Overview

overview

10

Static

static

3

4363463463...63.exe

windows7-x64

10

4363463463...63.exe

windows10-1703-x64

10

4363463463...63.exe

windows10-2004-x64

10

4363463463...63.exe

windows11-21h2-x64

10

Resubmissions

29/01/2024, 12:18

240129-pg3mqsbaap10

21/01/2024, 16:07

240121-tkz38sefc210

Analysis

  • max time kernel
    257s
  • max time network
    301s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29/01/2024, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4363463463464363463463463.exe
  • Size 10KB
  • Sample240129-pg3mqsbaap
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyasyncratdjvulummaredlinerhadamanthyssectopratvidarxworm1b9d7ec5a25ab9d78c31777a0016a097@rlreborn cloud (tg: @fatherofcarders)defaultexodusbootkitcollectiondiscoveryevasioninfostealerpersistenceransomwareratspywarestealertrojanvmprotect

Malware Config

Extracted

Family

  • redline

Botnet

  • @RLREBORN Cloud (TG: @FATHEROFCARDERS)

C2

  • 141.95.211.148:46011

Extracted

Family

  • redline

Botnet

  • Exodus

C2

  • 93.123.39.68:1334

Extracted

Family

  • asyncrat

Version

  • Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

  • Default

C2

  • 93.123.39.68:4449

Mutex

  • kszghixltbdczq

Attributes
  • delay

    1

  • install

    true

  • install_file

    chromeupdate.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • djvu

C2

  • http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdcc

  • offline_id

    LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

  • xworm

C2

  • 91.92.249.37:9049

Mutex

  • aMtkXNimPlkESDx9

aes.plain

Extracted

Family

  • vidar

Version

  • 7.6

Botnet

  • 1b9d7ec5a25ab9d78c31777a0016a097

C2

  • https://t.me/tvrugrats

  • https://steamcommunity.com/profiles/76561199627279110

Attributes
  • profile_id_v2

    1b9d7ec5a25ab9d78c31777a0016a097

Extracted

Family

  • amadey

Version

  • 3.85

C2

  • http://45.9.74.141

  • http://45.9.74.166

Attributes
  • install_dir

    c2868ed41c

  • install_file

    bstyoops.exe

  • strings_key

    8709db734eb892ca90360229fc73d3ae

  • url_paths

    /b7djSDcPcZ/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://gearboomchocolateowfs.site/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Detect Vidar Stealer 3 IoCs
    stealer
  • Detect Xworm Payload 2 IoCs
  • Detected Djvu ransomware 13 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Async RAT payload 1 IoCs
    rat
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 62 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • VMProtect packed file 9 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of SetThreadContext 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • c:\windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2504
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
          PID:4632
      • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
        "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:32
        • C:\Users\Admin\AppData\Local\Temp\Files\rdxx1.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\rdxx1.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2436
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1788
        • C:\Users\Admin\AppData\Local\Temp\Files\up.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\up.exe"
          2⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2412
        • C:\Users\Admin\AppData\Local\Temp\Files\KarLocker_exe.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\KarLocker_exe.exe"
          2⤵
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Sets desktop wallpaper using registry
          • Modifies Control Panel
          • Suspicious behavior: EnumeratesProcesses
          PID:4792
        • C:\Users\Admin\AppData\Local\Temp\Files\build.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\build.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5564
          • C:\Users\Admin\AppData\Local\Temp\adasda.exe
            "C:\Users\Admin\AppData\Local\Temp\adasda.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3108
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBB41.tmp.bat""
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5308
              • C:\Windows\system32\timeout.exe
                timeout 3
                5⤵
                • Delays execution with timeout.exe
                PID:5412
              • C:\Users\Admin\AppData\Roaming\chromeupdate.exe
                "C:\Users\Admin\AppData\Roaming\chromeupdate.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:5532
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"' & exit
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5280
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"'
                5⤵
                • Creates scheduled task(s)
                PID:5396
        • C:\Users\Admin\AppData\Local\Temp\Files\VLTKTanthuTN.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\VLTKTanthuTN.exe"
          2⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:988
        • C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:64
          • C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:5656
            • C:\Windows\SysWOW64\icacls.exe
              icacls "C:\Users\Admin\AppData\Local\55758f16-6f62-4763-b1c4-03b84cdabc6d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
              4⤵
              • Modifies file permissions
              PID:5996
            • C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe" --Admin IsNotAutoStart IsNotTask
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:2000
        • C:\Users\Admin\AppData\Local\Temp\Files\aoiido.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\aoiido.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:5832
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:4648
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1148
                4⤵
                • Program crash
                PID:4256
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
                PID:5968
            • C:\Users\Admin\AppData\Local\Temp\Files\first.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\first.exe"
              2⤵
              • Drops startup file
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of AdjustPrivilegeToken
              PID:5984
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'first.exe'
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:5812
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\first.exe'
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:8
            • C:\Users\Admin\AppData\Local\Temp\Files\rty45.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\rty45.exe"
              2⤵
              • Executes dropped EXE
              PID:4824
            • C:\Users\Admin\AppData\Local\Temp\Files\a3e34cb.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\a3e34cb.exe"
              2⤵
              • Executes dropped EXE
              PID:1048
              • C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
                "C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe"
                3⤵
                • Executes dropped EXE
                PID:4084
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "bstyoops.exe" /P "Admin:N"&&CACLS "bstyoops.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c2868ed41c" /P "Admin:N"&&CACLS "..\c2868ed41c" /P "Admin:R" /E&&Exit
                  4⤵
                    PID:800
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\c2868ed41c" /P "Admin:R" /E
                      5⤵
                        PID:4520
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\c2868ed41c" /P "Admin:N"
                        5⤵
                          PID:3608
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                          5⤵
                            PID:2388
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "bstyoops.exe" /P "Admin:R" /E
                            5⤵
                              PID:1724
                            • C:\Windows\SysWOW64\cacls.exe
                              CACLS "bstyoops.exe" /P "Admin:N"
                              5⤵
                                PID:200
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                5⤵
                                  PID:4756
                              • C:\Windows\SysWOW64\schtasks.exe
                                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F
                                4⤵
                                • Creates scheduled task(s)
                                PID:4588
                          • C:\Users\Admin\AppData\Local\Temp\Files\rty37.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\rty37.exe"
                            2⤵
                            • Executes dropped EXE
                            PID:5608
                          • C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe"
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:5516
                            • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                              C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1208
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                                4⤵
                                  PID:2376
                                  • C:\Windows\SysWOW64\chcp.com
                                    chcp 1251
                                    5⤵
                                      PID:5888
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                                      5⤵
                                      • Creates scheduled task(s)
                                      PID:6008
                                • C:\Users\Admin\AppData\Local\Temp\nsx64D.tmp
                                  C:\Users\Admin\AppData\Local\Temp\nsx64D.tmp
                                  3⤵
                                  • Executes dropped EXE
                                  • Checks processor information in registry
                                  PID:5716
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsx64D.tmp" & del "C:\ProgramData\*.dll"" & exit
                                    4⤵
                                      PID:924
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 5
                                        5⤵
                                        • Delays execution with timeout.exe
                                        PID:4592
                                • C:\Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:6032
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                    3⤵
                                      PID:5264
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                      3⤵
                                        PID:3228
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                        3⤵
                                        • Creates scheduled task(s)
                                        PID:5852
                                      • C:\Windows\System\svchost.exe
                                        "C:\Windows\System\svchost.exe" formal
                                        3⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:532
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                          4⤵
                                            PID:4332
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                            4⤵
                                              PID:5632
                                        • C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5020
                                          • C:\Users\Admin\AppData\Local\Temp\BLduscfibj.exe
                                            "C:\Users\Admin\AppData\Local\Temp\BLduscfibj.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:5728
                                            • C:\Users\Admin\AppData\Local\Temp\BLduscfibj.exe
                                              C:\Users\Admin\AppData\Local\Temp\BLduscfibj.exe
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:528
                                          • C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
                                            C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
                                            3⤵
                                            • Executes dropped EXE
                                            PID:1796
                                          • C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
                                            C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
                                            3⤵
                                            • Executes dropped EXE
                                            PID:5752
                                          • C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
                                            C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
                                            3⤵
                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                            • Executes dropped EXE
                                            PID:5556
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 516
                                              4⤵
                                              • Program crash
                                              PID:64
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 536
                                              4⤵
                                              • Program crash
                                              PID:6012
                                        • C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:5764
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            3⤵
                                              PID:5632
                                          • C:\Users\Admin\AppData\Local\Temp\Files\miner.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Files\miner.exe"
                                            2⤵
                                            • UAC bypass
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • System policy modification
                                            PID:6008
                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\miner.exe'; Add-MpPreference -ExclusionProcess 'miner'; Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
                                              3⤵
                                                PID:3864
                                              • C:\Users\Admin\AppData\Local\Temp\4cb9bd85-d4ed-437e-8b95-23c9ba13cc80.exe
                                                "C:\Users\Admin\AppData\Local\Temp\4cb9bd85-d4ed-437e-8b95-23c9ba13cc80.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                PID:5296
                                            • C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:5860
                                              • C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                PID:424
                                            • C:\Users\Admin\AppData\Local\Temp\Files\btcgood.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Files\btcgood.exe"
                                              2⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Accesses Microsoft Outlook profiles
                                              • outlook_office_path
                                              • outlook_win_path
                                              PID:4588
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\btcgood.exe"
                                                3⤵
                                                  PID:1528
                                                  • C:\Windows\system32\PING.EXE
                                                    ping 1.1.1.1 -n 1 -w 3000
                                                    4⤵
                                                    • Runs ping.exe
                                                    PID:6116
                                              • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:4784
                                              • C:\Users\Admin\AppData\Local\Temp\Files\univ.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\univ.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:3260
                                              • C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\WatchDog.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:5016
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 1400
                                                  3⤵
                                                  • Program crash
                                                  PID:5416
                                              • C:\Users\Admin\AppData\Local\Temp\Files\build3.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\build3.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:4192
                                                • C:\Users\Admin\AppData\Local\Temp\Files\build3.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Files\build3.exe"
                                                  3⤵
                                                    PID:5956
                                                • C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  PID:5996
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 724
                                                    3⤵
                                                    • Program crash
                                                    PID:3076
                                                • C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Files\dsdasda.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:6136
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    3⤵
                                                      PID:4548
                                                  • C:\Users\Admin\AppData\Local\Temp\Files\fortnite2.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Files\fortnite2.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:2556
                                                  • C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:2760
                                                  • C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:3032
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      3⤵
                                                        PID:5408
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 1136
                                                        3⤵
                                                        • Program crash
                                                        PID:3764
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\Otte-Locker.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\Otte-Locker.exe"
                                                      2⤵
                                                      • Modifies WinLogon for persistence
                                                      • Executes dropped EXE
                                                      • Drops desktop.ini file(s)
                                                      • Sets desktop wallpaper using registry
                                                      PID:4976
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\networa.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\networa.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      PID:700
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:928
                                                      • C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Files\f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae.exe"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Checks SCSI registry key(s)
                                                        • Suspicious behavior: MapViewOfSection
                                                        PID:4428
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 496
                                                          4⤵
                                                          • Program crash
                                                          PID:2788
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:5112
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\Files\TrumTrum.exe
                                                        3⤵
                                                          PID:3148
                                                          • C:\Windows\system32\choice.exe
                                                            choice /C Y /N /D Y /T 0
                                                            4⤵
                                                              PID:1116
                                                      • C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe" --Admin IsNotAutoStart IsNotTask
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:3760
                                                        • C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build2.exe
                                                          "C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build2.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          PID:4676
                                                          • C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build2.exe
                                                            "C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build2.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:2328
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 2064
                                                              4⤵
                                                              • Program crash
                                                              PID:5420
                                                        • C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build3.exe
                                                          "C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build3.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          PID:5288
                                                          • C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build3.exe
                                                            "C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build3.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:5840
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                              4⤵
                                                              • Creates scheduled task(s)
                                                              PID:5948
                                                      • C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
                                                        C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:2460
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:3248
                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:3544
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                            3⤵
                                                            • Creates scheduled task(s)
                                                            PID:5244
                                                      • C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
                                                        C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:5808
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:428
                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:5580
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABTAHQAcgBpAG4AZwBJAGQAcwAuAGUAeABlADsA
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3120
                                                      • C:\Users\Admin\AppData\Local\Detail\gkxvbr\StringIds.exe
                                                        C:\Users\Admin\AppData\Local\Detail\gkxvbr\StringIds.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:5376
                                                        • C:\Users\Admin\AppData\Local\Detail\gkxvbr\StringIds.exe
                                                          C:\Users\Admin\AppData\Local\Detail\gkxvbr\StringIds.exe
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:1068
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                            3⤵
                                                              PID:2280
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                4⤵
                                                                  PID:3236
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                                3⤵
                                                                  PID:3080
                                                            • C:\Windows\system32\AUDIODG.EXE
                                                              C:\Windows\system32\AUDIODG.EXE 0x3f8
                                                              1⤵
                                                                PID:4880
                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                PID:1120
                                                              • C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
                                                                C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                PID:5380
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABTAHQAcgBpAG4AZwBJAGQAcwAuAGUAeABlADsA
                                                                1⤵
                                                                  PID:6108

                                                                Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Reconnaissance

                                                                      Resource Development

                                                                      Initial Access

                                                                      Execution

                                                                      Scheduled Task/Job

                                                                      1
                                                                      T1053

                                                                      Persistence

                                                                      Boot or Logon Autostart Execution

                                                                      2
                                                                      T1547

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Winlogon Helper DLL

                                                                      1
                                                                      T1547.004

                                                                      Pre-OS Boot

                                                                      1
                                                                      T1542

                                                                      Bootkit

                                                                      1
                                                                      T1542.003

                                                                      Scheduled Task/Job

                                                                      1
                                                                      T1053

                                                                      Privilege Escalation

                                                                      Abuse Elevation Control Mechanism

                                                                      1
                                                                      T1548

                                                                      Bypass User Account Control

                                                                      1
                                                                      T1548.002

                                                                      Boot or Logon Autostart Execution

                                                                      2
                                                                      T1547

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Winlogon Helper DLL

                                                                      1
                                                                      T1547.004

                                                                      Scheduled Task/Job

                                                                      1
                                                                      T1053

                                                                      Defense Evasion

                                                                      Abuse Elevation Control Mechanism

                                                                      1
                                                                      T1548

                                                                      Bypass User Account Control

                                                                      1
                                                                      T1548.002

                                                                      File and Directory Permissions Modification

                                                                      1
                                                                      T1222

                                                                      Impair Defenses

                                                                      1
                                                                      T1562

                                                                      Disable or Modify Tools

                                                                      1
                                                                      T1562.001

                                                                      Modify Registry

                                                                      6
                                                                      T1112

                                                                      Pre-OS Boot

                                                                      1
                                                                      T1542

                                                                      Bootkit

                                                                      1
                                                                      T1542.003

                                                                      Credential Access

                                                                      Unsecured Credentials

                                                                      3
                                                                      T1552

                                                                      Credentials In Files

                                                                      3
                                                                      T1552.001

                                                                      Discovery

                                                                      Peripheral Device Discovery

                                                                      2
                                                                      T1120

                                                                      Query Registry

                                                                      6
                                                                      T1012

                                                                      Remote System Discovery

                                                                      1
                                                                      T1018

                                                                      System Information Discovery

                                                                      6
                                                                      T1082

                                                                      Lateral Movement

                                                                      Collection

                                                                      Data from Local System

                                                                      3
                                                                      T1005

                                                                      Email Collection

                                                                      1
                                                                      T1114

                                                                      Command and Control

                                                                      Web Service

                                                                      1
                                                                      T1102

                                                                      Exfiltration

                                                                      Impact

                                                                      Defacement

                                                                      1
                                                                      T1491

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      103621DE9CD5414CC2538780B4B75751
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                                                                      • Size 717B
                                                                      • SHA256 c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                      • Size 1KB
                                                                      • SHA256 cad2972ff89f0c5f4191632bb97e5d8e8adf02db81e7b30288bbf1a51aae8961
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      9E40F4660010397EE9DB08855BE67C64
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E40F4660010397EE9DB08855BE67C64
                                                                      • Size 503B
                                                                      • SHA256 e167df1a2db12f5d2b0e6ebad2c2d484822a8dee426e2a0239ce83442f1b5d67
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                                                                      • Size 724B
                                                                      • SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      103621DE9CD5414CC2538780B4B75751
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                                                                      • Size 192B
                                                                      • SHA256 95a9bbfb3b74c1b694b4b491ad592763b9c0d5ef161f096c762089f2322257b0
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                                      • Size 410B
                                                                      • SHA256 2d4900b63a33acebe87e3c40f04d3602f417a4432f898f11d81d65dd0c3bbe3d
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      9E40F4660010397EE9DB08855BE67C64
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E40F4660010397EE9DB08855BE67C64
                                                                      • Size 548B
                                                                      • SHA256 ef024601cc59b4fec757e6c626b79bc3f7017b42fc605ac936a641cc08ffef56
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                                                                      • Size 392B
                                                                      • SHA256 ab9ab2084c7e14927e90d2abe8ccaff88c77d005082a7f0c245018874cb051d3
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      build2.exe
                                                                      • Path C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build2.exe
                                                                      • Size 250KB
                                                                      • SHA256 ae3a2042d10308347970f9c7d9da075d964cbee2df5a52321adcc8013c6e196e
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      build2.exe
                                                                      • Path C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build2.exe
                                                                      • Size 71KB
                                                                      • SHA256 e2b8f39c6cf9236266f2fc9d713068b1c254b1a885c1a092da3ad7de3a3f91d7
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      build2.exe
                                                                      • Path C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build2.exe
                                                                      • Size 212KB
                                                                      • SHA256 f784193b3854267d4f9166341fff05214f7392779116f39344b0aa451a6fad26
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      build3.exe
                                                                      • Path C:\Users\Admin\AppData\Local\552bd6dd-d75d-4424-bf43-99655cc4dd15\build3.exe
                                                                      • Size 299KB
                                                                      • SHA256 fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      buildz.exe
                                                                      • Path C:\Users\Admin\AppData\Local\55758f16-6f62-4763-b1c4-03b84cdabc6d\buildz.exe
                                                                      • Size 269KB
                                                                      • SHA256 d85da0cbd23bb99269f79584b000cb011660b810bb5ce2c1f83c9cc2a9e38b9a
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      powershell.exe.log
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                      • Size 3KB
                                                                      • SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      InstallUtil.exe.log
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log
                                                                      • Size 1KB
                                                                      • SHA256 85774d8a9602cdd6dd90cf987551e9cc49a4d46610f071b8386706155dcaf079
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      StartupProfileData-NonInteractive
                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                      • Size 1KB
                                                                      • SHA256 a773a65f2ba94b723ce63e7c042b8a6afa6f7ac50de716550d61239e9284da7e
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      136442398.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\136442398.exe
                                                                      • Size 564B
                                                                      • SHA256 3c8cc37a98346bd0123b35e5ccd87bd07d69914dae04f8b49f61c150d96e9d1f
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      InstallSetup2.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup2.exe
                                                                      • Size 2.0MB
                                                                      • SHA256 fd3e41d4a4df236d5e99426b5ce4ecefd8b0a3ec43a33d5720daa3f74683fc4b
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      KarLocker_exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\KarLocker_exe.exe
                                                                      • Size 26KB
                                                                      • SHA256 6cb44095426be64819014dd2ecf4527908244573d959081ded911cf5004a30b0
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      KarLocker_exe.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\KarLocker_exe.exe
                                                                      • Size 35KB
                                                                      • SHA256 e2f96d35a5052abef9991c59d38ddff4b75339266521d5ac7d561ea013eeef3c
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      VLTKTanthuTN.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\VLTKTanthuTN.exe
                                                                      • Size 378KB
                                                                      • SHA256 bb46c0d742ca3951bfc055ea56e1c59fb83406cfbb65754e2608712df72d482c
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      VLTKTanthuTN.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\VLTKTanthuTN.exe
                                                                      • Size 331KB
                                                                      • SHA256 6002b48385fd6907c04bc206850ce0f23c782c87a14bbd14873a3233ab2694fc
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      a3e34cb.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\a3e34cb.exe
                                                                      • Size 466KB
                                                                      • SHA256 858e1293c2d3f2276a229ba0350d0c7dbc9eb0d818e39196bafd60ac5a532a0b
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      a3e34cb.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\a3e34cb.exe
                                                                      • Size 606KB
                                                                      • SHA256 49dbeefda9954d0584c02dc837a2c5d2433a64d5dd8a8be8019209da01cd43e1
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      aoiido.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\aoiido.exe
                                                                      • Size 102KB
                                                                      • SHA256 d1905585a37030decac5405b60e674510a9b993ef9796cd38e807c012bd380d5
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      aoiido.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\aoiido.exe
                                                                      • Size 142KB
                                                                      • SHA256 9679ad06592ac96b1581919636c4ad37738069a710479cccf03b1e3aab3dba4c
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      build.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\build.exe
                                                                      • Size 95KB
                                                                      • SHA256 79d7b0f170471f44ed6c07ddb4c4c9bb20c97235aef23ac052e692cb558a156d
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      buildz.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe
                                                                      • Size 231KB
                                                                      • SHA256 adaff9382e35b733835ad88f6401445a6424a0c83e530e6fd56fb110247975db
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      buildz.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe
                                                                      • Size 310KB
                                                                      • SHA256 1d1e20161a73cf0a6ef44db2ea1dff63b59682551e3e57884e1d9b4d8c562a1b
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      buildz.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe
                                                                      • Size 442KB
                                                                      • SHA256 544a8137bc91d99ea2bd954b3bd95e4977a2c0baa6fb9e5f9edb40568d7864b8
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      buildz.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe
                                                                      • Size 243KB
                                                                      • SHA256 94602817d055a3ed52d287e0a4d09b3e1f040cedba574f4a85769058b72ce486
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      buildz.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\buildz.exe
                                                                      • Size 402KB
                                                                      • SHA256 2d267f697ed2a0b9cacd539d92b9cffa871d6a02c0e6c93c3f7e4c1cfd40ca1a
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      first.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\first.exe
                                                                      • Size 66KB
                                                                      • SHA256 12aa47db9b5a1c6fddc382e09046d0f48fbdce4b0736b1d5cfcf6f1018fdd621
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      rdxx1.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\rdxx1.exe
                                                                      • Size 471KB
                                                                      • SHA256 64a21d074850a4e8dd28a846e8f9e5d72d5549dc68d9ded2e9bff99f730f4d80
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      rty37.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\rty37.exe
                                                                      • Size 320KB
                                                                      • SHA256 bcdf45549969aa03cc13d69af9ba1bf39c650b06bf504d454000625339ef9ace
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      rty37.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\rty37.exe
                                                                      • Size 189KB
                                                                      • SHA256 22ec203e47b56e83c06f0324743df03d0dbe4be755044daae9e4a7924b5b3059
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      rty37.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\rty37.exe
                                                                      • Size 715KB
                                                                      • SHA256 ffcc8e8a8b9fe0c6baf266253296bc0b99f0658035fd05fdef2e3c0fe5e31946
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      rty45.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\rty45.exe
                                                                      • Size 715KB
                                                                      • SHA256 d9cba8aea678e19b497b36f3d5f9869dbd042e45759039444581a5234c59ee7f
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      up.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\up.exe
                                                                      • Size 227KB
                                                                      • SHA256 f8de6275031cf692a0a7f03609bbcc6d4ed4542ee5d09267acb5e918ba63ca54
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      up.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Files\up.exe
                                                                      • Size 287KB
                                                                      • SHA256 d7443fd5de14b045f15564e2805d6f27d35292c7cd7c3caed9eeae62dfac8fdc
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      __PSScriptPolicyTest_qo4wnlgj.x2h.ps1
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qo4wnlgj.x2h.ps1
                                                                      • Size 1B
                                                                      • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      adasda.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\adasda.exe
                                                                      • Size 73KB
                                                                      • SHA256 4b02692bf468a164e333bbfc961c5974d0a95009a72ea8bff2e9cb677eae4f56
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      aut9337.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\aut9337.tmp
                                                                      • Size 9KB
                                                                      • SHA256 fc8c9890163e02c62f0b77026359569947690509807966747b22d3b0dcd75ce5
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      bstyoops.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
                                                                      • Size 174KB
                                                                      • SHA256 4c1603058385e2be98ddbae5d5f6a1ed347ff7fbaf264b89b5039217543e6461
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      bstyoops.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
                                                                      • Size 225KB
                                                                      • SHA256 c64b306ecc4db445d6cc3f249a9a611cde2d6535213ee818014d7f5170b62f73
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      bstyoops.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
                                                                      • Size 249KB
                                                                      • SHA256 e678b4bba9f3d1f88cc060a8bb1c06f03057dbf01fbe231038b73b74d5b7cd17
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      bstyoops.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe
                                                                      • Size 296KB
                                                                      • SHA256 aa3d1313160645f7bfdf4026ff6003f1f946ee968c2e709a95609b1364fd0547
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      ketix.ini
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ketix.ini
                                                                      • Size 6KB
                                                                      • SHA256 4fef04e01d00862f6ccab97aca296cc0a4d6bd91e8553d0dc1b42570e86f2dae
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      INetC.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\nsg37D.tmp\INetC.dll
                                                                      • Size 25KB
                                                                      • SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      tmpA672.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpA672.tmp
                                                                      • Size 46KB
                                                                      • SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      tmpA688.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpA688.tmp
                                                                      • Size 92KB
                                                                      • SHA256 110b310d47a1abf69a5650e22e8c384c79055393277f06f62070a4c13efd3956
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      tmpA6B3.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpA6B3.tmp
                                                                      • Size 96KB
                                                                      • SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      tmpBB41.tmp.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpBB41.tmp.bat
                                                                      • Size 156B
                                                                      • SHA256 6a0aa5c9d9a4b4b34d5ebb643c3b54766adfce485a7d1133ca16132bc5ab8451
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      x.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\x.exe
                                                                      • Size 207KB
                                                                      • SHA256 25f692ab50320f852057e67d6043cee23b503fefe7aa0e06714fa00eed6f773f
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      mstsca.exe
                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                      • Size 245KB
                                                                      • SHA256 809f6f2586003a8b922c4c61a1281a7bad6b73477875c35e31202afdb6286180
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      mstsca.exe
                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                      • Size 268KB
                                                                      • SHA256 fcec29bb4c04826760d3670cb19bee20aa8f276166adbd3681453f0613d35b40
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      mstsca.exe
                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                      • Size 12KB
                                                                      • SHA256 b5f2611b70c79bc4c7e12427a925e29d3d532825adac587a4229bbf575cf0c96
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      first.exe
                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\first.exe
                                                                      • Size 43KB
                                                                      • SHA256 f27e57ca70a106189ae14946d0778b9c8f5939f2cf02e8cc30290d963cc553c9
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      DataLogs.conf
                                                                      • Path C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
                                                                      • Size 8B
                                                                      • SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      cached-microdesc-consensus.tmp
                                                                      • Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
                                                                      • Size 2.4MB
                                                                      • SHA256 891b9a9964dae2c67d1ebf5d80a6654f81e255cc5bc1801dd6d9d283271be7ee
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      cached-microdescs.new
                                                                      • Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                                                      • Size 1.8MB
                                                                      • SHA256 da497a4c56ee27a590fc3406f1baa37993c2f2ecc769a1d6fdd103a7845010fe
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      ubcwceu
                                                                      • Path C:\Users\Admin\AppData\Roaming\ubcwceu
                                                                      • Size 187KB
                                                                      • SHA256 f4438ed05971a15d70c9683dc9e1a55c583ea8c61039e9e85eb391ca6e3fa0ae
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Lock.ClearCheckpoint.doc
                                                                      • Path C:\Users\Admin\Desktop\Lock.ClearCheckpoint.doc
                                                                      • Size 333KB
                                                                      • SHA256 e07a2d691970798d08db538710d8b03f7061a4a3c090983a3012696762d99027
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Lock.ConvertOut.docm
                                                                      • Path C:\Users\Admin\Desktop\Lock.ConvertOut.docm
                                                                      • Size 533KB
                                                                      • SHA256 b11ffc36e6d79d84d547fb38d42fb537f95aebb38d6401fa6fa19e242b37fe83
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Lock.SearchConvertTo.docx
                                                                      • Path C:\Users\Admin\Desktop\Lock.SearchConvertTo.docx
                                                                      • Size 399KB
                                                                      • SHA256 1a72b812bf8f7716d8149dd0b05c8e877a27317e69234dba9c6e7b9f418d536c
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Lock.Are.docx
                                                                      • Path C:\Users\Admin\Documents\Lock.Are.docx
                                                                      • Size 11KB
                                                                      • SHA256 ce28015b2b93deed2c7569c325e811aa9a0eef29070ae6f73e59dbdee7009fc8
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Lock.Files.docx
                                                                      • Path C:\Users\Admin\Documents\Lock.Files.docx
                                                                      • Size 11KB
                                                                      • SHA256 c71f3c90632452155fb7d95b54a56729160b0df0844121a5202b312d53a38040
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Lock.Opened.docx
                                                                      • Path C:\Users\Admin\Documents\Lock.Opened.docx
                                                                      • Size 11KB
                                                                      • SHA256 e0f3477b50b056bd140187350c589d1b74f3227fb5cb7458d3cacb96f179ece8
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Lock.Recently.docx
                                                                      • Path C:\Users\Admin\Documents\Lock.Recently.docx
                                                                      • Size 11KB
                                                                      • SHA256 a32731f9f73e4edac02c27369e59b8f80098b4045fcb4e9ebec20d1491faf01a
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Lock.These.docx
                                                                      • Path C:\Users\Admin\Documents\Lock.These.docx
                                                                      • Size 11KB
                                                                      • SHA256 8946767f36f5d439bb18c8a0e23b4c7dc401a6605cbc6bd0f6a0cc16e050a1f6
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      svchost.exe
                                                                      • Path C:\Windows\System\svchost.exe
                                                                      • Size 5.3MB
                                                                      • SHA256 1a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      memory/32-3-0x00000000057B0000-0x00000000057C0000-memory.dmp
                                                                      Download

                                                                      memory/32-1-0x00000000738B0000-0x0000000073F9E000-memory.dmp
                                                                      Download

                                                                      memory/32-2-0x0000000005590000-0x000000000562C000-memory.dmp
                                                                      Download

                                                                      memory/32-0-0x0000000000D80000-0x0000000000D88000-memory.dmp
                                                                      Download

                                                                      memory/1048-1137-0x0000000000280000-0x0000000000F16000-memory.dmp
                                                                      Download

                                                                      memory/1048-1132-0x0000000000280000-0x0000000000F16000-memory.dmp
                                                                      Download

                                                                      memory/1788-22-0x0000000005720000-0x00000000057B2000-memory.dmp
                                                                      Download

                                                                      memory/1788-25-0x00000000738B0000-0x0000000073F9E000-memory.dmp
                                                                      Download

                                                                      memory/1788-26-0x00000000058A0000-0x00000000058AA000-memory.dmp
                                                                      Download

                                                                      memory/1788-19-0x0000000000400000-0x0000000000452000-memory.dmp
                                                                      Download

                                                                      memory/1788-27-0x0000000006B40000-0x0000000007146000-memory.dmp
                                                                      Download

                                                                      memory/1788-29-0x0000000006B20000-0x0000000006B32000-memory.dmp
                                                                      Download

                                                                      memory/1788-30-0x00000000082D0000-0x000000000830E000-memory.dmp
                                                                      Download

                                                                      memory/1788-28-0x00000000083A0000-0x00000000084AA000-memory.dmp
                                                                      Download

                                                                      memory/1788-31-0x0000000008310000-0x000000000835B000-memory.dmp
                                                                      Download

                                                                      memory/2328-1045-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                      Download

                                                                      memory/2328-1077-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                      Download

                                                                      memory/2328-1050-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                      Download

                                                                      memory/2412-69-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-49-0x0000000002290000-0x0000000002291000-memory.dmp
                                                                      Download

                                                                      memory/2412-38-0x0000000002160000-0x0000000002161000-memory.dmp
                                                                      Download

                                                                      memory/2412-40-0x0000000002140000-0x0000000002141000-memory.dmp
                                                                      Download

                                                                      memory/2412-37-0x0000000031720000-0x0000000032310000-memory.dmp
                                                                      Download

                                                                      memory/2412-39-0x0000000002150000-0x0000000002151000-memory.dmp
                                                                      Download

                                                                      memory/2412-44-0x0000000002230000-0x0000000002231000-memory.dmp
                                                                      Download

                                                                      memory/2412-41-0x0000000002180000-0x0000000002181000-memory.dmp
                                                                      Download

                                                                      memory/2412-45-0x00000000021F0000-0x00000000021F1000-memory.dmp
                                                                      Download

                                                                      memory/2412-50-0x0000000002400000-0x0000000002401000-memory.dmp
                                                                      Download

                                                                      memory/2412-43-0x0000000002210000-0x0000000002211000-memory.dmp
                                                                      Download

                                                                      memory/2412-42-0x0000000002220000-0x0000000002221000-memory.dmp
                                                                      Download

                                                                      memory/2412-51-0x0000000003200000-0x0000000003201000-memory.dmp
                                                                      Download

                                                                      memory/2412-52-0x0000000002440000-0x0000000002441000-memory.dmp
                                                                      Download

                                                                      memory/2412-46-0x0000000002260000-0x0000000002261000-memory.dmp
                                                                      Download

                                                                      memory/2412-53-0x0000000002430000-0x0000000002431000-memory.dmp
                                                                      Download

                                                                      memory/2412-54-0x0000000002420000-0x0000000002421000-memory.dmp
                                                                      Download

                                                                      memory/2412-47-0x0000000002250000-0x0000000002251000-memory.dmp
                                                                      Download

                                                                      memory/2412-48-0x00000000022C0000-0x00000000022C1000-memory.dmp
                                                                      Download

                                                                      memory/2412-55-0x0000000002460000-0x0000000002461000-memory.dmp
                                                                      Download

                                                                      memory/2412-61-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-62-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-63-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-750-0x0000000031720000-0x0000000032310000-memory.dmp
                                                                      Download

                                                                      memory/2412-59-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-64-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-65-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-72-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-73-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-58-0x00000000022B0000-0x00000000022B1000-memory.dmp
                                                                      Download

                                                                      memory/2412-57-0x0000000002470000-0x0000000002471000-memory.dmp
                                                                      Download

                                                                      memory/2412-56-0x0000000003210000-0x0000000003211000-memory.dmp
                                                                      Download

                                                                      memory/2412-74-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-75-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-76-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-78-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-79-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-66-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-68-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-77-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-70-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-67-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2412-71-0x0000000003220000-0x0000000003320000-memory.dmp
                                                                      Download

                                                                      memory/2436-23-0x00000000738B0000-0x0000000073F9E000-memory.dmp
                                                                      Download

                                                                      memory/2436-9-0x00000000024F0000-0x0000000002552000-memory.dmp
                                                                      Download

                                                                      memory/2436-10-0x00000000738B0000-0x0000000073F9E000-memory.dmp
                                                                      Download

                                                                      memory/2436-11-0x0000000004A70000-0x0000000004A80000-memory.dmp
                                                                      Download

                                                                      memory/2436-13-0x0000000004A70000-0x0000000004A80000-memory.dmp
                                                                      Download

                                                                      memory/2436-12-0x0000000004A70000-0x0000000004A80000-memory.dmp
                                                                      Download

                                                                      memory/2436-15-0x00000000049B0000-0x0000000004A10000-memory.dmp
                                                                      Download

                                                                      memory/2436-14-0x0000000004A80000-0x0000000004F7E000-memory.dmp
                                                                      Download

                                                                      memory/2436-18-0x0000000004A70000-0x0000000004A80000-memory.dmp
                                                                      Download

                                                                      memory/2436-24-0x0000000002560000-0x0000000004560000-memory.dmp
                                                                      Download

                                                                      memory/3760-1012-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/3760-1016-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/3760-906-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/3760-1073-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/3760-1053-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/3760-1017-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/3760-905-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/3760-914-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/3760-913-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/4084-1146-0x0000000000A60000-0x00000000016F6000-memory.dmp
                                                                      Download

                                                                      memory/4648-874-0x0000000000400000-0x0000000000483000-memory.dmp
                                                                      Download

                                                                      memory/4648-883-0x0000000000400000-0x0000000000483000-memory.dmp
                                                                      Download

                                                                      memory/5656-843-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/5656-845-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/5656-846-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/5656-897-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                      Download

                                                                      memory/5840-1093-0x0000000000410000-0x00000000004D5000-memory.dmp
                                                                      Download

                                                                      memory/5840-1085-0x0000000000400000-0x0000000000406000-memory.dmp
                                                                      Download

                                                                      memory/5840-1090-0x0000000000400000-0x0000000000406000-memory.dmp
                                                                      Download