Overview

overview

10

Static

static

3

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    01-02-2024 22:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    6.3MB

  • MD5

    c67cb967230036816fd0cbbfd96959c6

  • SHA1

    d2fe988a302dce4bc0f34a1003a623f96a06b250

  • SHA256

    d2682ee0fe9e5bf429b7bea89d32cf417c3b684429dbff5e060b07e7335aaa76

  • SHA512

    2f51046e44bdfa470f676071c69da8c05d50d8f79e748748f25ac13ec53d346f1c3988148000fea3ece38623fd629d1b3dcc943006e80b7bee95da7f1f42920c

  • SSDEEP

    196608:GHqO3grg0lAc4G+JCJjsP8BXkf/hmzJzFYngA13jvHKvj4:GHzCOc4G+oB0BmdFY31zq

Score
10/10
dcratdjvugluptebariseprosmokeloaderstealcvidarpub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratrootkitspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes
  • url_path

    /3886d2276f6914c4.php

rc4.plain

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdcc

  • offline_id

    LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

risepro

C2

193.233.132.62:50500

Signatures

  • DcRat 6 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect Vidar Stealer 1 IoCs
    stealer
  • Detected Djvu ransomware 15 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 12 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 27 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 45 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
      "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2784
      • C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
        "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
        3⤵
        • DcRat
        • Windows security bypass
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Adds Run key to start application
        • Checks for VirtualBox DLLs, possible anti-VM trick
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\system32\cmd.exe
          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1828
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
            5⤵
            • DcRat
            • Modifies Windows Firewall
            • Modifies data under HKEY_USERS
            PID:1204
        • C:\Windows\rss\csrss.exe
          C:\Windows\rss\csrss.exe
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Manipulates WinMon driver.
          • Manipulates WinMonFS driver.
          • Drops file in Windows directory
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1192
          • C:\Windows\system32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            5⤵
            • DcRat
            • Creates scheduled task(s)
            PID:2052
          • C:\Windows\system32\schtasks.exe
            schtasks /delete /tn ScheduledUpdate /f
            5⤵
              PID:1072
            • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
              "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system certificate store
              PID:2532
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:1520
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:1464
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:1308
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:1120
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:1620
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:1512
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:1468
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:2128
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:936
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:568
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:2444
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -timeout 0
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:2068
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:2092
            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
              5⤵
              • Executes dropped EXE
              PID:1324
            • C:\Windows\system32\bcdedit.exe
              C:\Windows\Sysnative\bcdedit.exe /v
              5⤵
              • Modifies boot configuration data using bcdedit
              PID:2720
            • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
              C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
              5⤵
              • Executes dropped EXE
              PID:2732
            • C:\Windows\system32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              5⤵
              • DcRat
              • Creates scheduled task(s)
              PID:440
            • C:\Windows\windefender.exe
              "C:\Windows\windefender.exe"
              5⤵
              • Executes dropped EXE
              PID:1504
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                6⤵
                  PID:2056
                  • C:\Windows\SysWOW64\sc.exe
                    sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    7⤵
                    • Launches sc.exe
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1576
        • C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
          "C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2688
          • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
            C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2700
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1524
              • C:\Windows\SysWOW64\chcp.com
                chcp 1251
                5⤵
                  PID:2552
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                  5⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:1584
            • C:\Users\Admin\AppData\Local\Temp\nst84DB.tmp
              C:\Users\Admin\AppData\Local\Temp\nst84DB.tmp
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:2808
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nst84DB.tmp" & del "C:\ProgramData\*.dll"" & exit
                4⤵
                  PID:1620
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 5
                    5⤵
                    • Delays execution with timeout.exe
                    PID:2468
            • C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
              "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
              2⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious behavior: EnumeratesProcesses
              PID:2680
          • C:\Windows\system32\makecab.exe
            "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240201222545.log C:\Windows\Logs\CBS\CbsPersist_20240201222545.cab
            1⤵
            • Drops file in Windows directory
            PID:1952
          • C:\Users\Admin\AppData\Local\Temp\DC7A.exe
            C:\Users\Admin\AppData\Local\Temp\DC7A.exe
            1⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            • Suspicious behavior: MapViewOfSection
            PID:3012
          • C:\Users\Admin\AppData\Local\Temp\ED7B.exe
            C:\Users\Admin\AppData\Local\Temp\ED7B.exe
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1968
            • C:\Users\Admin\AppData\Local\Temp\ED7B.exe
              C:\Users\Admin\AppData\Local\Temp\ED7B.exe
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Modifies system certificate store
              PID:1716
              • C:\Windows\SysWOW64\icacls.exe
                icacls "C:\Users\Admin\AppData\Local\ffe0761d-165c-4e42-ba79-df2659dc25b6" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                3⤵
                • Modifies file permissions
                PID:1280
              • C:\Users\Admin\AppData\Local\Temp\ED7B.exe
                "C:\Users\Admin\AppData\Local\Temp\ED7B.exe" --Admin IsNotAutoStart IsNotTask
                3⤵
                  PID:1092
                  • C:\Users\Admin\AppData\Local\Temp\ED7B.exe
                    "C:\Users\Admin\AppData\Local\Temp\ED7B.exe" --Admin IsNotAutoStart IsNotTask
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:888
                    • C:\Users\Admin\AppData\Local\6327fb53-b004-4232-9e24-57ab92a85b48\build2.exe
                      "C:\Users\Admin\AppData\Local\6327fb53-b004-4232-9e24-57ab92a85b48\build2.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:2916
                      • C:\Users\Admin\AppData\Local\6327fb53-b004-4232-9e24-57ab92a85b48\build2.exe
                        "C:\Users\Admin\AppData\Local\6327fb53-b004-4232-9e24-57ab92a85b48\build2.exe"
                        6⤵
                          PID:2568
                      • C:\Users\Admin\AppData\Local\6327fb53-b004-4232-9e24-57ab92a85b48\build3.exe
                        "C:\Users\Admin\AppData\Local\6327fb53-b004-4232-9e24-57ab92a85b48\build3.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:2948
                        • C:\Users\Admin\AppData\Local\6327fb53-b004-4232-9e24-57ab92a85b48\build3.exe
                          "C:\Users\Admin\AppData\Local\6327fb53-b004-4232-9e24-57ab92a85b48\build3.exe"
                          6⤵
                          • Executes dropped EXE
                          PID:2572
                          • C:\Windows\SysWOW64\schtasks.exe
                            /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                            7⤵
                            • DcRat
                            • Creates scheduled task(s)
                            PID:2840
              • C:\Users\Admin\AppData\Local\Temp\3268.exe
                C:\Users\Admin\AppData\Local\Temp\3268.exe
                1⤵
                • Executes dropped EXE
                PID:2036
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 96
                  2⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:2348
              • C:\Users\Admin\AppData\Local\Temp\75BF.exe
                C:\Users\Admin\AppData\Local\Temp\75BF.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:1928
              • C:\Windows\system32\conhost.exe
                \??\C:\Windows\system32\conhost.exe "-1558395410-1791242699557819697-168314436114370882051948446104-1642516691-1160110590"
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                PID:1092
              • C:\Users\Admin\AppData\Local\Temp\E1EA.exe
                C:\Users\Admin\AppData\Local\Temp\E1EA.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2736
                • C:\Users\Admin\AppData\Local\Temp\is-P3CSG.tmp\E1EA.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-P3CSG.tmp\E1EA.tmp" /SL5="$A01E8,7069030,54272,C:\Users\Admin\AppData\Local\Temp\E1EA.exe"
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of FindShellTrayWindow
                  PID:3052
                  • C:\Users\Admin\AppData\Local\QT Zoneinfo Routine\qtziroutine.exe
                    "C:\Users\Admin\AppData\Local\QT Zoneinfo Routine\qtziroutine.exe" -i
                    3⤵
                    • Executes dropped EXE
                    PID:2960
                  • C:\Users\Admin\AppData\Local\QT Zoneinfo Routine\qtziroutine.exe
                    "C:\Users\Admin\AppData\Local\QT Zoneinfo Routine\qtziroutine.exe" -s
                    3⤵
                    • Executes dropped EXE
                    PID:2356
              • C:\Windows\system32\conhost.exe
                \??\C:\Windows\system32\conhost.exe "-1264880456-1308601031907772674-21307445081879827651-2068402957-19333693391505839410"
                1⤵
                  PID:1520
                • C:\Windows\windefender.exe
                  C:\Windows\windefender.exe
                  1⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  PID:2876
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {FC289941-EB47-4CE7-9D4C-E4C95BD35D93} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]
                  1⤵
                    PID:2312
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      2⤵
                      • Executes dropped EXE
                      PID:2328

                  Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  Scheduled Task/Job

                  1
                  T1053

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Defense Evasion

                  File and Directory Permissions Modification

                  1
                  T1222

                  Impair Defenses

                  4
                  T1562

                  Disable or Modify System Firewall

                  1
                  T1562.004

                  Disable or Modify Tools

                  2
                  T1562.001

                  Modify Registry

                  4
                  T1112

                  Subvert Trust Controls

                  1
                  T1553

                  Install Root Certificate

                  1
                  T1553.004

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  Credential Access

                  Unsecured Credentials

                  3
                  T1552

                  Credentials In Files

                  3
                  T1552.001

                  Discovery

                  Peripheral Device Discovery

                  1
                  T1120

                  Query Registry

                  7
                  T1012

                  System Information Discovery

                  5
                  T1082

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  Lateral Movement

                  Collection

                  Data from Local System

                  3
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                    Filesize

                    1KB

                    MD5

                    5f6b1424c30a074f61871d5232dff741

                    SHA1

                    3e8f4a56b1f591cc43441d19e5dde2387a335520

                    SHA256

                    b3c78c2a561ca6b76c64cf7736dfc3c29bde0c5b1b1a2246ee84666f7bf22b28

                    SHA512

                    6cb2e65fb31e85ca4ef211abdeb470cbce9fcdf6f9a154cf132e8a5b5b97f406d037fbf0ca24490f1aed59d3d97f1a94adaecd5f8b2e81698aa9dd26c4f16813

                    Download Submit

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                    Filesize

                    724B

                    MD5

                    8202a1cd02e7d69597995cabbe881a12

                    SHA1

                    8858d9d934b7aa9330ee73de6c476acf19929ff6

                    SHA256

                    58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                    SHA512

                    97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                    Download Submit

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                    Filesize

                    410B

                    MD5

                    65f5873339d5ea02e9f60ec1d27746c4

                    SHA1

                    91e5b22e05ef29748d630843b9646e131c3c7848

                    SHA256

                    9f0321db0cdf313a6c89ef2214c7d73643e692e2e5974cd4a4e3518e9851793c

                    SHA512

                    a72ac0ba33d793bde8a689fe5d18ee49470178b2c926d8184a8ed7982423fef66e8fd25d9cfd80877eaf02c614d793fde95ca33776fda5687e8812ee50e4e657

                    Download Submit

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                    Filesize

                    344B

                    MD5

                    bf9118690f4a2771b9d5fd96a713da1f

                    SHA1

                    bf7633b360110a76a3cba1a2521b311a68e89fa2

                    SHA256

                    baef6e73760b6ba840b87264551b299b0cfbc3504dae204634eec73bf804312a

                    SHA512

                    20f6b038134b194d314dbc6224baa2fa9c429592541f7b6fba33613b7b024978af5f6fa77b8ccbb61624f5b32aabddf85f56104480fd66a5b1bf66d5826094c9

                    Download Submit

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                    Filesize

                    344B

                    MD5

                    f2a9cc50281f89c861461b05b49cefbd

                    SHA1

                    9fc7b65a74cf62d324acb9c067b6ed3d16bd505b

                    SHA256

                    4552522f4ba5828a3a82ae17bb76a88f9fb658204c3490b33a4517ffeb5490d8

                    SHA512

                    5cd9910607a7807ee02135a06c594c001d8e4f606ef4ad31f63c414fc8e4935371294dd80fe02bfd00105c9829a2221e5afc34070b8f8b794a5f879f20e7c461

                    Download Submit

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                    Filesize

                    392B

                    MD5

                    24380721706f0b4b3f3ab5b7fb048d75

                    SHA1

                    2bf1a066d2180ff42fb385ad531bab138cfaf49b

                    SHA256

                    e8efb4edbaf4261bdcbc8778ed9d0e68c38956f3d1a99a9aa6d233465419360f

                    SHA512

                    d6b61b8cfb9ce52a3f5b227e0fad3423a786dd4dfcbb65f1322e1b6e4c44c1e4573ee1b0287a4b1e79e40e2f75e0ec10c0db1bc92e3219c6dca9b505bc6bf232

                    Download Submit

                  • C:\Users\Admin\AppData\Local\6327fb53-b004-4232-9e24-57ab92a85b48\build2.exe
                    Filesize

                    385KB

                    MD5

                    63e4a9cd7a8b37335b5f18cefc5dd9d2

                    SHA1

                    c781a30935afc452b108cc78724b60f389b78874

                    SHA256

                    c1e75efde3fd1da605135e5c3ffab0073299c80632d136f8eeba9d4a7c98c70f

                    SHA512

                    3818b5966938704c5830acb5426db7791f6ae476853248d8984b1aff35a6722a0684bea54a53ef6ded1f301f6de9ed044d45f007457a9c0f3a7ea3afc7bf0ecc

                    Download Submit

                  • C:\Users\Admin\AppData\Local\6327fb53-b004-4232-9e24-57ab92a85b48\build3.exe
                    Filesize

                    299KB

                    MD5

                    41b883a061c95e9b9cb17d4ca50de770

                    SHA1

                    1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

                    SHA256

                    fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

                    SHA512

                    cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\3268.exe
                    Filesize

                    5.6MB

                    MD5

                    978adeacb862253023f9c296c12ea083

                    SHA1

                    576fc339b8437045c2a34e568f2aae67f720d333

                    SHA256

                    4c917b7d4291d22d757f2bb707513c6e85c51fd268f1518eeba92128b1a0d673

                    SHA512

                    6b5049e46235b2d0d7d29fdef1f6977f03b670a822cc200dbb634352894b702624fb201b795e135d4b72e5c6456c24c8fae16a37d8454cdcf86fd25e85205561

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\75BF.exe
                    Filesize

                    1.3MB

                    MD5

                    e53a06f815d6561fd9c0dd01da47694c

                    SHA1

                    84ed37df6d77dceb161c1f5af329f31a830e0a35

                    SHA256

                    a27a32a5ce1ae60b66f8a502242df687f07e2bf263ecb824cbd9640390b20f27

                    SHA512

                    88b90d548bb49b4e5f05b4e55b93528e1d86a1824feb8e461be003d708d2478f6207d2c3a97d12038a4f08c0fd6ad10d5fd89609937bca7f227f5310a139c2bb

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\CabCA72.tmp
                    Filesize

                    65KB

                    MD5

                    ac05d27423a85adc1622c714f2cb6184

                    SHA1

                    b0fe2b1abddb97837ea0195be70ab2ff14d43198

                    SHA256

                    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                    SHA512

                    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\DC7A.exe
                    Filesize

                    183KB

                    MD5

                    beffaffcc9489c258943fc3df7a5fa3b

                    SHA1

                    be37b9f7f4689cacdf885663dde1977a309ed39b

                    SHA256

                    df66a2112a34f0696dfc4b1488dce0dd114e7036bb5b3faeffd666570c33a113

                    SHA512

                    08b2b472a02fad65358b5ba0bf7075dae423fff5dd756dd1581e7ced8c342fb2abe8d6d8a69f160b7d76e92e486e825a868b1b9de165e1b03f2f4921854618a7

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\ED7B.exe
                    Filesize

                    682KB

                    MD5

                    4eee38d71cb95047fae83cd62aac06fb

                    SHA1

                    aac96a7a2d31de525b1f3a4a43218a282068b03c

                    SHA256

                    5b87112b163a731587bfc8b4c075e3789ad69d86086e1100c6451683518b9ee0

                    SHA512

                    698252ec23ac7350ff5df0b4f1278d9b0f1a339031f86b0870f5d2900d3a089445abdc46857fab230269efec009d1ae95ed38340a6412237a94fffe6c944514c

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\ED7B.exe
                    Filesize

                    576KB

                    MD5

                    03cc6ce642c249c5fd6ae22153917b0b

                    SHA1

                    506cd66f5b97b3f5c0455a32fcc9e9b81cdb3995

                    SHA256

                    ebe902fb5e5ac0918113e7e433a00c2f0be55b18b0d43867a813023e1dcf01fc

                    SHA512

                    becac84c5ab250884888cb4e23eae8e04bcc2c972947e9b49048b12e472659d67c3c9868c35852bb90ba3113cdcaa9fa755897cd758cb23a7e0622d3b9d7127a

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                    Filesize

                    1024KB

                    MD5

                    1418e425f72721ba18b3f19eb058ab24

                    SHA1

                    103feda2b630916f8f3efdeb42bc9ff74e46ea5b

                    SHA256

                    187b964aad8ce54f07326ad8ea0c7d7b2af16dabec0c8eaa328e2939abf19dcc

                    SHA512

                    eb621ac1f37733b9670a181c106a4ecdff047aa94e18b7033617e7ca9fbaf942e7e81b6203b92a05e68a60c4fdaba7053853c7cd987823469b06a2b6023a481b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                    Filesize

                    395KB

                    MD5

                    5da3a881ef991e8010deed799f1a5aaf

                    SHA1

                    fea1acea7ed96d7c9788783781e90a2ea48c1a53

                    SHA256

                    f18fdb9e03546bfb98397bcb8378b505eaf4ac061749229a7ee92a1c3cf156e4

                    SHA512

                    24fbcb5353a3d51ee01f1de1bbb965f9e40e0d00e52c42713d446f12edceeb8d08b086a8687a6188decaa8f256899e24a06c424d8d73adaad910149a9c45ef09

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\TarCB40.tmp
                    Filesize

                    171KB

                    MD5

                    9c0c641c06238516f27941aa1166d427

                    SHA1

                    64cd549fb8cf014fcd9312aa7a5b023847b6c977

                    SHA256

                    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                    SHA512

                    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
                    Filesize

                    3.9MB

                    MD5

                    593d95797a7ff35c11dc63a8a3e3f9e0

                    SHA1

                    cc8c0ff551c11eebe82e02516b33970b56017161

                    SHA256

                    836d3bf600c9f49ed08f4204287a1a3bd1bcc420b7df1584e94faabf87ef7102

                    SHA512

                    1a2e0c9238d2de6596ad863b0433af2834bfa7d16807d1e1a991b518bf55575e19bac9d3ed134840cf29675576544838a035a0f0b149fe8ac4450ebae7fac745

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
                    Filesize

                    1.3MB

                    MD5

                    77868271546fb94c83aa9bba872f82d9

                    SHA1

                    3d37d23c33624bd4e23921cf3b7175ed7c897907

                    SHA256

                    62212fa470efb17c18ed0dee536558bad93b7d7d10906e0f7af547c8c693700c

                    SHA512

                    49946fce714b8ec389812fe66bd38c2231a59b9a9d48982ede12c040c19480588b8f30968a83704b8d641bb4049a7c0aba14985d3da460aa5df99436e179bdc8

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
                    Filesize

                    3.1MB

                    MD5

                    508cf4bc13faf7e1d0344414f9f72aa1

                    SHA1

                    7fa47bff1e826778178eefcf85f8372e557f72a9

                    SHA256

                    b82fcdeed058c4d524a5e28c71667620c6c8ec127ba86fce7500d8119cb1fa8e

                    SHA512

                    537ba019abf0b80a03c7ab78d9ad723a42f8084d34139ecb5963247ac78d6ac1a3bc1df0dab90dde6caa75816dde2d70ead04eb264ee6d804c6006b2f86ab1db

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\nst84DB.tmp
                    Filesize

                    184KB

                    MD5

                    4e5777fa873290ac25f6120324ac41c1

                    SHA1

                    d0ccdcf58e069e26aca711dc9d9d9eab25f94d11

                    SHA256

                    01280ad872d9f72c7bc4a3b53e27f05220fd186d5033a2dd036f4a0fcb1b19ad

                    SHA512

                    d82eaf553c2e61b7863d625e86a9c2fed8c9b393158d09ca96b2dcd367dd13a2edbbcf59d1109ae5b51e572996f57ee026e34b82ddeb61732b2a6b3957185734

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\osloader.exe
                    Filesize

                    64KB

                    MD5

                    367011d594a7f38c1e1d0e88f5028fbb

                    SHA1

                    d7ee26a3ed4ce1de0943a843b3e72a722da90698

                    SHA256

                    cce834eea99a6757290c5a9e560f88aa1e4b58c529fff4909c9b1a62753f9849

                    SHA512

                    a5a33f0640b80075878c604410eac19bd8add41e0bd5baf4bb9a052b26ab2e3af424203aec358809368fd4d53caf670cab25a272e1af7591cc0e20f548b3faa7

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
                    Filesize

                    171KB

                    MD5

                    4d1a4b3096f4a39f3a91df2f6efd43c6

                    SHA1

                    af7b52300363fa6f5ce8b5f99f753a9b1e0af94f

                    SHA256

                    ca5b5e71addd8a56460eefad5cd368a5f6aca71b7a2d6dcfb312f45d1ae6e20b

                    SHA512

                    d7cc6cf36fa0da5c22b531f7b3f58cbbcc206aaa47d40ebc0256fa5ede758fa7f636f9b70fa8077664067c8cbd3b38633ef2ca1e2e8e349b3b05c3cec1f8afd7

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                    Filesize

                    128B

                    MD5

                    11bb3db51f701d4e42d3287f71a6a43e

                    SHA1

                    63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                    SHA256

                    6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                    SHA512

                    907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                    Download Submit

                  • C:\Windows\rss\csrss.exe
                    Filesize

                    2.9MB

                    MD5

                    b21599760c8bbd30c2cc0264b03d390b

                    SHA1

                    6d0f104098c1d4cb46728ccf0b68b22ac8b4719a

                    SHA256

                    6ba9911ac9b015bc16f9a4b7dac36bcf8af637cb374d803003de04050b655702

                    SHA512

                    6e3fb77350026f242caf211b5c489fd81768c5fa6ec832862949c280b31f4f8eab0c3531ecfd28af12ee8193e31a0ed4b918a7ab486a5c1daffcdb91e058aa00

                    Download Submit

                  • C:\Windows\rss\csrss.exe
                    Filesize

                    576KB

                    MD5

                    d4b15b46aacade16f4ce4c07f294420f

                    SHA1

                    01e6b5dde1e9021ef8e088f1a6d7ea5cf06f8f1c

                    SHA256

                    e20a80461c0c08e22fa3d820c46520dac3d19be5a632a97b4551dd029c115f01

                    SHA512

                    b084bed874b124a3d278c0e1a5ed3c1c48e4fcfcd8005bc3c1e068ef3dcd7d1b1ca178a958153d96b03df30e449618b853e0b6aa359e63e1eca311bcdd184ba8

                    Download Submit

                  • \ProgramData\mozglue.dll
                    Filesize

                    593KB

                    MD5

                    c8fd9be83bc728cc04beffafc2907fe9

                    SHA1

                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                    SHA256

                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                    SHA512

                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                    Download Submit

                  • \ProgramData\nss3.dll
                    Filesize

                    2.0MB

                    MD5

                    1cc453cdf74f31e4d913ff9c10acdde2

                    SHA1

                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                    SHA256

                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                    SHA512

                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\3268.exe
                    Filesize

                    1.2MB

                    MD5

                    08925d3ee7f7b53ec884873261bf6fe9

                    SHA1

                    da45b3e1ba27a2fc943327f6296562096da64c4d

                    SHA256

                    58f9ac82915a2dc7376bf4fdeee2f24d8f6bfc569471fc49ea4326f8d4ff2712

                    SHA512

                    07104b56e28917053eec9398f125bdfb7f6cfad5553cb540af0e4270d1d35ecd190faa02d34003aea836744c79dbd9a4e858df9bb9844320dff034a60ebf3a74

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\BroomSetup.exe
                    Filesize

                    4.7MB

                    MD5

                    5e94f0f6265f9e8b2f706f1d46bbd39e

                    SHA1

                    d0189cba430f5eea07efe1ab4f89adf5ae2453db

                    SHA256

                    50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503

                    SHA512

                    473dfa66a36feed9b29a43245074141478327ce22ba7cce512599379dcb783b4d665e2d65c5e9750b988c7ed8f6c3349a7a12d4b8b57c89840eee6ca6e1a30cd

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\InstallSetup9.exe
                    Filesize

                    2.0MB

                    MD5

                    c7dfcf13b0dc4dd685114a6a2f0233ac

                    SHA1

                    ade01a01ce38e49de0136340333aa26f92a6f43f

                    SHA256

                    3786f3f45f703b7faa2b971ac1d9cddfa14115b1926a874a294809bf747355dc

                    SHA512

                    ff5769daa32508b261d807eaa2a70ff5e942f02b1903523d6cc280ce8c07c0bc58dcc2e555e5d24ddf240570da5f821ba01540904350804dea6eafa7131f9d29

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    Filesize

                    281KB

                    MD5

                    d98e33b66343e7c96158444127a117f6

                    SHA1

                    bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                    SHA256

                    5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                    SHA512

                    705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\csrss\patch.exe
                    Filesize

                    1.7MB

                    MD5

                    13aaafe14eb60d6a718230e82c671d57

                    SHA1

                    e039dd924d12f264521b8e689426fb7ca95a0a7b

                    SHA256

                    f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

                    SHA512

                    ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
                    Filesize

                    3.8MB

                    MD5

                    528b16bac314a672db67c1967b714a03

                    SHA1

                    dd627ba219ecc360dde59620982fa8a98e4fffbd

                    SHA256

                    37c4506f971bd7a5079aff3ab1f3a53f0f5548b6db6f31afd14e90666032177f

                    SHA512

                    cce4324cbf423e1097cafe5ec5655a4c556d9c7bcbc74e9d7806533b718b0591341f95413a91afa7f11f9fb19eae9095ca90f6d98beab43b614fdf62f76eda34

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
                    Filesize

                    4.1MB

                    MD5

                    0f396cc0dba8c2ef01e51ffa06bd2f93

                    SHA1

                    05bab98b65b1211b1207936f9e23626c7fd4eeee

                    SHA256

                    17dfd514df0d171e7d96202740cdb98cc71444c580f5b317712b58bc8e74be1a

                    SHA512

                    4685fb04d756177b28c9b8dd7cac28503d68d72d205869d25d2d8cacc50a2b9c973d2194942f5de1bd4e43e2d543904b0667c57dc9000eb2c1c43bbd47217128

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\dbghelp.dll
                    Filesize

                    1.5MB

                    MD5

                    f0616fa8bc54ece07e3107057f74e4db

                    SHA1

                    b33995c4f9a004b7d806c4bb36040ee844781fca

                    SHA256

                    6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

                    SHA512

                    15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\nst77C0.tmp\INetC.dll
                    Filesize

                    25KB

                    MD5

                    40d7eca32b2f4d29db98715dd45bfac5

                    SHA1

                    124df3f617f562e46095776454e1c0c7bb791cc7

                    SHA256

                    85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                    SHA512

                    5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                    Filesize

                    4.2MB

                    MD5

                    6887c953e6af391e4c8f1f6878a56379

                    SHA1

                    82ee7f92839290a95a44fa79dccb1a65729b61ad

                    SHA256

                    96b63e731b21d1832ceccc40eb80f0bc0de24de5eaf74e6e675318a112025303

                    SHA512

                    3aeaca150f5bc8e37d322e89c01a1236b72437180bd881ba849b9f7456f10940e0bcee90aefd6e09b8ae49812759a4e58d518d8675db4ffb5b50f07678cde021

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                    Filesize

                    3.6MB

                    MD5

                    170d66f9d75e64f50a295116ca704c25

                    SHA1

                    db0854fd1c8c705d62411aa8f13be7d2ebe2e476

                    SHA256

                    f6de5ced2a6adeb6c8422030a373c0a25756c5c79c5b066d9999a03ad9c04fd7

                    SHA512

                    d51b5ae12e52adf56941e8c4fadedaa6683fc013f6aa6a8c431db72fbf882d74ae75a940f53e7b793bf11e0740cc68eee3715e33eb526c4bdef42b51b74062c9

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                    Filesize

                    5.3MB

                    MD5

                    1afff8d5352aecef2ecd47ffa02d7f7d

                    SHA1

                    8b115b84efdb3a1b87f750d35822b2609e665bef

                    SHA256

                    c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

                    SHA512

                    e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\osloader.exe
                    Filesize

                    591KB

                    MD5

                    e2f68dc7fbd6e0bf031ca3809a739346

                    SHA1

                    9c35494898e65c8a62887f28e04c0359ab6f63f5

                    SHA256

                    b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                    SHA512

                    26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\osloader.exe
                    Filesize

                    128KB

                    MD5

                    f4645099153d40cd82d369f7e0e89759

                    SHA1

                    968fa9b59508636ea7e8b9e5fe611184a42fb315

                    SHA256

                    de485aefcaf449b3de5cc1d0ee02f74cb4c86bdfd64aaca6d82494b237a16e50

                    SHA512

                    0f3aa2a3983ea189034d060d098ac5482d61bfca58041535480bf73479b034a382f889ea553267709c6bf2fb67bb3fdf1b51ff69c1e3094ed252af0bf3d4dcff

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\symsrv.dll
                    Filesize

                    163KB

                    MD5

                    5c399d34d8dc01741269ff1f1aca7554

                    SHA1

                    e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

                    SHA256

                    e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

                    SHA512

                    8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

                    Download Submit

                  • \Windows\rss\csrss.exe
                    Filesize

                    1.8MB

                    MD5

                    178249da53d78feddf7829463ed473d4

                    SHA1

                    06ae90f3edb92d120dcd8113c3fe6059c3aaa7d2

                    SHA256

                    e94ce0b28a01042285bd1257e13f5aa1901d714837b884bbc7aa7c67df992f79

                    SHA512

                    b85d9dfb0111baf02ae264487b01a5ed24c3058c839019124d6442f57778781d5f0ddf6f11ad8cb83030d2afb708717a202a409cafbaffd84c362eae40ed7282

                    Download Submit

                  • \Windows\rss\csrss.exe
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit

                  • memory/888-489-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/888-368-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/888-341-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/888-358-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/888-342-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/888-375-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/888-357-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/888-370-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/1092-329-0x00000000004C0000-0x0000000000552000-memory.dmp

                    Filesize

                    584KB

                    Download

                  • memory/1092-340-0x00000000004C0000-0x0000000000552000-memory.dmp

                    Filesize

                    584KB

                    Download

                  • memory/1192-333-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/1192-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/1192-118-0x00000000026A0000-0x0000000002A98000-memory.dmp

                    Filesize

                    4.0MB

                    Download

                  • memory/1192-120-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/1192-321-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/1192-119-0x0000000002AA0000-0x000000000338B000-memory.dmp

                    Filesize

                    8.9MB

                    Download

                  • memory/1192-87-0x00000000026A0000-0x0000000002A98000-memory.dmp

                    Filesize

                    4.0MB

                    Download

                  • memory/1192-282-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/1384-66-0x0000000002720000-0x0000000002736000-memory.dmp

                    Filesize

                    88KB

                    Download

                  • memory/1384-297-0x0000000003E80000-0x0000000003E96000-memory.dmp

                    Filesize

                    88KB

                    Download

                  • memory/1716-286-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/1716-281-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1716-327-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/1716-296-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/1716-295-0x0000000000400000-0x0000000000537000-memory.dmp

                    Filesize

                    1.2MB

                    Download

                  • memory/1928-455-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1928-425-0x0000000002D70000-0x0000000002D71000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1928-458-0x0000000002D10000-0x0000000002D11000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1928-417-0x00000000027C0000-0x00000000027C1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1928-461-0x0000000002E90000-0x0000000002E92000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1928-419-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1928-501-0x0000000000330000-0x00000000008CA000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/1928-400-0x0000000000330000-0x00000000008CA000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/1928-459-0x0000000002710000-0x0000000002711000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1928-460-0x0000000002D20000-0x0000000002D21000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1928-415-0x0000000077C40000-0x0000000077C42000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1928-418-0x00000000025A0000-0x00000000025A1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1928-424-0x00000000028D0000-0x00000000028D1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1928-423-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1928-421-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1928-422-0x0000000000330000-0x00000000008CA000-memory.dmp

                    Filesize

                    5.6MB

                    Download

                  • memory/1968-290-0x0000000001DA0000-0x0000000001EBB000-memory.dmp

                    Filesize

                    1.1MB

                    Download

                  • memory/1968-287-0x0000000001D00000-0x0000000001D92000-memory.dmp

                    Filesize

                    584KB

                    Download

                  • memory/1968-262-0x0000000001D00000-0x0000000001D92000-memory.dmp

                    Filesize

                    584KB

                    Download

                  • memory/2036-413-0x0000000000130000-0x0000000000131000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2036-363-0x0000000000D00000-0x0000000001814000-memory.dmp

                    Filesize

                    11.1MB

                    Download

                  • memory/2040-77-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/2040-76-0x0000000002790000-0x0000000002B88000-memory.dmp

                    Filesize

                    4.0MB

                    Download

                  • memory/2040-86-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/2040-72-0x0000000002790000-0x0000000002B88000-memory.dmp

                    Filesize

                    4.0MB

                    Download

                  • memory/2356-559-0x0000000000400000-0x00000000006C8000-memory.dmp

                    Filesize

                    2.8MB

                    Download

                  • memory/2356-553-0x0000000000400000-0x00000000006C8000-memory.dmp

                    Filesize

                    2.8MB

                    Download

                  • memory/2532-162-0x0000000140000000-0x00000001405E8000-memory.dmp

                    Filesize

                    5.9MB

                    Download

                  • memory/2532-144-0x0000000140000000-0x00000001405E8000-memory.dmp

                    Filesize

                    5.9MB

                    Download

                  • memory/2572-477-0x0000000000400000-0x0000000000406000-memory.dmp

                    Filesize

                    24KB

                    Download

                  • memory/2680-67-0x0000000000400000-0x0000000000439000-memory.dmp

                    Filesize

                    228KB

                    Download

                  • memory/2680-41-0x00000000005B0000-0x00000000006B0000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/2680-45-0x0000000000400000-0x0000000000439000-memory.dmp

                    Filesize

                    228KB

                    Download

                  • memory/2680-42-0x0000000000220000-0x000000000022B000-memory.dmp

                    Filesize

                    44KB

                    Download

                  • memory/2700-46-0x00000000001D0000-0x00000000001D1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2700-243-0x00000000001D0000-0x00000000001D1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2700-75-0x0000000000400000-0x00000000008E2000-memory.dmp

                    Filesize

                    4.9MB

                    Download

                  • memory/2700-236-0x0000000000400000-0x00000000008E2000-memory.dmp

                    Filesize

                    4.9MB

                    Download

                  • memory/2736-487-0x0000000000400000-0x0000000000414000-memory.dmp

                    Filesize

                    80KB

                    Download

                  • memory/2752-0-0x0000000074C50000-0x000000007533E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/2752-1-0x00000000011F0000-0x000000000183A000-memory.dmp

                    Filesize

                    6.3MB

                    Download

                  • memory/2752-30-0x0000000074C50000-0x000000007533E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/2784-11-0x0000000002600000-0x00000000029F8000-memory.dmp

                    Filesize

                    4.0MB

                    Download

                  • memory/2784-40-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/2784-31-0x0000000002600000-0x00000000029F8000-memory.dmp

                    Filesize

                    4.0MB

                    Download

                  • memory/2784-71-0x0000000000400000-0x0000000000D1C000-memory.dmp

                    Filesize

                    9.1MB

                    Download

                  • memory/2784-74-0x0000000002600000-0x00000000029F8000-memory.dmp

                    Filesize

                    4.0MB

                    Download

                  • memory/2784-73-0x0000000002A00000-0x00000000032EB000-memory.dmp

                    Filesize

                    8.9MB

                    Download

                  • memory/2784-32-0x0000000002A00000-0x00000000032EB000-memory.dmp

                    Filesize

                    8.9MB

                    Download

                  • memory/2808-251-0x0000000000270000-0x0000000000370000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/2808-242-0x0000000000400000-0x000000000062E000-memory.dmp

                    Filesize

                    2.2MB

                    Download

                  • memory/2808-110-0x0000000000400000-0x000000000062E000-memory.dmp

                    Filesize

                    2.2MB

                    Download

                  • memory/2808-88-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                    Filesize

                    972KB

                    Download

                  • memory/2808-278-0x0000000000400000-0x000000000062E000-memory.dmp

                    Filesize

                    2.2MB

                    Download

                  • memory/2808-283-0x0000000000400000-0x000000000062E000-memory.dmp

                    Filesize

                    2.2MB

                    Download

                  • memory/2808-65-0x0000000000400000-0x000000000062E000-memory.dmp

                    Filesize

                    2.2MB

                    Download

                  • memory/2808-285-0x0000000000270000-0x0000000000370000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/2808-63-0x0000000000270000-0x0000000000370000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/2808-64-0x00000000001B0000-0x00000000001CC000-memory.dmp

                    Filesize

                    112KB

                    Download

                  • memory/2916-403-0x0000000000590000-0x0000000000690000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/2916-552-0x0000000000590000-0x0000000000690000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/2916-401-0x0000000000230000-0x0000000000260000-memory.dmp

                    Filesize

                    192KB

                    Download

                  • memory/2948-465-0x0000000000920000-0x0000000000A20000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/2948-466-0x0000000000220000-0x0000000000224000-memory.dmp

                    Filesize

                    16KB

                    Download

                  • memory/2960-545-0x0000000000400000-0x00000000006C8000-memory.dmp

                    Filesize

                    2.8MB

                    Download

                  • memory/2960-551-0x0000000000400000-0x00000000006C8000-memory.dmp

                    Filesize

                    2.8MB

                    Download

                  • memory/3012-298-0x0000000000400000-0x000000000043C000-memory.dmp

                    Filesize

                    240KB

                    Download

                  • memory/3012-265-0x0000000000250000-0x0000000000350000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/3012-266-0x0000000000400000-0x000000000043C000-memory.dmp

                    Filesize

                    240KB

                    Download

                  • memory/3052-502-0x00000000003D0000-0x00000000003D1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3052-544-0x0000000003700000-0x00000000039C8000-memory.dmp

                    Filesize

                    2.8MB

                    Download