lumma | cf99eaaa334a9c8ffc2fe0e1068ffcc02dda1dd8b2b0eab2821182c5d2c1f51d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

lumma phorphiex quasar redline stealc default runtimebroker credential_access discovery execution infostealer loader persistence spyware stealer trojan upx worm

Malware Config

Extracted

Family

stealc

Botnet

default

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

qrpn9be.localto.net:2810

Mutex

fc5edab1-6e8f-4963-98aa-bd077e08750f

Attributes

encryption_key
F749DCAC94A1FC3102D2B0CFBBFCB76086F86568
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
a7

Extracted

Family

lumma

https://atten-supporse.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000d0000000196be-1630.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/4716-2303-0x0000000000DE0000-0x0000000001104000-memory.dmp	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00060000000195e4-1434.dat	family_redline
behavioral1/memory/1144-1435-0x00000000009C0000-0x00000000009FE000-memory.dmp	family_redline

Redline family
redline
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3964	powershell.exe
4500	powershell.exe
4544	powershell.exe
4636	powershell.exe
4768	powershell.exe
4860	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 31 IoCs

pid	Process
2624	C1J7SVw.exe
1092	7z.exe
2824	7z.exe
1712	7z.exe
1752	7z.exe
2028	7z.exe
2120	7z.exe
1544	7z.exe
2692	7z.exe
392	in.exe
3036	Out2.exe
2432	processclass.exe
1520	5KNCHALAH.exe
1996	od.exe
1144	frap.exe
3176	Out2.exe
3368	Intel_PTT_EK_Recertification.exe
3928	stealc_default.exe
2140	XwormLoader.exe
1164	o.exe
4116	sysnldcvmr.exe
4460	849114491.exe
4584	99awhy8l.exe
4972	Intel_PTT_EK_Recertification.exe
1364	Cooper.pif
1056	t.exe
4212	lastest.exe
4240	TT18.exe
4380	tyhkamwdmrg.exe
4456	t1.exe
4716	RuntimeBroker.exe

Loads dropped DLL 53 IoCs

pid	Process
2036	4363463463464363463463463.exe
3056	cmd.exe
1092	7z.exe
3056	cmd.exe
2824	7z.exe
3056	cmd.exe
1712	7z.exe
3056	cmd.exe
1752	7z.exe
3056	cmd.exe
2028	7z.exe
3056	cmd.exe
2120	7z.exe
3056	cmd.exe
1544	7z.exe
3056	cmd.exe
2692	7z.exe
3056	cmd.exe
3056	cmd.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
3036	Out2.exe
3336	taskeng.exe
3336	taskeng.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
1336	WerFault.exe
1336	WerFault.exe
1336	WerFault.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
3928	stealc_default.exe
3928	stealc_default.exe
4116	sysnldcvmr.exe
2036	4363463463464363463463463.exe
4584	99awhy8l.exe
3336	taskeng.exe
4664	cmd.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe
2036	4363463463464363463463463.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\ElectronArtsCLI = "C:\\Users\\Admin\\Videos\\ElectronArts\\Bin\\ElectronArtsCLI.exe"	Out2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe"	o.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
12	bitbucket.org
13	bitbucket.org
51	raw.githubusercontent.com
52	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2276	tasklist.exe
3860	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4380	tyhkamwdmrg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3368 set thread context of 3400	3368	Intel_PTT_EK_Recertification.exe	63
PID 4972 set thread context of 2800	4972	Intel_PTT_EK_Recertification.exe	84

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001961d-143.dat	upx
behavioral1/memory/392-152-0x000000013F8F0000-0x000000013FD80000-memory.dmp	upx
behavioral1/memory/392-150-0x000000013F8F0000-0x000000013FD80000-memory.dmp	upx
behavioral1/memory/3056-147-0x000000013F8F0000-0x000000013FD80000-memory.dmp	upx
behavioral1/memory/3336-1462-0x000000013F240000-0x000000013F6D0000-memory.dmp	upx
behavioral1/memory/3368-1465-0x000000013F240000-0x000000013F6D0000-memory.dmp	upx
behavioral1/memory/3368-1476-0x000000013F240000-0x000000013F6D0000-memory.dmp	upx
behavioral1/memory/4972-2056-0x000000013FCA0000-0x0000000140130000-memory.dmp	upx
behavioral1/memory/4972-1979-0x000000013FCA0000-0x0000000140130000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\sysnldcvmr.exe	o.exe
File opened for modification	C:\Windows\sysnldcvmr.exe	o.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1336	2140	WerFault.exe	69

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Out2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysnldcvmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	od.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	99awhy8l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lastest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C1J7SVw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XwormLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cooper.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tyhkamwdmrg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Out2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TT18.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3444	powershell.exe
3580	PING.EXE
3436	powershell.exe
4020	PING.EXE
1044	powershell.exe
1564	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4300	timeout.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	od.exe

Modifies system certificate store 2 TTPs 16 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	4363463463464363463463463.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	4363463463464363463463463.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4363463463464363463463463.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	4363463463464363463463463.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4363463463464363463463463.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Cooper.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Cooper.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	4363463463464363463463463.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	4363463463464363463463463.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1564	PING.EXE
3580	PING.EXE
4020	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2508	schtasks.exe
4940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1044	powershell.exe
3368	Intel_PTT_EK_Recertification.exe
3444	powershell.exe
3928	stealc_default.exe
4972	Intel_PTT_EK_Recertification.exe
3436	powershell.exe
1364	Cooper.pif
1364	Cooper.pif
1364	Cooper.pif
3964	powershell.exe
4500	powershell.exe
4544	powershell.exe
4636	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	4363463463464363463463463.exe
Token: SeRestorePrivilege	1092	7z.exe
Token: 35	1092	7z.exe
Token: SeSecurityPrivilege	1092	7z.exe
Token: SeSecurityPrivilege	1092	7z.exe
Token: SeRestorePrivilege	2824	7z.exe
Token: 35	2824	7z.exe
Token: SeSecurityPrivilege	2824	7z.exe
Token: SeSecurityPrivilege	2824	7z.exe
Token: SeRestorePrivilege	1712	7z.exe
Token: 35	1712	7z.exe
Token: SeSecurityPrivilege	1712	7z.exe
Token: SeSecurityPrivilege	1712	7z.exe
Token: SeRestorePrivilege	1752	7z.exe
Token: 35	1752	7z.exe
Token: SeSecurityPrivilege	1752	7z.exe
Token: SeSecurityPrivilege	1752	7z.exe
Token: SeRestorePrivilege	2028	7z.exe
Token: 35	2028	7z.exe
Token: SeSecurityPrivilege	2028	7z.exe
Token: SeSecurityPrivilege	2028	7z.exe
Token: SeRestorePrivilege	2120	7z.exe
Token: 35	2120	7z.exe
Token: SeSecurityPrivilege	2120	7z.exe
Token: SeSecurityPrivilege	2120	7z.exe
Token: SeRestorePrivilege	1544	7z.exe
Token: 35	1544	7z.exe
Token: SeSecurityPrivilege	1544	7z.exe
Token: SeSecurityPrivilege	1544	7z.exe
Token: SeRestorePrivilege	2692	7z.exe
Token: 35	2692	7z.exe
Token: SeSecurityPrivilege	2692	7z.exe
Token: SeSecurityPrivilege	2692	7z.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	1520	5KNCHALAH.exe
Token: SeBackupPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeBackupPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeBackupPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeDebugPrivilege	2432	processclass.exe
Token: SeBackupPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeLockMemoryPrivilege	3400	explorer.exe
Token: SeBackupPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeSecurityPrivilege	1144	frap.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeBackupPrivilege	1144	frap.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1364	Cooper.pif
1364	Cooper.pif
1364	Cooper.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1364	Cooper.pif
1364	Cooper.pif
1364	Cooper.pif

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1996	od.exe
1996	od.exe
3176	Out2.exe
4380	tyhkamwdmrg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2624	2036	4363463463464363463463463.exe	31
PID 2036 wrote to memory of 2624	2036	4363463463464363463463463.exe	31
PID 2036 wrote to memory of 2624	2036	4363463463464363463463463.exe	31
PID 2036 wrote to memory of 2624	2036	4363463463464363463463463.exe	31
PID 2624 wrote to memory of 3056	2624	C1J7SVw.exe	32
PID 2624 wrote to memory of 3056	2624	C1J7SVw.exe	32
PID 2624 wrote to memory of 3056	2624	C1J7SVw.exe	32
PID 2624 wrote to memory of 3056	2624	C1J7SVw.exe	32
PID 3056 wrote to memory of 2168	3056	cmd.exe	34
PID 3056 wrote to memory of 2168	3056	cmd.exe	34
PID 3056 wrote to memory of 2168	3056	cmd.exe	34
PID 3056 wrote to memory of 1092	3056	cmd.exe	35
PID 3056 wrote to memory of 1092	3056	cmd.exe	35
PID 3056 wrote to memory of 1092	3056	cmd.exe	35
PID 3056 wrote to memory of 2824	3056	cmd.exe	36
PID 3056 wrote to memory of 2824	3056	cmd.exe	36
PID 3056 wrote to memory of 2824	3056	cmd.exe	36
PID 3056 wrote to memory of 1712	3056	cmd.exe	37
PID 3056 wrote to memory of 1712	3056	cmd.exe	37
PID 3056 wrote to memory of 1712	3056	cmd.exe	37
PID 3056 wrote to memory of 1752	3056	cmd.exe	38
PID 3056 wrote to memory of 1752	3056	cmd.exe	38
PID 3056 wrote to memory of 1752	3056	cmd.exe	38
PID 3056 wrote to memory of 2028	3056	cmd.exe	39
PID 3056 wrote to memory of 2028	3056	cmd.exe	39
PID 3056 wrote to memory of 2028	3056	cmd.exe	39
PID 3056 wrote to memory of 2120	3056	cmd.exe	40
PID 3056 wrote to memory of 2120	3056	cmd.exe	40
PID 3056 wrote to memory of 2120	3056	cmd.exe	40
PID 3056 wrote to memory of 1544	3056	cmd.exe	41
PID 3056 wrote to memory of 1544	3056	cmd.exe	41
PID 3056 wrote to memory of 1544	3056	cmd.exe	41
PID 3056 wrote to memory of 2692	3056	cmd.exe	42
PID 3056 wrote to memory of 2692	3056	cmd.exe	42
PID 3056 wrote to memory of 2692	3056	cmd.exe	42
PID 3056 wrote to memory of 2152	3056	cmd.exe	43
PID 3056 wrote to memory of 2152	3056	cmd.exe	43
PID 3056 wrote to memory of 2152	3056	cmd.exe	43
PID 3056 wrote to memory of 392	3056	cmd.exe	44
PID 3056 wrote to memory of 392	3056	cmd.exe	44
PID 3056 wrote to memory of 392	3056	cmd.exe	44
PID 392 wrote to memory of 1036	392	in.exe	45
PID 392 wrote to memory of 1036	392	in.exe	45
PID 392 wrote to memory of 1036	392	in.exe	45
PID 392 wrote to memory of 1296	392	in.exe	46
PID 392 wrote to memory of 1296	392	in.exe	46
PID 392 wrote to memory of 1296	392	in.exe	46
PID 392 wrote to memory of 2508	392	in.exe	49
PID 392 wrote to memory of 2508	392	in.exe	49
PID 392 wrote to memory of 2508	392	in.exe	49
PID 392 wrote to memory of 1044	392	in.exe	50
PID 392 wrote to memory of 1044	392	in.exe	50
PID 392 wrote to memory of 1044	392	in.exe	50
PID 1044 wrote to memory of 1564	1044	powershell.exe	53
PID 1044 wrote to memory of 1564	1044	powershell.exe	53
PID 1044 wrote to memory of 1564	1044	powershell.exe	53
PID 2036 wrote to memory of 3036	2036	4363463463464363463463463.exe	55
PID 2036 wrote to memory of 3036	2036	4363463463464363463463463.exe	55
PID 2036 wrote to memory of 3036	2036	4363463463464363463463463.exe	55
PID 2036 wrote to memory of 3036	2036	4363463463464363463463463.exe	55
PID 2036 wrote to memory of 3036	2036	4363463463464363463463463.exe	55
PID 2036 wrote to memory of 3036	2036	4363463463464363463463463.exe	55
PID 2036 wrote to memory of 3036	2036	4363463463464363463463463.exe	55
PID 2036 wrote to memory of 2432	2036	4363463463464363463463463.exe	56

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2152	attrib.exe
1296	attrib.exe
1036	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\Files\C1J7SVw.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\C1J7SVw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\system32\mode.com
      mode 65,10
      4⤵
      PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e file.zip -p24291711423417250691697322505 -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e extracted/file_7.zip -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e extracted/file_6.zip -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e extracted/file_5.zip -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e extracted/file_4.zip -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e extracted/file_3.zip -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e extracted/file_2.zip -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
      7z.exe e extracted/file_1.zip -oextracted
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2692
  - - C:\Windows\system32\attrib.exe
      attrib +H "in.exe"
      4⤵
      Views/modifies file attributes
      PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
      "in.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:392
    - - C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        5⤵
        Views/modifies file attributes
        
        PID:1036
    - - C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        5⤵
        Views/modifies file attributes
        
        PID:1296
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1044
      - C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1564
- C:\Users\Admin\AppData\Local\Temp\Files\Out2.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Out2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3036
- - C:\Users\Admin\AppData\Local\Temp\Files\Out2.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Out2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3176
- C:\Users\Admin\AppData\Local\Temp\Files\processclass.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\processclass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\Files\5KNCHALAH.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\5KNCHALAH.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Users\Admin\AppData\Local\Temp\Files\od.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\od.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\Files\frap.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\frap.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Users\Admin\AppData\Local\Temp\Files\stealc_default.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\stealc_default.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\stealc_default.exe" & del "C:\ProgramData\*.dll"" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4260
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4300
- C:\Users\Admin\AppData\Local\Temp\Files\XwormLoader.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\XwormLoader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 128
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1336
- C:\Users\Admin\AppData\Local\Temp\Files\o.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\o.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1164
- - C:\Windows\sysnldcvmr.exe
    C:\Windows\sysnldcvmr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\849114491.exe
      C:\Users\Admin\AppData\Local\Temp\849114491.exe
      4⤵
      Executes dropped EXE
      PID:4460
- C:\Users\Admin\AppData\Local\Temp\Files\99awhy8l.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\99awhy8l.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy Impacts Impacts.bat & Impacts.bat
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4664
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:2276
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3760
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:3860
  - - C:\Windows\SysWOW64\findstr.exe
      findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3868
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 578678
      4⤵
      System Location Discovery: System Language Discovery
      PID:4004
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "PEACEFOLKSEXUALISLANDS" Hill
      4⤵
      System Location Discovery: System Language Discovery
      PID:4068
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Webpage + ..\Von + ..\Exotic + ..\Relief + ..\Seo + ..\Serious + ..\Myth y
      4⤵
      System Location Discovery: System Language Discovery
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\578678\Cooper.pif
      Cooper.pif y
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1364
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:1688
- C:\Users\Admin\AppData\Local\Temp\Files\t.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\t.exe"
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Users\Admin\AppData\Local\Temp\Files\lastest.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\lastest.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4212
- C:\Users\Admin\AppData\Local\Temp\Files\TT18.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\TT18.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4240
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\mVjpAgYo'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3964
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\mVjpAgYo
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4500
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4544
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Windows
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4636
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4768
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4860
- C:\Users\Admin\AppData\Local\Temp\Files\tyhkamwdmrg.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\tyhkamwdmrg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4380
- C:\Users\Admin\AppData\Local\Temp\Files\t1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\t1.exe"
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  PID:4716
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Windows\system32\a7\RuntimeBroker.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4940
- C:\Users\Admin\AppData\Local\Temp\Files\pei.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\pei.exe"
  2⤵
  PID:4836

C:\Windows\system32\taskeng.exe
taskeng.exe {559DC784-A92E-4549-9A2D-76F1EB1975C4} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:3336
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:3368
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3580
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:4972
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - Drops file in System32 directory
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3436
  - - C:\Windows\system32\PING.EXE
      "C:\Windows\system32\PING.EXE" 127.1.10.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\registro\registros.dat

Filesize
180B

MD5
8ce3de0a34d95d4888b8d2ab0f0378cf

SHA1
f2a0f4d0d2290f78d3d4e83df82148ed35b7f4cf

SHA256
0d98812f1fde9f6c5b4219747ac39daa1785f61c74faa9cbc9d8b0e87ba95ad9

SHA512
f1adffd83293963dacdde9d63b907679a9206d13f39b1dbca9c03df7167c6c8f5b826bc0cfd394dd9ecafa6846197b1b36ecbc9abc3457288966621afaa718cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ce466fc703750dfad434fd5a21f46a1

SHA1
44e4e550a3e71aac56b4191ccd6bcbfafe0c6990

SHA256
e11ea965a8da62d4a87d3abda864d2abec5918f56de5e7b4dbcb56c803317c87

SHA512
c94b178cb0bab64ee15146dfac3164eb58af65ce847ebaea53cb12aab3f33f1c8320cfab946dbb19e0ef5ab647ebdc0708a58e9514a418eb889f163990ff061e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2f6b39bbd5a77e2f894bf1c7c748bdc

SHA1
0648905c093b11efa1b0062a1bda380d699804fa

SHA256
3b8aa95084cc74961883cb18c37abf8278938288652ddc969d80ff9f63e45e16

SHA512
5ccf0f4c4cd8ab05c7fec80b4cd9a7d1956d48b2b80510d739fc632eec253556b8f9e5a27eb1737e24b845aef37bc339cc0d050b397f1c74a647762891f0cd34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8413e2826080d7897087b94fe894269

SHA1
b94b68d3c407eaa98e54bb2ea8db56b9be7b268e

SHA256
a359e847608e91c7e8d1320366651b553cb12e591eace9604092f8e24e5910fa

SHA512
3bdc128301b5846366dfc1558a5e9b5571666e07d3b0578b16a9b2ff6f2f1d340e06fa71a21985dda07f83833d140bb14d11ab21cb43bc5debf546a573baa9fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4c6ce85e44b5a9d4eb8dd027f0a5358

SHA1
25f005579a74c3139e8c624382497a861a2373bd

SHA256
a3bf59d7282b19363b9bccc0952c6992afa58e2cece762c796133d376662d54d

SHA512
4940d452ea10e90ee71f6e694f5154860487f855a74983a9cf9843f5a6284f6fba554d1f1588052152f1eaac69884fb21a1d010727a0eb578e1e79d5e2ffea58

Download Submit
C:\Users\Admin\AppData\Local\Temp\578678\Cooper.pif

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA037.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\5KNCHALAH.exe

Filesize
1.6MB

MD5
3f99c2698fc247d19dd7f42223025252

SHA1
043644883191079350b2f2ffbefef5431d768f99

SHA256
ba8561bf19251875a15471812042adac49f825c69c3087054889f6107297c6f3

SHA512
6a88d1049059bba8f0c9498762502e055107d9f82dbc0aacfdd1e1c138bdb875cf68c2b7998408f8235e53b2bb864ba6f43c249395640b62af305a62b9bfcd67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\C1J7SVw.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\XwormLoader.exe

Filesize
490KB

MD5
9c9245810bad661af3d6efec543d34fd

SHA1
93e4f301156d120a87fe2c4be3aaa28b9dfd1a8d

SHA256
f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478

SHA512
90d9593595511e722b733a13c53d2e69a1adc9c79b3349350deead2c1cdfed615921fb503597950070e9055f6df74bb64ccd94a60d7716822aa632699c70b767

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\frap.exe

Filesize
227KB

MD5
6e2ecc4230c37a6eeb1495257d6d3153

SHA1
50c5d4e2e71a39e852ab09a2857ac1cb5f882803

SHA256
f5184103aaacf8c9a7b780ccf7729be92cb813b3b61f4d1a9394352050ae86a2

SHA512
849f39d00cdb3c1481adfe7a2b1745ba97cf02e6e45b471ec1e3292ef92130e2319455702c71f5c531926d008dd2e9dfbfe9d66e1c81406bc9532eb4bf1febd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\o.exe

Filesize
79KB

MD5
0c883b1d66afce606d9830f48d69d74b

SHA1
fe431fe73a4749722496f19b3b3ca0b629b50131

SHA256
d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

SHA512
c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\od.exe

Filesize
6.5MB

MD5
17ed6d1f2c94436b2c9711da860dc792

SHA1
7d63ec8b7581db639f60d417f36b79946d2095ad

SHA256
1762600d80df88a324452290a176bfab40ec965f5bb27be12a4cb71614b94c56

SHA512
52270196114a94e688edf6862f9b37aab2da7ea2094a310cbe497f90f5ebd1f39ddaabefeb506978796b4a2cdeb3a67a0ae376c09ec27bcc747209f305df552b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\stealc_default.exe

Filesize
187KB

MD5
e78239a5b0223499bed12a752b893cad

SHA1
a429b46db791f433180ae4993ebb656d2f9393a4

SHA256
80befdb25413d68adbadd8f236a2e8c71b261d8befc04c99749e778b07bcde89

SHA512
cee5d5d4d32e5575852a412f6b3e17f8c0cbafe97fd92c7024934234a23c240dcc1f7a0452e2e5da949dec09dcfeb006e73862c5bbc549a2ab1cfb0241eaddfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\tyhkamwdmrg.exe

Filesize
1.2MB

MD5
949249a7efcd8c6fd21bc9ffe9ecfdbb

SHA1
e335b63c7accfd306efb2cd83d3d669b915f6f15

SHA256
bfffe1926c7463a2f8dca190e700a5ff390cb028edfe1bb80491aaf706520123

SHA512
309e94d267b55bfb58547a021a53bebfed612da42c5c8dfe55063ed40188c0535095c7a19e5c56adeca53b268ddaa7dbac38857abe1dadca146cc7e7c90cf7b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Impacts.bat

Filesize
20KB

MD5
e66bce26cc9f5ea1c9e1d78fdb060e57

SHA1
5a83a6454cb6384fdaaf68585d743da3488eed28

SHA256
34e6b48e8a53c7f983f7944c69764cbac28fbd0d2283e797506d0e256debf3d2

SHA512
94ef52636660fb3d7aadc10459460781d95e1d83389e3519f19d093806f273b330b4596f03ac1f9268aad45a244e537ff6d0ba773be33c627fe86f18128bff7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA05A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

Filesize
2.2MB

MD5
579a63bebccbacab8f14132f9fc31b89

SHA1
fca8a51077d352741a9c1ff8a493064ef5052f27

SHA256
0ac3504d5fa0460cae3c0fd9c4b628e1a65547a60563e6d1f006d17d5a6354b0

SHA512
4a58ca0f392187a483b9ef652b6e8b2e60d01daa5d331549df9f359d2c0a181e975cf9df79552e3474b9d77f8e37a1cf23725f32d4cdbe4885e257a7625f7b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

Filesize
1.7MB

MD5
5659eba6a774f9d5322f249ad989114a

SHA1
4bfb12aa98a1dc2206baa0ac611877b815810e4c

SHA256
e04346fee15c3f98387a3641e0bba2e555a5a9b0200e4b9256b1b77094069ae4

SHA512
f93abf2787b1e06ce999a0cbc67dc787b791a58f9ce20af5587b2060d663f26be9f648d116d9ca279af39299ea5d38e3c86271297e47c1438102ca28fce8edc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

Filesize
1.7MB

MD5
5404286ec7853897b3ba00adf824d6c1

SHA1
39e543e08b34311b82f6e909e1e67e2f4afec551

SHA256
ec94a6666a3103ba6be60b92e843075a2d7fe7d30fa41099c3f3b1e2a5eba266

SHA512
c4b78298c42148d393feea6c3941c48def7c92ef0e6baac99144b083937d0a80d3c15bd9a0bf40daa60919968b120d62999fa61af320e507f7e99fbfe9b9ef30

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

Filesize
1.7MB

MD5
5eb39ba3698c99891a6b6eb036cfb653

SHA1
d2f1cdd59669f006a2f1aa9214aeed48bc88c06e

SHA256
e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2

SHA512
6c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

Filesize
1.7MB

MD5
7187cc2643affab4ca29d92251c96dee

SHA1
ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

SHA256
c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

SHA512
27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

Filesize
1.7MB

MD5
b7d1e04629bec112923446fda5391731

SHA1
814055286f963ddaa5bf3019821cb8a565b56cb8

SHA256
4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

SHA512
79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip

Filesize
1.7MB

MD5
0dc4014facf82aa027904c1be1d403c1

SHA1
5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

SHA256
a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

SHA512
cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip

Filesize
3.3MB

MD5
cea368fc334a9aec1ecff4b15612e5b0

SHA1
493d23f72731bb570d904014ffdacbba2334ce26

SHA256
07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

SHA512
bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\in.exe

Filesize
1.7MB

MD5
83d75087c9bf6e4f07c36e550731ccde

SHA1
d5ff596961cce5f03f842cfd8f27dde6f124e3ae

SHA256
46db3164bebffc61c201fe1e086bffe129ddfed575e6d839ddb4f9622963fb3f

SHA512
044e1f5507e92715ce9df8bb802e83157237a2f96f39bac3b6a444175f1160c4d82f41a0bcecf5feaf1c919272ed7929baef929a8c3f07deecebc44b0435164a

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\file.bin

Filesize
3.3MB

MD5
045b0a3d5be6f10ddf19ae6d92dfdd70

SHA1
0387715b6681d7097d372cd0005b664f76c933c7

SHA256
94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

SHA512
58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
440B

MD5
3626532127e3066df98e34c3d56a1869

SHA1
5fa7102f02615afde4efd4ed091744e842c63f78

SHA256
2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

SHA512
dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\64X75NN1CAC84P42I6OI.temp

Filesize
7KB

MD5
b7506b96d4690f826fd61586e761daef

SHA1
7d35c4a8b280f23d5a8cdc4d60a826d2ccd4c591

SHA256
8b4714eb19e892e3be8376328efcf59c072bdfc9c599e39d59fa876b7e068b92

SHA512
ebc752b3860ce0b54abe5dd95dd822e615abe969fb95c03ea9542b03a31dc7ee1f8db151c7ff6decebb9d7bcd05fddc1f5c5e95690e01877ef685f7525675d3a

Download Submit
\Users\Admin\AppData\Local\Temp\Files\Out2.exe

Filesize
2.3MB

MD5
b1a62f3fd3a9a4a06c6bbffbb1cbb463

SHA1
f3954f2ddbbe05daa9eeb3e9a9e0bb661f925e76

SHA256
5dcbcb9f5b780bb07e8eb4e98313fc5d0b222823ac94d338b3c3e3fb3efb77e5

SHA512
a53c1789f2c465809b307a1daabc0b4c10fafe983040ac112f0de0cf5afae3b532630095e62971e0588a7fd17b62caa4ff2f06cb04e6e3799ceca4ce43569528

Download Submit
\Users\Admin\AppData\Local\Temp\Files\processclass.exe

Filesize
6KB

MD5
c042782226565f89ce3954489075e516

SHA1
256dd5ba42837a33c7aa6cb71cef33d5617117ee

SHA256
a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

SHA512
9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

Download Submit
memory/392-150-0x000000013F8F0000-0x000000013FD80000-memory.dmp

Filesize
4.6MB

Download
memory/392-152-0x000000013F8F0000-0x000000013FD80000-memory.dmp

Filesize
4.6MB

Download
memory/1044-159-0x0000000001E20000-0x0000000001E28000-memory.dmp

Filesize
32KB

Download
memory/1044-158-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/1144-1435-0x00000000009C0000-0x00000000009FE000-memory.dmp

Filesize
248KB

Download
memory/1520-1491-0x00000000023A0000-0x00000000023FC000-memory.dmp

Filesize
368KB

Download
memory/1520-344-0x000000001BFB0000-0x000000001C0DA000-memory.dmp

Filesize
1.2MB

Download
memory/1520-400-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-398-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-396-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-394-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-392-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-390-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-388-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-386-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-384-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-382-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-380-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-378-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-376-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-374-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-372-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-370-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-368-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-366-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-364-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-362-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-360-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-358-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-356-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-354-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-352-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-350-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-348-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-346-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-345-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-404-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-1427-0x0000000000A20000-0x0000000000A6C000-memory.dmp

Filesize
304KB

Download
memory/1520-1426-0x0000000000B80000-0x0000000000C24000-memory.dmp

Filesize
656KB

Download
memory/1520-406-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-402-0x000000001BFB0000-0x000000001C0D4000-memory.dmp

Filesize
1.1MB

Download
memory/1520-343-0x0000000000280000-0x000000000041A000-memory.dmp

Filesize
1.6MB

Download
memory/1520-1492-0x0000000002670000-0x000000000272A000-memory.dmp

Filesize
744KB

Download
memory/1520-1490-0x0000000000C20000-0x0000000000C74000-memory.dmp

Filesize
336KB

Download
memory/2036-64-0x000000007475E000-0x000000007475F000-memory.dmp

Filesize
4KB

Download
memory/2036-1507-0x0000000006F00000-0x0000000007143000-memory.dmp

Filesize
2.3MB

Download
memory/2036-2280-0x0000000007800000-0x0000000007BBB000-memory.dmp

Filesize
3.7MB

Download
memory/2036-1-0x00000000011E0000-0x00000000011E8000-memory.dmp

Filesize
32KB

Download
memory/2036-2-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-0-0x000000007475E000-0x000000007475F000-memory.dmp

Filesize
4KB

Download
memory/2036-2279-0x0000000007800000-0x0000000007BBB000-memory.dmp

Filesize
3.7MB

Download
memory/2036-96-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download
memory/2036-1508-0x0000000006F00000-0x0000000007143000-memory.dmp

Filesize
2.3MB

Download
memory/2432-336-0x0000000000F50000-0x0000000000F58000-memory.dmp

Filesize
32KB

Download
memory/3056-148-0x000000013F8F0000-0x000000013FD80000-memory.dmp

Filesize
4.6MB

Download
memory/3056-161-0x000000013F8F0000-0x000000013FD80000-memory.dmp

Filesize
4.6MB

Download
memory/3056-160-0x000000013F8F0000-0x000000013FD80000-memory.dmp

Filesize
4.6MB

Download
memory/3056-147-0x000000013F8F0000-0x000000013FD80000-memory.dmp

Filesize
4.6MB

Download
memory/3336-1463-0x000000013F240000-0x000000013F6D0000-memory.dmp

Filesize
4.6MB

Download
memory/3336-1852-0x000000013FCA0000-0x0000000140130000-memory.dmp

Filesize
4.6MB

Download
memory/3336-1462-0x000000013F240000-0x000000013F6D0000-memory.dmp

Filesize
4.6MB

Download
memory/3336-2244-0x000000013FCA0000-0x0000000140130000-memory.dmp

Filesize
4.6MB

Download
memory/3336-1488-0x000000013F240000-0x000000013F6D0000-memory.dmp

Filesize
4.6MB

Download
memory/3368-1476-0x000000013F240000-0x000000013F6D0000-memory.dmp

Filesize
4.6MB

Download
memory/3368-1465-0x000000013F240000-0x000000013F6D0000-memory.dmp

Filesize
4.6MB

Download
memory/3436-2109-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/3436-2110-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/3444-1485-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/3444-1487-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/3928-1695-0x0000000000AF0000-0x0000000000D33000-memory.dmp

Filesize
2.3MB

Download
memory/4240-2270-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

Filesize
40KB

Download
memory/4380-2281-0x0000000000AA0000-0x0000000000E5B000-memory.dmp

Filesize
3.7MB

Download
memory/4716-2303-0x0000000000DE0000-0x0000000001104000-memory.dmp

Filesize
3.1MB

Download
memory/4972-1979-0x000000013FCA0000-0x0000000140130000-memory.dmp

Filesize
4.6MB

Download
memory/4972-2056-0x000000013FCA0000-0x0000000140130000-memory.dmp

Filesize
4.6MB

Download