Resubmissions

29/04/2023, 20:08

230429-ywmdqsdh7v 10

29/04/2023, 20:02

230429-yshldabh89 10

Analysis

  • max time kernel
    43s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    29/04/2023, 20:02

General

  • Target

    krnl_bootstrapper.exe

  • Size

    1.2MB

  • MD5

    f14153bbd95fc26d9ccea77c49cf09b9

  • SHA1

    cb59f900711ea751c4322b4dab50fa2c0ee70b33

  • SHA256

    27eab496d0b63d52c18cee063110d9d479523b58426bfcb58e420a5cae087c54

  • SHA512

    7f7618cf6f15d85e82cbfff07ca6e1df0aa763d64d6a37fb659f1612b950d16a15b723ec053765e991485e74a7301617019b166dcaa759ed6f1a281a9ebc4ed0

  • SSDEEP

    12288:aBVCrK2jsP3zv+FSF68GANNhWLS0B6L+FOCN+AzrnxdanvzFzho:SU7ecSgL6y+gk+rnxdarFu

Score
10/10

Malware Config

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\krnl_bootstrapper.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Users\Admin\Documents\krnl\7za.exe
      "C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\Monaco.zip" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:280
    • C:\Users\Admin\Documents\krnl\7za.exe
      "C:\Users\Admin\Documents\krnl\7za.exe" x "C:\Users\Admin\Documents\krnl\bin\src.7z" -o"C:\Users\Admin\Documents\krnl\bin" -aoa -bsp1
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1512
    • C:\Users\Admin\Documents\krnl\krnlss.exe
      "C:\Users\Admin\Documents\krnl\krnlss.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2324
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6609758,0x7fef6609768,0x7fef6609778
      2⤵
        PID:848
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1212,i,17421680975810033843,6372008783442124136,131072 /prefetch:2
        2⤵
          PID:1720
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1212,i,17421680975810033843,6372008783442124136,131072 /prefetch:8
          2⤵
            PID:1908
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1212,i,17421680975810033843,6372008783442124136,131072 /prefetch:8
            2⤵
              PID:1416
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2196 --field-trial-handle=1212,i,17421680975810033843,6372008783442124136,131072 /prefetch:1
              2⤵
                PID:1884
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2228 --field-trial-handle=1212,i,17421680975810033843,6372008783442124136,131072 /prefetch:1
                2⤵
                  PID:2100
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1396 --field-trial-handle=1212,i,17421680975810033843,6372008783442124136,131072 /prefetch:2
                  2⤵
                    PID:1868
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=996 --field-trial-handle=1212,i,17421680975810033843,6372008783442124136,131072 /prefetch:1
                    2⤵
                      PID:2452
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3936 --field-trial-handle=1212,i,17421680975810033843,6372008783442124136,131072 /prefetch:8
                      2⤵
                        PID:2512
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3956 --field-trial-handle=1212,i,17421680975810033843,6372008783442124136,131072 /prefetch:8
                        2⤵
                          PID:2520
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:2136

                        Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                Filesize

                                62KB

                                MD5

                                3ac860860707baaf32469fa7cc7c0192

                                SHA1

                                c33c2acdaba0e6fa41fd2f00f186804722477639

                                SHA256

                                d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

                                SHA512

                                d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\40edab41-ccae-482f-9166-5d63ddc52a7b.tmp

                                Filesize

                                4KB

                                MD5

                                facba56a5d4405475362ea165f37613c

                                SHA1

                                bf0bf4bf11d9c18614dfd73389dd01d89cdbbfc1

                                SHA256

                                2bbe50650cd27a134f7d0eda94fd04534c255aec83110b98b3ee52734da60357

                                SHA512

                                8af274af808752d5bf0569f4a6ea96deb414145735d9367dd371279543e7f55be131181867c4c110824257990125f6c15169a336d0db3e3521fa21d4c533a724

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                4KB

                                MD5

                                723289faca7df9329306414d17cca368

                                SHA1

                                962b042e43e45a775ef4e90b990d05df034d72ba

                                SHA256

                                048d59f19f65961bdf3f53c9df30c9986644a2fdf91467a83f8c01b38f52b855

                                SHA512

                                a3643293a7f211b04a3e00ee971572e5b5ef72d542103aa564437284836536a056f8fc131a55ec78411cfd601420189064d4bdd8003540b0180ef2079458ac0c

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                4KB

                                MD5

                                05c06db75c437e32a029db3bacda2c71

                                SHA1

                                44b7dcea5e9a2b52fa37fd22448f8bf89f48d790

                                SHA256

                                3bac435e626b844ce86e66e6b154483a1127dfebdcd43d562fc6ab1087f3019d

                                SHA512

                                5526f4b7d3244ec8ad757bc93ecf3572ecba6d8fc2276968da687762970d91d93aebe9fa7cd6705838da7aa9fe3179b1e66bea55d49c6085fd1b44a2594dd71a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Temp\Cab76E7.tmp

                                Filesize

                                61KB

                                MD5

                                fc4666cbca561e864e7fdf883a9e6661

                                SHA1

                                2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

                                SHA256

                                10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

                                SHA512

                                c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

                              • C:\Users\Admin\AppData\Local\Temp\Tar770A.tmp

                                Filesize

                                161KB

                                MD5

                                73b4b714b42fc9a6aaefd0ae59adb009

                                SHA1

                                efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

                                SHA256

                                c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

                                SHA512

                                73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

                              • C:\Users\Admin\AppData\Local\Temp\Tar79B0.tmp

                                Filesize

                                164KB

                                MD5

                                4ff65ad929cd9a367680e0e5b1c08166

                                SHA1

                                c0af0d4396bd1f15c45f39d3b849ba444233b3a2

                                SHA256

                                c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

                                SHA512

                                f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

                              • C:\Users\Admin\Documents\krnl\7za.exe

                                Filesize

                                628KB

                                MD5

                                ec79cabd55a14379e4d676bb17d9e3df

                                SHA1

                                15626d505da35bfdb33aea5c8f7831f616cabdba

                                SHA256

                                44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

                                SHA512

                                00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

                              • C:\Users\Admin\Documents\krnl\7za.exe

                                Filesize

                                628KB

                                MD5

                                ec79cabd55a14379e4d676bb17d9e3df

                                SHA1

                                15626d505da35bfdb33aea5c8f7831f616cabdba

                                SHA256

                                44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

                                SHA512

                                00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

                              • C:\Users\Admin\Documents\krnl\7za.exe

                                Filesize

                                628KB

                                MD5

                                ec79cabd55a14379e4d676bb17d9e3df

                                SHA1

                                15626d505da35bfdb33aea5c8f7831f616cabdba

                                SHA256

                                44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

                                SHA512

                                00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

                              • C:\Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

                                Filesize

                                236KB

                                MD5

                                2ecb51ab00c5f340380ecf849291dbcf

                                SHA1

                                1a4dffbce2a4ce65495ed79eab42a4da3b660931

                                SHA256

                                f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

                                SHA512

                                e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

                              • C:\Users\Admin\Documents\krnl\ScintillaNET.dll

                                Filesize

                                1.3MB

                                MD5

                                9166536c31f4e725e6befe85e2889a4b

                                SHA1

                                f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae

                                SHA256

                                ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163

                                SHA512

                                113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

                              • C:\Users\Admin\Documents\krnl\bin\Monaco.zip

                                Filesize

                                641KB

                                MD5

                                1a19fd7c42169c76e75e685dca02c190

                                SHA1

                                f16b4697bcd348d44965bf9ded731523db9bd606

                                SHA256

                                d686209afbbe718dc0506356e934ff190c1259a174aba12ef40a2fe7a014a331

                                SHA512

                                93d27188aab662ffffd78cfc31d100f161656ef37fe4f420a2cc2d514c935bce85b1e9b54eb374c94ba0ac75d0624e24676f8e359c32c9d3485aa5d7bbb14dd4

                              • C:\Users\Admin\Documents\krnl\bin\src.7z

                                Filesize

                                52.5MB

                                MD5

                                7c380ecd5bc2cd51511d0ee5b58df745

                                SHA1

                                615749979477621579dd9b04ada8d4dcd9430f1e

                                SHA256

                                38e1b82e4c9a2a8159c1c60afe7668855351a6e9b52fb13f6dcc633202abaf07

                                SHA512

                                110836411f3b44f1df8ecc5890f59d7b5b10d6175f627cc160f0fa5bbc72408c1463ac7067d9787ff9a18e50b9460edf2e2f0b3a418532cc9a273965da1cc1de

                              • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                Filesize

                                1.3MB

                                MD5

                                c7430597fb837d6bc7549b988bdc78a5

                                SHA1

                                447d90f6cad3afe3d2c47fd45f730c68d3201990

                                SHA256

                                531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                SHA512

                                41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                              • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

                                Filesize

                                27KB

                                MD5

                                103d84c4a22967defcbedaea6e11720f

                                SHA1

                                f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

                                SHA256

                                7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

                                SHA512

                                410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

                              • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

                                Filesize

                                29KB

                                MD5

                                5e5fe029bff022007c27d024ae7cf262

                                SHA1

                                fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

                                SHA256

                                7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

                                SHA512

                                60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

                              • C:\Users\Admin\Documents\krnl\bin\src\CefSharp.dll

                                Filesize

                                218KB

                                MD5

                                5f79e7737e5e8be2cf8711374c114e85

                                SHA1

                                86eabaa284074dd2f86f856cea043061091897ef

                                SHA256

                                5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

                                SHA512

                                41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

                              • C:\Users\Admin\Documents\krnl\bin\src\chrome_elf.dll

                                Filesize

                                788KB

                                MD5

                                6499ea6b92ab4971886bd06c12625819

                                SHA1

                                5ebb75eeca7625b9511233158a02f50a92867a39

                                SHA256

                                6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b

                                SHA512

                                e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

                              • C:\Users\Admin\Documents\krnl\bin\src\libcef.dll

                                Filesize

                                96.9MB

                                MD5

                                8c51876f1b5dfbf4964732a65c1f2724

                                SHA1

                                ed5653a3a5655ba65d6221285da93799bd2517f9

                                SHA256

                                5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e

                                SHA512

                                a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884

                              • C:\Users\Admin\Documents\krnl\krnlss.exe

                                Filesize

                                1.5MB

                                MD5

                                4d7c519cc2127f785d13694d7a281f33

                                SHA1

                                6d5d49494ca03fb99f7124197296d43c68d0c027

                                SHA256

                                6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5

                                SHA512

                                50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

                              • C:\Users\Admin\Documents\krnl\krnlss.exe

                                Filesize

                                1.5MB

                                MD5

                                4d7c519cc2127f785d13694d7a281f33

                                SHA1

                                6d5d49494ca03fb99f7124197296d43c68d0c027

                                SHA256

                                6da486f47b7cdc5f54bad208ae48a25e3f1827fed64d1455c9d986b68d37f7b5

                                SHA512

                                50ec05f9cf9b6c4309be0b18f40124b703700672fe784bf3d12c470e647409cb5824dce79f7a4db2e5be83b3be8879f248c1549e37e6633cb7369909527e99a5

                              • C:\Users\Admin\Documents\krnl\krnlss.exe.config

                                Filesize

                                202B

                                MD5

                                0ed4b3831ff5e91dff636145f68aac4c

                                SHA1

                                2d1140812945dc1b9e400a88c911803639cb2e49

                                SHA256

                                03962ae5a55dfc70e2717771a9a7aa37b956b2c5b4c62e3cff9fe24360250347

                                SHA512

                                4039d0272678777ba6fa496baf875050bd4c29352fffd37af8c3c07fb2abeedc54ba04a3dd085b491d848e951ccfcbd67ec7ba50a10ec0c624df45e98c18bf1c

                              • \Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x86\SciLexer.dll

                                Filesize

                                943KB

                                MD5

                                2ff7acfa80647ee46cc3c0e446327108

                                SHA1

                                c994820d03af722c244b046d1ee0967f1b5bc478

                                SHA256

                                08f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d

                                SHA512

                                50a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd

                              • \Users\Admin\Documents\krnl\7za.exe

                                Filesize

                                628KB

                                MD5

                                ec79cabd55a14379e4d676bb17d9e3df

                                SHA1

                                15626d505da35bfdb33aea5c8f7831f616cabdba

                                SHA256

                                44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

                                SHA512

                                00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

                              • \Users\Admin\Documents\krnl\7za.exe

                                Filesize

                                628KB

                                MD5

                                ec79cabd55a14379e4d676bb17d9e3df

                                SHA1

                                15626d505da35bfdb33aea5c8f7831f616cabdba

                                SHA256

                                44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

                                SHA512

                                00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

                              • \Users\Admin\Documents\krnl\7za.exe

                                Filesize

                                628KB

                                MD5

                                ec79cabd55a14379e4d676bb17d9e3df

                                SHA1

                                15626d505da35bfdb33aea5c8f7831f616cabdba

                                SHA256

                                44a55f5d9c31d0990de47b9893e0c927478930cef06fbe2d1f520a6d6cba587d

                                SHA512

                                00bbb601a685cbfb3c51c1da9f3b77c2b318c79e87d88a31c0e215288101753679e1586b170ccc9c2cb0b5ce05c2090c0737a1e4a616ad1d9658392066196d47

                              • \Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

                                Filesize

                                236KB

                                MD5

                                2ecb51ab00c5f340380ecf849291dbcf

                                SHA1

                                1a4dffbce2a4ce65495ed79eab42a4da3b660931

                                SHA256

                                f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

                                SHA512

                                e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

                              • \Users\Admin\Documents\krnl\Bunifu_UI_v1.5.3.dll

                                Filesize

                                236KB

                                MD5

                                2ecb51ab00c5f340380ecf849291dbcf

                                SHA1

                                1a4dffbce2a4ce65495ed79eab42a4da3b660931

                                SHA256

                                f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

                                SHA512

                                e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

                              • \Users\Admin\Documents\krnl\ScintillaNET.dll

                                Filesize

                                1.3MB

                                MD5

                                9166536c31f4e725e6befe85e2889a4b

                                SHA1

                                f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae

                                SHA256

                                ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163

                                SHA512

                                113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

                              • \Users\Admin\Documents\krnl\ScintillaNET.dll

                                Filesize

                                1.3MB

                                MD5

                                9166536c31f4e725e6befe85e2889a4b

                                SHA1

                                f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae

                                SHA256

                                ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163

                                SHA512

                                113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                Filesize

                                1.3MB

                                MD5

                                c7430597fb837d6bc7549b988bdc78a5

                                SHA1

                                447d90f6cad3afe3d2c47fd45f730c68d3201990

                                SHA256

                                531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                SHA512

                                41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                Filesize

                                1.3MB

                                MD5

                                c7430597fb837d6bc7549b988bdc78a5

                                SHA1

                                447d90f6cad3afe3d2c47fd45f730c68d3201990

                                SHA256

                                531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                SHA512

                                41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                Filesize

                                1.3MB

                                MD5

                                c7430597fb837d6bc7549b988bdc78a5

                                SHA1

                                447d90f6cad3afe3d2c47fd45f730c68d3201990

                                SHA256

                                531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                SHA512

                                41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                Filesize

                                1.3MB

                                MD5

                                c7430597fb837d6bc7549b988bdc78a5

                                SHA1

                                447d90f6cad3afe3d2c47fd45f730c68d3201990

                                SHA256

                                531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                SHA512

                                41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.Core.dll

                                Filesize

                                1.3MB

                                MD5

                                c7430597fb837d6bc7549b988bdc78a5

                                SHA1

                                447d90f6cad3afe3d2c47fd45f730c68d3201990

                                SHA256

                                531585fb2ae180dab6c32b577a964279d8c26a517271f05c3a22940594568f88

                                SHA512

                                41567ff616ed0b8fd37f0095c71326fa16c23b33e390b9f224c03eaa5bb33ce06f4e0b60e1ea7ce552f1f47ea38b749a50e16a8e2fcf69f364c8f210a3ad0ae1

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

                                Filesize

                                27KB

                                MD5

                                103d84c4a22967defcbedaea6e11720f

                                SHA1

                                f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

                                SHA256

                                7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

                                SHA512

                                410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

                                Filesize

                                27KB

                                MD5

                                103d84c4a22967defcbedaea6e11720f

                                SHA1

                                f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

                                SHA256

                                7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

                                SHA512

                                410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

                                Filesize

                                27KB

                                MD5

                                103d84c4a22967defcbedaea6e11720f

                                SHA1

                                f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

                                SHA256

                                7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

                                SHA512

                                410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.OffScreen.dll

                                Filesize

                                27KB

                                MD5

                                103d84c4a22967defcbedaea6e11720f

                                SHA1

                                f33ff1b8d18ba90ec6dc641dd9a6666746fc72a2

                                SHA256

                                7984b97cf1aa2a45381bf4d1849a70c3a37527da6c433b0ff6771912c28d20f2

                                SHA512

                                410e63fdae507b97d61b815a846a9ccfd655da4ff23e39652be182e139a974a4a26cc8d4c22057da99c42ce59f215db2f87a173d99ba9cd9a16f392671476fe7

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

                                Filesize

                                29KB

                                MD5

                                5e5fe029bff022007c27d024ae7cf262

                                SHA1

                                fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

                                SHA256

                                7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

                                SHA512

                                60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

                                Filesize

                                29KB

                                MD5

                                5e5fe029bff022007c27d024ae7cf262

                                SHA1

                                fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

                                SHA256

                                7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

                                SHA512

                                60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

                                Filesize

                                29KB

                                MD5

                                5e5fe029bff022007c27d024ae7cf262

                                SHA1

                                fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

                                SHA256

                                7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

                                SHA512

                                60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.WinForms.dll

                                Filesize

                                29KB

                                MD5

                                5e5fe029bff022007c27d024ae7cf262

                                SHA1

                                fb7250ec8ca1acd36023b966fae61e85fe2c8ab4

                                SHA256

                                7bee1ead1fe16cc4bae25758d1708163489724427f4b540b21ce1e943f070c3b

                                SHA512

                                60df60ca9c12295057afb10a050587010ac6326f8e636ef811bb13ef891aa19c98a54ca2e7514181f93a9622677c82d73ea13fb4e72a14f62911eb5ca9073216

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.dll

                                Filesize

                                218KB

                                MD5

                                5f79e7737e5e8be2cf8711374c114e85

                                SHA1

                                86eabaa284074dd2f86f856cea043061091897ef

                                SHA256

                                5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

                                SHA512

                                41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.dll

                                Filesize

                                218KB

                                MD5

                                5f79e7737e5e8be2cf8711374c114e85

                                SHA1

                                86eabaa284074dd2f86f856cea043061091897ef

                                SHA256

                                5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

                                SHA512

                                41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.dll

                                Filesize

                                218KB

                                MD5

                                5f79e7737e5e8be2cf8711374c114e85

                                SHA1

                                86eabaa284074dd2f86f856cea043061091897ef

                                SHA256

                                5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

                                SHA512

                                41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

                              • \Users\Admin\Documents\krnl\bin\src\CefSharp.dll

                                Filesize

                                218KB

                                MD5

                                5f79e7737e5e8be2cf8711374c114e85

                                SHA1

                                86eabaa284074dd2f86f856cea043061091897ef

                                SHA256

                                5b6ca21a1bc2c31640cf7bd270f8d69df7ca547d26828cabc25656b06a9f3f72

                                SHA512

                                41ea9a9a4f666a152b17f05a01571ba1c27b07051489660e923a94366bc66225530eabd8f1e3bef3da65feaa98ede44f0105092c86d526ab30b604b88c494f95

                              • \Users\Admin\Documents\krnl\bin\src\chrome_elf.dll

                                Filesize

                                788KB

                                MD5

                                6499ea6b92ab4971886bd06c12625819

                                SHA1

                                5ebb75eeca7625b9511233158a02f50a92867a39

                                SHA256

                                6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b

                                SHA512

                                e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

                              • \Users\Admin\Documents\krnl\bin\src\libcef.dll

                                Filesize

                                96.9MB

                                MD5

                                8c51876f1b5dfbf4964732a65c1f2724

                                SHA1

                                ed5653a3a5655ba65d6221285da93799bd2517f9

                                SHA256

                                5ae7eff0a7b91e54d211046111d088ed8820793c97ee689f20371c356af6b46e

                                SHA512

                                a4bb49b64b58767fcaf5b3b889a63c0917d56c59dd48283539903a6856caf69c5ce35655e68ef8bdad1e9bc80002fd2f68fc1e46977ba68926f7a731904a7884

                              • memory/1940-54-0x0000000000110000-0x000000000023A000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1940-55-0x0000000004A30000-0x0000000004A70000-memory.dmp

                                Filesize

                                256KB

                              • memory/1940-57-0x0000000000600000-0x000000000060A000-memory.dmp

                                Filesize

                                40KB

                              • memory/1940-56-0x0000000000600000-0x000000000060A000-memory.dmp

                                Filesize

                                40KB

                              • memory/1940-58-0x0000000002130000-0x000000000213A000-memory.dmp

                                Filesize

                                40KB

                              • memory/1940-329-0x0000000004A30000-0x0000000004A70000-memory.dmp

                                Filesize

                                256KB

                              • memory/1940-330-0x0000000000600000-0x000000000060A000-memory.dmp

                                Filesize

                                40KB

                              • memory/1940-333-0x0000000000600000-0x000000000060A000-memory.dmp

                                Filesize

                                40KB

                              • memory/2324-806-0x0000000001FD0000-0x000000000200E000-memory.dmp

                                Filesize

                                248KB

                              • memory/2324-807-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2324-803-0x0000000001FD0000-0x000000000200E000-memory.dmp

                                Filesize

                                248KB

                              • memory/2324-812-0x00000000066F0000-0x000000000683D000-memory.dmp

                                Filesize

                                1.3MB

                              • memory/2324-865-0x0000000005640000-0x0000000005682000-memory.dmp

                                Filesize

                                264KB

                              • memory/2324-617-0x0000000000820000-0x00000000009A4000-memory.dmp

                                Filesize

                                1.5MB

                              • memory/2324-866-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2324-867-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2324-861-0x0000000004B40000-0x0000000004B4E000-memory.dmp

                                Filesize

                                56KB

                              • memory/2324-815-0x00000000066F0000-0x000000000683D000-memory.dmp

                                Filesize

                                1.3MB

                              • memory/2324-854-0x0000000004B30000-0x0000000004B3E000-memory.dmp

                                Filesize

                                56KB

                              • memory/2324-871-0x0000000007DD0000-0x0000000007F24000-memory.dmp

                                Filesize

                                1.3MB

                              • memory/2324-858-0x0000000004B40000-0x0000000004B4E000-memory.dmp

                                Filesize

                                56KB

                              • memory/2324-837-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2324-886-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2324-808-0x0000000005950000-0x0000000005A0A000-memory.dmp

                                Filesize

                                744KB

                              • memory/2324-851-0x0000000004B30000-0x0000000004B3E000-memory.dmp

                                Filesize

                                56KB