cryptbot | 88b5f1f49c737d8889e26f62285c88ef671dc6945a7fdab799c22821d3938864

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_installer.exe
Size 4.3MB
Sample240118-fx27gadcfl
SHA256 78e623c6620f1b07f200e69f8d0127229cd3f415575e249b3539aa020c62e4d8
MD5 0286f9b59396cd300da7e312acde0650
SHA1 dd65aee16954c62a471d43ca7664d65dafa6e3e2
SHA512 0ba088170ef1c8a8088b459ee05ab7bda2adf68c7d98526cab13dbd7251032347a28ed47d68bd9d7e56ca08837ea71eec6c9ce62802b1676c7adc923a1122dc8
SSDEEP 98304:xCCvLUBsgg6+Nf/mWmCI9kBqwTNOu8XRAB3jlFblKNlBWzFiSt7/C4:xzLUCgh+oz9kBZJyABTlalI5iSx64
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

nullmixer

http://hsiens.xyz/

Extracted

Family

vidar

Version

40.1

Botnet

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

privateloader

http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
http://wfsdragon.ru/api/setStats.php
37.0.10.237

Extracted

Family

redline

Botnet

pub1

viacetequn.site:80

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/

rc4.i32

Signatures

CryptBot
A C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

CryptBot payload 3 IoCs

resource	yara_rule
behavioral4/memory/3100-211-0x0000000005F30000-0x0000000005FD3000-memory.dmp	family_cryptbot
behavioral4/memory/3100-212-0x0000000005F30000-0x0000000005FD3000-memory.dmp	family_cryptbot
behavioral4/memory/3100-213-0x0000000005F30000-0x0000000005FD3000-memory.dmp	family_cryptbot

NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral4/memory/3212-146-0x0000000004C80000-0x0000000004CA2000-memory.dmp	family_redline
behavioral4/memory/3212-152-0x0000000004D10000-0x0000000004D30000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

resource	yara_rule
behavioral4/memory/3212-146-0x0000000004C80000-0x0000000004CA2000-memory.dmp	family_sectoprat
behavioral4/memory/3212-153-0x0000000007470000-0x0000000007480000-memory.dmp	family_sectoprat
behavioral4/memory/3212-152-0x0000000004D10000-0x0000000004D30000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral4/memory/4364-120-0x00000000040A0000-0x000000000413D000-memory.dmp	family_vidar
behavioral4/memory/4364-123-0x0000000000400000-0x0000000002404000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral4/files/0x000600000002320c-40.dat	aspack_v212_v242
behavioral4/files/0x000600000002320c-43.dat	aspack_v212_v242
behavioral4/files/0x000600000002320e-48.dat	aspack_v212_v242
behavioral4/files/0x000600000002320e-45.dat	aspack_v212_v242
behavioral4/files/0x000600000002320b-47.dat	aspack_v212_v242
behavioral4/files/0x000600000002320b-46.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	Sat01419f8e1c6b.exe

Executes dropped EXE 13 IoCs

pid	Process
1380	setup_install.exe
3744	Sat01ae6a02b12.exe
772	Sat01419f8e1c6b.exe
2680	Sat0156f0a157aee8a1.exe
3212	Sat012ff5fe8ed.exe
792	Sat0167ecaf5f3d9e0ae.exe
1984	Sat0152d2e7e2627.exe
5108	Sat01d39b63165076cf6.exe
632	Sat0121d914644cacc0a.exe
4364	sihclient.exe
4024	Sat01419f8e1c6b.exe
2452	Piu.exe.com
3100	Piu.exe.com

Loads dropped DLL 8 IoCs

pid	Process
1380	setup_install.exe
1380	setup_install.exe
1380	setup_install.exe
1380	setup_install.exe
1380	setup_install.exe
1380	setup_install.exe
1380	setup_install.exe
1380	setup_install.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Sat0121d914644cacc0a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3680	1380	WerFault.exe	88
2016	1984	WerFault.exe	105
2268	4364	WerFault.exe	102

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat0152d2e7e2627.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat0152d2e7e2627.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat0152d2e7e2627.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2348	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4592	powershell.exe
4592	powershell.exe
1984	Sat0152d2e7e2627.exe
1984	Sat0152d2e7e2627.exe
4592	powershell.exe
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1984	Sat0152d2e7e2627.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	Sat0167ecaf5f3d9e0ae.exe
Token: SeDebugPrivilege	5108	Sat01d39b63165076cf6.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	3212	Sat012ff5fe8ed.exe
Token: SeShutdownPrivilege	3512	Process not Found
Token: SeCreatePagefilePrivilege	3512	Process not Found
Token: SeCreateGlobalPrivilege	4844	dwm.exe
Token: SeChangeNotifyPrivilege	4844	dwm.exe
Token: 33	4844	dwm.exe
Token: SeIncBasePriorityPrivilege	4844	dwm.exe
Token: SeShutdownPrivilege	3512	Process not Found
Token: SeCreatePagefilePrivilege	3512	Process not Found
Token: SeShutdownPrivilege	3512	Process not Found
Token: SeCreatePagefilePrivilege	3512	Process not Found
Token: SeShutdownPrivilege	3512	Process not Found
Token: SeCreatePagefilePrivilege	3512	Process not Found
Token: SeShutdownPrivilege	3512	Process not Found
Token: SeCreatePagefilePrivilege	3512	Process not Found
Token: SeShutdownPrivilege	3512	Process not Found
Token: SeCreatePagefilePrivilege	3512	Process not Found
Token: SeShutdownPrivilege	3512	Process not Found
Token: SeCreatePagefilePrivilege	3512	Process not Found
Token: SeShutdownPrivilege	3512	Process not Found
Token: SeCreatePagefilePrivilege	3512	Process not Found
Token: SeShutdownPrivilege	3512	Process not Found
Token: SeCreatePagefilePrivilege	3512	Process not Found
Token: SeShutdownPrivilege	4844	dwm.exe
Token: SeCreatePagefilePrivilege	4844	dwm.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2452	Piu.exe.com
2452	Piu.exe.com
2452	Piu.exe.com
3100	Piu.exe.com
3100	Piu.exe.com
3100	Piu.exe.com
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2452	Piu.exe.com
2452	Piu.exe.com
2452	Piu.exe.com
3100	Piu.exe.com
3100	Piu.exe.com
3100	Piu.exe.com
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found
3512	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3512	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 1380	4396	setup_installer.exe	88
PID 4396 wrote to memory of 1380	4396	setup_installer.exe	88
PID 4396 wrote to memory of 1380	4396	setup_installer.exe	88
PID 1380 wrote to memory of 3136	1380	setup_install.exe	125
PID 1380 wrote to memory of 3136	1380	setup_install.exe	125
PID 1380 wrote to memory of 3136	1380	setup_install.exe	125
PID 1380 wrote to memory of 980	1380	setup_install.exe	129
PID 1380 wrote to memory of 980	1380	setup_install.exe	129
PID 1380 wrote to memory of 980	1380	setup_install.exe	129
PID 1380 wrote to memory of 2460	1380	setup_install.exe	121
PID 1380 wrote to memory of 2460	1380	setup_install.exe	121
PID 1380 wrote to memory of 2460	1380	setup_install.exe	121
PID 1380 wrote to memory of 2740	1380	setup_install.exe	120
PID 1380 wrote to memory of 2740	1380	setup_install.exe	120
PID 1380 wrote to memory of 2740	1380	setup_install.exe	120
PID 1380 wrote to memory of 1068	1380	setup_install.exe	119
PID 1380 wrote to memory of 1068	1380	setup_install.exe	119
PID 1380 wrote to memory of 1068	1380	setup_install.exe	119
PID 1380 wrote to memory of 4428	1380	setup_install.exe	118
PID 1380 wrote to memory of 4428	1380	setup_install.exe	118
PID 1380 wrote to memory of 4428	1380	setup_install.exe	118
PID 1380 wrote to memory of 2684	1380	setup_install.exe	117
PID 1380 wrote to memory of 2684	1380	setup_install.exe	117
PID 1380 wrote to memory of 2684	1380	setup_install.exe	117
PID 1380 wrote to memory of 3236	1380	setup_install.exe	113
PID 1380 wrote to memory of 3236	1380	setup_install.exe	113
PID 1380 wrote to memory of 3236	1380	setup_install.exe	113
PID 1380 wrote to memory of 3160	1380	setup_install.exe	112
PID 1380 wrote to memory of 3160	1380	setup_install.exe	112
PID 1380 wrote to memory of 3160	1380	setup_install.exe	112
PID 1380 wrote to memory of 2620	1380	setup_install.exe	111
PID 1380 wrote to memory of 2620	1380	setup_install.exe	111
PID 1380 wrote to memory of 2620	1380	setup_install.exe	111
PID 2684 wrote to memory of 3744	2684	cmd.exe	91
PID 2684 wrote to memory of 3744	2684	cmd.exe	91
PID 2684 wrote to memory of 3744	2684	cmd.exe	91
PID 980 wrote to memory of 772	980	WerFault.exe	110
PID 980 wrote to memory of 772	980	WerFault.exe	110
PID 980 wrote to memory of 772	980	WerFault.exe	110
PID 3136 wrote to memory of 4592	3136	cmd.exe	109
PID 3136 wrote to memory of 4592	3136	cmd.exe	109
PID 3136 wrote to memory of 4592	3136	cmd.exe	109
PID 2740 wrote to memory of 2680	2740	cmd.exe	108
PID 2740 wrote to memory of 2680	2740	cmd.exe	108
PID 4428 wrote to memory of 3212	4428	cmd.exe	107
PID 4428 wrote to memory of 3212	4428	cmd.exe	107
PID 4428 wrote to memory of 3212	4428	cmd.exe	107
PID 2620 wrote to memory of 792	2620	cmd.exe	106
PID 2620 wrote to memory of 792	2620	cmd.exe	106
PID 2460 wrote to memory of 1984	2460	cmd.exe	105
PID 2460 wrote to memory of 1984	2460	cmd.exe	105
PID 2460 wrote to memory of 1984	2460	cmd.exe	105
PID 3236 wrote to memory of 5108	3236	cmd.exe	104
PID 3236 wrote to memory of 5108	3236	cmd.exe	104
PID 3160 wrote to memory of 632	3160	cmd.exe	103
PID 3160 wrote to memory of 632	3160	cmd.exe	103
PID 3160 wrote to memory of 632	3160	cmd.exe	103
PID 1068 wrote to memory of 4364	1068	cmd.exe	132
PID 1068 wrote to memory of 4364	1068	cmd.exe	132
PID 1068 wrote to memory of 4364	1068	cmd.exe	132
PID 632 wrote to memory of 3984	632	Sat0121d914644cacc0a.exe	101
PID 632 wrote to memory of 3984	632	Sat0121d914644cacc0a.exe	101
PID 632 wrote to memory of 3984	632	Sat0121d914644cacc0a.exe	101
PID 632 wrote to memory of 3240	632	Sat0121d914644cacc0a.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 568
    3⤵
    - Program crash
    PID:3680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat0167ecaf5f3d9e0ae.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat0121d914644cacc0a.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat01d39b63165076cf6.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat01ae6a02b12.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat012ff5fe8ed.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat0191dd9aa7513876e.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat0156f0a157aee8a1.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat0152d2e7e2627.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat01419f8e1c6b.exe
    3⤵
    PID:980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3136

C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat01ae6a02b12.exe
Sat01ae6a02b12.exe
1⤵
- Executes dropped EXE
PID:3744

C:\Windows\SysWOW64\cmd.exe
cmd /c cmd < Abbassero.wmv
1⤵
PID:3240
- C:\Windows\SysWOW64\cmd.exe
  cmd
  2⤵
  PID:2804
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V /R "^VHwgFRxzxxLcwcGoqrvwdRkyDDkqmNLTpdmTOMvFsotvynnSaSEGawtrcWKeGzUGIRjLVNzgHQJiNPZttzIGotBijvbSexZYgbNhjNWFndZB$" Rugiada.wmv
    3⤵
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com
    Piu.exe.com L
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com L
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3100
- - C:\Windows\SysWOW64\PING.EXE
    ping GAWKBMOT -n 30
    3⤵
    - Runs ping.exe
    PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1380 -ip 1380
1⤵
PID:4780

C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat01419f8e1c6b.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat01419f8e1c6b.exe" -a
1⤵
- Executes dropped EXE
PID:4024

C:\Windows\SysWOW64\dllhost.exe
dllhost.exe
1⤵
PID:3984

C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0191dd9aa7513876e.exe
Sat0191dd9aa7513876e.exe
1⤵
PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1616
  2⤵
  - Program crash
  PID:2268

C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0121d914644cacc0a.exe
Sat0121d914644cacc0a.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:632

C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat01d39b63165076cf6.exe
Sat01d39b63165076cf6.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0152d2e7e2627.exe
Sat0152d2e7e2627.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 372
  2⤵
  - Program crash
  PID:2016

C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0167ecaf5f3d9e0ae.exe
Sat0167ecaf5f3d9e0ae.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:792

C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat012ff5fe8ed.exe
Sat012ff5fe8ed.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0156f0a157aee8a1.exe
Sat0156f0a157aee8a1.exe
1⤵
- Executes dropped EXE
PID:2680

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat01419f8e1c6b.exe
Sat01419f8e1c6b.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1984 -ip 1984
1⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4364 -ip 4364
1⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv eo0WtMfIM0yeo2zGzrHweg.0.2
1⤵
- Executes dropped EXE
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sat0121d914644cacc0a.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0121d914644cacc0a.exe
Size 963KB
SHA256 f7b6ac23784de689ca5bf8a0de6cca172717672e617bb23ac742241a75838e38
MD5 10f99676d390a16cf728848ec021cdbf
SHA1 03182e9e78de4518a49a232f43c62d31ea9c18e5
SHA512 c56986a83a72747ec01e4ba233f277c9936e37a788252f579738907c9cd6de0fd3420976a372719945e87205900eb64bb1790cff4beee6d5049c86733e889447
SSDEEP 24576:oZxCqNuKnqhKfEi9RnjE/9kfQzysn7dFOKTJf:KNup+f9xE/9EBfw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat0121d914644cacc0a.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0121d914644cacc0a.exe
Size 158KB
SHA256 279e29befe3225faa80b68501710d7fe2206c74d369ea04bd09a93927db5fbb6
MD5 9ba3c47be630a06df376cff5e49d1c99
SHA1 b0b1e6748b67397a80f7c51f37cd08e80742d4ca
SHA512 f35c655404826e99af7dea4a533a8465b81d78e99ebd8e2e8dcbf3a5477f4db5677c8dab3b9a8d56a15531dfc2d839614ef2146a0db12246a00a45910373b4c2
SSDEEP 1536:K5GJEhlcbW5sk1BlfLvveIbXWm+nwN6JApS/6WmL7okiW:oGu9BlfzWIbXWm+w0JAc6WdZW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat012ff5fe8ed.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat012ff5fe8ed.exe
Size 248KB
SHA256 f02c1351a8b3dc296cf815bb4cd2bcc2d25b3b9a258ab2ad95e8be3d9602322c
MD5 d23c06e25b4bd295e821274472263572
SHA1 9ad295ec3853dc465ae77f9479f8c4f76e2748b8
SHA512 122b0ef44682f83651d81df622bbff5ad9fa0f5bbd6b925e35add9568825c0316c0f9921dac21cf92cb44658fc854f7829c01ae3b84aa0745929f8ef5e6ae1ae
SSDEEP 3072:6MPfazlHCqinGzqqqaf1dLBtwY+Or+GmXzTfcPrU/TSEG2ayRxZ4EvJ6zgFnLmx:6Vz8Gzqy9doYZ+GmyU7nx7dOgFnL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat012ff5fe8ed.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat012ff5fe8ed.exe
Size 89KB
SHA256 a91114e34ac2431bd2a8395efd58f9d8ce87e88d5df67d57de554e44b10b4ec5
MD5 3043553cba36d8fb5507310f8232a936
SHA1 2a1c72386fb531ecf364e9a58e955eeab81bf84b
SHA512 baff2f798ba89a4458f9172d4cfc69e0e25f7cb750eafbbe5642c90ce5057ca8f3bf5b72cb0fbae8c69b308df5c4e1a246d76d45a086ba367d775206abf9f78b
SSDEEP 1536:F659Tzm0mQAdr+tOFazlHCqOJV51GzJT+6qqghpaf1dL8Entp:6MPfazlHCqinGzqqqaf1dLBtp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat01419f8e1c6b.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat01419f8e1c6b.exe
Size 56KB
SHA256 78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
MD5 c0d18a829910babf695b4fdaea21a047
SHA1 236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA512 cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
SSDEEP 768:cMyTlenToDMTEp1Gjy76rM9QXPvRePLrlteeliY:cGEYT5y39QXHRErjliY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat0152d2e7e2627.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0152d2e7e2627.exe
Size 276KB
SHA256 d97cdf5a74a79f9fc96389b2ec0b85cb3040b8ee3fbeda1755aa2a6e5639d63b
MD5 873baa8dc83cc38373f0b63dcb832437
SHA1 20bba46dc16838240f717e0150e90908d09c8eac
SHA512 114df137923f31aadc82c89b917beefa00cd0de9f420a0914acfcf3af5e4072d8cb0381f24e7033e6f54997e63666508b77bed79045cae254281f5d4a460b32e
SSDEEP 6144:i2LRA4GKiYLNW5v7GW+nX9/G5lwht/LrCGTfczX:xRA4G5YL47MnX9/MWSGTf8X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat0152d2e7e2627.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0152d2e7e2627.exe
Size 139KB
SHA256 21fc6657b3227e4a4b4ca84e2ffd9a3a4b703e608ab4b0e45e88c25cb139e99c
MD5 c1b00e2ba6a5c46fe9909fb2a971671e
SHA1 48cc2ef468bd76fcbabf904e4a4f5cd504ec2664
SHA512 662165bb0ebf1da9522d0b6ca4a3e0e2b95673746611087fb330d7e6be80dd7a7aa55cf448cca1ac0c4ebbc266d3b8f3789cdf166fc811241ea491b29efd0fa9
SSDEEP 3072:i2X7RARhkFRyKiYtNN1o508R7GQ7+sAX9zDo7n8Hyn6yqV:i2LRA4GKiYLNW5v7GW+nX9/G5u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat0156f0a157aee8a1.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0156f0a157aee8a1.exe
Size 900KB
SHA256 a59457fbfaf3d1b2e17463d0ffd50680313b1905aff69f13694cfc3fffd5a4ac
MD5 0a0d22f1c9179a67d04166de0db02dbb
SHA1 106e55bd898b5574f9bd33dac9f3c0b95cecd90d
SHA512 8abf8dc0da25c0fdbaa1ca39db057db80b9a135728fed9cd0f45b0f06d5652cee8d309b92e7cb953c0c4e8b38ffa2427c33f4865f1eb985a621316f9eb187b8b
SSDEEP 12288:Tx1vJUpzeLkTqhqeEmC7QOZGafQei7fqXHf:32zIkTgqeEVQO5fQs3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat0156f0a157aee8a1.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0156f0a157aee8a1.exe
Size 576KB
SHA256 1dc4e152f3a6970aba3bdb6bdd1b7d2e7fe681a9c056852f1155c5b0b9dd3ae5
MD5 fb53231792b0679b4a51b2be1f31ddac
SHA1 55b3f66cb265714f274e03f2e5d36b7758fd1aa8
SHA512 a5555d64990ca809f7d300a44ce5de873949e817473d3b4e1cb0e9eacef69d4a41a8b5a90d4b658866cd55ea1ef8771ac570244ee1f3cdb82666eea5d4327867
SSDEEP 6144:Gf5ix6YvO+rHwf8uzemUQmJFqrDTqhVWyFYt98ElgIB7Hxxo9idw9h9LkZnCqJ7x:Tx1vJUpzeLkTqhqeEmC7QOZGafd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat0167ecaf5f3d9e0ae.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0167ecaf5f3d9e0ae.exe
Size 8KB
SHA256 8a77dd50b720322088fbe92aeba219cc744bd664ff660058b1949c3b9b428bac
MD5 d1d4b4d26a9b9714a02c252fb46b72ce
SHA1 af9e34a28f8f408853d3cd504f03ae43c03cc24f
SHA512 182929a5ff0414108f74283e77ba044ab359017ace35a06f9f3ebd8b69577c22ecc85705cb908d1aa99d3a20246076bc82a7f6de7e3c4424d4e1dc3a9a6954cd
SSDEEP 96:AJOElmu1B9ilJJMOfEkdEKozt1ExTfvcqkTzNt:ALkJwGE3Eha1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat0191dd9aa7513876e.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0191dd9aa7513876e.exe
Size 612KB
SHA256 36bc7d6d883c2daab6fc171443022aa13497c3fdbf5c4b7e46f204249c52ffa5
MD5 c9080d1b76e91ae039858a67c218b2d3
SHA1 9fde651375272397c3ed64de8763ef900a2b6ae8
SHA512 b9f1f836c1aee6dc27223abdd323cefe5728426a9b428576f6643a209dac760c053e16a8fc3173fb00bd25aac855709aecc1b13849b6c08dd547ee44f3ba22e5
SSDEEP 12288:hZD6enkK57DXE0U2tBA5rniAvwcLC+Xk7UMoQBj3bQgjFmIXRKmeTjVkX:7kK57jBKnpC+XvOzbH4Ih8Tj2X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat0191dd9aa7513876e.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat0191dd9aa7513876e.exe
Size 240KB
SHA256 c097553a23f387d9732fc11b80b36472483edc5f6fced26b35f2b0f91bbfe10f
MD5 67fb1d3a2139784d814d4d17595c6aad
SHA1 ec1778b5983964f1f23ee27f2d7ba9fc90b6abc7
SHA512 700cf593a9b328b2d07593b29983716744a33586977443adf8a600fb6ba146eb7d09addc841e66f2dba77c96f52f2af1452e0b5e8f8ff7f18658c2abc0ad1b10
SSDEEP 6144:0XCZD6eK8kKH5H7bW+XE0UhczxwyAjdbPnzGAJtwTcJsmj:hZD6enkK57DXE0U2tBA5rniAvwcLj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat01ae6a02b12.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat01ae6a02b12.exe
Size 802KB
SHA256 1802247ca8fafdd1d9b32846ee4c8e060844f0af85f9a843e80abaae80301461
MD5 3cc38c45e61440e4d9ef46de6d7dc755
SHA1 8d8de6687cf6bfded0a9b3be2865d17c9a006efd
SHA512 fc286ac1ca6e4c6ed0a729173093056d5110664a0716aa55ccddea9708d62c3fd4592e14a1c14b8b189723b51540681d9b0a0419d072cf41be838524f9838a2b
SSDEEP 12288:NaL+RhHfZweu+WRJZYUEwU/sBeZY4zYoKnGNIrxN7Pt2JjZ:NaKDi9JeUAsBeZYyYoMGYVl2JjZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat01ae6a02b12.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat01ae6a02b12.exe
Size 764KB
SHA256 685125eac56f97aa51a84fe1ff6fbf5faee8c672a24a2780598ce2c5d5817ef9
MD5 268984c195d238650809b55fa72834c4
SHA1 ee91b0ecb18d1166ca7c21f0d01eddbd08378ef0
SHA512 28bdf6049c13b05f63eefe18827709e7dc7fa38fa2b1a365d2305500eb582957e450f54a66a220106d1072910a1ac1447dafcd2f099ce7af2fad07a80f238a6c
SSDEEP 12288:NaL+RhHfZweu+WRJZYUEwU/sBeZY4zYoKnGNIrxN7Pt2Jjc:NaKDi9JeUAsBeZYyYoMGYVl2Jjc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sat01d39b63165076cf6.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\Sat01d39b63165076cf6.exe
Size 156KB
SHA256 1e07bb767e9979d4afa4f8d69b68e33dd7c1a43f6863096a2b091047a10cdc2e
MD5 cda12ae37191467d0a7d151664ed74aa
SHA1 2625b2e142c848092aa4a51584143ab7ed7d33d2
SHA512 77c4429e22754e50828d9ec344cd63780acd31c350ef16ef69e2a396114df10e7c43d791440faee90e7f80be73e845ab579fd7b38efbd12f5de11bbc906f1c1d
SSDEEP 3072:6vyo9QtafbXPCExJPoS1bgkoE19PdZzeG:6Ko9QtaDXaCJP5lZoi
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\libcurl.dll
Size 218KB
SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
MD5 d09be1f47fd6b827c81a4812b4f7296f
SHA1 028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA512 857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
SSDEEP 6144:Kk3jgivfCVSRrLV7yAVzKZIjCbanUKWw+ba//PXHUo:30iH0iVPVzKOOunLWf2//0
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\libcurl.dll
Size 57KB
SHA256 d78e0d875542bc746a88a6ecb68bebd9c7113b4b88e6dd2d92a5e25b1e140ab0
MD5 b672f2cfcd55760489a350cf8de11dab
SHA1 0f45d5916d9be597a23052cda01e90be6af5982d
SHA512 9254d4103fc2691e3966d5270088a9c9dc5fa9831f6676c5d6f1853f91d796470eccc743fc18538c5f342783a99e9e40d1d4473a331306d7ded34d2de68db8bc
SSDEEP 1536:NmFkE8MWp9yxtAvfeM/wlmvY18y+5p/iM1m2LkuMPd:Nck3jgivf9wVSyWiM1po
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurlpp.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\libcurlpp.dll
Size 45KB
SHA256 3c2aa8d89e25eea0034a6e18f4595fd764d7baf1291290df2e81a943e18ca424
MD5 aa330342b04d52de47bedc33bba2cd1c
SHA1 b15179198f8925627e1d1137e02f9d4ef1696183
SHA512 2ef099ea24976eb8852d9d439d0f38369f52dfabd776417f8653fa31940b43fc132f00db5d2ffd7cc394314b93355e04c85f06d5e2e907bb1bc834cec109f8bd
SSDEEP 768:W//WT2mbP+7x4Mx5KzVAn/QqvtdZs8LlR67diTNh4joK7qmQT:WHIK1R2VA/Qqvtzz67dbn1QT
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurlpp.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\libcurlpp.dll
Size 54KB
SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
MD5 e6e578373c2e416289a8da55f1dc5e8e
SHA1 b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA512 9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
SSDEEP 768:W//WT2mbP+7x4Mx5KzVAn/QqvtdZs8LlR67diTNh4joK7qmQhyOl4UuGoxX9j3D:WHIK1R2VA/Qqvtzz67dbn1QhyOl4UuD
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_dw2-1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\libgcc_s_dw2-1.dll
Size 45KB
SHA256 068bc0752a79b79084e5a66d272f23dfcd5abd62286d5f87e14d49eaa963b9aa
MD5 22c65840327b0a4d64580773d0e8d929
SHA1 148732d0ffc84201fa387b638ff90afefa79d0b3
SHA512 4b17d60708875ae96fc163823472da7ab1071a4ff689d64c8d406727bf0657dac2b3ea7842393b48ffe9b23d0e2879873090ab647240c4606ce9ea94043de347
SSDEEP 768:nHgf19DZ2i6DRXPivEEr7ye345RQdYmdL2vgvznCIRow4HLml:nq5Z2i6N6vLyeF9Rc8lRoDHg
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_dw2-1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\libgcc_s_dw2-1.dll
Size 52KB
SHA256 0041c88d1a802fe769b708f58d49496be249a47ca50fda2722cfe0d5d8005685
MD5 02f73e2bc8102d8b03cca3be6ba92d15
SHA1 5bc32f166b83c18c9d4039651c89c6525dda978b
SHA512 ce0c334df6c263e78b609896a9344bcebfc8c7cc7ed7b9b8936335b664d1c181d67a967f28ca2c89af01fd9fd5952953c7bc76a9aeba01de0d725807128adc7a
SSDEEP 768:nHgf19DZ2i6DRXPivEEr7ye345RQdYmdL2vgvznCIRow4HLmej3UdlA9keP7vn5:nq5Z2i6N6vLyeF9Rc8lRoDHhDUA9P5
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_dw2-1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\libgcc_s_dw2-1.dll
Size 60KB
SHA256 6e6438d14fa0c780578d02080ad6e22b80d4db522a22b342ba105c3014edd58b
MD5 24ee191a31ebdf6c9005749f0383f667
SHA1 bf89958a19726609b12b1440b7ff36d8e0c15838
SHA512 f66d0be0f41e7085a99a8fd5c224536102fa9d1af1ef30e08a1ba1df54333e50112e5c902c4989b08cbbbca275d574a39a763a8d8ca9d6c68134bbf80ed280bd
SSDEEP 1536:nq5Z2i6N6vLyeF9Rc8lRoDHhDUA9P/icag:nti6N0WeF35Ro7hAWP6cag
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_dw2-1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\libgcc_s_dw2-1.dll
Size 73KB
SHA256 26c125233124a483a33ddaf47c027f4cad838786b070672128a12c821b920aa1
MD5 19b6748e68db37c51b8e4e2b3e499339
SHA1 9b8beae416a6bbc46538d42d0488ff19273004df
SHA512 069bc9a9b908a103561eaee64662c8e70b51fd0318ad982548f1efc73427c99ad91e51fdd17727c51c5986de251f12b3a5da668de71a5e057d8f1d6526585b08
SSDEEP 1536:nq5Z2i6N6vLyeF9Rc8lRoDHhDUA9P/icagLPA7ZE1:nti6N0WeF35Ro7hAWP6cagLSu1
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\libstdc++-6.dll
Size 66KB
SHA256 41f4de87d28ecfebf94ffcd8f08b34c321ee27419dc669d6e24788c840795ef5
MD5 064cc721ea2648a6830be4b12bca35bc
SHA1 bedc86b9b87935d4f9e063d8979e241aca516d24
SHA512 530dc9362c096ac995ae1f93f91c43a6832569d8c5e7696c94ad78f2896ab3cc37f1ed705c48105e760cc0c1821092873a1b0e8366e920e2decb77d380fd6432
SSDEEP 1536:DtzqwUO9L0Yt+h0Vml4iUerj1TUFdjlNv:ZGwOYtamKvBpTUnjr
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\libstdc++-6.dll
Size 83KB
SHA256 8b5628effeb5eef0afa460a08dc5b2599103de54eda5635e799f28550411578d
MD5 81777357c65ed2ee077e0e7b71e6a0cc
SHA1 3cd679b93e7a171134999370c06c73e1a3d87f0a
SHA512 29c092ff50ccdc6a83acf5b23ff9281a3d8025d1fdb022bcce68436c28703476781fa11f2719b4112a9cf181df4577f8a062c8cb94c2b6fff0608498c942b8cb
SSDEEP 1536:DtzqwUO9L0Yt+h0Vml4iUerj1TUFdjlNF3TirSa8No6:ZGwOYtamKvBpTUnjBWz8N9
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\libwinpthread-1.dll
Size 69KB
SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
MD5 1e0d62c34ff2e649ebc5c372065732ee
SHA1 fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA512 3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
SSDEEP 1536:xPCESXKWzkxTz8uLfdkWr2sUX8YNKykl1wwwwUXrMZE4cYdz:x6baWwxH8EzSHYZE4cYdz
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup_install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\setup_install.exe
Size 577KB
SHA256 1135a7d60702c31fdbe53e64cd8059f09d3b659a34b00e6c714c85159351f45f
MD5 8c05fcba079980794adaaddfec07f9ba
SHA1 eab56b12436f7ca406b50bbe09e0ca71ff239127
SHA512 7081d382d205be0f911c72ea37bf809319c7eb3aa7cb481108f7a4d99165a068324291650b9217f38339df95c76e68c20a39ec69134286b70b8a8d7e33a0e2cf
SSDEEP 12288:iAiItENQn59edckf0YpYn+Q0gP8BemVnD2HinPp4ChX:MKkf0YpY+vgP8BhDKix4C1
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup_install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\setup_install.exe
Size 193KB
SHA256 ddc06fb4d97137cdb64ec2b88ad9f5c4a09bebdcaf8b17d47642471f1e148173
MD5 89feee936a7949f42adb070f419d3b63
SHA1 0eb9fef97d1142c612032b454049a3f5e450daa2
SHA512 73c2a01030057abcbe390421cd52c49ec7a26e3467bdf1549e552af184b3835b5290108b919eeb9224b25d19b1ffec000b4750c662ce571f3839869c9433f011
SSDEEP 6144:u3AiItENQn59uFd5AtnxREf0YpYn+Qwef:iAiItENQn59edckf0YpYn+Qx
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup_install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC21C6F47\setup_install.exe
Size 57KB
SHA256 b75087a3eb54063c72b89d044209d83c8bd1e93e7cf875a33e245128375f28e8
MD5 8c61d800b90de8b6790c493afbfde912
SHA1 a0714e855a3793df194cd40a6a1b9e262f3b4f88
SHA512 7706e0f8dc47657ed0f78e99b80058d6ed233538227a26590c5336029db9059401d52931306d4e566039b4e90f8c4397a3494d8ec995567f09236478b7478251
SSDEEP 1536:uwwtKiItENQn59ElwZylmxF6a6K+VeArZa/Fk:u3tKiItENQn59ECZRv6a6d5A9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Abbassero.wmv

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Abbassero.wmv
Size 534B
SHA256 6cb806bec68db2c4f5aee59c4f604b502a4266f020cdf408e4dc543974b88036
MD5 697af31c63a3d02a3e39109027671e68
SHA1 8a7083bc918366b05f75e54853cc39a45cc0da7c
SHA512 12a0b4f4023e04afe7515da738a4574931ff1d7538e264c93eef6142675be6bf83cdd590bbdaa6f704da9a78addd6b111a0bf23542f5c11d65b213feeaf8a8b8
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\L
Size 139KB
SHA256 8354f2b122b7152e4bc4a6b5d96744ea1fe1c97841df0a060db4b470b9d61e45
MD5 dee5541134eef11dcdc622b8f91d59a2
SHA1 1fc80aff6d7878af552413d7f8590da504f658d4
SHA512 d79dad2a4f80e4954d98dcb9ef0ba3948c042661cb0e7aa505c6c821d9f740ea38c9417b5cf57c1c8f21d70f1e77104046224560c0d5be04a5ac7a181b5b4747
SSDEEP 3072:tmHj59KTCdy7Xa727Q7vi7k7r7w7Z7y7r1++uC5i+kvVb3YeJq3p15gOAjU6qtt:Md9KTMy7Xa727Q7vi7k7r7w7Z7y7LQ+x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Piu.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com
Size 174KB
SHA256 3b42641a567a81e914742694ea399fff9122d60c16b4046ac6f8ab5fb3c538e5
MD5 deee68b309e5dbaa5a08372f9275e6e0
SHA1 5a6d2f2450022df22a64fa8f5aa49a1b6657e2f6
SHA512 e579c9796746ada19f5946dc5158da63214ea2b9190864a423b9bd58452afb079b7c5b918616626c3a744bd2ee0fa157ca33b372ab27613b74085695bcb7423d
SSDEEP 3072:6CV26MqgQTc5F446iYNpK5SB7BJBzLZDKJtIs8d9:6i2VWTyFsJ8gNJBnGtI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Piu.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com
Size 128KB
SHA256 370ef8659eb19a5499c8d983e633527b52604a444650f6099e808cfe76e87fee
MD5 fb0c76292398b549166980949080541c
SHA1 7c2ae507761ab2a5ed260265a05b97e836007131
SHA512 383b8ab5127bbb892f37b6d5141c1b1f11890b68525751b9ad57ee73b342dbe8fb2195badc36f3d8eb295efc7723f3eeb870eb4f64360090e5086c788637db41
SSDEEP 1536:mPCV21YEsmnq7Cv/+/Coc5m+4Xf8O46895LmNpRGDox2S3hPt8gNpkU5uG3xYwBw:6CV26MqgQTc5F446iYNpK5SB7BJBzLw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Piu.exe.com

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com
Size 1KB
SHA256 68fc0644768735a25d613567caf8fec9f3d0d35f40a3c01e7179e31b795c85b6
MD5 d6541057c5ac3dd9385fadb3c4fbd8c4
SHA1 d8dd2dc70cbf5ca86a7a9a15549b06414b8898d5
SHA512 302b1320982b0de70b20a82c28848f4cbffc02191b60fa7cd19d1f7b567a94acc4fce7335b4476641a7cbbb38763f4e99a986afeecac65b17ed11aac629044fc
MD5 SHA1 SHA512

Submit Download

Rinnovella.wmv

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rinnovella.wmv
Size 128KB
SHA256 c0f4d7f0332b786de714512ec8013dc72826c623bd49fcac946edeefb4e120f8
MD5 ea9ca65bb3c79fd1ba5a7dbf9235d303
SHA1 ef0cfa6a08e37f8792a9d0cf4b61b513d3e8ae89
SHA512 967dc3f2a0a46654d3f2d906e6c579e2e13e9a6efd72b0d45cd1347f91ab3bc2b469dfcc31fd951acd74023adae93f9c3827ab4d14367bc73d1c1f44c65e1f51
SSDEEP 3072:CGWzOpUyMuravJLrTzSrP6PdKwmqFX9rJd4z04f8qK4kyVy:7WzyUynr0auddZFXCwCy4kyVy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rugiada.wmv

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rugiada.wmv
Size 48KB
SHA256 098da3ed631cb1fec06d3215ab5137d4277b3133044fdd80e70c30316478800b
MD5 8cd205dcaf5f981811ae96a4f255cee0
SHA1 eff1c1295ba9148049d3fa38b85667143abcac4f
SHA512 8b9c3ade6636ffb40b84a8c37c87f6a179d6096b072c4513f6b76af1cafdc08380f3ed8f770e3eefd50dbe32204210791a15fca27778d65981473b81247a2ed1
SSDEEP 768:fcH7ACViIeTxYEhqHGnqA1sojvqt0hDthFb0GuCsuYCV5mhzw4NKCFOsQW+BfmB:fPCV21YEsmnq7Cv/+/Coc5m+4Xf8OB
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_qmn1uinq.uzy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qmn1uinq.uzy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/792-82-0x0000000000490000-0x0000000000498000-memory.dmp

Download

memory/792-104-0x000000001B0D0000-0x000000001B0E0000-memory.dmp

Download

memory/792-84-0x00007FFFD7760000-0x00007FFFD8221000-memory.dmp

Download

memory/1380-57-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1380-64-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1380-63-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1380-133-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1380-132-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/1380-137-0x000000006EB40000-0x000000006EB63000-memory.dmp

Download

memory/1380-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1380-62-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1380-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1380-134-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1380-60-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1380-59-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1380-56-0x0000000000F00000-0x0000000000F8F000-memory.dmp

Download

memory/1380-55-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1380-54-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1380-65-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1380-61-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1380-58-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1380-52-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1984-118-0x0000000000400000-0x00000000023B0000-memory.dmp

Download

memory/1984-198-0x0000000000400000-0x00000000023B0000-memory.dmp

Download

memory/1984-106-0x00000000024E0000-0x00000000025E0000-memory.dmp

Download

memory/1984-124-0x00000000024D0000-0x00000000024D9000-memory.dmp

Download

memory/3100-208-0x0000000005F30000-0x0000000005FD3000-memory.dmp

Download

memory/3100-213-0x0000000005F30000-0x0000000005FD3000-memory.dmp

Download

memory/3100-212-0x0000000005F30000-0x0000000005FD3000-memory.dmp

Download

memory/3100-211-0x0000000005F30000-0x0000000005FD3000-memory.dmp

Download

memory/3100-210-0x0000000005F30000-0x0000000005FD3000-memory.dmp

Download

memory/3100-207-0x0000000003710000-0x0000000003711000-memory.dmp

Download

memory/3100-209-0x0000000005F30000-0x0000000005FD3000-memory.dmp

Download

memory/3212-205-0x00000000047D0000-0x00000000047FF000-memory.dmp

Download

memory/3212-146-0x0000000004C80000-0x0000000004CA2000-memory.dmp

Download

memory/3212-153-0x0000000007470000-0x0000000007480000-memory.dmp

Download

memory/3212-169-0x0000000007320000-0x0000000007332000-memory.dmp

Download

memory/3212-171-0x0000000007340000-0x000000000737C000-memory.dmp

Download

memory/3212-147-0x0000000007480000-0x0000000007A24000-memory.dmp

Download

memory/3212-152-0x0000000004D10000-0x0000000004D30000-memory.dmp

Download

memory/3212-148-0x0000000000400000-0x0000000002CCD000-memory.dmp

Download

memory/3212-204-0x0000000002DC0000-0x0000000002EC0000-memory.dmp

Download

memory/3212-180-0x0000000007AF0000-0x0000000007BFA000-memory.dmp

Download

memory/3212-203-0x0000000000400000-0x0000000002CCD000-memory.dmp

Download

memory/3212-206-0x0000000007470000-0x0000000007480000-memory.dmp

Download

memory/3212-217-0x0000000007470000-0x0000000007480000-memory.dmp

Download

memory/3212-141-0x0000000002DC0000-0x0000000002EC0000-memory.dmp

Download

memory/3212-168-0x0000000073500000-0x0000000073CB0000-memory.dmp

Download

memory/3212-167-0x0000000008050000-0x0000000008668000-memory.dmp

Download

memory/3212-142-0x00000000047D0000-0x00000000047FF000-memory.dmp

Download

memory/3212-164-0x0000000007470000-0x0000000007480000-memory.dmp

Download

memory/3212-151-0x0000000007470000-0x0000000007480000-memory.dmp

Download

memory/3512-195-0x00000000024A0000-0x00000000024B6000-memory.dmp

Download

memory/4364-123-0x0000000000400000-0x0000000002404000-memory.dmp

Download

memory/4364-120-0x00000000040A0000-0x000000000413D000-memory.dmp

Download

memory/4364-125-0x0000000002600000-0x0000000002700000-memory.dmp

Download

memory/4592-190-0x0000000007770000-0x000000000778A000-memory.dmp

Download

memory/4592-100-0x0000000073500000-0x0000000073CB0000-memory.dmp

Download

memory/4592-189-0x0000000007680000-0x0000000007694000-memory.dmp

Download

memory/4592-191-0x0000000007760000-0x0000000007768000-memory.dmp

Download

memory/4592-194-0x0000000073500000-0x0000000073CB0000-memory.dmp

Download

memory/4592-188-0x0000000007670000-0x000000000767E000-memory.dmp

Download

memory/4592-165-0x000000007FAF0000-0x000000007FB00000-memory.dmp

Download

memory/4592-122-0x0000000005CF0000-0x0000000006044000-memory.dmp

Download

memory/4592-121-0x0000000005C80000-0x0000000005CE6000-memory.dmp

Download

memory/4592-187-0x0000000007640000-0x0000000007651000-memory.dmp

Download

memory/4592-108-0x0000000005240000-0x0000000005262000-memory.dmp

Download

memory/4592-177-0x0000000007440000-0x000000000745A000-memory.dmp

Download

memory/4592-105-0x0000000004C70000-0x0000000004C80000-memory.dmp

Download

memory/4592-102-0x0000000004C70000-0x0000000004C80000-memory.dmp

Download

memory/4592-99-0x0000000004B70000-0x0000000004BA6000-memory.dmp

Download

memory/4592-150-0x000000006EFB0000-0x000000006EFFC000-memory.dmp

Download

memory/4592-103-0x00000000052B0000-0x00000000058D8000-memory.dmp

Download

memory/4592-183-0x00000000076B0000-0x0000000007746000-memory.dmp

Download

memory/4592-181-0x00000000074C0000-0x00000000074CA000-memory.dmp

Download

memory/4592-131-0x00000000061B0000-0x00000000061FC000-memory.dmp

Download

memory/4592-172-0x0000000007A80000-0x00000000080FA000-memory.dmp

Download

memory/4592-166-0x00000000070E0000-0x0000000007183000-memory.dmp

Download

memory/4592-163-0x0000000007060000-0x000000000707E000-memory.dmp

Download

memory/4592-149-0x00000000070A0000-0x00000000070D2000-memory.dmp

Download

memory/4592-129-0x0000000006110000-0x000000000612E000-memory.dmp

Download

memory/4592-119-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Download

memory/5108-176-0x00007FFFD7760000-0x00007FFFD8221000-memory.dmp

Download

memory/5108-98-0x00007FFFD7760000-0x00007FFFD8221000-memory.dmp

Download

memory/5108-101-0x00000000016F0000-0x0000000001712000-memory.dmp

Download

memory/5108-85-0x0000000000F20000-0x0000000000F4C000-memory.dmp

Download