fabookie | b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe
Size

7.9MB
MD5

eb7233922891e1dad0434fbd52623647
SHA1

331126b108532ab9a1e932141bff55a38656bce9
SHA256

b39e29c24003441609c457a3455cae9d9fb6f4462f5e06d0c1d317d243711cb8
SHA512

597fbb0f397c45c8a2c5f63893c6d6bd4641e952510dfcac05dadb7afaaf4e005df1261649d4e79951979bad0be1fb09feebac7a6d23c31679590cbf40e1d4ac
SSDEEP

196608:41kIY19mLlZ1AM8uizyFMoKoEHihPnjTr6aGEiINJGzXe:jilZ1v8w3jhdGEJG7e

Score

10^/10

fabookie ffdroider glupteba metasploit smokeloader pub2 backdoor discovery dropper evasion loader persistence rootkit spyware stealer trojan upx vmprotect

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

ffdroider

http://186.2.171.3

Extracted

Family

smokeloader

Botnet

pub2

Signatures

Detect Fabookie payload 1 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files.exe family_fabookie
FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files.exe	family_fabookie

FFDroider payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/6000-205-0x0000000000400000-0x0000000000759000-memory.dmp	family_ffdroider
behavioral2/memory/6000-232-0x0000000000400000-0x0000000000759000-memory.dmp	family_ffdroider
behavioral2/memory/6000-738-0x0000000000400000-0x0000000000759000-memory.dmp	family_ffdroider

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4108-95-0x00000000014F0000-0x0000000001E16000-memory.dmp	family_glupteba
behavioral2/memory/4108-96-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/4108-102-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/4108-104-0x00000000014F0000-0x0000000001E16000-memory.dmp	family_glupteba
behavioral2/memory/3620-120-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/3620-136-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/5184-144-0x0000000001B00000-0x0000000002426000-memory.dmp	family_glupteba
behavioral2/memory/5184-145-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/5184-162-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/5184-183-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/5184-184-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/5184-185-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/5184-186-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/5184-208-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/5184-213-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba
behavioral2/memory/5184-238-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rUNdlL32.eXe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2544 5040 rUNdlL32.eXe
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Nirsoft 2 IoCs

Processes:

resource yara_rule

behavioral2/memory/5208-781-0x0000000000400000-0x000000000045B000-memory.dmp Nirsoft
behavioral2/memory/3320-793-0x0000000000400000-0x0000000000422000-memory.dmp Nirsoft
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4992 netsh.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	5040	rUNdlL32.eXe

resource	yara_rule
behavioral2/memory/5208-781-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/3320-793-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft

pid	process
4992	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

eb7233922891e1dad0434fbd52623647_JaffaCakes118.exeFolder.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	Folder.exe

Executes dropped EXE 14 IoCs

Processes:

KRSetp.exeFolder.exeFolder.exeInfo.exeInfo.exeInstallation.execsrss.exeinjector.exemd9_1sjm.exepub2.exemysetold.exeFiles.exejfiag3g_gg.exejfiag3g_gg.exe

pid	process
4368	KRSetp.exe
3888	Folder.exe
3448	Folder.exe
4108	Info.exe
3620	Info.exe
3360	Installation.exe
5184	csrss.exe
5600	injector.exe
6000	md9_1sjm.exe
4136	pub2.exe
3372	mysetold.exe
2784	Files.exe
5208	jfiag3g_gg.exe
3320	jfiag3g_gg.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4176 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4176	rundll32.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
behavioral2/memory/5208-778-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/5208-781-0x0000000000400000-0x000000000045B000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
behavioral2/memory/3320-787-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3320-793-0x0000000000400000-0x0000000000422000-memory.dmp	upx

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe	vmprotect
behavioral2/memory/6000-203-0x0000000000400000-0x0000000000759000-memory.dmp	vmprotect
behavioral2/memory/6000-204-0x0000000000400000-0x0000000000759000-memory.dmp	vmprotect
behavioral2/memory/6000-205-0x0000000000400000-0x0000000000759000-memory.dmp	vmprotect
behavioral2/memory/6000-232-0x0000000000400000-0x0000000000759000-memory.dmp	vmprotect
behavioral2/memory/6000-738-0x0000000000400000-0x0000000000759000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Info.exeFiles.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LivelyMoon = "\"C:\\Windows\\rss\\csrss.exe\""	Info.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	Files.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

md9_1sjm.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md9_1sjm.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

5 iplogger.org
11 iplogger.org
15 iplogger.org
23 iplogger.org
26 iplogger.org
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

98 ip-api.com
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mysetold.exe autoit_exe
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

Info.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN Info.exe
Drops file in Windows directory 2 IoCs

Processes:

Info.exe

description ioc process

File opened for modification C:\Windows\rss Info.exe
File created C:\Windows\rss\csrss.exe Info.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4456 4176 WerFault.exe rundll32.exe
1824 4136 WerFault.exe pub2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md9_1sjm.exe

flow	ioc
5	iplogger.org
11	iplogger.org
15	iplogger.org
23	iplogger.org
26	iplogger.org

flow	ioc
98	ip-api.com

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mysetold.exe	autoit_exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	Info.exe

description	ioc	process
File opened for modification	C:\Windows\rss	Info.exe
File created	C:\Windows\rss\csrss.exe	Info.exe

pid	pid_target	process	target process
4456	4176	WerFault.exe	rundll32.exe
1824	4136	WerFault.exe	pub2.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

pub2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

5392 schtasks.exe

pid	process
5392	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

GoLang User-Agent 4 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 41 Go-http-client/1.1
HTTP User-Agent header 63 Go-http-client/1.1
HTTP User-Agent header 64 Go-http-client/1.1
HTTP User-Agent header 65 Go-http-client/1.1

description	flow	ioc
HTTP User-Agent header	41	Go-http-client/1.1
HTTP User-Agent header	63	Go-http-client/1.1
HTTP User-Agent header	64	Go-http-client/1.1
HTTP User-Agent header	65	Go-http-client/1.1

Modifies data under HKEY_USERS 64 IoCs

Processes:

Info.execsrss.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Info.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Info.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	Info.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Info.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Info.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	Info.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	csrss.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeInfo.exeidentity_helper.exeInfo.execsrss.exeinjector.exe

pid	process
2196	msedge.exe
2196	msedge.exe
4516	msedge.exe
4516	msedge.exe
4108	Info.exe
4108	Info.exe
4176	identity_helper.exe
4176	identity_helper.exe
3620	Info.exe
3620	Info.exe
5184	csrss.exe
5184	csrss.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe
5600	injector.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

pub2.exe

pid process

4136 pub2.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid process

2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
2196 msedge.exe
2196 msedge.exe

pid	process
4136	pub2.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

KRSetp.exeInfo.exeInfo.execsrss.exemd9_1sjm.exe

description	pid	process
Token: SeDebugPrivilege	4368	KRSetp.exe
Token: SeDebugPrivilege	4108	Info.exe
Token: SeImpersonatePrivilege	4108	Info.exe
Token: SeSystemEnvironmentPrivilege	3620	Info.exe
Token: SeSystemEnvironmentPrivilege	5184	csrss.exe
Token: SeManageVolumePrivilege	6000	md9_1sjm.exe
Token: SeManageVolumePrivilege	6000	md9_1sjm.exe
Token: SeManageVolumePrivilege	6000	md9_1sjm.exe
Token: SeManageVolumePrivilege	6000	md9_1sjm.exe
Token: SeManageVolumePrivilege	6000	md9_1sjm.exe
Token: SeShutdownPrivilege	3412
Token: SeCreatePagefilePrivilege	3412
Token: SeShutdownPrivilege	3412
Token: SeCreatePagefilePrivilege	3412
Token: SeShutdownPrivilege	3412
Token: SeCreatePagefilePrivilege	3412
Token: SeShutdownPrivilege	3412
Token: SeCreatePagefilePrivilege	3412
Token: SeShutdownPrivilege	3412
Token: SeCreatePagefilePrivilege	3412
Token: SeShutdownPrivilege	3412
Token: SeCreatePagefilePrivilege	3412
Token: SeShutdownPrivilege	3412
Token: SeCreatePagefilePrivilege	3412

Suspicious use of FindShellTrayWindow 32 IoCs

Processes:

msedge.exemysetold.exe

pid	process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
3372	mysetold.exe
3412
3412
3372	mysetold.exe
3372	mysetold.exe
3412
3412

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

msedge.exemysetold.exe

pid	process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
3372	mysetold.exe
3372	mysetold.exe
3372	mysetold.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Installation.exe

pid process

3360 Installation.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3412

pid	process
3360	Installation.exe

pid	process
3412

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

eb7233922891e1dad0434fbd52623647_JaffaCakes118.exemsedge.exeFolder.exe

description	pid	process	target process
PID 876 wrote to memory of 4368	876	eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe	KRSetp.exe
PID 876 wrote to memory of 4368	876	eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe	KRSetp.exe
PID 876 wrote to memory of 2196	876	eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe	msedge.exe
PID 876 wrote to memory of 2196	876	eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe	msedge.exe
PID 2196 wrote to memory of 4620	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4620	2196	msedge.exe	msedge.exe
PID 876 wrote to memory of 3888	876	eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe	Folder.exe
PID 876 wrote to memory of 3888	876	eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe	Folder.exe
PID 876 wrote to memory of 3888	876	eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe	Folder.exe
PID 3888 wrote to memory of 3448	3888	Folder.exe	Folder.exe
PID 3888 wrote to memory of 3448	3888	Folder.exe	Folder.exe
PID 3888 wrote to memory of 3448	3888	Folder.exe	Folder.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4056	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4516	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 4516	2196	msedge.exe	msedge.exe
PID 876 wrote to memory of 4108	876	eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe	Info.exe
PID 876 wrote to memory of 4108	876	eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe	Info.exe
PID 876 wrote to memory of 4108	876	eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe	Info.exe
PID 2196 wrote to memory of 644	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 644	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 644	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 644	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 644	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 644	2196	msedge.exe	msedge.exe
PID 2196 wrote to memory of 644	2196	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb7233922891e1dad0434fbd52623647_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:876

C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/19Pfw7
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd943246f8,0x7ffd94324708,0x7ffd94324718
3⤵
PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
3⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
3⤵
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
3⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
3⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
3⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
3⤵
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
3⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
3⤵
PID:4116

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
3⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
3⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
3⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
3⤵
PID:860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
3⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9359921477342360583,2394530288146713564,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
3⤵
PID:408

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe" -a
3⤵
- Executes dropped EXE
PID:3448

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
4⤵
PID:4976

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
5⤵
- Modifies Windows Firewall
PID:4992

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe /94-94
4⤵
- Executes dropped EXE
- Manipulates WinMonFS driver.
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5184

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
5⤵
- Creates scheduled task(s)
PID:5392

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5600

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3360

C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:6000

C:\Users\Admin\AppData\Local\Temp\RarSFX0\pub2.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\pub2.exe"
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 368
3⤵
- Program crash
PID:1824

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mysetold.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mysetold.exe"
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3372

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2784

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:5208

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:2544

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 612
3⤵
- Program crash
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4176 -ip 4176
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4136 -ip 4136
1⤵
PID:2124

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
21608c39d2b544719ae83f330b56b55c

SHA1
e4b0f15dd8dfb172e7335aaa2064720ee293065c

SHA256
9d01123932d13938fe635d189b9699cc1d7b72a5a6dd1870ecc278e2969a610c

SHA512
933f9dce16e27305b9a9d03b6fb5d42e7d67a4291a04bcea8db624e1472071213f73423377b57a52df4dfe738621464e8d3b0911fdd1728ea30e0b7639960a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
493B

MD5
10c842d3e0fdc6c717847441a2f13b53

SHA1
d4713f4281250d81895ad463e3f843734ed0e09d

SHA256
26dfeb4b11642f3eefa6bc1b4afe2ffef9f1d6cee3cafc274974f3498783aa56

SHA512
4e6102f21b173b8fc9307d7d40d34cb9b79b1c047e46e617bec8de8891c099cab0b4d1a7ccb5ce43d7e56e446307c54b77ddc9ce99e84f36f3fd3412f610d4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d0ae877067b7afd4488bbeb1ebf9db6c

SHA1
645f88827aefc8ac02733ef282ceb4962b362c98

SHA256
e916790e5ce5aa3ddc6dc969dbd9fe27eddfa836e2d08c9cb799a806ea2ddf39

SHA512
6f7c0d310fd0e398e8208687d2a72d2f92367ffdc661a7ca3ccd6b2518136ddfec02d82f6d6ff2be3f78038ceee02b061304c875fd3e06fe36b30306b8eab65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
00d766627cb6fb3e60b659b5320cd4a6

SHA1
85c814b891c8356a9aedf5380bc13e78e6e84e14

SHA256
ecae523d1d946d6d622fad49df8a99d0994b5a9478adf3ecb11cdac2b0fbabdf

SHA512
f1d7fdc057ff2822273ebe9fdc2f9d94c382b822ff5e497e7469527aa986202d8a8681381e2fae0ee625d67fba1ba01d089e01e65dd54db84168f6fbbbc7e22a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
ec0b6079d4985dd6c3c14e39f24e9c4f

SHA1
d871548afc03f12e2ef4e4b6205ce40b44898214

SHA256
e60d0677d22ce7898ace604afb1f7e3a39c820e7ba0976a83288a540b1d6705a

SHA512
0be69943d02768d8e0fb78ce798b6c821bdfc340d8434c87d15048b07cb3b04cbece86dbe599dfe59ebd19f3598ced432fbb005592a2fb19ba512635932c7878

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Files.exe
Filesize
975KB

MD5
2d0217e0c70440d8c82883eadea517b9

SHA1
f3b7dd6dbb43b895ba26f67370af99952b7d83cb

SHA256
d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01

SHA512
6d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Folder.exe
Filesize
712KB

MD5
b89068659ca07ab9b39f1c580a6f9d39

SHA1
7e3e246fcf920d1ada06900889d099784fe06aa5

SHA256
9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

SHA512
940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Info.exe
Filesize
4.5MB

MD5
bda0c64936b09cfb76fda98e37f5b6a4

SHA1
8ee82a7dee86562cb7b1732dafe4c5a9f16f51b8

SHA256
4f5a67a18795c134aa846250f5e88b5fafd28f329fd1742d02b141e1095f9783

SHA512
cf1c0d7a5345ad68887a4f6328db54d3119935aad66544e466a002ec9491990da05614c0457c94e7545924b159afc0bc68f350342cc7f7335406c30ba0be362e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installation.exe
Filesize
631KB

MD5
cbafd60beffb18c666ff85f1517a76f9

SHA1
9e015cba7168b610969bfc299a4ffe4763f4fd5f

SHA256
d31f2d2d991acee74d9be732c8180f37cea12aceaba324804fbcf2d0d2891a3d

SHA512
ba61ac5f49827b0fba2c72f4b19540b91f8bceb8b441a713b7de00317059955ad592c88af8f9c94093077503ab3b4c4c522b0e577599ca5020ad1b0f254066ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KRSetp.exe
Filesize
154KB

MD5
5af9f5b4e531fab8417a2f137350c842

SHA1
644e6ea394ba94830101d4aeb7d9d23c690b0b83

SHA256
a8543cfdbca49e47db17342a882732ae5889601ab06c56927ec1761ba09bfbc4

SHA512
8a0fd77bb8dac23e84e559624c812326184145b7add8ea502c8c11a5c8ba68d5b69878311c41981d75a163ee428e7969e9dd5c4fef955e43913a1e037d4b7b31

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d
Filesize
14.0MB

MD5
05188e9d5061b3769d9bbf1a9012e8e2

SHA1
f395ce0d72ec8df630074c73a6582595147718ae

SHA256
6621843785f66fa64705dcaff71c44746a0abe4b9068a33d56af86d2cfac4dad

SHA512
5624df3ce935e6bd5e6d1e82033c87445e0d414c272223b10423b8a5638265c1f23f888e776fb740a17643fd57d93b12c480860bcc26f0f5476d3b7f0d735830

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.INTEG.RAW
Filesize
85KB

MD5
cf4b3cb9bbccff14b39a7cfe8497a196

SHA1
fe7c872a9785bfb086a57d57c67dbd8f984aef4f

SHA256
8376ba7eafbfc3659d14a2f16b9a3dee2eef8df813ffa0be6fec9f5fd6fee18b

SHA512
02484adfdbfa28e8b96f4fe954b39b0aeaa1440873292d3f8b4081d2b35d1ba4fcad913cc7580e688be29939b48680aa67e23a33da80f761f4fcddddfc3c0f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
674361820ba2467b0c2553316b3dec96

SHA1
f3e439fb9d05c4ba22922a22f36e3ecff10d3efe

SHA256
3d10f29a67f9ab49ab570286b93b04b219d8e81458440d7bb533148a2475011d

SHA512
88f56f8778a7d1025f3b40d47d08ef46e3acec22ba2acc564d303a3cd9476199fbeabebc158e717e2b440e1e6b15455b66b4c1dd8be41cfb57ee2871ffef0218

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
33cb82fb7af275f3e9e9fbbdf46ea917

SHA1
ab316172223074142170ace8e8c6f0a6ea89d4b8

SHA256
1f5c3709e098cf47c299b94ce0fbe6899d8a479baad68182e6d5eca679bec7f0

SHA512
892aa2fab143abfd485e86c49918796519daf1a211731a0aed46827a40c7f81dece6f47bcc6c67b89fafede37bdd0110eaddcd38411e2e76ddf7a61acaa03dbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
93ec3f6a68031b5c358284f15ca38d54

SHA1
ff78ff8a5af8dc2e2410ac0487ff32517aba3139

SHA256
fb3b3899e78fca1f8cc7fb0161e6fc68e8febeaa8876f05de1b8b5eee7084457

SHA512
035f22c2dfed5c76754613f527d067687f9b1d19625efb8adb09dca49727155f560eb453bc108ad745ed09127dbea9774e3e6de3e89375e061eaf1f36ed4e1a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
6b7db3cf4adbe6d42b7c2499f2669c12

SHA1
b7f8ab439efcef16c842f49807a5582917934e3c

SHA256
5f31a14add85a9eca5c08562835758854a7d4d0ee667f39e3dfcd96fc7564083

SHA512
d35f04928306445f2097b25f0f04de8d25b0fe5446f9eeb8bfe81657c3f0554bfa8fabf51b60900b406ed31f1841ddafa2c0102a8c1e4eeedc42c639b8ae5d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
879d3cbb9426378d516734c25606bfaf

SHA1
c92be58ee3e05ee811584ab8a9434b3d8315f8f4

SHA256
0e4afb7c0676e7517fc1c2bd645707aa41f22dbecacb815aa5f7d8156fa01c04

SHA512
c82bfa660a1a3a78eff2d5a12198c73535ceafd6b7694c0d4303d4b8cb64e3054bad8cab031c9b6514bbfb6f88658430066ed4eb683d70079662127cfe2ba973

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
577b3e15a3978776bacfe7f826235472

SHA1
5d1d8ac31c39444875ea2bb44b82a808f82ba36d

SHA256
a4f84f235d54e9980f83f2b7cfd6dd7666d592c5d6b0c00b86a7315b13eab908

SHA512
dbc271ca88510a6f3e640e01d7a0fb5d915da606af0599c8ed0187fed0ceb9df2c75de1acdc042b730a12ddd4ffd8d330a006f975d556870133519439c2356cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
f806b5c31418763b29be9dec0b1aaa79

SHA1
020be247b582944bcbec3542b91c850b9d5b2065

SHA256
ff44f3d90f31d2544c249747deb0ad3962002d6b976a57e4cc11be098a928a09

SHA512
2ae739f5c23cd9e89b3628e2165000034412e395d6f84534e7e5b7a63602cc463f532ec60e23a4e94d5a30abda847404fb2a5202c98d91faed54e8dd1c298e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
9c86d8865fcf403d6e6eb73e91cd3e47

SHA1
05d29cc36552a54a15a41a1db4b402a2d2ac9c72

SHA256
f5563132824f46c0291a28afb9c91716a4fbe375d56be5f0b6389d89430899d4

SHA512
32878563324424ce5eab9f041e5100f0925257d6e37277a6ade42d46cd39cabe21c0c46ac8fd383c6c2bc7877223fae1f62c925537835e12fe49a019498aa415

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
1d4d99f290d6cd37c4df72c507591845

SHA1
4b40590d3ca9f13a85f8cc267a48ac798916677b

SHA256
72f10ed5e4f2c48de70dc1ea8a9435d99eb18e1f7528d7b7317c0774de222d85

SHA512
27cd4f6f1765cb67747cdf01df07dd4b9d5374f28df3439687e43317b57ee9b60a7e21ab847c74b3063bf256887f7962966859d73aee117a588deeacbe40009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
d3043321aab96d9d66a9ba6b14d3542d

SHA1
02844423fb1fced9a7045864b299d49b49ea9091

SHA256
80603380fb64e57451cd35f0830e0dfabbaa5cb0bf0b6311ad48be0e5e67903a

SHA512
a290c43c7b80f2ffe9c631be2a0b24a068a98c3cb76540e10c788c14dacb5afdba51b331b204447e93ce3699c7eee896ae8c94cbabbc7e3ec702bfaa29495f7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
73513bf2c29c9d55e49bc4451da76da1

SHA1
d601377d3dcc6e9e97316645512a723df57a471b

SHA256
ed2e55e7418fa48d43de7fb4993530a2d22797197dc12108e3995eeb6ffe3a3e

SHA512
6df285b98d94346d7a2478f47d79d86316ba5d874591953bfcd368525fc099e3dd15ec119196fdbb159e80b179a79a7bb7a480ad6f2e631d502529b145947bbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
53002bfe1ab4efccd2eb5f74d753f62f

SHA1
c9076a7643fbc18cff6188f4bf494373a7d19c77

SHA256
ab3e9b9a047edec5695cccbf4866df286c6342905a37e5de034f1d76f3c98af0

SHA512
38dd0b8b4fdcff78f7208c096d6430331388237b4fb6722531611029957004c82082ee4287208033ad66bd68bddf61a70388947b277c81466a105e30efc510d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
a02c77d929bb2d39c43944c3da475409

SHA1
73a705d97f8909fb7be6d92bf4807438288e7470

SHA256
74ba819f14d0b5cd7d5f9837f7378d24d668c6e549f523d5f79a410f800fbe67

SHA512
e1ecbb7978d4f9d2c45b7c8bfce5eb04f7d545824b4f1ae747ade8a44736781191666bc643ba38c7a9dd3344feb541982077f848b0704680fca38ce5bb04b2b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
5df41a6b7b50da38d86a2dda270b38b3

SHA1
02331c8b4425babe4f6fdcaf13ef3ef3cbdd5b0e

SHA256
d510db9f2625ee57577bb776f206a644f332b62f9c11ee00570949e85669b406

SHA512
f47683ed7c4e04268e95cc6d3bf4d13feebcc158df43d6098c1a23e106fdde35376eb8b6a20bf10a9b6765e3338653af544ddb3a70f2eac517b7f98d4abc7b64

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
a568ff6e7c6335f72bb3f2d2bd22fbcf

SHA1
5250fafd7c22f9a8a2227cf82fce0f5f41cd153c

SHA256
67115bdd4ed82bbe543084a397986fe6a21832a6ee0cb7d3cf6f720e89ea5c9f

SHA512
226924f604d0f7e98a5c82cc0b5d81115458494e5525cd861891bc9d5a2a6fd11cc4521b6e4e2e7e6f5da4b79875c0ea8fefb6c60a1ce16d8825fea8af199020

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
6c90ae3bf71f07390c21b5cd5ce32f86

SHA1
a64092a083a5cdcf4c480ce49b67da0493d547be

SHA256
95b49221be1eb7d8ea3a05ad7f6bf5197fd82e6d860df624bcce3b4070901535

SHA512
3e61089b375480fd3bdeb4fbb4398b3281f7a44911b76426aaf032445c16fb9c1f334af44252bdbbdaa015da3ff3557ad07c1ada2d71c057c7150b4887aa08e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
283a300a588de4dad636e0c62ef664c1

SHA1
f88ac579339029967ab18a3605d8e3f12fa0c624

SHA256
bf94ccd9699aab3838dfbe8a53af67974591006af46574cb5750f0fed9b646c1

SHA512
cfef16e04d0a6343b3336a85450afe8a3bcd2c4674d4f98c1e46b991cfa5dcc0b797d563b68a06659853489500be313ff1a97de8fb609fe43877f11ca9b869f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
a03a04bae0aebde95bb62ce26cc1af22

SHA1
98709a3fc6ea6f694119a00b647cf6f98c22ec1f

SHA256
dd746a344469f70ad0c5f18c3c5b36926c01638ed1d0241b2cfd0d08da96791f

SHA512
b18fb5d541e00db102f13a9462b0a9d69cc61e6c9028ea345ed12f33819427b5fc0c4dc61186e21afe92779152c443aafa108e6677ac7a43d7c81d3af2cdef32

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
f8d5af68c1f681d200bab68ad250aeda

SHA1
2c9b6f26955b6476c984e576f47958afb7bc7754

SHA256
8d1d6417fd3170e114699b7fbcc3de96ff12c83ae6270cdc5e0504fadad07c68

SHA512
4327769fa1ae134fbc74cd354ee339b8bc33e0635908276495f9ab33ebef1fb50e39902cf5ac6d2b71bfd6bb290d662642268ece08fb6dc02d1749c965446cdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
d494699a6b582baccce9d77a977d8820

SHA1
ba8957824eb9f1f51887b4043a59ddddae4c58b9

SHA256
66a03fc6b72c4841fe938f574d5fe73b16313e13dae8e7d4bc078c77867d6809

SHA512
eadfee126a2f073f81d6b6db3a7fcf3924e8bc473df130b7953fff75c949c41309cc4120d81199517d42da5a371bbd84e47e3d73ed9f1a8d2f5574318d013be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
1e7838fe643ad2bfd1dfaa764a33515f

SHA1
c3b4d6d6557ba1121b9aa43c145bd2156c3407dc

SHA256
585ba3d67a80e7b5f28059ee0aa7d8fb25fe54d6de3c8c8e96e382c4a2ebdfd9

SHA512
076f4a622700dd6e9f93d3ec57cbd780843221a31aec8b751c9c24d6cb0d116cfdbebeed36db709cc3d3619b1d5fb373b67e870e6915055ffc5d4fe6edd60632

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
03f8c079e8a81d863dd8c8146824438e

SHA1
45c77c1ff657f7a778a168d4b87851a2a6c93d36

SHA256
138a10c9cbd9840ce95d0cf3a83dcd546028877bf38c2c09dedf3126fc8fc357

SHA512
a682a6862d8d6810fe11a229d3e1b9a5dd88639f5c5140ed94aa2121ae851fd4b99195f1c43ddefe2fb7a21a71c2d9189e6ac63957c4937d589c956f8b524552

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
bdbc5a5e5cf4c2524713c866ae0cfd45

SHA1
245b5fde346c63d93e26ac9c80d2525291c6e131

SHA256
00740a51f95075cea20a33d0bc5fe39455a4c98b4222275ae2305410277ebd82

SHA512
401954d8f463a41e89dadf2ad271b49c463ca57ffce40057895011c2e091a19e095cb0b0cb97d7c57096a3a5f4e843321aea366bc13672c1ea2a6f92c7eaafb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
36c73854bffc766240f72b8a5919f1f6

SHA1
2a1febfcc1dd2bb44dd24d7b8ea28f054cba9b25

SHA256
deb654881d5e88f6ce7a034d30adb9e34b040cdf456fcd3ffea6ad7ddbd16f4e

SHA512
4ebb4ec1f11af904569f824ab5b1d9a8391e5dab94676bf841d578c9a186bb8ba768d8e52c800bacacfee533efd5086845f1ef63883287c6d60915a3968c7fb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\d.jfm
Filesize
16KB

MD5
327dff7353eb21ba2d1bb980fcbbfc48

SHA1
3fe561f903937dc9714ca504e2ed701f15e89c42

SHA256
d955781d5d11815c0abc1c42232aa30810fa4aaa5d8b0965b97320707ac07bc7

SHA512
1e42a74c96cfab6b789142dc2c16068448bf7abe9a0c65d34dc0f71ec9024e4d22dda7f5cdc08badb9f7c2dc2d4b0a478abc490e97c475ba3badcfba6430370d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\md9_1sjm.exe
Filesize
1.2MB

MD5
9b55bffb97ebd2c51834c415982957b4

SHA1
728262abdfc4f0e8a84eb3b5cd2be9ea9d0acc16

SHA256
a62cee3d2610ed0f693179838803e5c60dcd4f68028c60f5761b90c750125e11

SHA512
4fa9d641aba15fd07a0711530ab1f1a4e8dbafe03e1ab71845bcdcd0a1efa9e59a05915834c5c717beada659dd5ee459aa7e08b4b0acc8f867ace07430eb11f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mysetold.exe
Filesize
846KB

MD5
96cf21aab98bc02dbc797e9d15ad4170

SHA1
86107ee6defd4fd8656187b2ebcbd58168639579

SHA256
35d3aec171b80d770f671e626024482017c5f4831208aa42032cea4c55983caf

SHA512
d0543a570376c198a326ff8c143f9de0b8e42b1bff5eb2f65e4307f144fe60ecf5987c72ae9819bafe5cb1207f3fbb81c05a5e48d85867f7438c5dfe70eb4a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\pub2.exe
Filesize
319KB

MD5
5e8856c0eaac948c6245109413df2cd3

SHA1
36cdf54f902f59530f5b555cc1d3726418dd1e12

SHA256
b9d5320c2f8baa3fba95bf4467e4160a4fd8096417bf3675be649a865461aa21

SHA512
6bd31da0979e1664808f473d68fcca458705f83f49d3a6b3b71a3b916c6fc0f8479677edba4caadac1cb97ec1de994067391f24b040a6d7f8d42a6010d932d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dat
Filesize
552KB

MD5
5fd2eba6df44d23c9e662763009d7f84

SHA1
43530574f8ac455ae263c70cc99550bc60bfa4f1

SHA256
2991e2231855661e94ef80a4202487a9d7dc7bebccab9a0b2a786cf0783a051f

SHA512
321a86725e533dedb5b74e17218e6e53a49fa6ffc87d7f7da0f0b8441a081fe785f7846a76f67ef03ec3abddacbe8906b20a2f3ce8178896ec57090ef7ab0eb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll
Filesize
73KB

MD5
1c7be730bdc4833afb7117d48c3fd513

SHA1
dc7e38cfe2ae4a117922306aead5a7544af646b8

SHA256
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

SHA512
7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
Filesize
31B

MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
Filesize
1KB

MD5
9c16e97b5a71e9459b99a29273408929

SHA1
f5cac1c4aca0588fe5fb3c5516d7c3376ec043cd

SHA256
81671aaf6e706704c693e9e25ddda9968863f35a57f6c3f181e06c9accbd214c

SHA512
819e65a2c785731ff84dce9fe2b3d1d490898d71e4e7bcc435fb9e867be1ed3966b58cf115a23d995a63a88c4887b759ff194679538aea863d6a9aaee86b2d5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
Filesize
184KB

MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
Filesize
61KB

MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
\??\pipe\LOCAL\crashpad_2196_FCIPJSPGKCNVBUKE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3320-787-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3320-793-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3620-136-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/3620-119-0x0000000000FF0000-0x0000000001437000-memory.dmp

Filesize
4.3MB

Download
memory/3620-120-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/4108-104-0x00000000014F0000-0x0000000001E16000-memory.dmp

Filesize
9.1MB

Download
memory/4108-94-0x00000000010B0000-0x00000000014EE000-memory.dmp

Filesize
4.2MB

Download
memory/4108-95-0x00000000014F0000-0x0000000001E16000-memory.dmp

Filesize
9.1MB

Download
memory/4108-96-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/4108-102-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/4136-747-0x0000000000C80000-0x0000000000D80000-memory.dmp

Filesize
1024KB

Download
memory/4136-749-0x0000000000400000-0x0000000000906000-memory.dmp

Filesize
5.0MB

Download
memory/4136-755-0x0000000000400000-0x0000000000906000-memory.dmp

Filesize
5.0MB

Download
memory/4136-748-0x00000000001C0000-0x00000000001C9000-memory.dmp

Filesize
36KB

Download
memory/4368-35-0x00007FFD93870000-0x00007FFD94331000-memory.dmp

Filesize
10.8MB

Download
memory/4368-33-0x000000001B490000-0x000000001B4A0000-memory.dmp

Filesize
64KB

Download
memory/4368-32-0x0000000000E90000-0x0000000000E96000-memory.dmp

Filesize
24KB

Download
memory/4368-31-0x0000000000E70000-0x0000000000E92000-memory.dmp

Filesize
136KB

Download
memory/4368-30-0x00007FFD93870000-0x00007FFD94331000-memory.dmp

Filesize
10.8MB

Download
memory/4368-29-0x0000000000E60000-0x0000000000E66000-memory.dmp

Filesize
24KB

Download
memory/4368-28-0x0000000000780000-0x00000000007AC000-memory.dmp

Filesize
176KB

Download
memory/5184-144-0x0000000001B00000-0x0000000002426000-memory.dmp

Filesize
9.1MB

Download
memory/5184-185-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/5184-143-0x0000000001600000-0x0000000001B00000-memory.dmp

Filesize
5.0MB

Download
memory/5184-145-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/5184-162-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/5184-173-0x0000000001600000-0x0000000001B00000-memory.dmp

Filesize
5.0MB

Download
memory/5184-183-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/5184-213-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/5184-208-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/5184-184-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/5184-238-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/5184-186-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/5208-778-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5208-781-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6000-263-0x00000000048A0000-0x00000000048A8000-memory.dmp

Filesize
32KB

Download
memory/6000-205-0x0000000000400000-0x0000000000759000-memory.dmp

Filesize
3.3MB

Download
memory/6000-254-0x0000000004540000-0x0000000004548000-memory.dmp

Filesize
32KB

Download
memory/6000-253-0x0000000004520000-0x0000000004528000-memory.dmp

Filesize
32KB

Download
memory/6000-246-0x0000000003A70000-0x0000000003A80000-memory.dmp

Filesize
64KB

Download
memory/6000-240-0x00000000038D0000-0x00000000038E0000-memory.dmp

Filesize
64KB

Download
memory/6000-260-0x0000000004750000-0x0000000004758000-memory.dmp

Filesize
32KB

Download
memory/6000-232-0x0000000000400000-0x0000000000759000-memory.dmp

Filesize
3.3MB

Download
memory/6000-738-0x0000000000400000-0x0000000000759000-memory.dmp

Filesize
3.3MB

Download
memory/6000-256-0x00000000045C0000-0x00000000045C8000-memory.dmp

Filesize
32KB

Download
memory/6000-261-0x0000000004B30000-0x0000000004B38000-memory.dmp

Filesize
32KB

Download
memory/6000-259-0x00000000045D0000-0x00000000045D8000-memory.dmp

Filesize
32KB

Download
memory/6000-204-0x0000000000400000-0x0000000000759000-memory.dmp

Filesize
3.3MB

Download
memory/6000-203-0x0000000000400000-0x0000000000759000-memory.dmp

Filesize
3.3MB

Download
memory/6000-262-0x0000000004A30000-0x0000000004A38000-memory.dmp

Filesize
32KB

Download
memory/6000-357-0x00000000044C0000-0x00000000044C8000-memory.dmp

Filesize
32KB

Download
memory/6000-276-0x0000000004540000-0x0000000004548000-memory.dmp

Filesize
32KB

Download
memory/6000-284-0x00000000048A0000-0x00000000048A8000-memory.dmp

Filesize
32KB

Download
memory/6000-286-0x00000000049D0000-0x00000000049D8000-memory.dmp

Filesize
32KB

Download
memory/6000-299-0x0000000004540000-0x0000000004548000-memory.dmp

Filesize
32KB

Download
memory/6000-307-0x00000000049D0000-0x00000000049D8000-memory.dmp

Filesize
32KB

Download
memory/6000-309-0x00000000048A0000-0x00000000048A8000-memory.dmp

Filesize
32KB

Download
memory/6000-348-0x0000000004400000-0x0000000004408000-memory.dmp

Filesize
32KB

Download
memory/6000-349-0x0000000004420000-0x0000000004428000-memory.dmp

Filesize
32KB

Download