Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2024, 14:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    5.9MB

  • MD5

    a22002306cbbdc52549b8998a7348cfb

  • SHA1

    6396fa71cd6042d915ec3244eb9eea7b11735b65

  • SHA256

    b29b6f1b6a2d7f6d8b63ac749bdc991892970c7e7643221cf6087d75e4f17c41

  • SHA512

    240cb963bfdf51c25b5284daa49f4fb86539dc6b614327fc5f3f5bf3956784974b7beaefe1df67cdf6e414bb86c2581321f44ec9b58eb25735b7d2e4d6cbd6e6

  • SSDEEP

    98304:3bch/RlekYSHAdakJEnHfCVf4Pp1ScWt/cS4HHQTHYuin7owuTALeZN/sa+gGgH9:3Y5u82J8npxWt/cS4nG47n7t/sGgH8rP

Score
10/10
gluptebastealcdiscoverydropperevasionloaderpersistencerootkitspywarestealerupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.145

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 15 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • NSIS installer 3 IoCs
    installer
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Users\Admin\AppData\Local\Temp\InstallSetup10.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallSetup10.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
        C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4304
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EHIJJDGDHD.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4568
          • C:\Users\Admin\AppData\Local\Temp\EHIJJDGDHD.exe
            "C:\Users\Admin\AppData\Local\Temp\EHIJJDGDHD.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            PID:4196
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\EHIJJDGDHD.exe
              6⤵
                PID:1088
                • C:\Windows\SysWOW64\PING.EXE
                  ping 2.2.2.2 -n 1 -w 3000
                  7⤵
                  • Runs ping.exe
                  PID:1240
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 2100
            4⤵
            • Program crash
            PID:3296
        • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
          C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4980
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1724
            • C:\Windows\SysWOW64\chcp.com
              chcp 1251
              5⤵
                PID:2224
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                5⤵
                • Creates scheduled task(s)
                PID:2436
        • C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
          "C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4976
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4900
          • C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
            "C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5108
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1812
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4448
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                5⤵
                • Modifies Windows Firewall
                PID:2288
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2260
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5000
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Manipulates WinMonFS driver.
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3252
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2088
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                5⤵
                • Creates scheduled task(s)
                PID:952
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /delete /tn ScheduledUpdate /f
                5⤵
                  PID:2144
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2392
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3664
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                  5⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4420
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  5⤵
                  • Creates scheduled task(s)
                  PID:744
                • C:\Windows\windefender.exe
                  "C:\Windows\windefender.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:2632
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1348
                    • C:\Windows\SysWOW64\sc.exe
                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      7⤵
                      • Launches sc.exe
                      • Suspicious use of AdjustPrivilegeToken
                      PID:220
          • C:\Users\Admin\AppData\Local\Temp\pub1E.exe
            "C:\Users\Admin\AppData\Local\Temp\pub1E.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4472
        • C:\Windows\windefender.exe
          C:\Windows\windefender.exe
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          PID:924
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4304 -ip 4304
          1⤵
            PID:3704

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Scheduled Task/Job

          1
          T1053

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          1
          T1112

          Credential Access

          Unsecured Credentials

          3
          T1552

          Credentials In Files

          3
          T1552.001

          Discovery

          Query Registry

          4
          T1012

          Remote System Discovery

          1
          T1018

          System Information Discovery

          4
          T1082

          Lateral Movement

          Collection

          Data from Local System

          3
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Are.docx
            Filesize

            11KB

            MD5

            a33e5b189842c5867f46566bdbf7a095

            SHA1

            e1c06359f6a76da90d19e8fd95e79c832edb3196

            SHA256

            5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

            SHA512

            f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

            Download Submit

          • C:\ProgramData\mozglue.dll
            Filesize

            593KB

            MD5

            c8fd9be83bc728cc04beffafc2907fe9

            SHA1

            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

            SHA256

            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

            SHA512

            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            Download Submit

          • C:\ProgramData\nss3.dll
            Filesize

            2.0MB

            MD5

            1cc453cdf74f31e4d913ff9c10acdde2

            SHA1

            6e85eae544d6e965f15fa5c39700fa7202f3aafe

            SHA256

            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

            SHA512

            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
            Filesize

            1.7MB

            MD5

            6c60e916776678ce27b554313a2dc92d

            SHA1

            a68a3ed1a558bdf8a6d317a470271e13f8dfa0b7

            SHA256

            e29ca40b07e6425f0caaabebd5a9d32977e9cd380a4f6c55e113db540172f8d2

            SHA512

            c1b558265e1645b41cc0129810a228e94ae5e4ee466740bcc95bbc167325891e19db0029bbbb96c8a7f4ba20e7655a2526acb1c77d94d51894f4b8fc7ee6c9f8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
            Filesize

            320KB

            MD5

            e1f5b4fd06ad2d3574b34d76bc2a8243

            SHA1

            bdb1c952752d053f5be142a2b006c048f0e4f6e0

            SHA256

            833f18937d051f7b01bc1e33439c5fb0f27eb15534e6a90ac2722a2de6f19a2b

            SHA512

            5ce43dc7d82cbdab04b0a9d65323db43ffda659f9c88e2866fb0ccdbe4ce35ddc33118ad6f9fcb47e4d61583e159d0917ad5a9a412b05e2d0384ccb45eb2510b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
            Filesize

            189KB

            MD5

            cdba5069aa970f1eef4706f07f565ae9

            SHA1

            2c105f25c63d2d176d74a97d0ba08dd7c0936ce0

            SHA256

            2df60cafacd05d55ff7856304d2c93b6615a4a94bf9b0104ed677d3fc0e48985

            SHA512

            9aa35493622666e847023368d87487921aba8d4a4b5d7a517239508dcfdcf54f79459e9d9d2e996bec86b523c90377d26aa25b69e39fe31fd31f947d3e794fe8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\453829d01bd822c255d951511849bab8.exe
            Filesize

            171KB

            MD5

            733c2b5f3e756c4cf9ac761fed7c2a50

            SHA1

            26e0af645104ea0f2e9493abec21b6e495221d01

            SHA256

            e7ff81d4e3aea16918c649e47b333767c65ea2c8563ef8d805581839e2a7a627

            SHA512

            c36356e211cc40d5cbf9d2ee1a804403ae5d01f5e1e2d304a0d1b2cea6294bda62e23578537eed961efb0d2cb2ce8ac7d514954cf72fabbd25b74ad89465f1f8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
            Filesize

            1.6MB

            MD5

            ae037bac6d5341e842df3756751a3319

            SHA1

            01e48a827dc1f6812143879924eb27002b1c2229

            SHA256

            96bb97f6479a7c4ef897e01a8b0bdbac53c76e730c717793fe50389fe3a1550e

            SHA512

            550f889a4978b8c98c6bebc265999eaf9bb58f81742e10bf625a24239a5a8257f665033bc7faa26c2824b20afa8ade0dde0841ed6d2c74f184a07ae5aa1b4bdb

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\EHIJJDGDHD.exe
            Filesize

            101KB

            MD5

            42b838cf8bdf67400525e128d917f6e0

            SHA1

            a578f6faec738912dba8c41e7abe1502c46d0cae

            SHA256

            0e4ffba62ce9a464aa1b7ff9f1e55ace8f51ff1e15102d856f801a81f8b4607d

            SHA512

            f64b39d885375251ab7db72c57dc5b5095f0c6412169f1035d1f6a25b8415a2a01004d06bfa0267cf683ef7dea7a9f969ad43fde5a4376f1fcb65a57403433c0

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\InstallSetup10.exe
            Filesize

            1.2MB

            MD5

            401bd40396a317989b6b57529fe4fd54

            SHA1

            6eba5a67c6681cfec6ec355ae5f6e2fdfcaec795

            SHA256

            6e565e3753b76dba168af3c32e342c3950c99449ba946010ba64c8e0dd3d637e

            SHA512

            be86fef86ece29178e44bda7914f2027cdb3e373327ab5916d38ddd091faef2b27f55c4845ea26f5ab517d884361d78d5d198215665ea1d068546fbeba15b8bd

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\InstallSetup10.exe
            Filesize

            1.1MB

            MD5

            01a40bc9d287bd8a5b601564427f3e42

            SHA1

            9d85c49212ec4af318b6157118aa97e8e517c39d

            SHA256

            30fe71bd799fccf952a86eccbec8d479c359f2b384f01da6d493b282aacd93d9

            SHA512

            3f3c17656e756a1c0e275dd563c879821ae5d5e5099dcb4c51ee56be50d978bd0c8a3801bbc7e57137c7d5067771e0ad960ba6582a2810f02dda01b3053eb5a2

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\InstallSetup10.exe
            Filesize

            1.8MB

            MD5

            12cfd4de0b77729cba35acd6ab559dad

            SHA1

            7ee89792a8e7efe3961417f439ece1d5051a106e

            SHA256

            6c528e4baf911f75d235717225e5c4197ad0178bf731e3702fc3c41edcbd72a0

            SHA512

            6d2bdc67668330d4eac0e7e79e7057b97913215372a14bf3d6db2db5fb3346a2dfaa9719243cf3d3b81cec06187a53fdcb05b3edc146bbb79ff965add7113967

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hspljtan.5ng.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            Filesize

            281KB

            MD5

            d98e33b66343e7c96158444127a117f6

            SHA1

            bb716c5509a2bf345c6c1152f6e3e1452d39d50d

            SHA256

            5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

            SHA512

            705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\nsd8167.tmp\INetC.dll
            Filesize

            21KB

            MD5

            2b342079303895c50af8040a91f30f71

            SHA1

            b11335e1cb8356d9c337cb89fe81d669a69de17e

            SHA256

            2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

            SHA512

            550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\pub1E.exe
            Filesize

            8KB

            MD5

            08bf7dfea9919ac71d97889b2bee673c

            SHA1

            e48b2bcebe43b9477f377a2d70f3cb75cd583813

            SHA256

            da737c0d2b3e011e362325b5c531f8c456f788121221a795990ce85c4fb1ab43

            SHA512

            71d5596783d5b1dd2f84bf9f508da514734c47d9575f81399ddb4a7e71015fcb7107957f63a6f024024ca76d5b3b9b183a91deb9590cd8e46b2d630bbb9b5680

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
            Filesize

            200KB

            MD5

            4daa194c9f29f77b6a97afcc50793020

            SHA1

            fa03fe3b16bc39ca17366c7b22bd71d0693cbf6f

            SHA256

            421f8d69e9d99d7e447bae84e0574e19c9210c6f6121944408be0669aa63c56e

            SHA512

            0638935945b3c181b59bda9dc13e53fc88cbbabe046af0460049f6e89688a9cd4e67783b93002330aa94cd25a04db492e1791bad4cc6c634ab6975affd63ba05

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
            Filesize

            195KB

            MD5

            f0b50ef573e91f7e3ed17bcda78bcb26

            SHA1

            2c1f97e2ccd48dbdb4f5b993377fb415d06e13a3

            SHA256

            d46f2e1669ade02bafd86c33bc23d188bbc6d58b0a688fab6ec4adad9d8ed810

            SHA512

            2961d71964f0165714adedd08f8b61cff775cf6a178ec2af4a46df1b5a7c2b779d9bf602502fa57885d9be5cf9da0d1c32a076618334ebead6f2dab1849b85a5

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Temp\Task.bat
            Filesize

            128B

            MD5

            11bb3db51f701d4e42d3287f71a6a43e

            SHA1

            63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

            SHA256

            6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

            SHA512

            907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

            Download Submit

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

            Download Submit

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
            Filesize

            19KB

            MD5

            924a2c6bfa1b56c1cac7755ec7191c7d

            SHA1

            33c4f6b2bd7709866a9d744b9dc002e2e6a2e7a3

            SHA256

            e7c8744df8b0347f2d75c057cbf60a9af7b7c7fdca24aad88a67b7a61f5e3b5c

            SHA512

            5113b692c3274050303ccb6f7dfe82583a86304a4345e27c7b9637d322392b68235e93a147a479edc83110d7782a1d08330f1d55ed0b49202a37942775632543

            Download Submit

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
            Filesize

            19KB

            MD5

            90476698c6fe88e2f057aa9cb892212c

            SHA1

            2cf2acff5ecfd2336e95e246559bc1db5cc8ad76

            SHA256

            81e2c887a9a4a342369e5fb09bdf7581d2ab1f9e51c88d046863d3e19b7c0d92

            SHA512

            a79555717aa6b24a643aba587a9131b7b5eed4296d2f1dc239c963a358b52f7092a9eaabd296a58ced3a121457266e385a922f1d0d43993161315ca784cc4c06

            Download Submit

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
            Filesize

            19KB

            MD5

            2e51ec288842a6b30593c050d7106d15

            SHA1

            6f2ad6c13677ba7f345bd64e6101ae953a454a65

            SHA256

            eb8d60b4fd270bc6be9dbff74cc4b4db11da3257faa3b5a06321e355fa4fdf8e

            SHA512

            f01eac77b89376b279e1a34a4c4b744eb6cd15084c603949b90e3e90bad42847e5d964165529b018675a869deba81517d382fc596e7443bf4e749a88fbbf9219

            Download Submit

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
            Filesize

            19KB

            MD5

            9e56f122c865a865555fba9802761be0

            SHA1

            f1209b0ce4a46077cba641d0d22ae22f8d976fd6

            SHA256

            31ef2f922bedd6fcac63f7cf3a482f92d2cc99d7c0575f603d2d47755f93ff34

            SHA512

            209438857938c50e3321be566490b54160517ee5f541e60b18083bdd72db85d837006d892657f51225b9f428fb1046e49416f270ef22605d7f92c0fd1d849dc5

            Download Submit

          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
            Filesize

            19KB

            MD5

            9863870899d61705e3a63f865cb71123

            SHA1

            95d37c38d4a90df7b3ba7b13c0ef09a22b712be1

            SHA256

            aac503f51900b6ace38c692e385516298b0d18bb1ea98d6f4199ec32ff5cb9d3

            SHA512

            ae44e1a38a977fa5c69ab01cb9f1b3e4dcf7a11d462e2eaef4f47bfa9da4fff63051874b8983f0ea96551317af97b4d3efa90d2dd872776ccdc6b09dc779c8db

            Download Submit

          • C:\Windows\rss\csrss.exe
            Filesize

            4.1MB

            MD5

            49203862b08ebc3c706bebae1be9c43b

            SHA1

            51fffb777959955ccde2ca5456a1b6ff5230b95d

            SHA256

            b12e77896a69c8953cb24500f9eb6660ae306ba6d4c7b814ba12c4ff2b2c9cb7

            SHA512

            75fa654c4ac67db9fb287cc781f8059774ff695c9d6197c5a00f97401fc57c50a0cde5f212e115cabdfca368585122343fe96fbe0c1edc19630df68cfebe05c5

            Download Submit

          • C:\Windows\windefender.exe
            Filesize

            2.0MB

            MD5

            8e67f58837092385dcf01e8a2b4f5783

            SHA1

            012c49cfd8c5d06795a6f67ea2baf2a082cf8625

            SHA256

            166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

            SHA512

            40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

            Download Submit

          • memory/220-67-0x0000000000400000-0x0000000000459000-memory.dmp

            Filesize

            356KB

            Download

          • memory/924-439-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

            Download

          • memory/924-421-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

            Download

          • memory/1812-198-0x00000000047F0000-0x0000000004800000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1812-186-0x0000000072900000-0x000000007294C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1812-185-0x000000007F960000-0x000000007F970000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1812-187-0x0000000071840000-0x0000000071B94000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/1812-171-0x00000000047F0000-0x0000000004800000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1812-170-0x0000000074540000-0x0000000074CF0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/1812-197-0x0000000006D50000-0x0000000006DF3000-memory.dmp

            Filesize

            652KB

            Download

          • memory/1812-172-0x00000000047F0000-0x0000000004800000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1812-199-0x0000000007080000-0x0000000007091000-memory.dmp

            Filesize

            68KB

            Download

          • memory/1812-183-0x0000000005BD0000-0x0000000005C1C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/2632-415-0x0000000000400000-0x00000000008DF000-memory.dmp

            Filesize

            4.9MB

            Download

          • memory/3252-425-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/3252-467-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/3252-458-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/3252-420-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/3252-463-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/3252-454-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/3252-438-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/3252-374-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/3252-416-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/3760-2-0x0000000005920000-0x0000000005986000-memory.dmp

            Filesize

            408KB

            Download

          • memory/3760-0-0x0000000075220000-0x00000000759D0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3760-45-0x0000000075220000-0x00000000759D0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3760-3-0x0000000005E80000-0x0000000005E90000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3760-1-0x00000000009E0000-0x0000000000FCC000-memory.dmp

            Filesize

            5.9MB

            Download

          • memory/4304-441-0x0000000000400000-0x000000000063B000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4304-49-0x0000000000870000-0x0000000000970000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/4304-205-0x0000000000400000-0x000000000063B000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4304-51-0x0000000000400000-0x000000000063B000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4304-122-0x0000000061E00000-0x0000000061EF3000-memory.dmp

            Filesize

            972KB

            Download

          • memory/4304-50-0x00000000007C0000-0x00000000007E7000-memory.dmp

            Filesize

            156KB

            Download

          • memory/4304-163-0x0000000000400000-0x000000000063B000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4304-452-0x0000000000400000-0x000000000063B000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4304-162-0x0000000000870000-0x0000000000970000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/4304-417-0x0000000000400000-0x000000000063B000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4304-327-0x0000000000400000-0x000000000063B000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4304-387-0x0000000000400000-0x000000000063B000-memory.dmp

            Filesize

            2.2MB

            Download

          • memory/4472-44-0x0000000000FA0000-0x0000000000FA8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4472-47-0x000000001BCD0000-0x000000001BCE0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4472-76-0x00007FF9AC7B0000-0x00007FF9AD271000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4472-46-0x00007FF9AC7B0000-0x00007FF9AD271000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4900-72-0x0000000074540000-0x0000000074CF0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4900-99-0x0000000072140000-0x000000007218C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/4900-70-0x0000000004AA0000-0x0000000004AD6000-memory.dmp

            Filesize

            216KB

            Download

          • memory/4900-71-0x00000000052A0000-0x00000000058C8000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/4900-73-0x0000000004C60000-0x0000000004C70000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4900-74-0x0000000004C60000-0x0000000004C70000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4900-75-0x00000000050A0000-0x00000000050C2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/4900-77-0x00000000059D0000-0x0000000005A36000-memory.dmp

            Filesize

            408KB

            Download

          • memory/4900-121-0x0000000074540000-0x0000000074CF0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4900-118-0x00000000077D0000-0x00000000077D8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4900-117-0x00000000077E0000-0x00000000077FA000-memory.dmp

            Filesize

            104KB

            Download

          • memory/4900-116-0x0000000007790000-0x00000000077A4000-memory.dmp

            Filesize

            80KB

            Download

          • memory/4900-115-0x0000000007770000-0x000000000777E000-memory.dmp

            Filesize

            56KB

            Download

          • memory/4900-114-0x0000000007730000-0x0000000007741000-memory.dmp

            Filesize

            68KB

            Download

          • memory/4900-87-0x0000000005BB0000-0x0000000005F04000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/4900-113-0x0000000007830000-0x00000000078C6000-memory.dmp

            Filesize

            600KB

            Download

          • memory/4900-112-0x0000000007720000-0x000000000772A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/4900-98-0x00000000075D0000-0x0000000007602000-memory.dmp

            Filesize

            200KB

            Download

          • memory/4900-110-0x0000000007610000-0x000000000762E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/4900-111-0x0000000007630000-0x00000000076D3000-memory.dmp

            Filesize

            652KB

            Download

          • memory/4900-100-0x0000000071840000-0x0000000071B94000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/4900-88-0x0000000006050000-0x000000000606E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/4900-97-0x000000007F320000-0x000000007F330000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4900-95-0x0000000007A70000-0x00000000080EA000-memory.dmp

            Filesize

            6.5MB

            Download

          • memory/4900-96-0x0000000007410000-0x000000000742A000-memory.dmp

            Filesize

            104KB

            Download

          • memory/4900-94-0x0000000007370000-0x00000000073E6000-memory.dmp

            Filesize

            472KB

            Download

          • memory/4900-93-0x00000000065C0000-0x0000000006604000-memory.dmp

            Filesize

            272KB

            Download

          • memory/4900-89-0x0000000006090000-0x00000000060DC000-memory.dmp

            Filesize

            304KB

            Download

          • memory/4976-169-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/4976-58-0x00000000029E0000-0x0000000002DE2000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/4976-164-0x00000000029E0000-0x0000000002DE2000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/4976-166-0x0000000002DF0000-0x00000000036DB000-memory.dmp

            Filesize

            8.9MB

            Download

          • memory/4976-59-0x0000000002DF0000-0x00000000036DB000-memory.dmp

            Filesize

            8.9MB

            Download

          • memory/4976-60-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/4980-68-0x0000000000400000-0x0000000000930000-memory.dmp

            Filesize

            5.2MB

            Download

          • memory/4980-69-0x0000000000B40000-0x0000000000B41000-memory.dmp

            Filesize

            4KB

            Download

          • memory/4980-173-0x0000000000400000-0x0000000000930000-memory.dmp

            Filesize

            5.2MB

            Download

          • memory/4980-184-0x0000000000B40000-0x0000000000B41000-memory.dmp

            Filesize

            4KB

            Download

          • memory/5108-168-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download

          • memory/5108-167-0x0000000002AD0000-0x0000000002ECC000-memory.dmp

            Filesize

            4.0MB

            Download

          • memory/5108-274-0x0000000000400000-0x0000000000D1C000-memory.dmp

            Filesize

            9.1MB

            Download