C:\\Program Files (x86)\\Downloaded Installers\\{240D57C0-234A-4CAD-B6E7-DFDE6B0B1272}\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1672	msiexec.exe
1672	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe
Token: SeSecurityPrivilege	1672	msiexec.exe
Token: SeCreateTokenPrivilege	2656	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2656	msiexec.exe
Token: SeLockMemoryPrivilege	2656	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2656	msiexec.exe
Token: SeMachineAccountPrivilege	2656	msiexec.exe
Token: SeTcbPrivilege	2656	msiexec.exe
Token: SeSecurityPrivilege	2656	msiexec.exe
Token: SeTakeOwnershipPrivilege	2656	msiexec.exe
Token: SeLoadDriverPrivilege	2656	msiexec.exe
Token: SeSystemProfilePrivilege	2656	msiexec.exe
Token: SeSystemtimePrivilege	2656	msiexec.exe
Token: SeProfSingleProcessPrivilege	2656	msiexec.exe
Token: SeIncBasePriorityPrivilege	2656	msiexec.exe
Token: SeCreatePagefilePrivilege	2656	msiexec.exe
Token: SeCreatePermanentPrivilege	2656	msiexec.exe
Token: SeBackupPrivilege	2656	msiexec.exe
Token: SeRestorePrivilege	2656	msiexec.exe
Token: SeShutdownPrivilege	2656	msiexec.exe
Token: SeDebugPrivilege	2656	msiexec.exe
Token: SeAuditPrivilege	2656	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2656	msiexec.exe
Token: SeChangeNotifyPrivilege	2656	msiexec.exe
Token: SeRemoteShutdownPrivilege	2656	msiexec.exe
Token: SeUndockPrivilege	2656	msiexec.exe
Token: SeSyncAgentPrivilege	2656	msiexec.exe
Token: SeEnableDelegationPrivilege	2656	msiexec.exe
Token: SeManageVolumePrivilege	2656	msiexec.exe
Token: SeImpersonatePrivilege	2656	msiexec.exe
Token: SeCreateGlobalPrivilege	2656	msiexec.exe
Token: SeBackupPrivilege	2832	vssvc.exe
Token: SeRestorePrivilege	2832	vssvc.exe
Token: SeAuditPrivilege	2832	vssvc.exe
Token: SeBackupPrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	2748	DrvInst.exe
Token: SeLoadDriverPrivilege	2748	DrvInst.exe
Token: SeLoadDriverPrivilege	2748	DrvInst.exe
Token: SeLoadDriverPrivilege	2748	DrvInst.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe
Token: SeTakeOwnershipPrivilege	1672	msiexec.exe
Token: SeRestorePrivilege	1672	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2656	msiexec.exe
2496	iexplore.exe
2656	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2496	iexplore.exe
2496	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2104	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	31
PID 2344 wrote to memory of 2104	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	31
PID 2344 wrote to memory of 2104	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	31
PID 2344 wrote to memory of 2104	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	31
PID 2344 wrote to memory of 1976	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	32
PID 2344 wrote to memory of 1976	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	32
PID 2344 wrote to memory of 1976	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	32
PID 2344 wrote to memory of 1976	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	32
PID 2344 wrote to memory of 2724	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2724	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2724	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2724	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2724	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2724	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	33
PID 2344 wrote to memory of 2724	2344	337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe	33
PID 2724 wrote to memory of 2876	2724	setup.exe	34
PID 2724 wrote to memory of 2876	2724	setup.exe	34
PID 2724 wrote to memory of 2876	2724	setup.exe	34
PID 2724 wrote to memory of 2876	2724	setup.exe	34
PID 2724 wrote to memory of 2876	2724	setup.exe	34
PID 2724 wrote to memory of 2876	2724	setup.exe	34
PID 2724 wrote to memory of 2876	2724	setup.exe	34
PID 2876 wrote to memory of 2656	2876	setup.exe	35
PID 2876 wrote to memory of 2656	2876	setup.exe	35
PID 2876 wrote to memory of 2656	2876	setup.exe	35
PID 2876 wrote to memory of 2656	2876	setup.exe	35
PID 2876 wrote to memory of 2656	2876	setup.exe	35
PID 2876 wrote to memory of 2656	2876	setup.exe	35
PID 2876 wrote to memory of 2656	2876	setup.exe	35
PID 1976 wrote to memory of 2220	1976	tcpsrvc.exe	38
PID 1976 wrote to memory of 2220	1976	tcpsrvc.exe	38
PID 1976 wrote to memory of 2220	1976	tcpsrvc.exe	38
PID 1976 wrote to memory of 2220	1976	tcpsrvc.exe	38
PID 1976 wrote to memory of 2220	1976	tcpsrvc.exe	38
PID 1976 wrote to memory of 2220	1976	tcpsrvc.exe	38
PID 1976 wrote to memory of 2220	1976	tcpsrvc.exe	38
PID 2496 wrote to memory of 2176	2496	iexplore.exe	40
PID 2496 wrote to memory of 2176	2496	iexplore.exe	40
PID 2496 wrote to memory of 2176	2496	iexplore.exe	40
PID 2496 wrote to memory of 2176	2496	iexplore.exe	40
PID 1672 wrote to memory of 1128	1672	msiexec.exe	46
PID 1672 wrote to memory of 1128	1672	msiexec.exe	46
PID 1672 wrote to memory of 1128	1672	msiexec.exe	46
PID 1672 wrote to memory of 1128	1672	msiexec.exe	46
PID 1672 wrote to memory of 1128	1672	msiexec.exe	46
PID 1672 wrote to memory of 1128	1672	msiexec.exe	46
PID 1672 wrote to memory of 1128	1672	msiexec.exe	46
PID 1128 wrote to memory of 1652	1128	MsiExec.exe	47
PID 1128 wrote to memory of 1652	1128	MsiExec.exe	47
PID 1128 wrote to memory of 1652	1128	MsiExec.exe	47
PID 1128 wrote to memory of 1652	1128	MsiExec.exe	47

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\337f603c8b740238d363cca78e8687d5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\sys.exe
  "C:\Users\Admin\AppData\Local\Temp\sys.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2104
- C:\Users\Admin\AppData\Local\Temp\tcpsrvc.exe
  "C:\Users\Admin\AppData\Local\Temp\tcpsrvc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Installs/modifies Browser Helper Object
  - Maps connected drives based on registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer Protected Mode
  - Modifies Internet Explorer Protected Mode Banner
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\lnezpwjnwyo.dll"
    3⤵
    - Adds Run key to start application
    - Installs/modifies Browser Helper Object
    - Maps connected drives based on registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2220
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\7zSEF5E.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSEF5E.tmp\setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\SysWOW64\msiexec.exe
      "msiexec" /i "C:\Program Files (x86)\Downloaded Installers\{240D57C0-234A-4CAD-B6E7-DFDE6B0B1272}\setup.msi"
      4⤵
      Blocklisted process makes network request
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2656

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD27BA2251C796AD33C9B6865EA4D451 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe
    "C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1652

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2496 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003E0" "00000000000003D4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f77c3be.rbs

Filesize
7KB

MD5
3c2a1f874aca80c86159c35423a40df1

SHA1
7d01f852d8b8b26f95c8cac128f1ef5de20dbbd8

SHA256
5f8768debd026394cf01569c0f27b54ae9b6845f8b71a26eb82acafb3b2cfd0c

SHA512
8ff6c9b3f27adfac465db9a9fee1e95b82b48871dbfcb36cb8b8e7390dc12ef02e65eadab1ac6c72566b14972dc911bcb88d00fa0b015b7ef8fd7e09542e4871

Download Submit
C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe

Filesize
22.5MB

MD5
1698d9ac0c1167d6cf7b8a32ebff81b3

SHA1
31241974219fcba442fe61937df9a891fcf829ac

SHA256
796ca26fc493a66153fc1129acc989bddef7fccf7ca3cbfac409088be8437378

SHA512
40e416467ac416c87efd8e7876a86c9f618684ddd0b107108345d7ac67c0db7ed72f395844ac1dc8f5039683593015bf61ab84bf5ba5f22797d8419aacb9e16f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6

Filesize
75KB

MD5
84fb59541357ebbac17a5dd906b3957e

SHA1
ef72d52c513b97a066a4922609862559645a6f7a

SHA256
44e527b61336921190fca1222af6ced398b67b36a7803c05525eb5dc9a18a93a

SHA512
8547ae3ebcf38b9c46b18ad0264222a93520bf55fd2fbbcbe757b61b5fd18d209817dae5dc432f12c65fae6be769da6f71c1b24afe03ef473854e1b00baeec01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_0AEA4C6D6CCC81E7AABA17FA25994227

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F

Filesize
834B

MD5
543ff9c4bb3fd6f4d35c0a80ba5533fc

SHA1
e318b6209faeffe8cde2dba71f226d2b161729af

SHA256
40c04d540c3d7d80564f34af3a512036bdd8e17b4ca74ba3b7e45d6d93466bcd

SHA512
6257994ac1ec8b99edcf0d666838a9874031a500adac9383d9b4242edc6c6ffec48f230740d443c1088aa911a36de26e7ce3b97313e3d36b00aede5352a8cf5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6

Filesize
212B

MD5
f8b32753192314d9a65d561fd58f12c8

SHA1
00e3a97a84920060e60cd965214c687e1e050736

SHA256
c8a249be76448bda99740f0e9899a17b1279b0ee9444fb7d95d16ae92a424fe9

SHA512
6d597bffd4f4d314123a0c4bcc0a85449c736be1980053f94f17ea30f5cfbe247a19e348fd976e11df504d831ffa11339057e2a722601a3127341b3bd4a7ff3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_0AEA4C6D6CCC81E7AABA17FA25994227

Filesize
404B

MD5
8a77354a60f964b1df5eacca737714b6

SHA1
a8868edbeef54edb9bcea5b1d170ad73817679b9

SHA256
1ab3e1e11c34500b9e49dc837f9768030f82af2e3cdfb67480d7b39d6b40e0d2

SHA512
2e03a7e27d68e1c4e1a42f8fd7fa405fecc0c559dceac99a71790a863a7212bf976a8c41173d687ae9ffe68d3790ff5dd617b3ae72f0264edc02377d59225626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6

Filesize
404B

MD5
2fea74f8afd4b83a336bb36f4b2be3bc

SHA1
1ea9de5948309a57d38c290265442b0081df0f6c

SHA256
0d9870b6ec99581bc874b0e64cf0cbac94c59983347d9af956431796b3d369c5

SHA512
ade3b938f45129ba613916dbc95060ff68b479c62b44030be67662906ab3e220924c15ad95b3c5800a15082825d8585570ff7e2f9fd15a920cdba38177800cae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F

Filesize
188B

MD5
b343b7e8e7ec976bc3c101de33a69481

SHA1
b126e653b7fe0a0bf06540d8ba899e0f69298e49

SHA256
f951e5d11ea28fd04996b91c43a8a14b159afa52979843da8e36425a16247f50

SHA512
d62f026010db968bb228b97d528fdac92cb91d170bb279d13050bbef27d63f07b32f0da6661d4028c5f92e4f3b2cc1246425a131f78cb7147d30fc0f86c511b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79290909b8816b9f0ff50849d90c8501

SHA1
91f793f5242d3e38668b64f8d71cdcb62735c584

SHA256
dda535939d2c33d22b0e7fe36ed79ee2c359732a79325301cf4b473b7fea986c

SHA512
abcb4c34a55b7a84196d3670710c75c9ca32741684ea0d91eba4fd473f801ec523bf13b75c778a28c75cb6a84301265bca627b10bd3fad478e7ca64fb7f68553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbae44cb706e663e872b6d5a7a0cca7d

SHA1
3e03fc9cc2a3fae9db40f6b86a6127c64d659af9

SHA256
e24b046b61639869442d3cc39bc43f31896be8c9968c0b9e12d9bd0922ea5bc5

SHA512
aa3b85d4a3c03a3dd42e23cc3d0849166fa64a724fd6cbc44f6de0241394563da4de46e83ac59856bf8f44b208b126b4c1a274de6ba2685b8385ae709ad3bd15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14eccc3909fdf4f9f9be4df1f7818f2b

SHA1
c5e071a9485be68b6bae785c63fccf0b92a7091a

SHA256
61f47d38d83d94c54ece1a49c26d0378f7dd2bb541a6a357832da40593a24e87

SHA512
13f1638c50d7dda35ce975e4c5779e286c1970f7feddc8e1a22c79f4872a3ab4f0f5fcf9648aea17da214894908568738c475d2b803ceec6bc2a3134bbf0f71b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd31b0663b7e07891eb379e2760e6eda

SHA1
858af7bb1175ee6e70d79306500bc68c37d9bd96

SHA256
84d0f6117385dfb109e58da1a151e29b48b890da93b2f69f9119cafda8dde621

SHA512
0c117efb1479525d7c5140c836d5c6e4556ebf2b83be5a7cb6d7c099879f256d7308802ec647c1f94ea7d97aa143782b1a547784fb32aeac4303e34a3e52e8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18be907a1d34323b7329c0fcb8a886dd

SHA1
c61bd755a63a65f4df7e8d83370e3b88ed91e18f

SHA256
038907839b8d58a28def4f26a28a730d289f8d6910a2afb26861a355ace6c769

SHA512
318f62701769a0e21d3937436aa3d2f99ea9df7f882bc7cc219554ecc766a4a8f637a7ac299fea9a5be0a3ddd821d99a8f9765a19d8d9cdde20073e04d5fce60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dbcbc6fb6d8a25265a0c3e2cfc5f799

SHA1
53e19c6c37d264a24a1dba667ff5e794bb225be1

SHA256
57c57b735ac4bbe99cf93e83ddc476fb4cdd80a9b91ed8af54a6f53c6b345679

SHA512
eb366bf00c9c1fde79567dd0a17080f4295ad27c3a640c1476d9a781e9f3daa0e24b151b9a2ec038caf2881653f7ff2832c765cb7f9dc6e73be10ff0904625e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00c90177248e24c27238b21a6639baec

SHA1
c50536d7c7117a50cb7b62c339789f4f78943e12

SHA256
1fb55eb84b6eb727859ee7348199b26326fca11f30c12eaae7b04815608a5461

SHA512
9a468f8cb719341d8f044235dd8668266973599f9518ee6ab8f78edabddd8d17348ae34c0f6ba4a43fc4246a9b28bb1eb8cd6fa3378ba717ed22c1bc1c945e29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c1b9ceae0c9daa162831b19090cbcab

SHA1
adfa4f35ce4a26aa19dc966d7e1c3fbde95d15f9

SHA256
735e8d815a349d6454866c3c2b3f27f0b4e1876b8c9902837fe545a7e7c9ced8

SHA512
0190f53b76991a64a1dde3350d41f96ca425981d99cf04d2ad29d739efacdbb127af5e8efbca5a0622bba795f5e4dc4c1bc3e95b1ec74e19136075e70fcdbb0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a23f332d9de7a496e063991aa4c6ea89

SHA1
baf213485d29c0ebb2aef623370911d80504bdbf

SHA256
4b22edc0c1f4baa88a8ac061ff86df875198085348c1a2a2191be2534f70281e

SHA512
76895c2333e6fee8e77e1d7e91c13887283107656e31f798b1cf2c0378d6ad16a10234911394e2030528c6de9ef7df16f65e77014e9df8aa6241457dbf3a6b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5d103b75345b41836e8faaf97d8683a

SHA1
14b0cd9a89668f70a92e32850d7084d781bd0e80

SHA256
4d35b9c7aec9ec9e90c713acc059904eade21b6e0f03862e7759212bf5e71efd

SHA512
8bc415b16208e70bd019c56cd484dfd75c9a3d276d9500801176cf421b94f65daf97feea7f99e1017d9fa6cec653ddb28fee4c49c46dfca783227c83db2054f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74bf8a846f4f2022bd1276e83e5a7500

SHA1
30096c047240e5bbb7753385f56adc4ddb31e557

SHA256
d8a863ad3b2403ac0ded1b7d2709db9685856ad48f1cbbf14143a446218a9f3c

SHA512
f69aee3ff4d2d840b439c7276641ef56d8c27522be74fae8e20d067d3c621898596c02a649b24340bd15f380b3ddb5bedf8d89cb497963f81892207344498eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a86fee614dcd849c86f0da8e54f01e62

SHA1
794965192feaa32426a7606bf023a42ef8234c2d

SHA256
7a66f0833d3826472845f4f3a9e019840132e66bcbf382564098bc43cc9545b7

SHA512
ad8e01ca1ce065e51aeb054d9a0ed0b7b3c853daa8cfb7427133c96d7b6be2043f9d88051b408acae2ec7bd5c748ec9773464ae8cdce5df1fd63be5af88779f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac4185d840d82bdd3f12afcb7b829995

SHA1
f17c2ead887a17bccd20101ba3b331fd8932388b

SHA256
fffb20e22b375429f584d39b77a37722b06a79fd41b490f30a3c1f5d474d278b

SHA512
f95bfe53afa95e0d52ffd4653fd59e52fef4a371b12563e218a93aa3deb00a04d99665d8234569b6af86ab211b99830e5394287ada2b4470ac9c5996873f89cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a504a06c35b2c9cff787fa910a74fe99

SHA1
ea2167e1a09dfdd91bfe38af7836b779e37cddcc

SHA256
edc0fe317e042abd04b932ca7eb074cdf4341cd512d04e4e4634dcfd0616db11

SHA512
7b17f8f45cbcdba74f06b55f002546560a794ef14b36c30a32488ba117c8011a8106aba4b8082dbf2a089e188ef4118a97e711d37564d147febe28258b16d654

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a1757b97e2b01ffa05d8a8eada7d323

SHA1
3f93d677c662df3eba8ce5d19ba45e217ec434d4

SHA256
b0c3d713b5bb12da409948c0a028441d0ed0329928bf0cd6bb33f5db8a7e8ac2

SHA512
c807a93f7f4926e6acc06b937091db57464bfccad60245f475ac5b66867e7846cd5416066fa8a00ee38ec73d882901fb80fe11ee1c02aa2d151c47dce9288126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab33f2e6507ca4b643dccfec7bac5ddb

SHA1
2a47956c45c803eea4b3dc18681b9086c06de958

SHA256
7cf7ae9d6fd6cd60fbc60bec1829f12cea0ef6e8f0bd69d117e98a9c5a5ae117

SHA512
763fb2bc617611768254c946858f5de40307044b727168d2d4e5bed2d8d66eeaa79634572f34b125a42a19dd520378a3d642a83d1abbe6716af05125a0eb8b79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e767ce2d72607a354a8be5eda356713

SHA1
50b6b3fdd646e789abc2e13025b47cec408eb24a

SHA256
7784691895dc842f813377b5c0a6b98715ac98433c6c0a04b2b51a10d898cac8

SHA512
f76f85728a6bfceb23bf31be2a9bc601947fe9c7fa36f96be4f28b8ff7a7f459c33c6c993e6351617b58383922618ee38fb1a8c3d7fac6e0f81f4bb26d98084c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21dd37d84fd54a0de4d6810a7c40bffd

SHA1
dc2615bcafde974ea545c02714f74b5dd7099fe9

SHA256
c2edd32c5f8ec58817c8e8960844454dae0b493f6ecd458ecd0e1aaf33edeaba

SHA512
3b4ef80e79c64836207ab30eac0c007be1b5200d0f72d45d85af08be7e2679829615120b170a6ab81ff154e058a1333122bcae2b24f4c6d741f1c7e03eacdbfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aed938525bd369dbbecd0e275c3dd86

SHA1
6dd7881c72d6588c420f3cbf04d6cf49648816eb

SHA256
e51ffbd435e9f821f13ba0f134a52017fcdd72b9dec70b1a5fd29357cf9981bb

SHA512
cc8c28956a949621f44836d9d3348a894c18d1cf3f7472614dd5132f12b7430d8f90095d53bd5b04e2490a0269690a99db9cc5869796a326f1ae62680b4a126f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5693413d64d6114971619ad71f31a35b

SHA1
d18457468fe2f6845ac2659b885e64e63376e97d

SHA256
ea2fd00db65820469141a45ee3ad6d5d9fc352bb19d537519dca6f1f3cf4acb7

SHA512
3997c4739060d07a94f994ca4d1700f34a7465856cc6f46edde6c4afb5b5430d85837802945446dc0a86c55aab10971af29509b0a9b8209f74047555468eb387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20da0a62ecb4e8faee13846c984131e2

SHA1
689b2e03f098653e8ab9c35bb1386ec797f5476b

SHA256
f5e447d8a83418f94f3a0e45fb1c6f724c8c214d13fa11382f044487d57d400f

SHA512
b98e06c0149761a3217ab5a6f59f103640ffd356033346a58d06396a50da288d1c6f6e9b197e59fce25ddf52a502f007e7fdee0b4c47fb9c0944c5afd2792eac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c81d1cf9cbb09cc40e79c591b58f5839

SHA1
ca96782bf463dedb3fefd9f96e9ffd0948b6296e

SHA256
87f92322d7211d791994fb7d0be03a1170be77d2c5f98e081d49f3c3333e8bc4

SHA512
1836e66d08e4b0d8e008b2dd6ff3fc85422273efe0a3ada5a63d49146871907898564a6e099b54b74c5a877eb7717e1bdcd58c7bc4cf054d6836711302789ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57c012984f0038bb893e89d7790bfa07

SHA1
24cb8cd8a1ddb5426c96aba1bba2278d60bb0c92

SHA256
9f0396059c4339fe0188be04538d4e04ae65aafc4d685672179c3341a0a6f521

SHA512
a6a79cbebd248be1bfd6bd952bd221f1e3092ee9f49ad1cdbe066ed4e55591416366f40140fd16655ba3f153019df1a4e3af15976acc0028724c39bd80f05b1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00a92083985c235b1e7d263052153e99

SHA1
d87595f67e79b4fd3079f6b1fe333ee4298daab5

SHA256
226fbf29495439bd754e6abe424c246f581ae1866875c7eb001175e93c54f811

SHA512
23facf4cb17ac2f60d7e714bc9242cb6b94ec66a3799c00749ae140a4a7003a791d382eb8e523706dbbdb2af62251f63528014760007a4475679be2b8fb387ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEF5E.tmp\setup.msi

Filesize
23.6MB

MD5
66105820fc90d4728885dc0a497b8213

SHA1
4575ee17d6c1ee5ff114ca1be6b5ae547d6df965

SHA256
eb34cd95f9da684b1d680bc5d7d710fbd14318d341711a9e53b43578ad7d9310

SHA512
a865fa5fb01509ca9a18d51f4d173b4fbf6ee61c8cb1a13ccde2bb99f134085355325240a598eec5c9bb5138ba8c00ad577a17611ae9d0844baa34e74aaa72d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIDBB9.tmp

Filesize
148KB

MD5
14c01c848d8452005734858a64b6784b

SHA1
d3d81fcd1267095880218ef09b92220248905ea8

SHA256
fa9b83479f1b955790325dc557624185a8c72df3e31870dae075437146858185

SHA512
8334c467c470c13b0245425d3bc1ba9676a04e1e015bec56122504d622e7e3858d5ad7950d09c155f3666a90b7d3c7b40f324d0786553d6e81711b7f38cf1d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tcpsrvc.exe

Filesize
372KB

MD5
8c706a763e7622b72fe3222ec053d326

SHA1
2ee23255a22f1d42eefbc1fe88f4d82736e6c1b7

SHA256
79b06d3d76b61edfc0d3f48d0189e37ab2245ab169a06cf0aeb815576cdc7819

SHA512
21c36d1c470d71374e4da34cb9b589cb0f6105145509bb4d30187be4e219f34e0f96ed0cd6d1a25cc3e366474e918d5b99a9f5e2c25d610b8f1cf7dc4ba5cbc8

Download Submit
\Users\Admin\AppData\Local\Temp\7zSEF5E.tmp\setup.exe

Filesize
73KB

MD5
ca6be57a4f75e216f320f97ae1098ff6

SHA1
3d8824b17c5a4c4afb887182a9af68c981b4b859

SHA256
7061f18bc963a9452432458cbffba4607ab55c360cfda38dda2fb913adb7a3ed

SHA512
8ff5f86a03d70bbe5cc34c0ce3586d49edccf557ed3f6565cebd07fb9218cb6ebf80f536f93ea0401373e309127bfe9dea83f66325623a5bc66ce677be886804

Download Submit
\Users\Admin\AppData\Local\Temp\nseF53B.tmp.dll

Filesize
604KB

MD5
b8b303dbcda489ce392dd78b9c3088ae

SHA1
5fbb5dc212a26c8d995d9fc70aaed84972c81378

SHA256
6fc9b661c0be1f1c29943c41125ed6e883576f2714bc9c4738a1098850f5bbde

SHA512
551745e3bdf647fcf0c8e0b9d92cb691c0d011382c9867c0d575221cec5c669277d79467d751b37269c5e61d31a9485d9a21c5015db0663b4c9a3639ced96b03

Download Submit
\Users\Admin\AppData\Local\Temp\nstEBD7.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
2.4MB

MD5
b774d568aaf090164ec32291370cb341

SHA1
f5a55bcd898ff2848df1bb067e5012951dfbc266

SHA256
56e96195f7c806eb74503977eb61fd681b99ac14fcdb9f852d89ee46b0edc5ef

SHA512
0ffe18d77b13e5a94be4575984982d4d583450821865821be9c7dcffcb2fb03a744b4ca530516ba8917eb2d130bf8767416259563ecefe511ccbf34254f52691

Download Submit
\Users\Admin\AppData\Local\Temp\sys.exe

Filesize
1.9MB

MD5
361afb77460382b303ff0feab78b65c7

SHA1
e3b44a60f2bb4998399252cc36d3e65dc80deef1

SHA256
2063d5933ad5f7789082e04d6209032c4f85ef495f06b9de3f41546f0fde6de8

SHA512
b81233d5d15884158ec99a64ecfd9239906d67bf149282f87e458718a9eb8ae71b8c00cbe5e6d289b48ab5ac0ff7d1f061bb1caff67d93dfcf9c1a387726615b

Download Submit
\Windows\Installer\{240D57C0-234A-4CAD-B6E7-DFDE6B0B1272}\Icon.exe

Filesize
128KB

MD5
70d9701d954dee05eb8a89d50b496bff

SHA1
15f775be9e3e7eaad93bb63dd246c5fd7a098e89

SHA256
71f324531ed89aead63e1cf05ea06715e86f017bfd873b7efb38d4b80a8c8d8e

SHA512
f1cd0ac56dc24908b2ab81b9691b01ca0e74b49d9f8772b84f1fd4188e94938c30b26253b546999338b00197b22b23e0b838abf747df19e89b11fe4e260a4c50

Download Submit
memory/1976-117-0x0000000028DE0000-0x0000000028E7E000-memory.dmp

Filesize
632KB

Download
memory/2220-120-0x0000000028DE0000-0x0000000028E7E000-memory.dmp

Filesize
632KB

Download
memory/2220-592-0x0000000028DE0000-0x0000000028E7E000-memory.dmp

Filesize
632KB

Download
memory/2220-119-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2220-521-0x0000000028DE0000-0x0000000028E7E000-memory.dmp

Filesize
632KB

Download
memory/2220-1066-0x0000000028DE0000-0x0000000028E7E000-memory.dmp

Filesize
632KB

Download
memory/2220-1068-0x0000000028DE0000-0x0000000028E7E000-memory.dmp

Filesize
632KB

Download
memory/2220-1070-0x0000000028DE0000-0x0000000028E7E000-memory.dmp

Filesize
632KB

Download
memory/2220-1071-0x0000000028DE0000-0x0000000028E7E000-memory.dmp

Filesize
632KB

Download