Overview

overview

10

Static

static

3

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14-02-2024 12:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    7.1MB

  • MD5

    9a82e4f9ba1881fa411b6473d792f1a3

  • SHA1

    24c48768340c61376d3d5ef99091b456ad1f89fb

  • SHA256

    d823740cca44676c9fa128c25ca53cc16fbf8a1ad23c10d08f997e9e3fcd6655

  • SHA512

    a0819af9c420b188c9f326459ffd23f10d3d038dae0b48a98df34f1ad87d0d08323e184c3cda41ab794b8857f4a3f2c2f1b8c2f42dbc88f375ad87feccba17ec

  • SSDEEP

    98304:biPxK2EIDpN+bKXY/TMTRQOEThYBCvSx/Q1t1rakS9f4X/3mTiVRn:Sx3rQDTj9SCvl4F4uTiVRn

Score
10/10
dcratdjvufabookiegluptebasmokeloaderstealcvidarzgrat13bd7290c1961db27b4ede41bfbf4c5epub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .lkhy

  • offline_id

    OxV6DGl22io8sqMOW1zCCOlzPiv4f1Vqzw7Y8zt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-uNdL2KHHdy Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0851ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.8

Botnet

13bd7290c1961db27b4ede41bfbf4c5e

C2

https://t.me/karl3on

https://steamcommunity.com/profiles/76561199637071579
Attributes
  • profile_id_v2

    13bd7290c1961db27b4ede41bfbf4c5e

  • user_agent

    Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Signatures

  • DcRat 6 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect Fabookie payload 2 IoCs
  • Detect Vidar Stealer 3 IoCs
    stealer
  • Detect ZGRat V1 1 IoCs
  • Detected Djvu ransomware 12 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 10 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 41 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Suspicious use of SetThreadContext 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 19 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2684
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
          4⤵
            PID:2328
            • C:\Windows\SysWOW64\chcp.com
              chcp 1251
              5⤵
                PID:860
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                5⤵
                • DcRat
                • Creates scheduled task(s)
                PID:2248
          • C:\Users\Admin\AppData\Local\Temp\nso829A.tmp
            C:\Users\Admin\AppData\Local\Temp\nso829A.tmp
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:3008
        • C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
          "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
          2⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:2780
        • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
          "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2704
          • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
            "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
            3⤵
            • DcRat
            • Windows security bypass
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:2964
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              4⤵
                PID:2480
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  5⤵
                  • Modifies Windows Firewall
                  • Modifies data under HKEY_USERS
                  PID:2832
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe
                4⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Manipulates WinMon driver.
                • Manipulates WinMonFS driver.
                • Drops file in Windows directory
                • Modifies system certificate store
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2716
                • C:\Windows\system32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  5⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:2752
                • C:\Windows\system32\schtasks.exe
                  schtasks /delete /tn ScheduledUpdate /f
                  5⤵
                    PID:2808
                  • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                    "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Modifies system certificate store
                    PID:1824
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1988
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2532
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2156
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1376
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2988
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2924
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      PID:976
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      • Suspicious use of WriteProcessMemory
                      PID:2480
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2760
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2664
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2756
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -timeout 0
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      PID:872
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                      6⤵
                      • Modifies boot configuration data using bcdedit
                      • Suspicious use of WriteProcessMemory
                      PID:2328
                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                    5⤵
                    • Executes dropped EXE
                    PID:2476
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\Sysnative\bcdedit.exe /v
                    5⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1572
                  • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                    5⤵
                    • Executes dropped EXE
                    PID:1960
                  • C:\Windows\system32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    5⤵
                    • DcRat
                    • Creates scheduled task(s)
                    PID:1800
                  • C:\Windows\windefender.exe
                    "C:\Windows\windefender.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:2728
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      6⤵
                        PID:2756
                        • C:\Windows\SysWOW64\sc.exe
                          sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          7⤵
                          • Launches sc.exe
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1884
              • C:\Users\Admin\AppData\Local\Temp\rty25.exe
                "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
                2⤵
                • Executes dropped EXE
                • Modifies system certificate store
                PID:3048
            • C:\Windows\system32\makecab.exe
              "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240214122921.log C:\Windows\Logs\CBS\CbsPersist_20240214122921.cab
              1⤵
              • Drops file in Windows directory
              PID:1380
            • C:\Users\Admin\AppData\Local\Temp\C89C.exe
              C:\Users\Admin\AppData\Local\Temp\C89C.exe
              1⤵
                PID:1524
              • C:\Users\Admin\AppData\Local\Temp\E580.exe
                C:\Users\Admin\AppData\Local\Temp\E580.exe
                1⤵
                  PID:2428
                  • C:\Users\Admin\AppData\Local\Temp\E580.exe
                    C:\Users\Admin\AppData\Local\Temp\E580.exe
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Modifies system certificate store
                    PID:2028
                    • C:\Windows\SysWOW64\icacls.exe
                      icacls "C:\Users\Admin\AppData\Local\a97f23c7-4acd-4188-9386-4d81e4847f2e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                      3⤵
                      • Modifies file permissions
                      PID:1572
                    • C:\Users\Admin\AppData\Local\Temp\E580.exe
                      "C:\Users\Admin\AppData\Local\Temp\E580.exe" --Admin IsNotAutoStart IsNotTask
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      PID:972
                      • C:\Users\Admin\AppData\Local\Temp\E580.exe
                        "C:\Users\Admin\AppData\Local\Temp\E580.exe" --Admin IsNotAutoStart IsNotTask
                        4⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1556
                        • C:\Users\Admin\AppData\Local\f3a8bb7a-caf7-4bd3-94c1-7448a6d18e0f\build2.exe
                          "C:\Users\Admin\AppData\Local\f3a8bb7a-caf7-4bd3-94c1-7448a6d18e0f\build2.exe"
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:2544
                          • C:\Users\Admin\AppData\Local\f3a8bb7a-caf7-4bd3-94c1-7448a6d18e0f\build2.exe
                            "C:\Users\Admin\AppData\Local\f3a8bb7a-caf7-4bd3-94c1-7448a6d18e0f\build2.exe"
                            6⤵
                            • Executes dropped EXE
                            • Modifies system certificate store
                            PID:3000
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 1460
                              7⤵
                              • Loads dropped DLL
                              • Program crash
                              PID:580
                        • C:\Users\Admin\AppData\Local\f3a8bb7a-caf7-4bd3-94c1-7448a6d18e0f\build3.exe
                          "C:\Users\Admin\AppData\Local\f3a8bb7a-caf7-4bd3-94c1-7448a6d18e0f\build3.exe"
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:1652
                          • C:\Users\Admin\AppData\Local\f3a8bb7a-caf7-4bd3-94c1-7448a6d18e0f\build3.exe
                            "C:\Users\Admin\AppData\Local\f3a8bb7a-caf7-4bd3-94c1-7448a6d18e0f\build3.exe"
                            6⤵
                            • Executes dropped EXE
                            PID:1860
                            • C:\Windows\SysWOW64\schtasks.exe
                              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                              7⤵
                              • DcRat
                              • Creates scheduled task(s)
                              PID:2448
                • C:\Windows\system32\taskeng.exe
                  taskeng.exe {98A5D3F5-FD93-44C1-BE72-944CD5914F38} S-1-5-21-928733405-3780110381-2966456290-1000:VTILVGXH\Admin:Interactive:[1]
                  1⤵
                    PID:3036
                    • C:\Users\Admin\AppData\Roaming\ciwbafa
                      C:\Users\Admin\AppData\Roaming\ciwbafa
                      2⤵
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      • Suspicious behavior: MapViewOfSection
                      PID:1868
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:2120
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                        3⤵
                        • Executes dropped EXE
                        PID:1948
                        • C:\Windows\SysWOW64\schtasks.exe
                          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                          4⤵
                          • DcRat
                          • Creates scheduled task(s)
                          PID:2632
                  • C:\Windows\system32\conhost.exe
                    \??\C:\Windows\system32\conhost.exe "-3009654111764701846-144673060619680777961539628413-303516334-398557871-1894489177"
                    1⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: MapViewOfSection
                    PID:1524
                  • C:\Windows\system32\conhost.exe
                    \??\C:\Windows\system32\conhost.exe "-1686932473-17794346819635982281933462654-558399960-159239937380166971424468501"
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    PID:2428
                  • C:\Windows\windefender.exe
                    C:\Windows\windefender.exe
                    1⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    PID:872
                  • C:\Windows\system32\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\BCDB.bat" "
                    1⤵
                      PID:2872
                      • C:\Windows\system32\reg.exe
                        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                        2⤵
                          PID:1952
                      • C:\Users\Admin\AppData\Local\Temp\D189.exe
                        C:\Users\Admin\AppData\Local\Temp\D189.exe
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetThreadContext
                        PID:2948
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                          2⤵
                            PID:1296
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 92
                              3⤵
                              • Program crash
                              PID:1524

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        Scheduled Task/Job

                        1
                        T1053

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Defense Evasion

                        File and Directory Permissions Modification

                        1
                        T1222

                        Impair Defenses

                        4
                        T1562

                        Disable or Modify System Firewall

                        1
                        T1562.004

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        4
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Credential Access

                        Unsecured Credentials

                        3
                        T1552

                        Credentials In Files

                        3
                        T1552.001

                        Discovery

                        Peripheral Device Discovery

                        1
                        T1120

                        Query Registry

                        4
                        T1012

                        System Information Discovery

                        4
                        T1082

                        Lateral Movement

                        Collection

                        Data from Local System

                        3
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                          Filesize

                          1KB

                          MD5

                          1bac88119d73b08d53ba32ac0ece3388

                          SHA1

                          2c4c95afe28554c557e4635f1e16cc363b8ba618

                          SHA256

                          98c2db5f24c693e7aec5acf5dd3f6642ed602726fb9df94b22342a5fddd11880

                          SHA512

                          5b54d45246920f77c3a333729f3c804afcc902385c0334949e2eb8995d551dad9aafbe4efa08e53889f16cca32cc909ce194d2ea11b7d9b48ee50c9eb54ceb99

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                          Filesize

                          724B

                          MD5

                          8202a1cd02e7d69597995cabbe881a12

                          SHA1

                          8858d9d934b7aa9330ee73de6c476acf19929ff6

                          SHA256

                          58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                          SHA512

                          97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                          Filesize

                          1KB

                          MD5

                          a266bb7dcc38a562631361bbf61dd11b

                          SHA1

                          3b1efd3a66ea28b16697394703a72ca340a05bd5

                          SHA256

                          df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                          SHA512

                          0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                          Filesize

                          410B

                          MD5

                          27ab7c1508efd57370b9a7892ad7130c

                          SHA1

                          2c69d3fca90f291ece4d136212158099a5a97efb

                          SHA256

                          c738dc298be6039f436a39865b5b1b21bbcaec8d247fece0c0a69a05930e2ad3

                          SHA512

                          baa8c9c36baecf66db476183ad714779fb458e49184b913f2d50b3d5dcb4556707f22ed3ad6497d9d4a75416739f54642d6bb3d0b005ac90da254829334eb78f

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          ac304eb16df51e2ef5456332e8017c65

                          SHA1

                          669f8220dc904257e9f2d2a56326b374827a644e

                          SHA256

                          6c8873ce523b11ca7b036deda67bc2a18c942c2d9cc960313513598df76ba5b0

                          SHA512

                          33932cee0429770f6059eceae5d2d612f5d5737eee4bbad144b329038a27b418e9d9fa0237a9c13bfe5828f52208cfa4868d6ee420e8e31ec217e9940625bd3d

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          5b9efccd12bd0fe57414620725386a04

                          SHA1

                          12c2c45b3b7e62fecebfbce982a1a6950f014663

                          SHA256

                          2583b5c5da837e83dc5528ad744e15665c8420b0a46efcc7b8e0e6b7e137e35a

                          SHA512

                          21f5d74b362ba139fb96e480bb925ee784e06e79ed677f141518f174232d43c04984fdf3ad107799e302d32016b39060e0e17016fd623980bd09f182c56e1baf

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          344B

                          MD5

                          476d383696f7bdf6b132115fc99e8e20

                          SHA1

                          37f12ec8e93e15019225b805c179590bfab706c5

                          SHA256

                          28cd567e645a144af8e4aa4c442e5359c77a0e9177de682905cec3f2ba70fb7b

                          SHA512

                          e0b2bce40ca363915cd88f8a59e7e5f95fe5f2b13f72c9385a83502a6b0922aafbcd952f74ff7b18b4f0bf86876ab378cfbcb0773690024513a7f3f04c27bce9

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                          Filesize

                          392B

                          MD5

                          b9e3c355e4e0dd0f1d1daea9fe0c3f66

                          SHA1

                          d4b1c20609e5da9f87bd79b21d35be87817ce586

                          SHA256

                          8e3d205fa13c6e0ebbdca7f3dcfc99d35e0b8d83cbe3d960815c1840b5ddfb83

                          SHA512

                          336e44c5742255e65d7b877f90364f562b19dd12da15bfa384106118644bd2ac8b5e05eed7b908df3f6f2749d3a1a93c085929a9345b1d6512c381cb9cf4b004

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                          Filesize

                          242B

                          MD5

                          e1b71d8ad7a37c1f28f2e96b1ce5bfb3

                          SHA1

                          d93c1e414decf936b09622f58167e061e2e1afe8

                          SHA256

                          eb7678b8de47ece2503a4206725a8dae33f4ba176133696fc3bdbcf9d95480d4

                          SHA512

                          dce56177ddbe27694344495c9e22c98d0219fd9936f014c3d5a235f7a61e9147e89cd6c3dddcef51cd7e204b8a0dd8fb91baf058ce46254d514e5798f149e3cf

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                          Filesize

                          1024KB

                          MD5

                          71695711652a98d67cd442d432755db9

                          SHA1

                          92aaa4b454adf6ee824282e5d686872cc2925019

                          SHA256

                          31f92966d31b3a96d7f411d159f5e7a46c230864d1b1aa47146a901e9d2c8956

                          SHA512

                          7e4662a12e0e597e6de376b6b3efc191b80e368f0753ccc1bc5d330ed5559a9e5d28313a3f9bbb80bc30f83f9bec7b0f3b1d165934cddb6038a029c254280589

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                          Filesize

                          250KB

                          MD5

                          983a594ad9359a5652a51020ca7f564e

                          SHA1

                          fe21353bf43d21efc6c420903a508751573c85bd

                          SHA256

                          30d5bbc79e4c3afc070a2f119a5a8bed64a8d5177071a7c1b79620c41b91507f

                          SHA512

                          cf73961c7b4bfe9f735079f0ed284608f4f3326d1858fd548ffa481381e95dfccebc8c9668cd07e4ecc10407e3012cd49cb8d89c764333146fe858ffbb49a184

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                          Filesize

                          320KB

                          MD5

                          8eb2cf9df2c04bf20f24fbda4c67bf94

                          SHA1

                          244b6b72419658f26cceef8a65dfcf8491cd66ae

                          SHA256

                          7eaa1fcb38386822997100ea8dacff3a82ab8db10c19a25d2e251f82ac380c5c

                          SHA512

                          b5f3dbf131b2e16140d8af6d1492f0741aef33b326640eddbc1315b025a4d2a840c0ff9537fb24b9d1e66cf8ee03a9c438036e331db1ab22f45e8a4b2b5747e8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\BCDB.bat
                          Filesize

                          77B

                          MD5

                          55cc761bf3429324e5a0095cab002113

                          SHA1

                          2cc1ef4542a4e92d4158ab3978425d517fafd16d

                          SHA256

                          d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                          SHA512

                          33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                          Filesize

                          128KB

                          MD5

                          1844d76e7d4331107eeb8fc6274fa9b2

                          SHA1

                          82ae81925c68a662af3b5243db9ae9d0b1721958

                          SHA256

                          0fddf79ba668abf7a760e7076da3fdcca389e221c5005b10737a75b271da3aa1

                          SHA512

                          2be6c7a7f25b12ee3082f122fd17ded3697dd97518e41765d49f5141e969b6e4d24f664a6aae29e647c2e8d7518d3a6b1216c8a460a7425ab4c60e5bd60dc947

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\C89C.exe
                          Filesize

                          287KB

                          MD5

                          263d29d8b5135fc48c8e955dfcd12e29

                          SHA1

                          6b8a4a62c7aa5ee676620f2c8877cac42abc3621

                          SHA256

                          44cbb62968b251236aef9a8ebd7e3ab8feee62e7f70b7c0de5bdee8f41a21db5

                          SHA512

                          0c1725a6f822460200d76a8fd85850436480246e193b776348f6bb2ab78baab7660a2130af40c77dcf8f20eff6e62e0cc969297658758aa5ac5e2b880b0381c6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Cab7F5F.tmp
                          Filesize

                          65KB

                          MD5

                          ac05d27423a85adc1622c714f2cb6184

                          SHA1

                          b0fe2b1abddb97837ea0195be70ab2ff14d43198

                          SHA256

                          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                          SHA512

                          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\E580.exe
                          Filesize

                          815KB

                          MD5

                          3043b51856a9952a786bc652ce002cfc

                          SHA1

                          af06bb3cffde686d83c207d8f103308f92aefc47

                          SHA256

                          1400669b77b5b580972a0112a3fbf31732b0769a79621f6c16e2315700431360

                          SHA512

                          75e689891423c9e96d5758c806f200ca8d0e2b1c6b9eefee57f9f5fc4524be6a1c5f0b11d6f57ba636e3504a3ee41b0bcc4543ad1788a247bd0431182f6ee259

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                          Filesize

                          512KB

                          MD5

                          a0eb85a10cf0c11e5b3498a463631754

                          SHA1

                          2a5fe63812bf6437fafa5dcc2ad29c11cd8f5b2a

                          SHA256

                          487370f11ec8c2c62d17a1a62c552f30755ab1f7ffff16d28977d8cf5e5e525a

                          SHA512

                          6c4776b352433591d4c0f1ecca53b72752350b0ee619800dc04707f4754f7e00a22ed932565fc9697799d6a1637e4ad0e946488f41f49c4471aa3b6f8260ad73

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                          Filesize

                          492KB

                          MD5

                          fafbf2197151d5ce947872a4b0bcbe16

                          SHA1

                          a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                          SHA256

                          feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                          SHA512

                          acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tar8136.tmp
                          Filesize

                          171KB

                          MD5

                          9c0c641c06238516f27941aa1166d427

                          SHA1

                          64cd549fb8cf014fcd9312aa7a5b023847b6c977

                          SHA256

                          4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                          SHA512

                          936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                          Filesize

                          281KB

                          MD5

                          d98e33b66343e7c96158444127a117f6

                          SHA1

                          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                          SHA256

                          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                          SHA512

                          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                          Filesize

                          1.3MB

                          MD5

                          46215c5df28fcbae1f5b7c99a96abca3

                          SHA1

                          cebea2b906d09a34a4fc878190298dc7e15b5e7e

                          SHA256

                          9454dff099d290798b481fbf12fc9f74f32fdbf622bc6fcfe396a00a7f6a36cb

                          SHA512

                          c5cf3f40395d84bfa26efaa304b1ce33e1c003d86bbc73b7ae92696c615ee8c3bdd46115b81f4fd263c4c4ca09b81cbb9b01df75a7b0d2e8ff4b22b469e3a49b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                          Filesize

                          1.2MB

                          MD5

                          2022201131acd81fc6d3d9b6762df5e2

                          SHA1

                          eb7c5857be57bc6de72115a4795b7d4bf007ca20

                          SHA256

                          4a226def8fbc55175482267af32183e4cec36ee3e3862d8bb5608bd71dec33f1

                          SHA512

                          812a3fd153882b98b845d02b70c0abafa615f423c763ba24ab10cfabc0305cd6b118714b6d01c158c6e4c098a0beee1e491e74c00e0bcef1c1d4e48c476280c2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\osloader.exe
                          Filesize

                          591KB

                          MD5

                          e2f68dc7fbd6e0bf031ca3809a739346

                          SHA1

                          9c35494898e65c8a62887f28e04c0359ab6f63f5

                          SHA256

                          b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                          SHA512

                          26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\rty25.exe
                          Filesize

                          715KB

                          MD5

                          0b374be36fee0eae8b1e305f1e4073f5

                          SHA1

                          3e5f24441b9f00c3e5beb7ef2438d1868259d852

                          SHA256

                          bbd48c58bc41696a56c317d9650057c725642e5c1dee71a8b4f0b9cbd9095ad4

                          SHA512

                          f8abf77020dfe9cba6c8afb6535a86338a8923dac7d3a81ce78110302708611109c3b80104178ec6dcd95ce7d9e60829fa8b88c7411aa726699aec04eaaccb9c

                          Download Submit

                        • C:\Users\Admin\AppData\Local\f3a8bb7a-caf7-4bd3-94c1-7448a6d18e0f\build2.exe
                          Filesize

                          255KB

                          MD5

                          c57c76d6dc6ed6b6e534d8180294fc2d

                          SHA1

                          6c164812674571f84eeba36d07e47241ca22c40e

                          SHA256

                          4e8d80a17217b51fde5079a5c195b4dc24890797cf6346c366a59c9c35847a2b

                          SHA512

                          6f92fe7f51aeecc12c216b4b801cc6320e70f89ac1bf5f9905df6bf2f753b7045da78d238cceddb0d93bac0feabaf8f4ffbb65acded8ba679515444f166a56a3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\f3a8bb7a-caf7-4bd3-94c1-7448a6d18e0f\build3.exe
                          Filesize

                          299KB

                          MD5

                          41b883a061c95e9b9cb17d4ca50de770

                          SHA1

                          1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

                          SHA256

                          fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

                          SHA512

                          cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                          Filesize

                          128B

                          MD5

                          11bb3db51f701d4e42d3287f71a6a43e

                          SHA1

                          63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                          SHA256

                          6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                          SHA512

                          907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                          Download Submit

                        • C:\Windows\rss\csrss.exe
                          Filesize

                          1.2MB

                          MD5

                          f9c31de795570aeb555e6fc845f6d12c

                          SHA1

                          6dde3598d47412941d37c3c6cbe48879d26524be

                          SHA256

                          2487b69632686bcdc72100e0e1ee51f34a12f2d9adfdb7ec5cefcba8a36f1a9c

                          SHA512

                          fa6a082acae966604f3593b1df0fa91f7fe7fa75737554412b1636deede14d2960c067cba8f6239376b446ae2c210f194d22620ce226ef20e7b9d5d173fd811c

                          Download Submit

                        • C:\Windows\rss\csrss.exe
                          Filesize

                          886KB

                          MD5

                          c4082d8bbee40caf103e2fe51f088d21

                          SHA1

                          b1ea1ec7a1aabf4d8078c06f33167af4dc5e597a

                          SHA256

                          9577b0596c1ae45341c2ccb00ffa36e90368aee084a82a507073248b4e8f55c0

                          SHA512

                          91a38ae3c25422777a534591620246b237116e805bc1f405ee020e3c7dda94387ed13fe9326574a9fb7c4935c5f00d7e3d9eba3bbb7198dd097a2964836aeebf

                          Download Submit

                        • \ProgramData\mozglue.dll
                          Filesize

                          593KB

                          MD5

                          c8fd9be83bc728cc04beffafc2907fe9

                          SHA1

                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                          SHA256

                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                          SHA512

                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                          Download Submit

                        • \ProgramData\nss3.dll
                          Filesize

                          758KB

                          MD5

                          34546891a8ce62861287386c3049123b

                          SHA1

                          5c7a06890c85e8a57c908c6f37698f39261b2865

                          SHA256

                          e8a6883635ccdcac798bd67c2987c0e2ba92f3b79164936a8bc99f567eb3da2f

                          SHA512

                          310582eedb70fd1bc6cffe1ec74f31e7c825766e7adf8e70afa49ac04adb9b82409cf67e6436c3192e3cd7022b88a2b042e5b7276a6fa27bdfe185fbbaf7581a

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                          Filesize

                          1.1MB

                          MD5

                          7129cbf6b9c9580df2dbb8cda6806eb2

                          SHA1

                          3ce32cc9b88722bb9d92699a9d47963fc87d09c0

                          SHA256

                          307433c05de7890ea50c0b8fb79700e5d67601ae314b2e0bb4da79eb4b147eeb

                          SHA512

                          ad999072fbdea9fef8879e5df041d3a259afae02be575f74088d8d1f1d3287cb7557c667431ebf19d8a971e5d75f299a909f31b5cd457b36173a52fd51aee734

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                          Filesize

                          1.3MB

                          MD5

                          c94a3e362f137547d881e40d59ba5af4

                          SHA1

                          8c7bedaef6f73e7b8e6e69536395157a3c6e701a

                          SHA256

                          567ffb62bf3d10161c3b45b26428fbb06f74ae4db75291bf76541b01e64096e1

                          SHA512

                          6927a2f3bcb70c7415912ccb42e1cd5151a6f735289a7bc6929745f6f01b445976423256671339a8da102f2c121dcc20cb8a8da125505129b097e356270b0876

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\BroomSetup.exe
                          Filesize

                          1.4MB

                          MD5

                          3303bc5c1120a0e3c2c564a7a66078ae

                          SHA1

                          b7f57efcdd0e4abb312d199c77057b7baf339235

                          SHA256

                          b49a568e976108e10721372a2beb5b5e29e3693021b46dc2edb81659d10f7224

                          SHA512

                          e7faa1578c7952a6035e01b3d6c1f6b3c5b52b54eaee19a2f8e32c7aa0ce520580e7f15f6bbfd8d732256f93cbdc764c2f5a7505b664df557bc666a4da676e62

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\InstallSetup8.exe
                          Filesize

                          2.0MB

                          MD5

                          1bf708425e397e8cd7784d14322f0435

                          SHA1

                          77e4209e868eb1115dda3ebb64e37ddddd2a825c

                          SHA256

                          8a94354407a01f31848af8bea6aa9fc300a852e66c096e78015585fa3eea546a

                          SHA512

                          93b58cea1c32f9b76b91b8e1f3422a4e8a9e95f30ddca2fee0a309640f6137b8f52a82d6d05ba33dd3aa3bb91208762edf12f0d26c4c38771e23297ab0d3a29a

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\csrss\patch.exe
                          Filesize

                          1.2MB

                          MD5

                          9a89f6e8894143d6401a6fb2680945ca

                          SHA1

                          a737e228b5633b913dd3eaf3c00839694eec9844

                          SHA256

                          c4a25f53cf4a5b0d956e133491ea038a2b06d41acf95223be0aebdb64149f80f

                          SHA512

                          285020844ab52b60292e240e179b2cc7e682062441121238d4a1411bc3afa96df8ff85cc46e9e05a3464f8b299a445d9f6613802715404e2e2430376d591bd7b

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\dbghelp.dll
                          Filesize

                          1.3MB

                          MD5

                          5f5032c4b0daeb906f3d708b14801ca2

                          SHA1

                          9791517ac52d30454612a54ec9a112c451ac5ce3

                          SHA256

                          9d16fad002edb990b64109f75a509b34d859fc5a5e69ec954eff0b30bc2567b4

                          SHA512

                          9eab94630a97712c5da839d23f18c615bdf6cb0a45fc7f3c1ce3e63a65779559f80e90de0bf6a05f2133ad20468d38e4625795711d41a67008fc3f057a6d4d00

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\nso829A.tmp
                          Filesize

                          328KB

                          MD5

                          38fd35b8131d42f467b1992d2e066733

                          SHA1

                          90bc2a4ff3760f1a17ca61fe7c8c8458f203b4d7

                          SHA256

                          dea886ee959d041eeecc1f0ed9e015d9e24879dd6dda919810609d84832a228f

                          SHA512

                          a4437978f153e6d842b67c41df1e5446b79f44bcdd59cd245762a0a488f76fe284322e10bb2242d186b1e60e9412ada8120be8699a2c76ce143375628562f544

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\nsy760B.tmp\INetC.dll
                          Filesize

                          25KB

                          MD5

                          40d7eca32b2f4d29db98715dd45bfac5

                          SHA1

                          124df3f617f562e46095776454e1c0c7bb791cc7

                          SHA256

                          85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                          SHA512

                          5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                          Filesize

                          1.4MB

                          MD5

                          579e6d19ad381acb003c8ef04515d233

                          SHA1

                          fd3520cab41bec8aa17beae57ed0c176197a79d4

                          SHA256

                          dc1891828820863aadbcde95834ac2ee20f6c1508bf4c51abe260c54b3133284

                          SHA512

                          a7179f6a2964abc74dcbcdfe6c4f3597fb112f036f74dd1644e44c4ae3285632c24c2e52b94c9c09e5981f8bee5640ad2381a6c9da4cc9bdee2cceb043d5e083

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                          Filesize

                          800KB

                          MD5

                          434b80b1d79aa0a28da5e469dbbb30dc

                          SHA1

                          bc7de5080c76fae57bfb9e7da5a729503820f7dd

                          SHA256

                          44e806137b19fc2f6b9bf6ad730bff4c21e3e017f26fd6854d1ae3f608f247cf

                          SHA512

                          a2645a681bebb5b362639d04b3f64b31362276b4515fd6475b0ac3c8208c760038481b0d686d6a0910f7785e968ad96cac8b047fec94dbb3fc6b3d218b43973f

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                          Filesize

                          1.3MB

                          MD5

                          3bb0272552c94bf46d50da3d89339ee5

                          SHA1

                          49a9d37a4e405cf72f08c8c430634a60c7ec99c2

                          SHA256

                          82e7311ba9a45ae48add531dff002a1bc933e3e05f1ac13d0799e5a410bd9c80

                          SHA512

                          6cce229636ef2a94269ca344ccf6c4afb34b2fd0b4c46e19f4ea8c7766d45c75e09e21d6fad9ea385ab6564ea6a1eb9e364e7f4526840db9f47703bb5fb915e3

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\symsrv.dll
                          Filesize

                          163KB

                          MD5

                          5c399d34d8dc01741269ff1f1aca7554

                          SHA1

                          e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

                          SHA256

                          e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

                          SHA512

                          8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\toolspub1.exe
                          Filesize

                          175KB

                          MD5

                          01fb175d82c6078ebfe27f5de4d8d2aa

                          SHA1

                          ff655d5908a109af47a62670ff45008cc9e430c4

                          SHA256

                          a07112e236e0136b43294b31a43fb4456072941a135853e761680d04315841c3

                          SHA512

                          c388d632c5274aa47d605f3c49a6754d4ad581eb375c54ce82424cffa2ad86410a2ad646867a571dcf153e494b4e7ca7a7cf6952b99ddcf5940a443f7039f2fe

                          Download Submit

                        • \Windows\rss\csrss.exe
                          Filesize

                          1.2MB

                          MD5

                          bb1a08387acc63a5364809c3a9c1a7ef

                          SHA1

                          0b20585c4ef51e6f6d93d9d8b9dfe821b0b4bca6

                          SHA256

                          a567003970ef8bcc68bf631127b6b2d73749f8fd2e88ca99379699a2c053bfc0

                          SHA512

                          2af2dbb09204d17aa32871657e51ae34d475b721e7d528944c5d84a71827aac9dc190ddd271ef7e41e6fbd798c018b82500587d12e553ff9aa534c2e6bdf9467

                          Download Submit

                        • \Windows\rss\csrss.exe
                          Filesize

                          960KB

                          MD5

                          372695288d40e8c7c93499af906ec7d1

                          SHA1

                          38157527e90577e9e652426eccf91f7ebc3faf2a

                          SHA256

                          0eb7a2bed3f45cb20b4894a9c9d34867b83cb3e78a4f93a431669fcc8b909659

                          SHA512

                          80f473c7aedddc97e6eccfafdd2275de5a0c545556bd6347bcee35b4ea91e9af67e88d49e03809380aca08d977847ad122a0cbdb41f5c7c25b8a92a46fa2ba46

                          Download Submit

                        • memory/972-434-0x00000000002F0000-0x0000000000382000-memory.dmp

                          Filesize

                          584KB

                          Download

                        • memory/972-435-0x00000000002F0000-0x0000000000382000-memory.dmp

                          Filesize

                          584KB

                          Download

                        • memory/1204-134-0x0000000001D90000-0x0000000001DA6000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/1204-376-0x0000000003B90000-0x0000000003BA6000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/1524-366-0x0000000000400000-0x0000000002BF4000-memory.dmp

                          Filesize

                          40.0MB

                          Download

                        • memory/1524-367-0x0000000002DC0000-0x0000000002EC0000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/1524-377-0x0000000000400000-0x0000000002BF4000-memory.dmp

                          Filesize

                          40.0MB

                          Download

                        • memory/1556-458-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/1556-463-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/1556-465-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/1556-466-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/1556-459-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/1556-445-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/1556-443-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/1652-543-0x0000000000962000-0x0000000000973000-memory.dmp

                          Filesize

                          68KB

                          Download

                        • memory/1652-545-0x0000000000220000-0x0000000000224000-memory.dmp

                          Filesize

                          16KB

                          Download

                        • memory/1824-283-0x0000000140000000-0x00000001405E8000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/1824-300-0x0000000140000000-0x00000001405E8000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/1860-551-0x0000000000400000-0x0000000000406000-memory.dmp

                          Filesize

                          24KB

                          Download

                        • memory/1868-706-0x0000000000400000-0x0000000002B04000-memory.dmp

                          Filesize

                          39.0MB

                          Download

                        • memory/1868-705-0x0000000002CEF000-0x0000000002D05000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/2028-432-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/2028-401-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/2028-391-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2028-400-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/2028-394-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/2120-750-0x00000000008F2000-0x0000000000902000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/2168-235-0x0000000074930000-0x000000007501E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/2168-0-0x0000000074930000-0x000000007501E000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/2168-1-0x0000000000D30000-0x000000000145C000-memory.dmp

                          Filesize

                          7.2MB

                          Download

                        • memory/2428-388-0x0000000002C80000-0x0000000002D12000-memory.dmp

                          Filesize

                          584KB

                          Download

                        • memory/2428-392-0x0000000004620000-0x000000000473B000-memory.dmp

                          Filesize

                          1.1MB

                          Download

                        • memory/2428-387-0x0000000002C80000-0x0000000002D12000-memory.dmp

                          Filesize

                          584KB

                          Download

                        • memory/2544-486-0x0000000000655000-0x0000000000670000-memory.dmp

                          Filesize

                          108KB

                          Download

                        • memory/2544-488-0x0000000000230000-0x0000000000261000-memory.dmp

                          Filesize

                          196KB

                          Download

                        • memory/2684-209-0x0000000000400000-0x00000000008E2000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2684-361-0x00000000003D0000-0x00000000003D1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2684-359-0x0000000000400000-0x00000000008E2000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2684-51-0x00000000003D0000-0x00000000003D1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2704-229-0x0000000000EC0000-0x00000000012B8000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2704-36-0x0000000000EC0000-0x00000000012B8000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2704-208-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/2704-39-0x0000000000EC0000-0x00000000012B8000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2704-223-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/2704-40-0x00000000029E0000-0x00000000032CB000-memory.dmp

                          Filesize

                          8.9MB

                          Download

                        • memory/2704-49-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/2716-270-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/2716-264-0x0000000001160000-0x0000000001558000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2716-444-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/2716-269-0x0000000001160000-0x0000000001558000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2716-375-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/2716-438-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/2728-712-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2780-135-0x0000000000400000-0x0000000002B04000-memory.dmp

                          Filesize

                          39.0MB

                          Download

                        • memory/2780-20-0x0000000002CD0000-0x0000000002DD0000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/2780-149-0x0000000000220000-0x000000000022B000-memory.dmp

                          Filesize

                          44KB

                          Download

                        • memory/2780-21-0x0000000000220000-0x000000000022B000-memory.dmp

                          Filesize

                          44KB

                          Download

                        • memory/2780-33-0x0000000000400000-0x0000000002B04000-memory.dmp

                          Filesize

                          39.0MB

                          Download

                        • memory/2948-773-0x0000000004E59000-0x0000000004E5D000-memory.dmp

                          Filesize

                          16KB

                          Download

                        • memory/2948-757-0x00000000009E0000-0x00000000009F0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/2948-752-0x0000000006C90000-0x0000000006E22000-memory.dmp

                          Filesize

                          1.6MB

                          Download

                        • memory/2948-751-0x0000000005840000-0x0000000005B5E000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2948-741-0x0000000001290000-0x000000000174A000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2948-772-0x00000000721F0000-0x00000000728DE000-memory.dmp

                          Filesize

                          6.9MB

                          Download

                        • memory/2964-236-0x0000000001260000-0x0000000001658000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2964-231-0x0000000001260000-0x0000000001658000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/2964-252-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/2964-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

                          Filesize

                          9.1MB

                          Download

                        • memory/3000-489-0x0000000000400000-0x0000000000644000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/3000-482-0x0000000000400000-0x0000000000644000-memory.dmp

                          Filesize

                          2.3MB

                          Download

                        • memory/3000-480-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3008-374-0x0000000000400000-0x0000000002BFF000-memory.dmp

                          Filesize

                          40.0MB

                          Download

                        • memory/3008-162-0x00000000001B0000-0x00000000001E4000-memory.dmp

                          Filesize

                          208KB

                          Download

                        • memory/3008-163-0x0000000000400000-0x0000000002BFF000-memory.dmp

                          Filesize

                          40.0MB

                          Download

                        • memory/3008-177-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                          Filesize

                          972KB

                          Download

                        • memory/3008-373-0x0000000000400000-0x0000000002BFF000-memory.dmp

                          Filesize

                          40.0MB

                          Download

                        • memory/3008-368-0x00000000002D0000-0x00000000003D0000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/3008-161-0x00000000002D0000-0x00000000003D0000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/3008-265-0x0000000000400000-0x0000000002BFF000-memory.dmp

                          Filesize

                          40.0MB

                          Download

                        • memory/3008-402-0x0000000000400000-0x0000000002BFF000-memory.dmp

                          Filesize

                          40.0MB

                          Download

                        • memory/3008-404-0x00000000002D0000-0x00000000003D0000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/3048-210-0x00000000034A0000-0x00000000035AA000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/3048-211-0x00000000036E0000-0x000000000380C000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/3048-238-0x00000000036E0000-0x000000000380C000-memory.dmp

                          Filesize

                          1.2MB

                          Download

                        • memory/3048-38-0x00000000FFA40000-0x00000000FFAF7000-memory.dmp

                          Filesize

                          732KB

                          Download