Overview

overview

10

Static

static

531bf9fac0...2f.exe

windows7-x64

10

531bf9fac0...2f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2022 17:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    531bf9fac0acb821391741eb0ed737df303aba700db962771e7795845bf8c72f.exe

  • Size

    9.9MB

  • MD5

    656725f09aa6a07f41fef88b362ad8b9

  • SHA1

    9b4949a9d2d7ddbbefb5bb553bed4a39d2b392c9

  • SHA256

    531bf9fac0acb821391741eb0ed737df303aba700db962771e7795845bf8c72f

  • SHA512

    27eec396079486535a8a870ed2c8d1c4fa97cca0cdf72a5331516c0d7f41d43b84e68844a61f0b9722c1a1da96300e7e29303c3edade635df67807a42003038b

  • SSDEEP

    6144:YJl5cP2e8F3cUAojUmFvMKpiC+afJRda3RIkvNIyI/VEpAl/JgIj0oTYibGRrgUW:MiTTeLe0D4

Score
10/10
asyncratkatayumievasionrattrojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Katayumi

C2

normal-knife.auto.playit.gg:54950

normal-knife.auto.playit.gg:7707
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    ZxKKE4oK8.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • Turns off Windows Defender SpyNet reporting 2 TTPs
    evasion
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • Async RAT payload 1 IoCs
    rat
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 12 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification 2 TTPs 10 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 50 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 5 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 5 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\531bf9fac0acb821391741eb0ed737df303aba700db962771e7795845bf8c72f.exe
    "C:\Users\Admin\AppData\Local\Temp\531bf9fac0acb821391741eb0ed737df303aba700db962771e7795845bf8c72f.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Windows security bypass
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks computer location settings
    • Windows security modification
    • Maps connected drives based on registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\531bf9fac0acb821391741eb0ed737df303aba700db962771e7795845bf8c72f.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1200
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:256
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:4972
    • C:\Users\Admin\AppData\Local\Temp\531bf9fac0acb821391741eb0ed737df303aba700db962771e7795845bf8c72f.exe
      "C:\Users\Admin\AppData\Local\Temp\531bf9fac0acb821391741eb0ed737df303aba700db962771e7795845bf8c72f.exe"
      2⤵
        PID:640
      • C:\Users\Admin\AppData\Local\Temp\531bf9fac0acb821391741eb0ed737df303aba700db962771e7795845bf8c72f.exe
        "C:\Users\Admin\AppData\Local\Temp\531bf9fac0acb821391741eb0ed737df303aba700db962771e7795845bf8c72f.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1280
        • C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
          "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
          3⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2156
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c timeout 1
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1776
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              5⤵
              • Delays execution with timeout.exe
              PID:4852
          • C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
            "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
            4⤵
            • Executes dropped EXE
            PID:3492
          • C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
            "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:3644
            • C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
              "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3952
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 1900
                6⤵
                • Program crash
                PID:4468
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 1500
            4⤵
            • Program crash
            PID:1684
        • C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
          "C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
          3⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2316
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c timeout 1
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3356
            • C:\Windows\SysWOW64\timeout.exe
              timeout 1
              5⤵
              • Delays execution with timeout.exe
              PID:3568
          • C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
            "C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
            4⤵
            • Executes dropped EXE
            PID:4960
          • C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
            "C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
            4⤵
            • Executes dropped EXE
            PID:3332
          • C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
            "C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
            4⤵
            • Executes dropped EXE
            PID:2752
          • C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
            "C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
            4⤵
            • Executes dropped EXE
            • Checks computer location settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1536
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ZxKKE4oK8" /tr '"C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"' & exit
              5⤵
                PID:2408
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /f /sc onlogon /rl highest /tn "ZxKKE4oK8" /tr '"C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"'
                  6⤵
                  • Creates scheduled task(s)
                  PID:1764
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp89D1.tmp.bat""
                5⤵
                  PID:3012
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 3
                    6⤵
                    • Delays execution with timeout.exe
                    PID:3572
                  • C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe
                    "C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"
                    6⤵
                    • Executes dropped EXE
                    • Checks computer location settings
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2688
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c timeout 1
                      7⤵
                        PID:4180
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout 1
                          8⤵
                          • Delays execution with timeout.exe
                          PID:4044
                      • C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe
                        "C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2536
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1472
                        7⤵
                        • Program crash
                        PID:1192
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 1464
                  4⤵
                  • Program crash
                  PID:2720
              • C:\Users\Admin\AppData\Roaming\LunaInjector.exe
                "C:\Users\Admin\AppData\Roaming\LunaInjector.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1144
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6699.tmp\669A.tmp\66AB.bat C:\Users\Admin\AppData\Roaming\LunaInjector.exe"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:544
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:3592
                    • C:\Windows\system32\mode.com
                      mode 82,24
                      5⤵
                        PID:4596
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 2272
                  2⤵
                  • Program crash
                  PID:4740
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4416 -ip 4416
                1⤵
                  PID:1140
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2156 -ip 2156
                  1⤵
                    PID:3576
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2316 -ip 2316
                    1⤵
                      PID:432
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2688 -ip 2688
                      1⤵
                        PID:3872
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3952 -ip 3952
                        1⤵
                          PID:3704

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Initial Access

                        Execution

                        Scheduled Task

                        1
                        T1053

                        Persistence

                        Modify Existing Service

                        1
                        T1031

                        Scheduled Task

                        1
                        T1053

                        Privilege Escalation

                        Scheduled Task

                        1
                        T1053

                        Defense Evasion

                        Modify Registry

                        4
                        T1112

                        Disabling Security Tools

                        4
                        T1089

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Discovery

                        Query Registry

                        5
                        T1012

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        System Information Discovery

                        4
                        T1082

                        Peripheral Device Discovery

                        1
                        T1120

                        Lateral Movement

                        Collection

                        Exfiltration

                        Command and Control

                        Web Service

                        1
                        T1102

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DD8989123MD.exe.log
                          Filesize

                          1KB

                          MD5

                          b5291f3dcf2c13784e09a057f2e43d13

                          SHA1

                          fbb72f4b04269e0d35b1d9c29d02d63dbc7ad07e

                          SHA256

                          ad995b51344d71019f96fc3a424de00256065daad8595ff599f6849c87ae75ce

                          SHA512

                          11c89caac425bccaa24e2bb24c6f2b4e6d6863278bf8a5304a42bb44475b08ca586e09143e7d5b14db7f1cd9adacd5358769e0d999dc348073431031067bd4d4

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\6699.tmp\669A.tmp\66AB.bat
                          Filesize

                          438B

                          MD5

                          ad81fd823266aabb73a229b8d842720e

                          SHA1

                          09c851304e0626bbf5fd15aa4212e14c9a8294a2

                          SHA256

                          ad3ce6e067e2210681ffca11d32d91c6be6cc13fca5f9fb7ab7a73e4daa31f00

                          SHA512

                          201bc9e51c00bbb38e949c06b59adcb32f9a07caeba38fc92db7ec8f9c54e43932fed045982cd4fa56d605f082f44828de7f9ad732777fc7ca86a4ff7f91989e

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
                          Filesize

                          545KB

                          MD5

                          9c8b5486b38230c7c1f934c01a895d95

                          SHA1

                          85626e89ca6a0a3838786698ec670d909c5eec5b

                          SHA256

                          fd8eb30f8c98d4e97459b051f6e14a52e6194e4b431ae1243c8638f08701f5a5

                          SHA512

                          5555b9c7ccef651f03787f7531eea69023fc7c4aaa2315aba878d490f1a655afbd6347da0721d5e88cad3a956e399d21dfda2f2d2a83afc1c7277f1468a17450

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
                          Filesize

                          545KB

                          MD5

                          9c8b5486b38230c7c1f934c01a895d95

                          SHA1

                          85626e89ca6a0a3838786698ec670d909c5eec5b

                          SHA256

                          fd8eb30f8c98d4e97459b051f6e14a52e6194e4b431ae1243c8638f08701f5a5

                          SHA512

                          5555b9c7ccef651f03787f7531eea69023fc7c4aaa2315aba878d490f1a655afbd6347da0721d5e88cad3a956e399d21dfda2f2d2a83afc1c7277f1468a17450

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
                          Filesize

                          545KB

                          MD5

                          9c8b5486b38230c7c1f934c01a895d95

                          SHA1

                          85626e89ca6a0a3838786698ec670d909c5eec5b

                          SHA256

                          fd8eb30f8c98d4e97459b051f6e14a52e6194e4b431ae1243c8638f08701f5a5

                          SHA512

                          5555b9c7ccef651f03787f7531eea69023fc7c4aaa2315aba878d490f1a655afbd6347da0721d5e88cad3a956e399d21dfda2f2d2a83afc1c7277f1468a17450

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
                          Filesize

                          545KB

                          MD5

                          9c8b5486b38230c7c1f934c01a895d95

                          SHA1

                          85626e89ca6a0a3838786698ec670d909c5eec5b

                          SHA256

                          fd8eb30f8c98d4e97459b051f6e14a52e6194e4b431ae1243c8638f08701f5a5

                          SHA512

                          5555b9c7ccef651f03787f7531eea69023fc7c4aaa2315aba878d490f1a655afbd6347da0721d5e88cad3a956e399d21dfda2f2d2a83afc1c7277f1468a17450

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
                          Filesize

                          545KB

                          MD5

                          9c8b5486b38230c7c1f934c01a895d95

                          SHA1

                          85626e89ca6a0a3838786698ec670d909c5eec5b

                          SHA256

                          fd8eb30f8c98d4e97459b051f6e14a52e6194e4b431ae1243c8638f08701f5a5

                          SHA512

                          5555b9c7ccef651f03787f7531eea69023fc7c4aaa2315aba878d490f1a655afbd6347da0721d5e88cad3a956e399d21dfda2f2d2a83afc1c7277f1468a17450

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
                          Filesize

                          660KB

                          MD5

                          cc62fe37de863f616d672eaf6b22b0c3

                          SHA1

                          2aca0fd587e4a998e749162a2a12f40bc49d50e7

                          SHA256

                          edefa1d69e62fd464ffd2599c369b147edcff115e1f7a0454d9d9b567ce15d1b

                          SHA512

                          7923d36d4651062684058c817cf2dd19295864e7bc82d33b8120ca3695390d5610cf37731f92f8acbb936df6f72e13c9cb1d64d4b3b13aafd82374bce1a0ac4d

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
                          Filesize

                          660KB

                          MD5

                          cc62fe37de863f616d672eaf6b22b0c3

                          SHA1

                          2aca0fd587e4a998e749162a2a12f40bc49d50e7

                          SHA256

                          edefa1d69e62fd464ffd2599c369b147edcff115e1f7a0454d9d9b567ce15d1b

                          SHA512

                          7923d36d4651062684058c817cf2dd19295864e7bc82d33b8120ca3695390d5610cf37731f92f8acbb936df6f72e13c9cb1d64d4b3b13aafd82374bce1a0ac4d

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
                          Filesize

                          660KB

                          MD5

                          cc62fe37de863f616d672eaf6b22b0c3

                          SHA1

                          2aca0fd587e4a998e749162a2a12f40bc49d50e7

                          SHA256

                          edefa1d69e62fd464ffd2599c369b147edcff115e1f7a0454d9d9b567ce15d1b

                          SHA512

                          7923d36d4651062684058c817cf2dd19295864e7bc82d33b8120ca3695390d5610cf37731f92f8acbb936df6f72e13c9cb1d64d4b3b13aafd82374bce1a0ac4d

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
                          Filesize

                          660KB

                          MD5

                          cc62fe37de863f616d672eaf6b22b0c3

                          SHA1

                          2aca0fd587e4a998e749162a2a12f40bc49d50e7

                          SHA256

                          edefa1d69e62fd464ffd2599c369b147edcff115e1f7a0454d9d9b567ce15d1b

                          SHA512

                          7923d36d4651062684058c817cf2dd19295864e7bc82d33b8120ca3695390d5610cf37731f92f8acbb936df6f72e13c9cb1d64d4b3b13aafd82374bce1a0ac4d

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
                          Filesize

                          660KB

                          MD5

                          cc62fe37de863f616d672eaf6b22b0c3

                          SHA1

                          2aca0fd587e4a998e749162a2a12f40bc49d50e7

                          SHA256

                          edefa1d69e62fd464ffd2599c369b147edcff115e1f7a0454d9d9b567ce15d1b

                          SHA512

                          7923d36d4651062684058c817cf2dd19295864e7bc82d33b8120ca3695390d5610cf37731f92f8acbb936df6f72e13c9cb1d64d4b3b13aafd82374bce1a0ac4d

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
                          Filesize

                          660KB

                          MD5

                          cc62fe37de863f616d672eaf6b22b0c3

                          SHA1

                          2aca0fd587e4a998e749162a2a12f40bc49d50e7

                          SHA256

                          edefa1d69e62fd464ffd2599c369b147edcff115e1f7a0454d9d9b567ce15d1b

                          SHA512

                          7923d36d4651062684058c817cf2dd19295864e7bc82d33b8120ca3695390d5610cf37731f92f8acbb936df6f72e13c9cb1d64d4b3b13aafd82374bce1a0ac4d

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe
                          Filesize

                          660KB

                          MD5

                          cc62fe37de863f616d672eaf6b22b0c3

                          SHA1

                          2aca0fd587e4a998e749162a2a12f40bc49d50e7

                          SHA256

                          edefa1d69e62fd464ffd2599c369b147edcff115e1f7a0454d9d9b567ce15d1b

                          SHA512

                          7923d36d4651062684058c817cf2dd19295864e7bc82d33b8120ca3695390d5610cf37731f92f8acbb936df6f72e13c9cb1d64d4b3b13aafd82374bce1a0ac4d

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe
                          Filesize

                          660KB

                          MD5

                          cc62fe37de863f616d672eaf6b22b0c3

                          SHA1

                          2aca0fd587e4a998e749162a2a12f40bc49d50e7

                          SHA256

                          edefa1d69e62fd464ffd2599c369b147edcff115e1f7a0454d9d9b567ce15d1b

                          SHA512

                          7923d36d4651062684058c817cf2dd19295864e7bc82d33b8120ca3695390d5610cf37731f92f8acbb936df6f72e13c9cb1d64d4b3b13aafd82374bce1a0ac4d

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe
                          Filesize

                          660KB

                          MD5

                          cc62fe37de863f616d672eaf6b22b0c3

                          SHA1

                          2aca0fd587e4a998e749162a2a12f40bc49d50e7

                          SHA256

                          edefa1d69e62fd464ffd2599c369b147edcff115e1f7a0454d9d9b567ce15d1b

                          SHA512

                          7923d36d4651062684058c817cf2dd19295864e7bc82d33b8120ca3695390d5610cf37731f92f8acbb936df6f72e13c9cb1d64d4b3b13aafd82374bce1a0ac4d

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\tmp89D1.tmp.bat
                          Filesize

                          156B

                          MD5

                          0166a8a051c8a26f365a15dd89bd6bc1

                          SHA1

                          c53329a1f9cd616cccfbdcb858382ff10b7007a4

                          SHA256

                          2e40230e00a157ce817afae15055346d346924b1a749a16b49af18a7477f4772

                          SHA512

                          7e80f5d0f814ceb0254fcf3b976baf2b03e8e63d47c4231f1b2676e08991b0b655e3c2b71d281f5d731f3534ed9afc46db0958adbe53133bd6f15b28f562e134

                          Download Submit
                        • C:\Users\Admin\AppData\Roaming\LunaInjector.exe
                          Filesize

                          89KB

                          MD5

                          38bece8d537dea0d0bf7603c073aa90c

                          SHA1

                          fc70b8b4d22b323fe9e886f36620269d6c791eac

                          SHA256

                          261b67c10cca406ce934032f7e6da36b8408db3fce6df7d7a37dca69703c59cb

                          SHA512

                          224d70c8f2b8c98456177cd087faa77436c86fbcd4fe36ae410c6d184181b30cbd50718fbfa347b85a0d2d303f273197fd9fea5addb28538eab43d84f527185d

                          Download Submit
                        • C:\Users\Admin\AppData\Roaming\LunaInjector.exe
                          Filesize

                          89KB

                          MD5

                          38bece8d537dea0d0bf7603c073aa90c

                          SHA1

                          fc70b8b4d22b323fe9e886f36620269d6c791eac

                          SHA256

                          261b67c10cca406ce934032f7e6da36b8408db3fce6df7d7a37dca69703c59cb

                          SHA512

                          224d70c8f2b8c98456177cd087faa77436c86fbcd4fe36ae410c6d184181b30cbd50718fbfa347b85a0d2d303f273197fd9fea5addb28538eab43d84f527185d

                          Download Submit
                        • memory/256-141-0x0000000000000000-mapping.dmp
                          Download
                        • memory/544-158-0x0000000000000000-mapping.dmp
                          Download
                        • memory/640-144-0x0000000000000000-mapping.dmp
                          Download
                        • memory/1144-155-0x0000000000000000-mapping.dmp
                          Download
                        • memory/1200-189-0x0000000007280000-0x0000000007316000-memory.dmp
                          Filesize

                          600KB

                          Download
                        • memory/1200-143-0x00000000056B0000-0x00000000056CE000-memory.dmp
                          Filesize

                          120KB

                          Download
                        • memory/1200-202-0x0000000005D00000-0x0000000005D08000-memory.dmp
                          Filesize

                          32KB

                          Download
                        • memory/1200-136-0x0000000000000000-mapping.dmp
                          Download
                        • memory/1200-137-0x0000000002350000-0x0000000002386000-memory.dmp
                          Filesize

                          216KB

                          Download
                        • memory/1200-196-0x0000000007340000-0x000000000735A000-memory.dmp
                          Filesize

                          104KB

                          Download
                        • memory/1200-195-0x0000000007230000-0x000000000723E000-memory.dmp
                          Filesize

                          56KB

                          Download
                        • memory/1200-138-0x0000000004F20000-0x0000000005548000-memory.dmp
                          Filesize

                          6.2MB

                          Download
                        • memory/1200-188-0x0000000006FE0000-0x0000000006FEA000-memory.dmp
                          Filesize

                          40KB

                          Download
                        • memory/1200-187-0x0000000006330000-0x000000000634A000-memory.dmp
                          Filesize

                          104KB

                          Download
                        • memory/1200-186-0x0000000007620000-0x0000000007C9A000-memory.dmp
                          Filesize

                          6.5MB

                          Download
                        • memory/1200-185-0x00000000061F0000-0x000000000620E000-memory.dmp
                          Filesize

                          120KB

                          Download
                        • memory/1200-184-0x000000006F770000-0x000000006F7BC000-memory.dmp
                          Filesize

                          304KB

                          Download
                        • memory/1200-183-0x0000000006210000-0x0000000006242000-memory.dmp
                          Filesize

                          200KB

                          Download
                        • memory/1200-139-0x0000000004A30000-0x0000000004A52000-memory.dmp
                          Filesize

                          136KB

                          Download
                        • memory/1200-140-0x0000000004E60000-0x0000000004EC6000-memory.dmp
                          Filesize

                          408KB

                          Download
                        • memory/1280-145-0x0000000000000000-mapping.dmp
                          Download
                        • memory/1280-146-0x0000000000400000-0x000000000054E000-memory.dmp
                          Filesize

                          1.3MB

                          Download
                        • memory/1536-178-0x0000000000400000-0x0000000000412000-memory.dmp
                          Filesize

                          72KB

                          Download
                        • memory/1536-177-0x0000000000000000-mapping.dmp
                          Download
                        • memory/1764-193-0x0000000000000000-mapping.dmp
                          Download
                        • memory/1776-160-0x0000000000000000-mapping.dmp
                          Download
                        • memory/2156-150-0x00000000000F0000-0x000000000017E000-memory.dmp
                          Filesize

                          568KB

                          Download
                        • memory/2156-147-0x0000000000000000-mapping.dmp
                          Download
                        • memory/2316-151-0x0000000000000000-mapping.dmp
                          Download
                        • memory/2316-154-0x0000000000340000-0x00000000003EA000-memory.dmp
                          Filesize

                          680KB

                          Download
                        • memory/2408-190-0x0000000000000000-mapping.dmp
                          Download
                        • memory/2536-203-0x0000000000000000-mapping.dmp
                          Download
                        • memory/2688-197-0x0000000000000000-mapping.dmp
                          Download
                        • memory/2752-174-0x0000000000000000-mapping.dmp
                          Download
                        • memory/3012-191-0x0000000000000000-mapping.dmp
                          Download
                        • memory/3332-172-0x0000000000000000-mapping.dmp
                          Download
                        • memory/3356-159-0x0000000000000000-mapping.dmp
                          Download
                        • memory/3492-165-0x0000000000000000-mapping.dmp
                          Download
                        • memory/3568-163-0x0000000000000000-mapping.dmp
                          Download
                        • memory/3572-194-0x0000000000000000-mapping.dmp
                          Download
                        • memory/3592-164-0x0000000000000000-mapping.dmp
                          Download
                        • memory/3644-206-0x00000000056C0000-0x00000000056DE000-memory.dmp
                          Filesize

                          120KB

                          Download
                        • memory/3644-169-0x0000000000400000-0x000000000040C000-memory.dmp
                          Filesize

                          48KB

                          Download
                        • memory/3644-180-0x0000000005560000-0x000000000556A000-memory.dmp
                          Filesize

                          40KB

                          Download
                        • memory/3644-182-0x0000000005610000-0x0000000005686000-memory.dmp
                          Filesize

                          472KB

                          Download
                        • memory/3644-175-0x00000000053D0000-0x0000000005462000-memory.dmp
                          Filesize

                          584KB

                          Download
                        • memory/3644-167-0x0000000000000000-mapping.dmp
                          Download
                        • memory/3952-207-0x0000000000000000-mapping.dmp
                          Download
                        • memory/3952-208-0x0000000000400000-0x0000000000408000-memory.dmp
                          Filesize

                          32KB

                          Download
                        • memory/4044-201-0x0000000000000000-mapping.dmp
                          Download
                        • memory/4180-200-0x0000000000000000-mapping.dmp
                          Download
                        • memory/4416-132-0x0000000000CC0000-0x00000000016A8000-memory.dmp
                          Filesize

                          9.9MB

                          Download
                        • memory/4416-135-0x0000000008350000-0x00000000083B6000-memory.dmp
                          Filesize

                          408KB

                          Download
                        • memory/4416-134-0x0000000008890000-0x0000000008E34000-memory.dmp
                          Filesize

                          5.6MB

                          Download
                        • memory/4416-133-0x0000000005FE0000-0x000000000607C000-memory.dmp
                          Filesize

                          624KB

                          Download
                        • memory/4596-181-0x0000000000000000-mapping.dmp
                          Download
                        • memory/4852-162-0x0000000000000000-mapping.dmp
                          Download
                        • memory/4960-168-0x0000000000000000-mapping.dmp
                          Download
                        • memory/4972-142-0x0000000000000000-mapping.dmp
                          Download